Problem with privileges - 12.2 IOS

[Filip Knezevic]

Hello,

We have a problem with user privileges on some older devices, mainly Cisco 6509.

The problem is I don't know how to assign all possible sub commands of a command, namely ip route.

So, for example, colleagues from L1 department can do static routes, but they cant name them. Now for me that is a big issues since they are just piling the routes with no description, which is making troubleshooting harder and it looks really ugly.

On newer IOS (15) you can do:

privilege configure all level 2 ip route.

This will allow all the iterations of the ip route command. 

But on IOS 12.2 there is no all subcommand.

R2D2-NEW(config)#privilege configure ?
level Set privilege level of command
reset Reset privilege level of command

R2D2-NEW(config)#privilege configure lev ?
<0-15> Privilege level

R2D2-NEW(config)#privilege configure lev 2 ?
LINE Initial keywords of the command to modify

R2D2-NEW(config)#privilege configure lev 2

The result is this:

 R2D2-NEW(config)#ip route 8.8.8.8 255.255.255.255 1.1.1.1 ?
<1-255> Distance metric for this route
<cr>

R2D2-NEW(config)#ip route 8.8.8.8 255.255.255.255 1.1.1.1

Cisco says (if I understood correctly) that first couple of keywords for a command will enable all sub commands but it's not working.

R2D2-NEW(config)#privilege configure level 2 ip route name. - This is not working.

Any advice?

Upgrade to new IOS is out of question since we can't risk any issues with these devices. There are a lot of links there and if it wouldn't come back up after an IOS upgrade lot of stuff could potentially go wrong and that would be a catastrophe.  

[Filip Knezevic]

We have a problem with user privileges on some older devices, mainly Cisco 6509.

The problem is I don't know how to assign all possible sub commands of a command, namely ip route.

So, for example, colleagues from L1 department can do static routes, but they cant name them. Now for me that is a big issues since they are just piling the routes with no description, which is making troubleshooting harder and it looks really ugly.

On newer IOS (15) you can do:

privilege configure all level 2 ip route.

This will allow all the iterations of the ip route command. 

But on IOS 12.2 there is no all subcommand.

R2D2-NEW(config)#privilege configure ?
level Set privilege level of command
reset Reset privilege level of command

R2D2-NEW(config)#privilege configure lev ?
<0-15> Privilege level

R2D2-NEW(config)#privilege configure lev 2 ?
LINE Initial keywords of the command to modify

R2D2-NEW(config)#privilege configure lev 2

The result is this:

 R2D2-NEW(config)#ip route 8.8.8.8 255.255.255.255 1.1.1.1 ?
<1-255> Distance metric for this route
<cr>

R2D2-NEW(config)#ip route 8.8.8.8 255.255.255.255 1.1.1.1

Cisco says (if I understood correctly) that first couple of keywords for a command will enable all sub commands but it's not working.

R2D2-NEW(config)#privilege configure level 2 ip route name. - This is not working.

Any advice?

Upgrade to new IOS is out of question since we can't risk any issues with these devices. There are a lot of links there and if it wouldn't come back up after an IOS upgrade lot of stuff could potentially go wrong and that would be a catastrophe.  

[Filip Knezevic]

Sorry, was not sure where to place the thread.

[Filip Knezevic]

No one?

[Georg Pauwen]

Hello,

entering:

username john level 2 password 0 cisco

!
privilege exec level 2 configure terminal

privilege configure level 2 ip route

!

line vty 0 15

login local

will allow level 2 users to use all subcommands of 'ip route'. However, as I understand it, you want to force users to name the routes ?

[Filip Knezevic]

George,

Thank you very much for answering.

Yes, if I do privilege configure level 2 ip route, users with priv2  can create static route but cannot add a name after it... That creates a mess on our transport 6509 switches. Subcommand all is missing.

privilege configure all level 2 ip route would allow them to name the routes, but the command is simply missing.

R2D2-NEW(config)#privilege interface ?
  level  Set privilege level of command
  reset  Reset privilege level of command
Notice how 'all' sub-command is missing.

So the result for a user with priv 2 is this:

R2D2-NEW(config)#ip route 1.1.1.1 255.255.255.255 2.2.2.2 ?
  <1-255>  Distance metric for this route
  <cr>

But if I login with my full priv level:

R2D2-NEW(config)#ip route 1.1.1.1 255.255.255.255 2.2.2.2 ?
  <1-255>    Distance metric for this route
  name       Specify name of the next hop
  permanent  permanent route
  tag        Set tag for this route
  track      Install route depending on tracked item
  <cr>

Any workaround for this?

[Georg Pauwen]

Hello,

I am testing this in GNS3 with 12.4. It allows me to add the 'all' keyword (see below)...

username john level 2 password 0 cisco

!
privilege exec level 2 configure terminal

privilege configure all level 2 ip route

!

line vty 0 15

login local

[Filip Knezevic]

Georg, thank you for time and effort to try this.

I know, that is very strange. The official Cisco document about 12.0 IOS clearly states the 'all' command should be there. However it's missing on our 65XX series.

R2D2#sh vers
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI9, RELEASE SOFTWARE (fc2)
cisco WS-C6513 (R7000) processor (revision 1.0) with 983008K/65536K bytes of memory.

Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI13, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport

cisco WS-C6506 (R7000) processor (revision 3.0) with 458720K/65536K bytes of memory.

I would never get a green light to upgrade IOS on the production switches with hundreds of customers so we'd rather have to replace them with newer ones.

However this is really bugging me...

ObiWan(config)#ip route 1.1.1.1 255.255.255.255 2.2.2.2 name?
% Unrecognized command

ObiWan(config)#ip route 1.1.1.1 255.255.255.255 2.2.2.2 ?
  <1-255>  Distance metric for this route
  <cr>

[Georg Pauwen · Accepted solution]

Hello,

I did some research, and indeed the 'all' keyword was added in 12.0(22)S, but...not for all platforms.

I am afraid that apart from the upgrade, you have no options...

[Filip Knezevic]

Thank you, Georg.

Just can't believe Cisco failed to include such a thing. Just hoped there is some workaround... Too bad if there isn't.

Thanks again!                       

[Georg Pauwen]

Hello,

a 'workaround' albeit an indirect one would be to use an external TACACS server. There are numerous free ones out there, so there is no cost involved. If that is an option in your environment, I can check out the details.

[Filip Knezevic]

Well,

We use Radius in combination with Active Directory, so we log in with our AD credentials. So I'm not sure how TACACS would go with that?

Also, thinking about it, some kind of a TCL script could be an option? Or it would still be overridden by their privilege level? 

[santoshbajimaya]

Hello Knezevic,

I have got similar problem with sub commands  (all) while configuring privilege levels in my network switch. Did you find any solution for it? I do have similar infrastructure as yours having a Radius authentication server linked with AD.

My problem is i can't upgrade IOS as well as we don't have any service contract. My organization is a non-profit organization with much of the infrastructure donated. 

Also, i wanted to know if it is legal to download IOS images from Cisco website and use it in my organization.

Thank You

[Filip Knezevic]

Yes, the workaround is to upgrade IOS to 15. :)

"Also, i wanted to know if it is legal to download IOS images from Cisco website and use it in my organization."

Good luck with that.