Technical Tip: How to make an access profile for a system administrator invisible when creating a new admin in a VDOM

In order to make an access profile invisible in a different vdom, the 'mnt' setting in access profile should have less permission then the access profile that the admin is mapped to.

The permission order is as follows:
'none' < 'read' < 'read-write'

The permission order above means:

• Any access profile which has 'mnt' set to 'read' or 'read-write', has higher permissions than an access profile with 'mnt' set to 'none'.
• Any access profile which has 'mnt' set to 'read-write' has higher permissions than an access profile with 'mnt' set to 'read' and 'none'.

Here is an config example:

• Configure two access profiles and set 'mnt' to 'none' in one of the access profile and in other profile to 'read' or 'read-write' as shown below:

config system accprofile

    edit Profile-1

        set sysgrp custom
            config sysgrp-permission
                set admin read-write
                set cfg read-write
                set mnt none <-----
            end
        next
        edit Profile-2
            set sysgrp custom
                config sysgrp-permission
                    set admin read-write
                    set cfg read-write
                    set mnt read-write <----- or set mnt to 'read'.
                end
            next
        end

• Create two administrators as follows, and set each of the different access profiles above per administrator:

config system admin
    edit Tester-A
        set accprofile "Profile-1" <-----

        set password <password>
        set vdom root
    next
    edit Tester-B
        set accprofile "Profile-2" <------
        set password <password>
        set vdom root
    next
end 

Result:

When admin Tester-A logins to the GUI, and wants to create a new administrator profile under System -> Administrator -> Create New -> Administrator, the access profile 'Profile-2' will not be visible under 'Administrator profile' since the access profile 'Profile-1', which has been set to Tester-A, has fewer permissions (set mnt none) than the access profile 'Profile-2' (set mnt read-write).