TechKnowSurge
Cisco CCNA 5.3 Cisco CCNA 5.8 Cisco CCNA 2.8 Cisco CCST Cybersecurity 1.3
TechKnowSurge Catalog Videos DEMO: Privilege Levels
VideoNetworkFree

DEMO: Privilege Levels

Cisco IOS supports 16 privilege levels that can be assigned to individual user accounts, enabling granular access control on routers and switches. Levels 2 through 14 are fully customizable, allowing specific commands to be mapped to each level to enforce least privilege.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Cisco IOS devices support 16 distinct privilege levels, numbered 0 through 15, that control what commands a user can execute after logging in. Level 1 corresponds to the basic user EXEC mode, level 15 grants full privileged EXEC access, and levels 2 through 14 are available for custom configuration. Administrators can verify the current privilege level at any time using the show privilege command, which makes it straightforward to confirm what access a given session holds. User accounts are configured in global configuration mode using the username command, where a privilege level and password are assigned at creation. A user can receive full administrative access at level 15, be restricted to read-only user EXEC access at level 1, or be placed at any custom level in between. Once a custom level is assigned to a user, the administrator must explicitly map commands to that level using the privilege exec level command, since custom levels carry no default permissions on their own. This architecture is well suited to environments that require tiered access control, such as a support organization where tier-one staff need only a limited set of diagnostic commands and tier-two staff require broader operational capabilities on the same device. By aligning privilege levels with organizational roles, network administrators can enforce least-privilege access across routers and switches without creating separate management infrastructure for each user group.

What you'll learn

What's covered

Cisco Privilege Levels

Aligned to

Cisco CCNA
5.3 Configure and verify device access control using local passwords
5.8 Compare authentication, authorization, and accounting concepts
2.8 Describe network device management access
Cisco CCST Cybersecurity
1.3 Explain access management principles

Key terms

Privilege Level
A numeric value (0–15) assigned to a Cisco IOS user or command that determines the scope of access granted on the device.
User Exec Mode
The initial CLI access level on a Cisco IOS device, indicated by the greater-than sign (>), that provides limited commands and privileges.
Privileged EXEC Mode
An elevated Cisco IOS CLI access level, indicated by a pound sign prompt (#), that provides full access to device monitoring and the ability to enter configuration modes.
Least Privilege
A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Authorization
The process of determining what actions or resources an authenticated user is permitted to access.
Role-Based Access Control
RBAC
An access control model that assigns permissions based on a user's role within an organization.

Topics

Cisco Ios Privilege Levels Access Control Network Security Least Privilege Networking

Transcript

One thing that you can do is you can set a privilege level for different user accounts. So let's take a look at setting privilege levels on our equipment.

Checking Your Current Privilege Level

The first thing we'll take a look at is the privilege level that we're at right now. Here I am in just the user exec mode, so in the user exec mode I'm going to type in show privilege to see what level I'm at, and I am at a level one right now. So you can equate the user exec mode with level one.

If I get into the privileged exec mode, so I'm going to type in the password here to get into the privileged exec mode, and in this privileged exec mode, if now I type in show privilege, you can see that I am at 15. So there's the difference between the basic user exec mode and privileged exec mode.

There's a total of 16 different levels. There's 0 through 15, one being the user exec mode and 15 being the privileged exec mode, and then 2 through 14 is assignable. So what you can do is you can create different levels within there, so that way you can practice that least privilege and only give people certain rights into certain sections of the router or switch.

Assigning a Privilege Level to a User

So the next question is, how do we use this? In here I'm going to get into the global config mode, and then we're going to configure a user on the local database. So let's start out with username and then whoever that we're adding to this. Maybe we're adding Susan to this, so we'll add the username of Susan. And privilege: what level do we want to give her? This could be one, this could be 15. In fact, I'll use the question mark and you can see that there's the privilege levels there. So I'm going to assign 15 to Susan. And then the password that we're going to give Susan, so password and then whatever password that we're going to set up for her. So there it is. Then we'll hit enter, and now we set up a user account for Susan.

Defining a Custom Level

If we wanted to give some custom privileges to Susan, what we could do is we could change that from 15 to one of our custom levels. So maybe we're going to do two, because that's the next one. So we set up two right there, but now we need to tell this device what a privilege level of two actually means, because right now it doesn't really know what commands are associated with a privilege level of two.

So what we'll do is a privilege exec level, and then we're going to specify it for level two, and then the commands that we want to associate with this. So maybe we want Susan to be able to take a look at the running config, so we'll do a show running-config and then hit enter, and now that command is associated with Susan or anybody else that's assigned to a level two.

Mapping Levels to Roles

Now we can assign certain levels to certain roles. For instance, let's say we had a tiered system with our support. Then we give tier one certain executable commands that they can work with when they're on this device, and then the tier 2 could have an escalated level of privilege so that way they can do more on this.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →