Administrator Guide

Creating a Custom Privilege Level
Custom privilege levels start with the default EXEC mode command set.
You can then customize privilege levels 2-14 by:
• removing commands from the EXEC mode commands
• moving commands from EXEC Privilege mode to EXEC mode
• allowing access to CONFIGURATION mode commands
• allowing access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode commands
You can access all commands at your privilege level and below.
Moving a Command from EXEC Privilege Mode to EXEC
Mode
Remove a command from the list of available commands in EXEC mode for a specific privilege level using the
privilege exec command from CONFIGURATION mode. In the command, specify a level greater than the
level given to a user or terminal line, then the first keyword of each restricted command.
Moving a Command from EXEC Privilege Mode to EXEC
Mode
Move a command from EXEC Privilege to EXEC mode for a privilege level using the privilege exec
command from CONFIGURATION mode. In the command, specify the privilege level of the user or terminal
line, and specify all keywords in the command to which you want to allow access.
Allowing Access to CONFIGURATION Mode Commands
Allow access to CONFIGURATION mode using the privilege exec level level command configure
from CONFIGURATION mode. A user that enters CONFIGURATION mode remains at his privilege level, and
has access to only two commands, end and exit. Individually specify each CONFIGURATION mode command
to which you want to allow access using the privilege configure level level command. In the
command, specify the privilege level of the user or terminal line, and specify
all keywords in the command to
which you want to allow access.
Allowing Access to INTERFACE, LINE, ROUTE-MAP, and
ROUTER Mode
1 Similar to allowing access to CONFIGURATION mode, to allow access to INTERFACE, LINE, ROUTE-
MAP, and ROUTER modes, first allow access to the command that enters you into the mode. For
example, allow a user to enter INTERFACE mode using the privilege configure level level
interface gigabitethernet command.
2 Then, individually identify the INTERFACE, LINE, ROUTE-MAP or ROUTER commands to which you want
to allow access using the privilege {interface | line | route-map | router} level
Management 74