topic Re: privilege interface shutdown in Network Access Control

privilege interface shutdown

tirumalababu.e — Sun, 10 Mar 2019 21:42:56 GMT

Kindly help me to configure lower privilege user should be able to shutdown the fast ethernnet inteface of the switches in my LAN.

I have configure Level 1 user. who has given accesses to show interface through privilege command. Now i would like give him interface shutdown option.

below the configuration already in my switch. but the user is unable to shutdwon the interface.

===================================

switch95#sh run | includ privi

* are authorized access and the level of privilege you *

privilege configure level 0 interface

privilege configure level 0 interface all shutdown

privilege exec level 0 ping

privilege exec level 0 traceroute

privilege exec level 0 show vlan

privilege exec level 0 show interface

privilege exec level 0 configure terminal

========================================

Re: privilege interface shutdown

mbrown — Tue, 22 Aug 2006 19:59:22 GMT

Can you move commands down to level 0? I've always used 1 through 15, and moved commands down from 15 to something like level 3.

-Mason

Re: privilege interface shutdown

mbrown — Tue, 22 Aug 2006 20:16:57 GMT

Looks like you can move commands down to level 0, and here's where it says so:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_r/srprt5/srdpass.htm#wp1017782

'You can use level 0 to specify a subset of commands for specific users or lines. For example, you can allow user "guest" to use only the show users and exit commands.'

There's another passage in the same link that talks about how Level 0 commands don't automatically get allowed for higher levels:

'There are five commands associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included.'

So maybe that's the issue - that your level 1 user isn't inheriting level 0 command privileges because they don't pass from level 0 to higher levels.

-Mason

Re: privilege interface shutdown

fausto-oliveira — Wed, 23 Aug 2006 14:24:07 GMT

Humm the priv level 0 isn't supposed to even permit login, I agree with a previous post that you should use privilege 1.

I have tried that in several customers with considerable sucess.

Re: privilege interface shutdown

ปลาวาฬทราย RMUTT CPE IX — Thu, 11 Jun 2020 05:34:12 GMT

I can't put this command:

privilege configure level 5 interface all shutdown

Thank you very much.

Re: privilege interface shutdown

poongarg — Sat, 13 Jun 2020 14:45:53 GMT

What is the HW/SW version of the device. If you logged in via privilege level 15 user.

Re: privilege interface shutdown

ปลาวาฬทราย RMUTT CPE IX — Mon, 15 Jun 2020 09:34:52 GMT

WS-C3650-48TD/IOS-XE Version 03.06.08.E

and could nexus do this?

Thank you very much.