Configuring Roles and Permissions for Admins

You can assign different Role Based Access Control (RBAC) roles to admins for the Cato Management Application, and restrict their permissions to only view or edit specific screens. A role is a set of granular permissions that controls the editing and viewing privileges for each screen within the Cato Management Application. Roles help you protect your network by providing admins with the minimum level of access needed for performing their tasks.

You can define RBAC admin permissions to edit or only view specific sites, groups of sites, and SDP users. Admins that don't have permissions, can't view the sites or SDP users, and the analytics screens and dashboards are automatically filtered to only show the items with the correct permissions. For example, an admin has view permissions for a group of 10 sites. When the admin opens the Events screen, only events for those 10 sites are shown in the screen. When creating a new rule for a policy, admins can only choose those sites and user groups that they have permissions to edit.

The Roles & Permissions screen comes with several out of the box roles with predefined permissions for common admin types. You can also create custom roles to fit the specific needs of admins in your organization. When you create a custom role, you define permissions for the role on a per screen basis. These are the permissions that can be defined for each screen:

You can create custom roles and define granular permissions for all screens in the Cato Management Application to fit the exact needs of your organization. However, you can't set separate permissions for individual tabs and features within a screen.

By default, when you create a new role all permissions are set to View only. You can click in the row of the role to modify the permissions in the Edit Role panel. You can delete a role from the more menu in the row of the role, however, you can't delete a custom role that is currently assigned to an admin.

The permissions for some screens automatically configure dependent permissions for other screens and features. The following dependent permissions apply when creating a role:

In the Administrators screen, you can assign one or more roles to each admin. When an admin is assigned multiple roles that include different permissions for the same screen, the greater permissions apply. For example, if an admin is assigned one role with Edit permissions for the WAN Firewall screen, and another role with View only permissions, the admin can edit the WAN Firewall policy.

You can define which sites and SDP users that new and existing Cato Management Application admins have permissions to edit or access. When you assign groups that contain sites and other items, the Administrators screen only shows the sites in the group.

Admins can only create new SDP users when they have Edit permissions for all user groups.

For admins that are assigned permissions based on roles, there is an AND relationship between the role and the site or user group. For example, if an admin is assigned view permissions for the London site and they no permissions for the Sites screen, then they can't view the London site. Or if they have edit permissions for the London site, but have view permissions for the site screen, then they can only view the site and can't edit it.