Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way, to create such privilege, which will let to configure just one particular port ex: gi1/0/1 , but at that time will not let to configure gi1/0/2 .

Smth like: privilege interface gi1/0/1 10

UPD: As radius said, from /usr/local/share/doc/tac_plus/users_guide :

    The following configuration example permits user Fred to run the
following commands:

    telnet 131.108.13.<any number> and
    telnet 128.<any number>.12.3 and
    show <anything>

All other commands are denied (by default).

user=fred {

    cmd = telnet {
        # permit specified telnets
        permit 131\.108\.13\.[0-9]+
        permit 128\.[0-9]+\.12\.3
    cmd = show {
        # permit show commands
        permit .*
share|improve this question
up vote 1 down vote accepted

You can use a TACAS+ server to do this using authorization, see

share|improve this answer

No, IOS's permissions are not this granular unfortunately.

share|improve this answer
And AAA server wont help? – TiFFolk Sep 25 '09 at 15:29
You could try the link @radius posted. I believe that's referring to telnet access to particular ports however, rather than config access. As I understand it, you need access to global configuration mode to enter interface configuration mode, and by it's nature, global configuration mode is global. I'd be glad for someone to prove me wrong though :-) – Cian Sep 25 '09 at 16:39
i can limit command "conf" cmd = configure { permit .* } May be the same works like: cmd = interface gigabitEthernet 1/0/1 { permit .* } – TiFFolk Sep 25 '09 at 17:09
Try it and see :-) – Cian Sep 25 '09 at 19:23
@Cian with TACACS+ you can restrict access as you want, a user can be only able to change speed on only one interface if you want. – radius Sep 28 '09 at 14:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.