How to provide a user only shutdown/unshutdown permission for a particular BGP session and no other permission.

We are trying to achieve the following, where a user can only shutdown or unshutdown particular BGP sessions,

rancid@jtac-mx204-r2028> configure

Entering configuration mode

Users currently editing the configuration:

 labroot terminal pts/0 (pid 46671) on since 2024-11-24 17:07:36 IST

     [edit]

[edit]

rancid@jtac-mx204-r2028# set ?

Possible completions:

> protocols           Routing protocol configuration

[edit]

rancid@jtac-mx204-r2028# set protocols ?

Possible completions:

> bgp                 BGP options

> bgpmcast            BGP multicast options

[edit]

rancid@jtac-mx204-r2028# set protocols bgp ?

Possible completions:

+ apply-groups        Groups from which to inherit configuration data

+ apply-groups-except Don't inherit configuration data from these groups

> group               Define a peer group

[edit]

rancid@jtac-mx204-r2028# set protocols bgp group ?

Possible completions:

 <group_name>        Group name

 NEW_GROUP           Group name

[edit]

rancid@jtac-mx204-r2028# set protocols bgp group NEW_GROUP ?

Possible completions:

> dynamic-neighbor    Configure peer options for specific networks

> neighbor            Configure a neighbor

[edit]

rancid@jtac-mx204-r2028# set protocols bgp group NEW_GROUP neighbor ?

Possible completions:

 <address>           

  10.20.1.10          

[edit]

rancid@jtac-mx204-r2028# set protocols bgp group NEW_GROUP neighbor 10.20.1.10 ?

Possible completions:

 <[Enter]>           Execute this command

> graceful-shutdown   BGP peer graceful shutdown option

> shutdown            Shutdown

 |                   Pipe through a command

[edit]

rancid@jtac-mx204-r2028# set protocols bgp group NEW_GROUP neighbor 10.20.1.10 shutdown

[edit]

rancid@jtac-mx204-r2028# delete protocols ?

Possible completions:

 <[Enter]>           Execute this command

> bgp                 BGP options

> bgpmcast            BGP multicast options

 |                   Pipe through a command

[edit]

rancid@jtac-mx204-r2028# delete protocols bgp group NEW_GROUP neighbor 10.20.1.10 shutdown

[edit]

rancid@jtac-mx204-r2028# show | compare

[edit protocols bgp group NEW_GROUP neighbor 10.20.1.10]

-     shutdown;

[edit]

rancid@jtac-mx204-r2028# commit

commit complete

set system login class NOC permissions configure

set system login class NOC permissions routing-control

set system login class NOC permissions view

set system login class NOC permissions view-configuration

set system login class NOC allow-configuration-regexps "protocols bgp group .* neighbor .* shutdown"

set system login class NOC deny-configuration-regexps .*

set system login user rancid uid 2002

set system login user rancid class NOC

set system regex-additive-logic <<< This line is important to allow regexps logic to be evaluated

If there are logical groups in your configuration, you can change add another evaluation term to match,

logical-systems logical-system-name protocols bgp group group-name neighbor address

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/protocols-bgp-shutdown.html

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/protocols-bgp-shutdown.html

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-access-privileges.html

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-access-privileges.html

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-login-class-overview.html

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/regex-additive-logic-edit-system.html