User/Role based commands

[S891]

Hi,

I  want to give limited access to our first level support so that they can execute certain basic commands like, port vlan change, access port shut/no-shut on Cisco 6509 and 3750E switches IOS based. I want to restrict them to only few options so they can not make changes to uplink (TenGig) ports and can not issue reload command etc. We do not have TACACS. What is the best way to achieve this? Is there an example, any links etc?

Would appreciate help!!   

Fawad

[Mohamed Sobair]

Try the below and you should be fine:

username xxxx privilege level 7 pasword yyyy

privilege interface level 7  shutdown

privilege interface level 7  no shutdown

privilege exec level 7  ping

privelege exec level 7  trace

privelege exec level 7 show run

privelege exec level 7  copy running-config startup-config

privlege configure level 7  vlan

privelege configure level 7  no vlan

privelege interface level 7  switch port mode

privelege interface level 7  switch port access

Regards,

Mohamed

[Alessio Andreoli]

Hi Fawad,

a bit of (vendor-specific) theory to better understand the importance of what you are doing:

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/quick/guide/rbac.pdf

A very interesting article (not practical.. not at all ) can be found on wikipedia looking for rbac or role based access control

Hope this helps

Alessio