In which configuration mode is privilege exec level [0-15] [command] used?

The privilege exec level [0-15] [command] command is entered in Global Config mode on Cisco IOS devices.

AAAGlobal Config

privilege exec level [0-15] [command]

Assigns a specific privilege level (0-15) to a Cisco IOS command, allowing granular control over which commands users at different privilege levels can execute.

Definition: privilege exec level [0-15] [command] is a Cisco IOS global config command. Assigns a specific privilege level (0-15) to a Cisco IOS command, allowing granular control over which commands users at different privilege levels can execute.

Overview

The `privilege exec level` command in Cisco IOS is a powerful tool for implementing role-based access control (RBAC) on network devices. It allows an administrator to assign a specific privilege level (0–15) to an individual EXEC command, thereby controlling which commands users at different privilege levels can execute. This command is essential for environments where multiple administrators or operators require different levels of access—for example, help desk staff might only need to run `show` commands, while senior engineers need full configuration access.

By default, Cisco IOS has 16 privilege levels (0–15), with level 1 (user EXEC) and level 15 (privileged EXEC) being the most commonly used. Level 0 includes only a few basic commands (like `disable`, `enable`, `exit`, and `help`), while level 15 grants full access to all commands. The `privilege exec level` command enables you to customize the command set available at any intermediate level (2–14).

This granularity is crucial for compliance with security policies like the principle of least privilege, where users are given only the permissions necessary to perform their job functions. The command is configured in global configuration mode and affects the running configuration immediately. It is important to note that privilege levels are hierarchical: a user at level 15 can execute all commands, while a user at level 5 can execute commands assigned to levels 1–5.

When you assign a command to a specific level, that command becomes available at that level and all higher levels. For example, if you assign `show ip route` to level 5, users at levels 5–15 can run it. The command syntax is `privilege exec level <0-15> <command>`, where `<command>` is the exact EXEC command string (e.g., `show ip interface brief`).

You can also use the `all` keyword to apply the privilege level to all subcommands of a command (e.g., `privilege exec level 5 show ip` would make all `show ip` subcommands available at level 5). This command is often used in conjunction with the `username` command to assign privilege levels to individual users, or with the `aaa authorization` command to enforce privilege levels via a TACACS+ or RADIUS server. A common alternative is to use the `enable secret` command to set a password for level 15, but that does not provide granular control.

Another alternative is to use the `role`-based access control in newer IOS-XE versions, but `privilege exec level` remains widely used in traditional IOS. When troubleshooting, you can verify the current privilege level with the `show privilege` command. One important IOS behavior is that the `privilege exec level` command does not affect commands that are already part of a higher level; it only adds commands to lower levels.

Also, if you assign a command to a level that is already its default level (e.g., `show` commands are typically level 1), the command remains at that level unless explicitly changed. The command impacts the running configuration immediately, and you must save the configuration to startup-config to make the changes persistent. This command is a cornerstone of Cisco device security and access control, enabling network engineers to tailor command access to meet organizational needs without compromising security.

Syntax·Global Config

privilege exec level [0-15] [command]

When to Use This Command

Restricting 'show running-config' to privilege level 15 so junior admins cannot view sensitive configurations.
Granting 'ping' and 'traceroute' at privilege level 5 for help desk staff to perform basic troubleshooting.
Allowing 'reload' only at privilege level 15 to prevent accidental router reboots by lower-level users.
Creating custom privilege levels for different teams (e.g., level 10 for network engineers, level 5 for NOC technicians).

Parameters

Parameter	Syntax	Required	Description
level	<0-15>	Required	Specifies the privilege level (0 to 15) to which the command will be assigned. Level 0 is the most restricted (only basic commands), level 1 is user EXEC mode, and level 15 is privileged EXEC mode. Intermediate levels (2-14) are custom. A common mistake is using level 0 thinking it will restrict commands, but level 0 only includes a few built-in commands; assigning a command to level 0 may make it unavailable unless the user is at level 0.
command	EXEC command string	Required	The exact EXEC command to assign to the specified privilege level. This can be a simple command like `show ip route` or a command with subcommands. Use the `all` keyword after the command to include all subcommands (e.g., `privilege exec level 5 show ip all`). Common mistakes include omitting the `all` keyword when intending to cover subcommands, or using incomplete command strings that do not match the actual command syntax.

Command Examples

Grant ping and traceroute at privilege level 5

privilege exec level 5 ping

No output is generated upon successful configuration. The command simply modifies the privilege database.

Restrict show running-config to privilege level 15

privilege exec level 15 show running-config

No output is generated. This ensures only users with privilege level 15 can execute 'show running-config'.

Understanding the Output

This command does not produce any output when executed. It silently updates the internal privilege table. To verify the configuration, use 'show privilege' or 'show running-config | include privilege'.

The 'show privilege' command displays the current privilege level of the session, while 'show running-config' will show the configured privilege statements.

Configuration Scenarios

Granting show commands to help desk staff at privilege level 5

A company wants its help desk staff to be able to run basic show commands (like `show ip interface brief`, `show version`, and `show running-config`) but not make configuration changes. The help desk users are assigned privilege level 5 via their local username.

Topology

Single router (R1) with local users configured.

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: Assign `show ip interface brief` to privilege level 5: R1(config)# privilege exec level 5 show ip interface brief
3.Step 3: Assign `show version` to privilege level 5: R1(config)# privilege exec level 5 show version
4.Step 4: Assign `show running-config` to privilege level 5: R1(config)# privilege exec level 5 show running-config
5.Step 5: Create a local user with privilege level 5: R1(config)# username helpdesk privilege 5 secret cisco123
6.Step 6: Exit and test: R1(config)# end, then log in as helpdesk and try the commands.

Configuration

! Assign show commands to privilege level 5
privilege exec level 5 show ip interface brief
privilege exec level 5 show version
privilege exec level 5 show running-config
! Create local user with privilege level 5
username helpdesk privilege 5 secret cisco123

Verify: Log in as helpdesk (password cisco123). At the Router> prompt, type `show ip interface brief` – it should work. Type `configure terminal` – it should be denied. Use `show privilege` to confirm current level is 5.

Watch out: If you forget to assign `show running-config` to level 5, the help desk user will get a '% Invalid input detected' error when trying to run it. Also, ensure the command string exactly matches the IOS syntax (e.g., `show ip interface brief` not `show ip int brief`).

Restricting access to debug commands to only level 15 users

An organization wants to ensure that only senior engineers (privilege level 15) can run debug commands, as these can impact router performance. By default, debug commands are available at level 15, but the administrator wants to explicitly enforce this and prevent any lower-level user from accessing them.

Topology

Single router (R1) with multiple local users at different privilege levels.

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: (Optional) Explicitly set debug commands to level 15 (they already are, but for clarity): R1(config)# privilege exec level 15 debug all
3.Step 3: Create a user at level 10 (e.g., network operator) who should not have debug access: R1(config)# username operator privilege 10 secret cisco123
4.Step 4: Create a user at level 15 (senior engineer): R1(config)# username senior privilege 15 secret cisco456
5.Step 5: Exit and test: R1(config)# end

Configuration

! Ensure debug commands are only at level 15 (default)
privilege exec level 15 debug all
! Create users
username operator privilege 10 secret cisco123
username senior privilege 15 secret cisco456

Verify: Log in as operator (level 10). At the prompt, type `debug ip icmp` – should be denied. Log in as senior (level 15) – the same command should work. Use `show privilege` to confirm levels.

Watch out: The `debug all` command assigns all debug subcommands to level 15. However, if you later assign a specific debug command to a lower level (e.g., `privilege exec level 10 debug ip icmp`), that command becomes available at level 10, overriding the `all` setting. Be careful with the order of commands; the last assignment wins.

Troubleshooting with This Command

When troubleshooting issues related to command access and privilege levels, the `privilege exec level` command itself is not directly used for diagnosis, but its effects are verified using other commands. The primary troubleshooting tool is `show privilege`, which displays the current privilege level of the user session. If a user reports that a command is not available, first check their privilege level with `show privilege`.

If the level is lower than expected, verify the username configuration with `show running-config | include username`. Next, confirm that the desired command is assigned to that level using `show running-config | include privilege exec level <level>`. For example, to see all commands assigned to level 5, use `show running-config | include privilege exec level 5`.

If the command is not listed, it means it has not been assigned to that level. Another useful command is `show parser context` (in some IOS versions) to see the privilege level required for a specific command. However, a more common approach is to use the `?` help at the command line; if a command is not available, it will not appear in the help output.

When a user attempts a command and receives '% Invalid input detected at '^' marker', it often indicates the command is not available at their privilege level. In such cases, verify the exact command syntax and ensure it matches the string used in the `privilege exec level` assignment. Also, remember that privilege levels are cumulative: a user at level 10 can execute commands assigned to levels 1 through 10.

If a command is assigned to level 11, it will not be available to level 10 users. Another common pitfall is the use of the `all` keyword. If you assign `privilege exec level 5 show ip all`, it makes all `show ip` subcommands available at level 5.

