Setting Privilege Levels For No Or Default Versions; Setting Privilege Levels For Multiple Commands; Setting Privilege Levels For All Commands In A Mode; Setting Privilege Levels For A Group Of Commands - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - SYSTEM BASICS CONFIGURATION GUIDE 2010-10-04 Configuration Manual

JunosE 11.3.x System Basics Configuration Guide

Setting Privilege Levels for no or default Versions

Setting Privilege Levels for Multiple Commands

56
The privilege command allows you to set command privilege levels for no and default
versions of commands. However, setting the privilege level for either the no or default
versions of a command does not set the privilege level of the affirmative version of the
command. This means that you can have the no or default version of a command at a
different privilege level than its affirmative version.
NOTE: You can set the no or default command to a separate privilege level
without specifying any other command to follow. This would force all
commands that have a no or default version to function only for that privilege
level and higher.
For example, if you issue the privilege exec level 10 no command, all no
versions in the Privileged Exec mode are available to users at level 10 and
higher.
The all keyword is a wildcard parameter that enables you to set privilege levels for multiple
commands rather than setting them individually.

Setting Privilege Levels for All Commands in a Mode

You can set the privilege level for all commands within a specified mode. This setting
includes all commands in modes that you can access from a specified mode.
If the command specified in the privilege command changes the configuration mode,
all commands in the configuration will also be set to the specified privilege level. For
more information about accessing modes, see "Accessing Command Modes" on page 66.
For example, issuing the configure command in Privileged Exec mode changes the
configuration mode to Global Configuration. If you issue the privilege exec all level 5
configure command, all commands in Global Configuration mode become accessible
to users who have CLI privileges at level 5 and higher. For more information about user
privilege levels, see "Privileged-Level Access" on page 46.

Setting Privilege Levels for a Group of Commands

You can set the privilege level for a group of commands by using the beginning keyword
in a command.
For example, if you issue the privilege configure all level 5 snmp command, all commands
in Global Configuration mode that begin with snmp become accessible to users who
have CLI privileges at level 5 and higher.

Using the Order of Precedence

The effectiveness of a privilege level that is set with the all keyword depends on its
precedence level in the CLI. A privilege level is considered to be in effect only if a privilege
level that is configured at a higher precedence level does not override it.
Copyright © 2010, Juniper Networks, Inc.