https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClETCA0
3.Create Administrator for Administrator Type "Device Group and Template Admin" and bind the access domain
Access domains allow you to control which permissions a specific administrator has when that administrator accesses a set of managed devices through Panorama. Access domains use Device Group and Template permission sets that you must define beforehand.
Hmm no dude. Let's see...you'd choose either A or D if you want to create users, and customize what actions a user can perform with A (Role based, for example, I want admin Bob to be able to do whatever he wants in the web ui, but he will not have any access through CLI).
With an access domain, you define more than just actions, but the scope an admin can have when configuring through Panorama. For example, you want adminBilly to be the Panorama administrator for a device group called: Dallas-DC, and he can only manage devices within that specific DG. You will remove adminBilly the global scope, and further DGs except for Dallas-DC.
Makes sense, access domain is some part of your installation. In Panorama there are two kinds of such parts - Templates(for device mgmt) and Device Groups(for traffic mgmt).
upvoted 4 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Ab121213
Highly Voted 4 years, 1 month agoPag0s
Highly Voted 3 years, 5 months agoMarshpillowz
Most Recent 5 months, 3 weeks agoJRKhan
6 months, 1 week agoccaiccie
6 months, 3 weeks agoCarlosDV06
1 week, 4 days agodjedeen
1 year, 6 months agoTAKUM1y
1 year, 9 months agoqqqq123
3 years, 10 months ago