Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow junior staff to make certain changes to the configuration on our Cisco routers. I don't much like having to divulge the enable password, but if I can at least keep them to a few configuration commands, I'd feel better.

They just need to be able to be able to adjust a NAT/PAT statement in the configuration. so they'll need to be able to do the following, for example:

no ip nat inside source static tcp 192.168.1.**1** 9100 9101

ip nat inside source static tcp 192.168.1.**2** 9100 9101

Is there a way to limit them to just these types of commands? The routers are Cisco 1941s running IOS ver 15.0

share|improve this question

You need to change the privilege level of the commands from the default 15 (enable) to a lower level, then give each user name a sufficient privilege level to run those commands.

Something like this should do the job:

privilege configure level 6 ip nat
privilege configure level 6 ip
privilege exec level 6 configure terminal
privilege exec level 6 configure
username junior privilege 6 password 0 juniorpass
share|improve this answer

Depending on the size of your group, Cisco produces a product to do exactly this called Cisco Secure Access Control System. In essence, the admins would log into the routers using their own personal accounts, and every time they run a command the router will ask ACS if that person is allowed to run that command. Thus allowing you to be extremely granular in what the admins are allowed to do, as well as giving you the ability, in the event of an unfortunate situation, to shut off their access at any point. It can be backended by RADIUS, for centralized authentication against such sources as Active Directory.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.