I need to make a sure a certain user on an IOS router can only type specific commands. I was able to do this with privilege levels but them whenever the user would type "enable" he would be right back to priv level 15 and about to type all commands. I want to make sure that even when he enters "enable" he will still only be able to type the specific commands I've allow. I also tried with Role-Based cli but ran into the same issue. I don't want to use any external authentication servers.


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Jan 3, 2021 at 6:03

2 Answers 2


You already know the majority of the answer to your own question - you need to configure commands the user can run at a specific privilege level. enable without a privilege level argument defaults to privilege level 15, which has permissions to run all commands. The two things you need to do are:

  1. Change the default enable password so the user doesn't have access to it anymore and therefore can't get to privilege level 15.

  2. Set the user's default privilege level at login to the same privilege level that you've changed the desired commands the user can run at:

Router(config)#username joe privilege <x> password foobar

where X is the privilege level for your desired command set.

EDIT: I should point out that this doesn't actually provide true user based command authorization, it only provides privilege level based authorization, because the commands themselves are only bound to one privilege level at a time, so it's effectively a router-wide change. It's intended to work in a hierarchical fashion; each privilege level can run the commands at that level as well as all levels below it. If you want true user based authorization, you need an AAA server of some kind (see my note below).

You could technically also change the privilege level of the enable command to be one higher than the user's privilege level so they don't even have the option of running it:

Router(config)#privilege exec level <x> enable

This of course assumes that you don't want the user to be able to run any configuration commands.

Another option is to make sure that when the user logs in and types enable they need to specify their privilege level rather than no privilege level, which defaults to 15.

Router>enable <x>

Obviously you can specify enable passwords for all 16 privilege levels if you so desire.

My final point is that without an external AAA server, all of this is a giant pain in the ass. There are a multitude of open source TACACS+ implementations available that only have a cost of initial setup, but they make doing stuff like this somewhat trivial, and it's centralized, so if you have multiple routers you don't have to keep repeating the same command privilege jumprope on every device you manage. This is why AAA servers exist in the first place, so your requirement that you don't want to use one doesn't make a lot of sense.


Restricting the commands can be done in Cisco ACS if you configure the device to use TACACS for AAA.

  • Please consider adding more information to this answer.
    – Teun Vink
    Commented Dec 11, 2014 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.