However, if you later assign a specific `show ip` subcommand to a different level (e.g., `privilege exec level 10 show ip route`), the more specific assignment takes precedence for that subcommand. To correlate with other commands, use `debug aaa authorization` to see if AAA is overriding local privilege settings. If AAA authorization is enabled, the privilege level may be determined by the AAA server, and local `privilege exec level` assignments may be ignored.

In that case, check the AAA server configuration. Finally, if changes to privilege levels do not take effect immediately, ensure you have exited and re-entered the session, as privilege levels are set at login. Use the `clear line` command to force a user to re-authenticate if needed.

CCNA Exam Tips

Remember that privilege levels 0-15 exist; level 1 is the default user EXEC mode, and level 15 is privileged EXEC (enable) mode.

The 'privilege exec level' command only affects commands in EXEC mode; for configuration commands, use 'privilege configure level'.

CCNA exam may ask which privilege level allows 'show running-config' by default (level 15).

Know that 'enable secret' sets the password for level 15, but you can also set passwords for other levels with 'enable secret level <level>'.

Common Mistakes

Mistake: Applying privilege to a command that does not exist or is misspelled — the command is accepted but has no effect.

Mistake: Forgetting to also set the enable password for the custom level — users cannot authenticate to that level.

Mistake: Using 'privilege exec level' for configuration commands — those require 'privilege configure level'.

privilege exec level [0-15] [command] vs enable secret [password]

Both 'privilege exec level' and 'enable secret' are global configuration commands that affect privilege levels on Cisco IOS devices, but they target different aspects of access control. 'privilege exec level' controls authorization by assigning commands to specific privilege levels, while 'enable secret' manages authentication by setting a password required to enter a privilege level (typically level 15). They are often confused because both involve privilege levels and are used in security configurations.

Aspect	privilege exec level [0-15] [command]	enable secret [password]
Scope	Assigns a command to a privilege level for authorization	Sets a password for authentication to enter a privilege level
Configuration mode	Global configuration	Global configuration
Persistence	Stored in running-config and startup-config	Stored in running-config and startup-config (encrypted)
Precedence	Affects which commands are available per level	Affects which password is required to access a level
Typical use	Grant lower-level users access to specific commands	Secure privileged EXEC access with a strong encrypted password
Effect on privilege levels	Defines command availability for levels 0-15	Sets password for level 15 (or specified level with 'enable secret level')

Use privilege exec level [0-15] [command] when you need to grant a specific command to users at a lower privilege level without elevating their overall level.

Use enable secret [password] when you need to set a secure, encrypted password for users to enter privileged EXEC mode (level 15).

Platform Notes

In Cisco IOS-XE (e.g., 16.x and later), the `privilege exec level` command syntax remains the same as traditional IOS. However, IOS-XE also supports role-based access control (RBAC) using the `role` command, which provides more granular and scalable control. The `privilege exec level` command is still available for backward compatibility.

In NX-OS (Cisco Nexus switches), the equivalent command is `role feature` and `role policy`, which are part of the RBAC framework. NX-OS does not use the `privilege exec level` command; instead, you create roles and assign permissions to commands using the `role` CLI. For example, to allow a user to run `show ip route`, you would create a role policy that includes the command `show ip route` and assign that role to the user.

There is no direct `privilege exec level` equivalent in NX-OS. On Cisco ASA (Adaptive Security Appliance), command authorization is handled via the `privilege` command in a similar way, but the syntax is `privilege show level <level> command <command>` or `privilege configure level <level> command <command>`. The ASA also uses a different privilege level range (0-15) but the concept is analogous.

In IOS-XR, the command does not exist; instead, IOS-XR uses a task-based security model with task groups and user groups. You assign permissions to tasks (e.g., `cisco-support`) rather than individual commands. For example, to allow a user to run `show running-config`, you would add the user to a user group that has the `config-services` task permission.

The `privilege exec level` command is specific to Cisco IOS and IOS-XE. When migrating from IOS to IOS-XE, the command will work, but consider adopting RBAC for better manageability. In older IOS versions (12.x), the command behaves identically to 15.x and 16.x.

One notable difference is that in some early 12.x versions, the `all` keyword might not be supported; you would need to assign each subcommand individually. Always check the documentation for your specific IOS version.

Related Commands

enable secret [password]

Sets an encrypted password for privileged EXEC access, replacing the less secure 'enable password' command.

show privilege

Displays the current privilege level of the user session, used to verify access rights and confirm the effective privilege level after authentication or privilege escalation.

username privilege

Creates a local user account with a specific privilege level (0-15) and a hashed password stored in the configuration. Privilege 15 grants full access equivalent to enable mode.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions