privilege interface shutdown

[tirumalababu.e]

Kindly help me to configure lower privilege user should be able to shutdown the fast ethernnet inteface of the switches in my LAN.

I have configure Level 1 user. who has given accesses to show interface through privilege command. Now i would like give him interface shutdown option.

below the configuration already in my switch. but the user is unable to shutdwon the interface.

===================================

switch95#sh run | includ privi

* are authorized access and the level of privilege you *

privilege configure level 0 interface

privilege configure level 0 interface all shutdown

privilege exec level 0 ping

privilege exec level 0 traceroute

privilege exec level 0 show vlan

privilege exec level 0 show interface

privilege exec level 0 configure terminal

========================================

[mbrown]

Can you move commands down to level 0? I've always used 1 through 15, and moved commands down from 15 to something like level 3.

-Mason

[mbrown]

Looks like you can move commands down to level 0, and here's where it says so:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_r/srprt5/srdpass.htm#wp1017782

'You can use level 0 to specify a subset of commands for specific users or lines. For example, you can allow user "guest" to use only the show users and exit commands.'

There's another passage in the same link that talks about how Level 0 commands don't automatically get allowed for higher levels:

'There are five commands associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included.'

So maybe that's the issue - that your level 1 user isn't inheriting level 0 command privileges because they don't pass from level 0 to higher levels.

-Mason

[fausto-oliveira]

Humm the priv level 0 isn't supposed to even permit login, I agree with a previous post that you should use privilege 1.

I have tried that in several customers with considerable sucess.

[ปลาวาฬทราย RMUTT CPE IX]

I can't put this command:

privilege configure level 5 interface all shutdown

Thank you very much.

[poongarg]

What is the HW/SW version of the device. If you logged in via privilege level 15 user.

[ปลาวาฬทราย RMUTT CPE IX]

WS-C3650-48TD/IOS-XE Version 03.06.08.E

and could nexus do this?

Thank you very much.