DownloadsClient Area
Administration

Network Operator Role

R13 Appliance-Scoped RBAC

The Network Operator role lets network engineering teams work directly with network-appliance certificate automation without receiving general SSL Nexus administration rights. It is intended for organisations where infrastructure, security and network teams share one SSL Nexus deployment but own different parts of the estate.

Why this role exists
Network engineers can enter and rotate appliance API credentials, test management connectivity, maintain approved network targets and operate their network-bound certificate jobs themselves. This removes the ticket loop where another team must repeatedly copy credentials, configure an appliance target, run a test and report the result back.

What Network Operators Can Do

AreaNetwork Operator Access
DashboardRead operational data limited to the network-appliance estate.
Deployment targetsCreate, edit and test targets whose platform is network.
Appliance credentialsEnter or rotate encrypted API credentials. Stored secrets are never returned through the API.
Management healthRun Test connection against the target's native management API.
Certificate authority healthRun Test CA against the CA profile bound to that target.
CertificatesView and operate certificate records that are bound to network targets, including the scoped lifecycle actions exposed by the dashboard.
SecurityManage the signed-in user's own password, MFA and sessions.

What Remains Outside The Role

Network Operators cannot manage Linux or Windows targets, custom deployment plugins, organisation settings, licensing, backups, Vendor Portal administration, staff administration, global identity-provider configuration or certificate import/ownership-changing workflows. The restriction is enforced by the server API and object-level target/certificate checks, not only by hiding menu items in the browser.

Assign The Role

Administrators can assign Network Operator directly to a named staff account or map directory/SSO groups to it. LDAP / Active Directory and OIDC profiles include a dedicated Network Operator groups field. This allows an existing Network Engineering, Load Balancer or Firewall group to receive appliance-scoped access without maintaining a second set of roles in SSL Nexus.

  1. Open Settings - Authentication & identity.
  2. Add the required LDAP/AD or OIDC group to Network Operator groups.
  3. Save the identity settings and let SSL Nexus restart.
  4. Confirm a member sees only Overview, Deployment targets, Certificates and their own Security controls.

Normal Network Operator Workflow

  1. Open Deployment targets and create or edit the network appliance.
  2. Select Palo Alto Networks, F5 BIG-IP or VMware vCenter.
  3. Enter the appliance management address and API credential plus the application-specific fields.
  4. Select and configure the target-bound CA adapter.
  5. Save the target.
  6. Run Test connection to verify the appliance management plane.
  7. Run Test CA to verify the certificate authority independently.
  8. Only after both paths are healthy should production certificate work be attached to the target.

Test Connection And Test CA Are Deliberately Separate

Test connection proves SSL Nexus can authenticate to the appliance using the same native API family used by deployment. Test CA proves the CA profile stored on that target can perform its non-issuing health check. A target can therefore show a healthy appliance connection and a failed CA connection, or the reverse, without hiding which dependency is broken.

Current Network Target Class

TargetManagement APICertificate Model
Palo Alto Networks PAN-OS / PanoramaHTTPS XML APIAppliance-held private key and CSR, signed certificate import, commit tracking.
F5 BIG-IPiControl RESTManaged certificate/key objects with explicit Client SSL profile binding.
VMware vCentervCenter REST APIvCenter-generated Machine SSL private key and CSR, certificate-only return.
R13 validation status: Palo Alto Networks is the established R12 network target. F5 BIG-IP and VMware vCenter are implemented in R13 and should be validated against non-production appliances that match your production version/profile design before automatic renewals are enabled.

Audit And Ownership

Network Operator actions continue through the normal SSL Nexus job and audit pipeline. Use named identities instead of shared accounts so target changes, certificate operations and connection tests remain attributable to the engineer who performed them.