Restrict Admin Access to Cisco SD-WAN Manager

Updated 14 November 2026 · Standard formula, shown below

This guide shows you how to restrict administrative access to Cisco SD-WAN Manager (vManage) so only authorized users can manage your SD-WAN fabric. You’ll control who can log in, what they can do, and where they can connect from. You’ll need administrative privileges on the vManage cluster and access to the vManage web UI or CLI.

What You’ll Need

Administrative credentials for Cisco SD-WAN Manager (vManage).
Access to the vManage web interface (typically via HTTPS).
Optional: CLI access via SSH for advanced settings.
Knowledge of your organization’s user roles and IP address ranges for access control.

Step-by-Step

Log in to vManage – Open a web browser and navigate to your vManage IP or hostname. Log in with an account that has the admin or superuser role.
Navigate to Administration – In the left menu, click Administration > Manage Users. This is where you control user accounts and roles.
Review existing roles – Click the Roles tab to see the default roles (e.g., admin, operator, viewer). Understand what each role can do. For example, admin has full read/write access, while viewer is read-only.
Create custom roles (optional) – If you need finer control, click Add Role. Name it (e.g., “NetworkOps”) and select the specific permissions (e.g., read/write for Configuration, read-only for Monitoring). This lets you restrict what admins can do beyond the default roles.
Assign roles to users – Go to the Users tab. For each user, click the pencil icon to edit. Change the Role to a more restrictive one if needed. For example, change a user from admin to operator if they only need to monitor.
Enable TACACS+ or RADIUS (optional) – For centralized control, go to Administration > AAA and configure TACACS+ or RADIUS servers. This allows you to manage authentication externally and apply per-user restrictions. Set the Authentication Order to use the external server first.
Restrict by IP address – In the Administration > Settings page, look for Session Options or Access Control. Some versions allow you to specify allowed source IP ranges for admin access. If available, enter the IP subnets that are permitted to reach the vManage admin UI. Save changes.
Use the CLI for IP filtering (if not in UI) – SSH to vManage and enter config mode. Use the ip access-list command to create an ACL that permits only specific management hosts. Then apply it to the vManage interface (e.g., interface eth0). Example: ip access-list extended MGMT-ACL then permit ip host 192.168.1.10 any and finally apply access-list MGMT-ACL in on the interface.
Set password policies – In Administration > Settings, configure password complexity and expiration. This reduces the risk of credential compromise.
Enable two-factor authentication (if supported) – Some vManage versions support TOTP or external IdP. If available, enable it for admin accounts to add an extra layer.
Audit and monitor – Regularly review Administration > Audit Log to see who logged in and what changes they made. This helps detect unauthorized access.
Test the changes – Log out and try logging in with a user who has restricted rights. Verify they cannot access admin functions. Also try connecting from an IP outside the allowed range (if you set IP filtering) to confirm access is blocked.

Common Mistakes

Not testing after changes – You might lock yourself out. Always have a backup admin account or console access.
Overly broad IP ACLs – Using permit ip any any defeats the purpose. Be specific with host IPs or subnets.
Ignoring default roles – The default admin role is powerful. If you leave it assigned to many users, you haven’t restricted access.
Misconfiguring AAA – If TACACS+ is unreachable, you might be locked out. Always configure a fallback (e.g., local authentication) and test carefully.
Forgetting about API access – vManage has a REST API. Restricting the UI doesn’t block API calls. Use the same user roles and IP filters for API access.

Tips

Use the principle of least privilege: give users only the permissions they need.
Create a separate role for break-glass emergency access with full admin, and keep it unused except in emergencies.
Regularly rotate admin passwords and use strong, unique passwords.
If you use TACACS+, integrate with your corporate identity provider for centralized control.
Document your access control policy and review it quarterly.
For IP restrictions, consider using a jump host or VPN to access vManage, so you only need to allow that host’s IP.

Troubleshooting

Locked out of vManage – If you accidentally block your own IP, use console access (via serial or SSH from the management network) to revert the ACL. Alternatively, reboot vManage and interrupt the boot process to access recovery mode.
Users still have too much access – Check if they have multiple roles or if the role you changed is overridden by a group policy. Review the user’s effective permissions in the UI.
AAA authentication fails – Verify that the TACACS+ server is reachable (ping from vManage), and check the shared secret. Test with a known-good user. If all fails, temporarily set authentication order to local only.
IP ACL not working – Ensure the ACL is applied to the correct interface and direction (inbound). Check the vManage logs for dropped packets. Use show access-lists in CLI to verify counters.
API access still open – The API uses the same user roles, but IP filtering may not apply if you only restricted the UI. Apply the same ACL to the API endpoint (usually port 443) or use a reverse proxy.

Frequently Asked Questions

Can I restrict admin access by time of day?

vManage does not natively support time-based restrictions. You would need an external identity provider or a network device (like a firewall) to enforce time-based policies.

What is the difference between admin and operator roles?

Admin has full read/write access to all configuration and monitoring. Operator typically has read-only access to monitoring and can run certain commands, but cannot change configuration.

Can I use LDAP instead of TACACS+?

Yes, vManage supports RADIUS and LDAP for authentication. You can configure LDAP in the AAA settings. However, TACACS+ is often preferred because it provides per-command authorization.

Will restricting admin access affect normal operations?

No, it only affects who can log in and what they can do. Network traffic through the SD-WAN fabric is unaffected. Make sure your network operations team has appropriate access to perform their duties.

How do I audit who made changes?

Go to Administration > Audit Log. It shows login events, configuration changes, and which user performed them. You can filter by time and user.

What if I need to give temporary admin access?

Create a temporary user with admin role and set an expiration date (if supported) or manually remove the user after the task. Alternatively, use a break-glass account and change its password after use.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.