Tag: Cisco privilege levels

Securing access to your Cisco router is critical to maintaining network integrity. By configuring login authentication and privilege levels, you can control who has access to the router and what actions they can perform. In this guide, we’ll walk you through the steps to set up login authentication and privilege levels on a Cisco router, ensuring your network remains secure and well-managed.

---

Why Configure Login Authentication and Privilege Levels?

• Enhanced Security: Prevents unauthorized access to the router.
• Granular Control: Limits user access based on privilege levels.
• Accountability: Tracks user activity through individual login credentials.
• Compliance: Meets security best practices and regulatory requirements.

---

Step 1: Access the Router’s CLI

1. Connect to your router via console cable, Telnet, or SSH.
2. Enter privileged EXEC mode:
   Router> enable
Router#

---

Step 2: Configure Local User Accounts

1. Enter global configuration mode:
   Router# configure terminal
Router(config)#
2. Create a local user account with a password:
   Router(config)# username admin privilege 15 secret StrongPassword123
   • Replace admin with the desired username.
   • Replace StrongPassword123 with a strong password.
   • privilege 15 grants the user the highest privilege level (full access).

---

Step 3: Configure Privilege Levels

Cisco routers have 16 privilege levels (0–15). Level 15 is the highest (full access), while levels 1–14 can be customized.

1. Create Custom Privilege Levels

1. Assign specific commands to a custom privilege level (e.g., level 5):
   Router(config)# privilege exec level 5 show running-config
Router(config)# privilege exec level 5 show ip interface brief

2. Assign Users to Custom Privilege Levels

1. Create a user with a custom privilege level:
   Router(config)# username operator privilege 5 secret OperatorPass123
   • Replace operator with the desired username.
   • Replace OperatorPass123 with a strong password.
   • privilege 5 assigns the user to the custom privilege level.

---

Step 4: Enable Login Authentication

1. For Console Access

1. Enter line configuration mode for the console:
   Router(config)# line console 0
Router(config-line)#
2. Enable login authentication using the local user database:
   Router(config-line)# login local

2. For Remote Access (VTY Lines)

1. Enter line configuration mode for VTY lines:
   Router(config)# line vty 0 4
Router(config-line)#
2. Enable login authentication using the local user database:
   Router(config-line)# login local
3. Restrict remote access to SSH (recommended for security):
   Router(config-line)# transport input ssh

---

Step 5: Enable Password Encryption

To ensure all passwords are stored securely in the configuration file:

Router(config)# service password-encryption

---

Step 6: Verify the Configuration

1. Exit configuration mode:
   Router(config-line)# exit
Router(config)# exit
Router#
2. Verify local user accounts:
   Router# show running-config | include username
3. Verify privilege levels:
   Router# show privilege

---

Step 7: Test Login Authentication

1. Log out of the router and attempt to log in using the new credentials.
2. Verify that users with custom privilege levels can only execute allowed commands.

---

Step 8: Save the Configuration

To ensure your changes persist after a reboot:

Router# write memory

or

Router# copy running-config startup-config

---

Conclusion

Configuring router login authentication and privilege levels is a critical step in securing your Cisco router. By following the steps outlined in this guide, you can control access to your router, limit user privileges, and ensure your network remains secure. Whether you’re managing a small office network or a large enterprise infrastructure, these configurations are essential for maintaining a robust security posture.

If you found this guide helpful, feel free to share it with your peers or leave a comment below with your thoughts or questions. Happy securing!

About the Author: