Blog

Which command will move the show access-lists command to privilege level 14?

• router(config)# privilege level 14 command show access-lists
• router(config)# privilege exec level 14 show access-lists
• router(config)# show access-lists privilege level 14
• router(config)# set privilege level 14 show access-lists

The correct command to move the show access-lists command to privilege level 14 is:

router(config)# privilege exec level 14 show access-lists

Explanation:

Privilege levels in Cisco IOS define the commands a user can execute based on their assigned privilege level. By default, Cisco IOS has three primary privilege levels:

1. Privilege level 0: Very limited set of commands like logout, enable, disable, exit, etc.
2. Privilege level 1: User EXEC mode, which includes basic commands for monitoring but not configuration.
3. Privilege level 15: Full administrative access, including configuration commands.

Between privilege levels 1 and 15, there are 13 intermediate levels (2-14) that network administrators can assign to users to create customized privilege levels with specific command permissions.

In many cases, network administrators want to control access to certain commands, like show commands, which display critical information about the network. One such command is show access-lists, which displays the access control lists (ACLs) configured on the device. Controlling access to this command is crucial because ACLs can include sensitive information like firewall rules and security policies.

Why the Correct Answer is:

router(config)# privilege exec level 14 show access-lists

This command is used to move a specific EXEC mode command (show access-lists) to a different privilege level. Let’s break down the elements of this command:

• router(config): This indicates that we are in global configuration mode, where we can make system-wide changes.
• privilege exec level 14: The privilege exec keyword is used to modify the privilege levels of EXEC mode commands. The number 14 specifies that we are moving the command to privilege level 14.
• show access-lists: This is the specific command that we want to assign to privilege level 14.

This command modifies the EXEC mode privilege level for the show access-lists command, allowing users with privilege level 14 to execute it. After running this command, only users with privilege level 14 or higher will be able to use the show access-lists command.

Detailed Breakdown of the Other Command Options:

1. router(config)# privilege level 14 command show access-lists:This command is incorrect because it uses the wrong syntax. The correct syntax to modify a command’s privilege level is to use privilege exec level, followed by the privilege level number and the command. The keyword command is not necessary here. Therefore, this command will not work as expected.
2. router(config)# show access-lists privilege level 14:This command is incorrect for several reasons. First, show access-lists is a command to display access lists, not a configuration command to change privilege levels. Second, the syntax does not follow the correct format for modifying privilege levels in Cisco IOS. This command will not alter the privilege level and is simply invalid in this context.
3. router(config)# set privilege level 14 show access-lists:This command is also incorrect because it uses the keyword set, which is not a valid command in Cisco IOS for adjusting privilege levels. The correct keyword is privilege exec level. Using the word set will lead to an error because it does not correspond to any command for privilege level configuration in Cisco devices.

Privilege Levels in Cisco IOS:

Privilege levels are a powerful security tool in Cisco IOS because they allow granular control over which users can execute specific commands. For example, in a large organization with multiple network administrators, it is common to divide administrative tasks. Some administrators may be responsible for monitoring and troubleshooting, while others handle configuration and changes to the network. By assigning different privilege levels, the organization can limit what commands each user can execute based on their role and responsibilities.

In this scenario, we are assigning the show access-lists command to privilege level 14, meaning that any user with privilege level 14 or higher can execute this command. However, users with lower privilege levels (like 1) will not be able to view access lists. This can be useful for preventing unauthorized users from seeing sensitive network security configurations.

Customizing Privilege Levels:

While the default privilege levels in Cisco IOS are 1 and 15, administrators can create custom privilege levels (such as 2-14) to suit their specific needs. For example, an organization might want to allow helpdesk staff to view interface status but not allow them to make configuration changes. This can be achieved by moving specific show commands (like show interfaces) to a lower privilege level, such as 2 or 3.

The flexibility of privilege levels allows organizations to implement the principle of least privilege — a security concept where users are given the minimum level of access necessary to perform their tasks. By customizing privilege levels and assigning users to different levels, the organization can reduce the risk of accidental or malicious configuration changes.

How to Configure Privilege Levels:

To configure privilege levels in Cisco IOS, administrators typically follow these steps:

1. Enter Global Configuration Mode:
   router# configure terminal
   

2. Assign a Command to a Privilege Level: Use the privilege exec level command to move a specific command to a different privilege level.
   router(config)# privilege exec level <level> <command>
   

   For example, to move the show access-lists command to privilege level 14:

   router(config)# privilege exec level 14 show access-lists
   

3. Assign Users to a Privilege Level: By default, all users start at privilege level 1 unless specified otherwise. You can assign a user to a specific privilege level using the username command.
   router(config)# username <username> privilege <level> secret <password>
   

   This command creates a user with the specified privilege level and password. For example:

   router(config)# username admin privilege 14 secret password123
   

4. Verifying Privilege Levels: To verify the commands available at a specific privilege level, you can use the show privilege command.
   router# show privilege
   

Conclusion:

Customizing privilege levels in Cisco IOS is a crucial part of securing network devices and implementing role-based access control. The correct command to move the show access-lists command to privilege level 14 is router(config)# privilege exec level 14 show access-lists. This allows users with privilege level 14 or higher to execute the show access-lists command, limiting access to potentially sensitive network configurations. Understanding and using privilege levels effectively can help network administrators enforce security policies, reduce the risk of unauthorized changes, and provide a safer network environment.