Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set-up privilege level 2, so that it has access to read and modify object and object-groups. Showing them seems to be no problem. I can also enter configure mode. I just can't get the 'object-group network blah' command to work (it shows as unauthorized). However, I've come across something odd. I did the following and found what I thought to be the correct line to change:

ciscoasa# sh run all priv all 

... privilege cmd level 15 mode configure command object-group ...

But, when I try to apply this:

ciscoasa(config)# privilege cmd level 2 mode configure command object-group
ERROR: specified command 'object-group' not found in mode 'configure'.

Can anyone shed any light?

share|improve this question
Seems to be a bug/"feature" because it didn't work on my home v8.4 but does work on our data centre v8.6 – user225477 Jun 9 '14 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.