Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time privileged access to Cisco IOS XE devices — creating a local user account with a configurable privilege level at checkout and deleting it at checkin.

What you’ll accomplish:

• Deploy and configure the Britive Access Broker with SSH access to your Cisco IOS XE device
• Configure checkout and checkin routines from the access-broker-examples repository
• Register the Cisco device as a Resource Manager resource in Britive
• Create a Resource Manager access profile
• Check out privileged access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

• A Britive tenant with administrator access
• A running Britive Access Broker with network access to the Cisco device (SSH port 22)
• A Cisco IOS XE local admin account with privileges to create and delete local users
• ssh available on the broker host; target device must support ip ssh and local authentication

How It Works

The Access Broker SSHes into the Cisco device and runs IOS commands to create or delete local user accounts. At checkout, Britive creates a local user with the configured privilege level (1–15). At checkin (or on expiry), the user is deleted with no username — no standing network device accounts remain.

User → Britive Console → Access Broker → SSH → IOS: username create/delete (privilege 1–15)

Onboarding the Application

Configure the broker for Cisco IOS XE access management. This is a one-time setup performed by an administrator.

git clone https://github.com/britive/access-broker-examples.git
# Copy CiscoIOSXE/permissions/ scripts to your broker's scripts directory

ip ssh version 2
username britive_admin privilege 15 secret StrongPassword!

CISCO_HOST=router.example.com
CISCO_ADMIN_USER=britive_admin
CISCO_ADMIN_PASSWORD=...   # From Britive Secrets Store
CISCO_PRIVILEGE_LEVEL=15   # 1–15; 15 = full admin
BRITIVE_USER_EMAIL=user@example.com

resource "britive_resource_manager_resource_type" "cisco" {
  name        = "CiscoIOSXE"
  description = "Cisco IOS XE network device"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "router01" {
  name          = "core-router-01"
  resource_type = britive_resource_manager_resource_type.cisco.name

  parameter_values = {
    hostname = "router.example.com"
    port     = "22"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

resource "britive_resource_manager_profile" "cisco_readonly" {
  name                = "Cisco-ReadOnly-Access"
  expiration_duration = 3600000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "cisco_perm" {
  profile_id = britive_resource_manager_profile.cisco_readonly.id
  name       = "Cisco-Level1-Access"
  version    = "latest"

  variables {
    name              = "CISCO_PRIVILEGE_LEVEL"
    value             = "1"
    is_system_defined = false
  }
}

Verify

ssh <temp-username>@router.example.com

show privilege

Troubleshoot

Next Steps

• Britive documentation