In which configuration mode is show privilege used?

The show privilege command is entered in Privileged EXEC mode on Cisco IOS devices.

AAAPrivileged EXEC

show privilege

Displays the current privilege level of the user session, used to verify access rights and confirm the effective privilege level after authentication or privilege escalation.

Definition: show privilege is a Cisco IOS privileged exec command. Displays the current privilege level of the user session, used to verify access rights and confirm the effective privilege level after authentication or privilege escalation.

Overview

The 'show privilege' command is a fundamental diagnostic tool in Cisco IOS that displays the current privilege level of the user session. Privilege levels (0-15) determine which commands a user can execute, with 15 being full access (equivalent to enable mode) and 1 being user EXEC mode. This command is essential for verifying access rights after authentication, privilege escalation (e.g., using 'enable' or 'enable secret'), or when troubleshooting permission issues.

Unlike other commands that show configuration or status, 'show privilege' focuses solely on the user's current authority level. It is often the first command used when a user encounters 'Command rejected' errors, as it confirms whether the session has the necessary privileges. The command outputs a single line indicating the privilege level, which is immediately useful for network engineers to ensure they are operating at the correct level before executing sensitive commands.

In the broader workflow, 'show privilege' is typically used after logging in, after using 'enable', or after applying AAA authorization policies. It does not affect the running configuration and requires no special privileges to execute—any user can check their own level. Understanding privilege levels is crucial for security and role-based access control (RBAC) in Cisco devices, especially in environments with multiple administrators.

The command also helps in debugging AAA configurations, as it reflects the effective privilege level after authentication and authorization processes. For example, if a user is assigned privilege level 7 via a RADIUS server, 'show privilege' will confirm that level. This command is lightweight and can be used repeatedly without impacting device performance.

It is also useful in scripts or automated tasks to verify that the session has the required permissions before proceeding. In summary, 'show privilege' is a quick, reliable way to confirm user access rights, making it an indispensable part of any network engineer's toolkit.

Syntax·Privileged EXEC

show privilege

When to Use This Command

After logging in to a device, verify that you have the expected privilege level (e.g., 15 for full access).
Troubleshoot why certain commands are not available by checking if the current privilege level is sufficient.
After using the 'enable' command, confirm that the privilege level has been elevated.
When configuring privilege levels for different users, test that the correct level is assigned.

Command Examples

Verify current privilege level after login

show privilege

Current privilege level is 15

The output shows the current privilege level is 15, which is the highest level (privileged EXEC). This indicates the user has full access to all commands.

Check privilege level after using 'enable'

show privilege

Current privilege level is 1

The output shows privilege level 1, which is user EXEC mode. This means the user has not yet entered the enable command or authentication failed, so only basic commands are available.

Understanding the Output

The output of 'show privilege' is a single line indicating the current privilege level. The privilege level is an integer from 0 to 15. Level 1 is user EXEC mode (limited commands), level 15 is privileged EXEC mode (full access).

Levels 2-14 are custom levels that can be configured. A level of 0 is reserved for the most basic commands. In a real network scenario, if you see level 1 but expect level 15, you need to use the 'enable' command and provide the correct password.

If you see level 15 but cannot execute certain commands, check if those commands are restricted to a specific privilege level or if there are other authorization mechanisms (like AAA) in place.

Configuration Scenarios

Verify privilege level after enable password authentication

A network engineer logs into a router and needs to confirm that they have successfully escalated to privilege level 15 after entering the enable password.

Topology

Single router: R1

Steps

1.Step 1: Connect to the router via SSH or console.
2.Step 2: At the user EXEC prompt (Router>), enter 'enable'.
3.Step 3: Provide the enable password when prompted.
4.Step 4: At the privileged EXEC prompt (Router#), enter 'show privilege'.

Configuration

! No configuration required; this scenario uses default settings.
! The enable password is configured as:
Router(config)# enable secret MySecretPassword

Verify: Command: show privilege Expected output: Current privilege level is 15

Watch out: If the enable password is not set, the 'enable' command will not prompt for a password and the privilege level will remain at 1. Always configure an enable secret.

Troubleshoot AAA authorization failure for privilege level

A user is authenticated via RADIUS but cannot execute certain commands. The engineer needs to check the effective privilege level assigned by AAA.

Topology

R1 (Gi0/0) --- 192.168.1.0/24 --- AAA Server

Steps

1.Step 1: Log in to the router as the user experiencing issues.
2.Step 2: At the user EXEC prompt, enter 'show privilege' to see the current level.
3.Step 3: If the level is not 15, attempt to escalate using 'enable' (if permitted).
4.Step 4: Check AAA configuration on the router and server to ensure correct privilege level assignment.

