Defining access group rules using the CLI

Use the commands in this topic to define an access group rule.

To define an access group rule:

Go to CLI configuration mode:

cm-hostname > enable
cm-hostname # configure terminal

Define the rule:
```
cm-hostname (config) # aaa authorization access-groups group <access group name> rules rule <operation> <match option 1> [<match option 2>...]
```
where:
- access group name specifies the name of the access group.
- position option specifies the position of the rule in the list. For a description of the possible values, see Rule management options.
- match option specifies the alert criteria to match. For a description of the possible values, see Access group rule options.

Verify your changes:

cm-hostname (config) # show aaa authorization access-groups rules

Save your changes:
```
cm-hostname (config) # write memory
```

Example

The following example creates a rule that grants users in the nx-alerts access group access to all major and critical alerts from the acme-nx2500 appliance.

cm-05 (config) # aaa authorization access-groups group nx-alerts rules rule append tail match appliance-name acme-nx2500 match-not-alert-severity minor

cm-05 (config) # show aaa authorization access-groups group nx-alerts

AAA Authorization Access-groups Rules : Enabled
------------------------------------------------
# Group: nx-alerts
------------------------------------------------
# Rule         Statements
------------------------------------------------
 #1            Match Appliance Name: acme-nx2500
               Not Match Alert Severity : minor

Note

For an example of a fully configured access group, see Example: configuring an access groups for alerts.