topic Re: local aaa privileges in Network Access Control

local aaa privileges

lkadlik — Mon, 11 Mar 2019 00:31:20 GMT

I want to be able to set up

read only access to one of our cisco routers while letting the other users still be able to get into enable and config mode.

My current config ( without the read only access user) is as follows

aaa new-model
aaa authentication login default local-case
aaa authentication login NO_AUTHENT none
aaa authorization exec default local

username x password y

Thank you.

Re: local aaa privileges

Jason Masker — Tue, 26 Oct 2010 20:07:56 GMT

You can set a different privilege in the username command, so your view user could look like

username view privilege 1 secret

where view is the username.

Re: local aaa privileges

lkadlik — Wed, 27 Oct 2010 14:02:08 GMT

Hi,

I tried that on a test router logging into the console port and I could not log in with a privilege level of 1. I could log in with a privilege level of 3. However, it let me make changes to the router in config mode. My goal is to allow the account to run show commands on the router and have read only access.

Thoughts?

Re: local aaa privileges

Panos Kampanakis — Wed, 27 Oct 2010 18:42:07 GMT

You would need to move the "show command" to level 3.

Use command "privilege exec level 6 show".

I hope it helps.

Re: local aaa privileges

cadet alain — Thu, 28 Oct 2010 20:44:32 GMT

If your IOS is greater than 12.3(7)T then you could use role-based CLI.