Here is another option:
We are half way to make this work. You already have authentication happening locally; we should be able to attach the user authentication to the assigned privilege by using authorization.
aaa new-model
aaa authentication login default local
aaa authorization exec default local <<< Once you add this the Switch will place the new authenticated user into the correct Privilege level.
The users will not be prompt for the enable password, but will jump directly into the enable mode. You could confirm the privilege level assigned to the user with the show priv command.
The original enable password/secret would still be there, if you allow users access to the enable command, then they can still jump into the Full Privilege Enable mode (15). This can be avoided by giving the users a lower privilege level, then moving the enable command up to a higher privilege level.
I don't have a switch with me at this moment to test the cli, but I think the command to change the privilege would be:
Switch(config)#privilege exec level X enable
where X is the new privilege evel. Of course the junior user should be in a lower level in order to not reach the command.
HTH,
Did you find this post helpful?
