This article describes access privileges in operational and configuration mode. It also explains the differences between allow-commands, deny-commands, allow-configuration and deny-configuration and their use cases.

Each top-level command-line interface (CLI) command and each configuration statement in Junos OS have an access privilege level associated with them. Users can execute only those commands and configure and view only those statements for which they have access privileges. The access privileges for each login class are defined by one or more permission flags.

 For each login class, you can explicitly deny or allow the use of operational and configuration mode commands that would otherwise be permitted or not allowed by a privilege level specified in the permissions statement.

• allow-commands and deny-commands can allow or deny access to operational commands but not to configuration mode commands.

• allow-configuration and deny-configuration can allow or deny access to particular configuration hierarchy only.

Allow-configuration takes precedence over the deny-configuration. If command/configuration is allowed, for example, using permission all , then we can use deny-configuration to deny access to a hierarchy. In that case deny-configuration takes precedence. But if we use both allow and deny configuration on a particular hierarchy, allow will take precedence.

Please refer to the following KB for more details.
www.juniper.net/techpubs/en_US/junos15.1/topics/example/access-privileges-configuration-mode-commands-regexps-configuring.html

We also have permission with permission bits which can selectively combine both. For example, permission security-control can view and configure security information at the [edit security] hierarchy level, while security can view security configuration in configuration mode and with the show configuration operational mode command.

Following article explains access privileges in detail.

www.juniper.net/documentation/en_US/junos15.1/topics/concept/access-privileges-levels-overview.html

Scenario 1


The following user class "Test" was configured and permissions security (no access to configure) was provided. Also allow-commands access to "set" was allowed and everything is denied. Allow-configuration access to security policies was configured.

Result:

Deny commands work in operational mode where only set is allowed. Security permission should provide access to show configuration which is also denied by deny-commands.

Scenario 2


The user class "Test" was configured and permissions security (no access to configure) was provided. Also allow-commands provided access to configure and denied everything.Allow-configuration access to security policies was provided.

Result:

Access to only configure was granted. Once into config mode, user gets access to all commands. As specified in allow-configuration, user gets access only to Security policies. The result is below.

We can provide access to selective hierarchy and certain operational mode commands, but it is not possible to allow deactivate/activate configuration mode commands while denying other configuration mode commands. At this stage it is not possible to achieve it.