How to configure Role-Based CLI Access using Cisco IOS?
Today we will try to
configure Role-Based CLI Access using Cisco router. The main purpose of
this configuration is to define the "Views and Superviews" that provides
the selective or limited access to Cisco IOS commands. You can restrict
your users to run and display some particular commands that are defined
in View for particular user. First time this feature was introduced in
12.3(7)T IOS version. CLI views provide the
detailed access control for network administrator to manage over network
security and accountability.
Configuring a first CLI View with name Five
In global configuration Mode:
To create the Views, first run the
aaa new-model command on
router
global
configuration mode.
Router(config) # aaa new-model
(enable user authentication)
Router# exit
Router > enable view
(enable the root view)
Router# configure terminal
(enter global configuration Mode)
Router(config)# parser view Five
(create a View with name Five)
Router(config-view)# secret champion
(assign a secret password to view)
Router(config-view)# commands exec include show running
Router(config-view)# commands exec include show ip route
(add show running and show ip route commands to this view)
Router(config-view)# exit
(exit from view mode)
Router(config)# exit
(exit from global configuration mode)
Router# exit
(exit from privileges exec mode)
Now to verify the commands access the Five view, run the
following command on user exec mode.
Router > enable view Five
Router # ?
Type question mark to verify the commands that are included in
Five view.
Now Configuring a second CLI View with name Six
Router# configure terminal
(enter global configuration Mode)
Router(config)# parser view Six
(create a View with name Six)
Router(config-view)# secret champion1
(assign a secret password to view)
Router(config-view)# commands exec include show startup-config
Router(config-view)# commands exec include show interface
brief
(add show startup-config and show interface brief command to this
view)
Router(config-view)# exit
(exit from view mode)
Router(config)# exit
(exit from global configuration mode)
Router# exit
(exit from privileges exec mode)
Now to verify the commands access the Six view, run the
following command on user exec mode.
Router > enable view Six
Router # ?
Type question mark to verify the commands that are included in
Six view.
Now adding both CLI Views to a Superview
You
can assign one or more views to a superview and then superview inherit
the all commands that are associated with views.
Router# configure terminal
(enter global configuration Mode)
Router(config)# parser view Seven superview
(create a superview with name Seven)
Router(config-view)# secret champion2
(assign a secret password to view)
Router(config-view)# view Five
(add view Five in superview name Seven)
Router(config-view)# view Six
(add view Six in superview name Seven)
Router(config-view)# exit
(exit from view mode)
Router(config)# exit
(exit from global configuration mode)
Router# exit
(exit from privileges exec mode)
Now to verify the commands access the Seven superview, run the
following command on user exec mode.
Router > enable view Seven
Router #
show parser view
To
verify the commands those are inherit from both views to superview.
Yesterday Tip.
How to apply password and compressed feature in
windows XP?
COMPUTER TIPS