<?xml version="1.0" encoding="utf-8"?>
<!-- Version 1.2 -->
<Authorizations xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
	<Authorizations>
	<Authorization>
		<!--This entry will only be processed in the times given below-->
		<!--<Time>MTWRFSN,04:00-21:00</Time>-->
		<!--This authorization section applies to the following user groups. In case of conflicting authorization entries for the same group, the entry which appears first in the file is used.-->
		<UserGroups>
			<UserGroup>Network Engineering</UserGroup>
		</UserGroups>
		<!--This authorization section applies to the following client groups. In case of conflicting authorization entries for the same client group, the entry which appears first in the file is used.-->
			<!--If no client groups are specified then the settings are applied to the specified usergroups irrespective of the clients they come from-->
		<ClientGroups>
			<ClientGroup>LOCALHOST</ClientGroup>
			<ClientGroup>INTERNAL</ClientGroup>
		</ClientGroups>
		<AutoExec>
			<!--<Set>acl=7</Set>-->
			<!-- When an exec is started, its connection access list will be 7.  It will also automatically execute this autocmd. If the cmd element is not provided then the shell entry is used when the shell is first invoked.-->
			<!--<Set>autocmd=telnet 10.1.1.1</Set>-->
			<!--<Set>priv-lvl=7</Set>-->
		</AutoExec>
		
		<Shell> <!--note that the login and exit commands are always permitted-->
			<!--<Permit>configure</Permit>--> <!--this will allow configure command -->
			<!--<Deny>show running-config</Deny>--> <!--this will deny the user to run 'show running-config' -->
			<!--<Permit>enable</Permit>--> <!--this will allow this group to run enable command -->
			<!--<Deny>show bgp all</Deny>-->	<!--this will deny this group to run show bgp all command -->
			<!--<Permit>show bgp .*</Permit>--><!--this will deny this group to run other show bgp commands -->
			<Permit>.*show.*</Permit> <!--This will allow all show commands -->
			<Deny>.*</Deny>           <!--This will deny all other commands -->
	    </Shell>
		<Services>
			<!-- <Service>
				<Set>service=ppp</Set>
				<Set>protocol=ip </Set> -->
				<!--these groups can run IP over PPP only if they use one of the following mandatory addresses. If they supply no address, the first one here will be mandated-->
				<!--<Set>addr=10.1.1.1</Set>--> <!--mandatory argument-->
				<!--Their  mandatory input access list number is 5-->
				<!--<Set>inacl=5</Set>-->
				<!--We will suggest an output access list of 10 but the NAS may choose to ignore or override it-->
				<!--<SetOptional>outacl=10</SetOptional>-->
				<!--These are examples of vendor specific attributes(VSAs)-->
				<!--<Set>foundry-privlvl=5</Set>-->
			<!-- </Service> -->
		</Services>
	</Authorization>

	<Authorization>
		<UserGroups>
			<UserGroup>Local System Administrators</UserGroup>
		</UserGroups>
		<!--No client group provided so this authorization section applies to the above user groups from all the clients -->
		
		<!--this group is allowed to telnet everywhere except from addresses beginning with 161.-->
		<Shell>
			<!--<deny>telnet 161\.*</deny>
			<Permit>telnet .*</Permit>-->
			<Permit>.*show.*</Permit> <!--This will allow all show commands -->
			<Deny>.*</Deny>           <!--This will deny all other commands -->
		</Shell>
	</Authorization>


<!-- DEFAULT PROFILE -->

<!-- The DEFAULT Authorization Profile is added by default with the Server 
installation and is used to enable ALL Users full access to ALL Clients. 
This group should be removed or commented out before deploying the Server 
in a production environment. 
-->

	<Authorization>
		<Shell>
			<Permit>.*show.*</Permit> <!--This will allow all show commands -->
			<Deny>.*</Deny>           <!--This will deny all other commands -->
		</Shell>
	</Authorization>

</Authorizations>
</Authorizations>
