Privilege Levels for Tiered CLI Access

Bundle lab

Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.

Learning objectives

• Configure a management-only IPv4 LAN for SSH access to a Cisco IOS router
• Enable SSH-only remote access with local authentication
• Create tiered local users: a full administrator at privilege 15 and a junior operator at privilege 5
• Grant exact CLI capabilities to a mid-tier role using 'privilege exec level N <command>'
• Verify effective privilege level and command access from remote SSH sessions
• Differentiate login/authentication from authorization and command privilege control

Troubleshooting focus

• Operator logs in at level 1 instead of 5: verify 'username oper privilege 5 secret <p>'
• Operator cannot run intended commands: confirm 'privilege exec level 5 <command>' entries exist
• SSH blocked or refused: ensure non-default hostname, configured ip domain name, local users, VTY 'transport input ssh' with 'login local', and RSA keys exist
• Admin cannot enter configuration mode: verify admin account is privilege 15 and enable secret is set
• Console appears to hang or spam output: set 'logging synchronous' and reasonable 'exec-timeout' on console