topic Re: Cisco 9200L Privilege level stops working in Network Access Control

Cisco 9200L Privilege level stops working

MichelWilfred — Wed, 25 Oct 2023 19:11:03 GMT

Hi,

I have a few switches here that I configured a separate account with privilege level 7 to allow another user to only change the vlan of interfaces and save the configurations. This works fine for a few days but then they are unable to type switchport access, it shows invalid input detected for "access". I have to add "privilege interface level 7 switchport access vlan" again and it will work for a few days. Here's the commands I entered to set this up:

username _____ privilege 7 secret ______

privilege exec level 7 conf t
privilege exec level 7 copy run start
privilege configure level 7 interface
privilege interface level 7 switchport access vlan
privilege interface level 7 description
privilege exec level 7 copy run start
file privilege 7

Re: Cisco 9200L Privilege level stops working

ahollifield — Wed, 25 Oct 2023 19:38:01 GMT

Is something else overriding the configuration? Do the privilege level configurations still show in show run? Also a AAA server like ISE would be much better for controlling things like this.

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Wed, 25 Oct 2023 19:54:45 GMT

There shouldn't be anything else overriding it and the configurations still show up in the show run. We did it directly on these switches since we only needed to do this for 1 user.

Re: Cisco 9200L Privilege level stops working

ahollifield — Wed, 25 Oct 2023 19:56:49 GMT

It's very strange it stops working after a couple of days. What version of IOS-XE? Right but what happens when user 2 comes along? Its also much easier/better to define users/groups/policies on centralized AAA server.

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Thu, 26 Oct 2023 13:12:38 GMT

It is on 16.12.03a

Re: Cisco 9200L Privilege level stops working

ahollifield — Thu, 02 Nov 2023 11:02:35 GMT

I would really suggest trying a newer code 17.9 is now a gold-star option.

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Thu, 02 Nov 2023 14:11:08 GMT

We are planning on doing that upgrade, will update the post if that solves the issue. Thank you

Re: Cisco 9200L Privilege level stops working

MHM Cisco World — Sun, 05 Nov 2023 14:33:46 GMT

switchport mode access <<- this make port access and assign to vlan 1 by default
or
switchport access vlan x <<- if you dont specify vlan then it by default use vlan 1

so I think it not privilege issue it port Access/Trunk mode issue

Thanks A Lot
MHM

Re: Cisco 9200L Privilege level stops working

GCT Network — Mon, 26 May 2025 11:31:34 GMT

Hello,

Have you found any solution for this problem? I'm facing the same issue on different switches C9300, C9200, C2960X running different OS versions. Once I configure and save privilege access this way:

privilege interface level 12 switchport

privilege interface level 12 switchport mode access

privilege interface level 12 switchport mode trunk

privilege interface level 12 switchport access vlan

privilege interface level 12 switchport trunk allowed vlan add

privilege interface level 12 switchport trunk native vlan

After couple of days or weeks, access is blocked. And configuration only contains this command:

privilege interface level 12 switchport

Best regards,

Marek

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Wed, 17 Sep 2025 14:58:47 GMT

No, it was working for some time after I changed from privilege level 7 to privilege level 8 but now I'm having the issue again.

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Wed, 17 Sep 2025 15:00:10 GMT

These are the commands I typed:

privilege exec level 8 conf t
privilege exec level 8 copy run start
privilege configure level 8 interface
privilege interface level 8 switchport access vlan
privilege interface level 8 description
privilege exec level 8 copy run start
file privilege 8

But the running config shows this, it works for a few weeks then stops letting me type after switchport:

privilege interface level 8 switchport
privilege interface level 8 description
privilege configure level 8 interface
privilege exec level 8 copy running-config startup-config
privilege exec level 8 copy running-config
privilege exec level 8 copy

Re: Cisco 9200L Privilege level stops working

MHM Cisco World — Wed, 17 Sep 2025 15:05:24 GMT

Can I see

Show aaa server

MHM

Re: Cisco 9200L Privilege level stops working

MichelWilfred — Wed, 17 Sep 2025 15:12:46 GMT

we don't use an aaa server, credentials are local

Re: Cisco 9200L Privilege level stops working

MHM Cisco World — Wed, 17 Sep 2025 15:25:02 GMT

Can I see vty line config

MHM