Access Layer admin access

[G_W_Albrecht]

A question has developed by being asked by our customers: Deployment is on R80.10 for two main sites (1 + 2) with an admin each. it is easy to configure admin1 with read/write access for site1 and admin2 with read/write access for site2, but then, admin1 has read access for site2 and admin2 has read access for site1.

With TP and Access Layer, you can define one admin for TP and one for Access Layer, with each admin having absolute no access to the others layer. But is that possible for two admins on Access Layer, too ?

[Danny]

I see two solutions here:

Solution 1: Use a Multi-Domain Server (MDS) and set up two DMS, one for site 1 (managed by admin1) and another one for site 2 (managed by admin2).

Solution 2: Configuring Permissions for Access Control Layers

Create two Access Control Layers for use within your Access Control Policy. One layer for site 1 (managed by admin1) and another layer for site 2 (managed by admin2).

[G_W_Albrecht]

Solution two does not give read access to the other admin ?

[Danny]

You could achieve this by creating a separate readonly account for admin1 und admin2 (admin1_ro, admin2_ro).

[G_W_Albrecht]

What i meant was that an admin with all blades from access layer has read access to all access layers. I did not find how to give read/write to one layer and no access to another access layer...

[G_W_Albrecht · Accepted solution]

I found the answer given by Tomer Sole in Permission profile just for one inline layer:

With Permissions Per Layer, you can either have:

- Show all policies and edit specific layers

- Show and edit all policies and layers

- Not see any security policy

You cannot limit users from seeing just some of the layers with R80.10 unfortunately.