View source for Configuring privilege levels on Cisco switch

[[Main Page|Home]] > [[Switch configuration notes]] > [[Configuring privilege levels on Cisco switch]]

We can configure different command access based on priviledge level of user logged in. Hence, the commands available would depend entirely on username / password supplied to switch during login. 


==Creating users==
First we have to create user with some privilege level between 0 and 15 (both inclusive). Level 15 always has full control. So it is better to create limited access user from privilege level 3 onwards. To create user with privilege level 3 use syntax in configure terminal mode
<pre>
username <username> privilege 3 password 0 <plain text password>
</pre>

==Defining which commands are allowed==
Then in 'configure terminal' mode we can specify which exec mode commands should be allowed to users with privilege level 3 using syntax `<tt>privilege exec level 3 &lt;command&gt;</tt>'.

For example:
<pre>
privilege exec level 3 traceroute
privilege exec level 3 ping
</pre>

If you want to allow the user with privilege level 3 to change hostname then you need to enter following lines in 'configure terminal' mode
<pre>
privilege exec level 3 configure terminal
privilege configure level 3 hostname
</pre>

==Enabling local login==
In order to allow users to login using this method you must configure local login for some vty lines. That is you should configure
<pre>
line vty 0 15
login local
</pre>

Using 'aaa new-model' wont work. With 'aaa new-model' users will be able to login using the configured username and password but they would have to type 'en' and then enable password to be able to run exec commands. Now since we cannot configure per user enable commands we must use 'login local' for vty due to which after login
users are automatically in enable mode and there is no need to type 'en' command separately.



[[Main Page|Home]] > [[Switch configuration notes]] > [[Configuring privilege levels on Cisco switch]]