Port-Level Permissions
In Meraki Dashboard it is possible to provision read-only administrator accounts with read-write access to selected switchports. In traditional networks, doing this wasn’t easy, so we avoided it. However, now that the capability exists, some immediate use cases come to mind:
Labs, teaching environments, dormitories, and the like. If you have any such environments in your network, you can now provide limited admin access to staff or students without having to provide them with admin access to the rest of the network. With the access locked down, if required, you could continue to serve regular users off the remaining ports.
Multitenanted environments like airports or shopping centers. In a multitenanted environment where you’re responsible for providing network connectivity to businesses inside your premises, you could provide tenants with admin access to the ports serving just their premises. Because the control is down to the port level, potentially you could now share switches between tenants where you previously had provided a switch per tenant, reducing costs.
Follow these steps to tag your ports and configure roles with port-level permissions:
Step 1. Log in to Meraki Dashboard (https://dashboard.meraki.com).
Step 2. Navigate to Switching > Switch Ports (under Monitor), as demonstrated in Figure 4-7.
)
Figure 4-7 Navigating to the Switch Ports Page
Step 3. Select the ports that you want to tag using the check box next to their name, as demonstrated in Figure 4-8.
)
Figure 4-8 Selecting Ports to Tag
Step 4. Click the Tags drop-down menu and enter the name for a new tag or select an existing tag. In the example in Figure 4-9, we added the tag Lab. Click Add to confirm the changes.
)
Figure 4-9 Creating Port Tags
If you have the Tags column enabled (click the spanner symbol on the far-right column name to customize the columns displayed), you see the new tag associated with these ports, as demonstrated in Figure 4-10.
)
Figure 4-10 Showing Port Tags on the Switch Port Page
Step 5. Navigate to Network-wide > Administration to open the Network administration page, as demonstrated in Figure 4-11.
)
Figure 4-11 Navigating to the Network Administration Page
Step 6. Scroll down to the Port Management Privileges section and click Add a Port Management Privilege.
The privilege name is displayed in the Access drop-down menu when this role is assigned to administrators, as demonstrated in Figure 4-12. Enter a privilege name that makes sense for your use case; then select the port tags that apply.
)
Figure 4-12 Creating a Port Management Role
Step 7. Decide whether this role should be able to do packet captures on these ports (the default is Allowed), as demonstrated in Figure 4-13, and then click Save in the bottom-right corner. A message at the top of the screen confirms that the changes have been saved.
)
Figure 4-13 Selecting Packet Capture Permissions
Step 8. Navigate to Organization > Administrators to open the Organization administrators page, as demonstrated in Figure 4-14.
)
Figure 4-14 Navigating to the Organization Administrators Page
Step 9. Click the name or email address of an existing administrator that you want to modify (or create a new one), as demonstrated in Figure 4-15.
)
Figure 4-15 The Organization Administrators Page (Port-Based Permissions)
Step 10. Set the Organization access to Read-only or None and then select the target network. At the time of writing, the target network cannot be a tagged group of networks—that is, one starting with Tag:. In Figure 4-16, you can now select the Lab admins role created in the Access drop-down menu.
)
Figure 4-16 Assigning Port-Level Permissions on the Organization Administrators Page
Step 11. Click Update Admin to save the changes.
Perform the following steps to verify that these changes are now in effect:
Step 1. Log in to Meraki Dashboard as the user that was just configured. In the example in Figure 4-17, this is the user John Smith. You can see on the network-wide administrators page (Network-wide > Administrators) that this user is configured with the Lab admins privileges. Note how the X is missing under the Actions column, confirming the user has read-only access.
)
Figure 4-17 A Network Admin with Lab Admin Privileges
Step 2. Navigate to the switch ports page (Switching > Switch Ports). Here, the Tags column is enabled to make it clear which ports you have access to. Select those port(s) with the tag to which this user has read-write permissions; then click Edit. In this example, the lab admin has selected port 1/9, as shown in Figure 4-18.
)
Figure 4-18 A Lab Admin Selecting Switch Ports to Modify
Step 3. On the update port page, as shown in Figure 4-19, change the port status to Enabled and click Update.
)
Figure 4-19 A Lab Admin Enabling a Disabled Port
Thanks to port-level permissions, you have successfully enabled this port, despite only having read-only access to the rest of the network (see Figure 4-20). If you try to make changes to another port that is not tagged correctly, you will receive an error, as demonstrated in Figure 4-21.
)
Figure 4-20 Verifying That the Lab Admin Was Able to Enable a Port
)
Figure 4-21 Verifying That the Lab Admin Is Not Able to Edit Other Ports