Setting Privilege Levels For No Or Default Versions; Setting Privilege Levels For Multiple Commands; Setting Privilege Levels For All Commands In A Mode - Juniper SYSTEM BASICS - CONFIGURATION GUIDE V 11.1.X Configuration Manual

When you enter an ambiguous command and an exact match of the command is
found, partial matches are ignored and are not modified.
For example, the traffic-class and traffic-class-group commands are available in
Global Configuration mode. If you issue the privilege configure level 5 traffic-class
command, an exact match is made to traffic-class, and traffic-class-group is not
modified.
If you want to set the privilege level for both traffic-class and traffic-class-group
and you do not want the exact match to be made to traffic-class, issue a partial
command such as traffic-c. The privilege level of all commands that begin with
traffic-c is modified.

Setting Privilege Levels for no or default Versions

The privilege command allows you to set command privilege levels for no and
default versions of commands. However, setting the privilege level for either the no
or default versions of a command does not set the privilege level of the affirmative
version of the command. This means that you can have the no or default version
of a command at a different privilege level than its affirmative version
NOTE: You can set the no or default command to a separate privilege level without
specifying any other command to follow. This would force all commands that have
a no or default version to function only for that privilege level and higher.
For example, if you issue the privilege exec level 10 no command, all no versions
in the Privileged Exec mode are available to users at level 10 and higher.
.

Setting Privilege Levels for Multiple Commands

The all keyword is a wildcard parameter that enables you to set privilege levels for
multiple commands rather than setting them individually.

Setting Privilege Levels for All Commands in a Mode

You can set the privilege level for all commands within a specified mode. This setting
includes all commands in modes that you can access from a specified mode.
If the command specified in the privilege command changes the configuration mode,
all commands in the configuration will also be set to the specified privilege level. For
more information about accessing modes, see "Accessing Command Modes" on
page 69.
For example, issuing the configure command in Privileged Exec mode changes the
configuration mode to Global Configuration. If you issue the privilege exec all level
5 configure command, all commands in Global Configuration mode become
accessible to users who have CLI privileges at level 5 and higher. For more information
about user privilege levels, see "Privileged-Level Access" on page 49.
Chapter 2: Command-Line Interface
CLI Command Privileges
59