Configuration

! AAA configuration on the router:
Router(config)# aaa new-model
Router(config)# aaa authentication login default group radius local
Router(config)# aaa authorization exec default group radius local
Router(config)# radius-server host 192.168.1.100 key MyRadiusKey

Verify: Command: show privilege Expected output: Current privilege level is X (where X is the level assigned by AAA, e.g., 7) Also use: debug aaa authentication to see the privilege level assigned.

Watch out: If the RADIUS server does not send the 'cisco-avpair' attribute with the privilege level, the user may default to level 1. Ensure the server is configured to send 'shell:priv-lvl=15' for full access.

Troubleshooting with This Command

When troubleshooting access issues, 'show privilege' is the first command to run after authentication. A healthy output shows 'Current privilege level is 15' for full access, or the expected level for a restricted user. If the output shows level 1 or an unexpected level, the user may not have escalated privileges.

Common symptoms include 'Command rejected' errors when trying to enter configuration mode or execute privileged commands. In such cases, verify that the enable password is correct and that AAA authorization is not overriding the privilege level. For AAA environments, check the RADIUS or TACACS+ server logs to confirm the privilege level attribute is sent.

Use 'debug aaa authentication' and 'debug aaa authorization' to see the privilege level assigned during login. If the issue is with a specific user, compare their privilege level with a working user. Also, check if the user is in a privilege level that does not have access to certain commands—Cisco IOS allows custom privilege levels (0-15) with command authorization.

Use 'show running-config | include privilege' to see any privilege level configurations. Another common issue is that the 'enable' command may be restricted by AAA; use 'show privilege' after each escalation attempt to confirm the change. If the output does not change after entering 'enable', the password may be wrong or the user may not have permission to escalate.

In some cases, the privilege level may be set by a line configuration (e.g., 'privilege level 7' under line vty). Use 'show line' to check line-level privilege settings. Correlate 'show privilege' with 'show users' to see the current user and line.

For automated scripts, always include 'show privilege' in the output to verify the session state. If the command returns an error like 'Invalid input detected', ensure you are in the correct mode (user EXEC or privileged EXEC). The command is available in both modes but will show the current level.

Finally, remember that 'show privilege' reflects the effective privilege level after all authentication and authorization processes, making it a reliable indicator of access rights.

CCNA Exam Tips

CCNA exam tip 1: The 'show privilege' command is often used in troubleshooting scenarios to verify that the user has the appropriate access level.

CCNA exam tip 2: Remember that privilege level 15 is the highest and gives full access; level 1 is the default for user EXEC mode.

CCNA exam tip 3: The exam may test your understanding that 'enable' command raises the privilege level from 1 to 15 (or a configured level).

CCNA exam tip 4: Be aware that AAA can override local privilege levels; 'show privilege' reflects the effective level after authentication.

Common Mistakes

Mistake 1: Assuming that being in privileged EXEC mode always means privilege level 15 — it could be a lower level if custom levels are configured.

Mistake 2: Forgetting to use 'show privilege' after 'enable' to confirm the privilege escalation was successful.

Mistake 3: Confusing 'show privilege' with 'show users' or 'show sessions' — they show different information.

show privilege vs show users

Both 'show privilege' and 'show users' are used to manage user sessions, but they serve different purposes: 'show privilege' reveals the current user's privilege level, while 'show users' lists all active sessions. They are often compared when verifying authentication and monitoring access.

Aspect	show privilege	show users
Scope	Single session (current user)	All active sessions
Output Type	Single line with privilege level	Table with line, user, idle time, etc.
Typical Use	Verify effective privilege after login or escalation	Monitor who is logged in and for how long
Category	AAA	System

Use show privilege when you need to confirm your current access rights or verify the effect of privilege level changes.

Use show users when you need to see all users currently logged into the router and their session details.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'show privilege' command behaves identically to classic IOS, with the same output format. There is no difference in syntax or output between IOS 15.x and IOS-XE 16.x. For NX-OS (e.g., Nexus switches), the equivalent command is 'show privilege' as well, but the output may include additional information such as the user role.

For example, on NX-OS, the output might be 'Current privilege level: 15' or 'Current privilege level: network-admin'. NX-OS uses roles (network-admin, vdc-admin, etc.) instead of numeric privilege levels, but the command still works. On ASA firewalls, the command is 'show privilege' and returns the current privilege level (0-15) similar to IOS.

However, ASA uses a different authentication model (e.g., 'enable' password or AAA). In IOS-XR, the command is 'show privilege' and returns the current user privilege level, but IOS-XR uses a role-based access control (RBAC) model with task groups and user groups. The output may show 'Privilege level: 15' or 'Privilege level: root-system'.

Overall, the command is consistent across platforms, but the underlying privilege model may differ. Always refer to the specific platform documentation for exact behavior.

Related Commands

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

show users

Displays active user sessions on the router, including line type, idle time, and remote IP addresses, useful for monitoring who is logged in and troubleshooting connectivity issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions