System information

ISR Overview and Providing Secure Administrative Access 93

Configuring Privilege Levels

Larger enterprise environments might need to support multiple administrative privilege

levels for router conﬁguration. For example, help desk staff might need access to a subset

of the IOS commands available to the primary router conﬁguration team.

Cisco IOS routers normally use two of the 16 supported privilege levels. Speciﬁcally, Cisco

IOS routers support privilege levels in the range 0 to 15. By default, when you attach to a

router, you are in user mode, which has a privilege level of 0. After entering the enable

command and providing appropriate credentials, you are moved to privileged mode, which

has a privilege level of 15.

However, for a ﬁner granularity of administrative privileges, you can conﬁgure privilege

levels in the range 1 to 14 using the privilege mode {level level command | reset command}

command in global conﬁguration mode. reset is used to reset the privilege level of a

command to its original privilege level. To illustrate, Example 3-10 shows how to conﬁgure

the debug command to be a privilege level 5 command and how to set the enable secret

password for level 5 administrative access.

After additional privilege levels are conﬁgured, an administrator can specify the privilege

level she wants to change to using the enable level command. For example, for an

administrator to switch to the previously conﬁgured privilege level of 5, she would enter the

enable 5 command. After switching to a privilege level of 5, the administrator would have

access to all commands associated not only with privilege level 5, but also all lower

privilege levels.

Creating Command-Line Interface Views

Similar to making different commands available to different administrators using privilege

levels, role-based command-line interface (CLI) views can be used to provide different sets

of conﬁguration information to different administrators. However, unlike making

commands available via privilege levels, using role-based CLI views you can control

NOTE Although it isn’t recommended, you can disable the inactivity timer by entering

a 0 for both the minutes and seconds arguments in the exec-timeout command (that is,

exec-timeout 0 0).

Example 3-10 Conﬁguring a Privilege Level

R1# cc

R1(config)# pp

R1(config)# ee