Privilege Levels; How To Control Switch Access With Passwords And Privilege Levels; Setting Or Changing A Static Enable Password - Cisco Catalyst 2960-X Security Configuration Manual

Privilege Levels

Privilege Levels
Cisco switches (and other devices) use privilege levels to provide password security for different levels of
switch operation. By default, the Cisco IOS software operates in two modes (privilege levels) of password
security: user EXEC (Level 1) and privileged EXEC (Level 15). You can configure up to 16 hierarchical
levels of commands for each mode. By configuring multiple passwords, you can allow different sets of users
to have access to specified commands.
Privilege Levels on Lines
Users can override the privilege level you set using the privilege level line configuration command by logging
in to the line and enabling a different privilege level. They can lower the privilege level by using the disable
command. If users know the password to a higher privilege level, they can use that password to enable the
higher privilege level. You might specify a high level or privilege level for your console line to restrict line
usage.
For example, if you want many users to have access to the clear line command, you can assign it level 2 security
and distribute the level 2 password fairly widely. But if you want more restricted access to the configure
command, you can assign it level 3 security and distribute that password to a more restricted group of users.
Command Privilege Levels
When you set a command to a privilege level, all commands whose syntax is a subset of that command are
also set to that level. For example, if you set the show ip traffic command to level 15, the show commands
and show ip commands are automatically set to privilege level 15 unless you set them individually to different
levels.
Related Topics
Setting the Privilege Level for a Command, on page 31
Example: Setting the Privilege Level for a Command, on page 36
Changing the Default Privilege Level for Lines, on page 33
Logging into and Exiting a Privilege Level, on page 34
How to Control Switch Access with Passwords and Privilege
Levels

Setting or Changing a Static Enable Password

The enable password controls access to the privileged EXEC mode. Follow these steps to set or change a
static enable password:
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
22
Controlling Switch Access with Passwords and Privilege Levels
OL-29048-01