How To Set Privileged Exec Password Packet Tracer

Controlling Switch Access with Passwords and Privilege Levels

Controlling Switch Access with Passwords and Privilege Levels

---

• Finding Feature Information
• Restrictions for Decision-making Switch Access with Passwords and Privileges
• Information Nigh Passwords and Privilege Levels
• How to Control Switch Access with Passwords and Privilege Levels
• Monitoring Switch Admission
• Configuration Examples for Setting Passwords and Privilege Levels

Finding Feature Data

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Characteristic Navigator to observe information about platform support and Cisco software image back up. To access Cisco Feature Navigator, go to http:/​/​www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for Controlling Switch Access with Passwords and Privileges

The post-obit are the restrictions for decision-making switch admission with passwords and privileges:

• Disabling countersign recovery volition not piece of work if you have ready the switch to boot upward manually by using the boot manual global configuration command. This command produces the boot loader prompt (switch:) later on the switch is power cycled.

Data Nigh Passwords and Privilege Levels

Default Password and Privilege Level Configuration

A simple way of providing terminal access control in your network is to utilize passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels ascertain what commands users can enter afterward they have logged into a network device.

This table shows the default countersign and privilege level configuration.

Table one Default Countersign and Privilege Levels

Feature	Default Setting
Enable password and privilege level	No password is divers. The default is level 15 (privileged EXEC level). The password is non encrypted in the configuration file.
Enable surreptitious password and privilege level	No password is divers. The default is level 15 (privileged EXEC level). The password is encrypted before it is written to the configuration file.
Line password	No password is defined.

Additional Password Security

To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a Picayune File Transfer Protocol (TFTP) server, you can utilise either the enable password or enable secret global configuration commands. Both commands accomplish the same matter; that is, you tin can found an encrypted password that users must enter to access privileged EXEC style (the default) or any privilege level y'all specify.

We recommend that you use the enable surreptitious command considering it uses an improved encryption algorithm.

If you configure the enable underground control, it takes precedence over the enable password command; the two commands cannot exist in effect simultaneously.

If you enable password encryption, it applies to all passwords including username passwords, authentication central passwords, the privileged command password, and console and virtual final line passwords.

Password Recovery

Past default, any stop user with physical access to the Catalyst 3850 switch tin can recover from a lost countersign by interrupting the boot procedure while the switch is powering on and then by entering a new countersign.

The password-recovery disable characteristic protects admission to the switch countersign past disabling part of this functionality. When this feature is enabled, the end user can interrupt the kick procedure only by agreeing to fix the system back to the default configuration. With password recovery disabled, you can still interrupt the boot process and alter the countersign, just the configuration file (config.text) and the VLAN database file (vlan.dat) are deleted.

If you disable password recovery, we recommend that y'all continue a backup copy of the configuration file on a secure server in example the finish user interrupts the boot process and sets the organization back to default values. Do not keep a backup re-create of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that y'all too continue a backup re-create of the VLAN database file on a secure server. When the switch is returned to the default organisation configuration, you tin download the saved files to the switch by using the Xmodem protocol.

To re-enable password recovery, use the service password-recovery global configuration control.

Terminal Line Telnet Configuration

When you lot power-up your switch for the outset time, an automatic setup plan runs to assign IP information and to create a default configuration for continued apply. The setup programme too prompts y'all to configure your switch for Telnet admission through a password. If yous did not configure this password during the setup plan, you can configure it when you lot set a Telnet password for a terminal line. For more information on doing this, run into Related Topics.

Username and Countersign Pairs

You can configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or ports and cosign each user before that user tin access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and countersign pair.

Privilege Levels

Cisco switches (and other devices) use privilege levels to provide password security for different levels of switch operation. By default, the Cisco IOS software operates in ii modes (privilege levels) of password security: user EXEC (Level ane) and privileged EXEC (Level fifteen). Y'all can configure upwardly to xvi hierarchical levels of commands for each mode. By configuring multiple passwords, you tin can permit unlike sets of users to have admission to specified commands.

Privilege Levels on Lines

Users can override the privilege level y'all set up using the privilege level line configuration control by logging in to the line and enabling a different privilege level. They tin can lower the privilege level by using the disable command. If users know the password to a higher privilege level, they can apply that password to enable the college privilege level. You might specify a high level or privilege level for your console line to restrict line usage.

For example, if you want many users to have access to the clear line control, you lot can assign information technology level ii security and distribute the level ii password fairly widely. But if you want more restricted access to the configure control, you can assign it level 3 security and distribute that password to a more restricted group of users.

Control Privilege Levels

When y'all set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. For instance, if you prepare the show ip traffic control to level 15, the show commands and prove ip commands are automatically set up to privilege level xv unless you set them individually to different levels.

How to Control Switch Access with Passwords and Privilege Levels

Setting or Changing a Static Enable Countersign

The enable password controls access to the privileged EXEC manner. Get-go in privileged EXEC way, follow these steps to set or change a static enable password:

SUMMARY STEPS

one. configure last


2. enable countersign password


three. cease

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Case: Switch # configure terminal	Enters the global configuration fashion.
Step 2	enable password countersign Example: Switch (config)# enable password secret321	Defines a new password or changes an existing password for access to privileged EXEC style. By default, no password is defined. For password , specify a cord from 1 to 25 alphanumeric characters. The string cannot starting time with a number, is example sensitive, and allows spaces merely ignores leading spaces. It can contain the question mark (?) character if you precede the question mark with the key combination Crtl-v when y'all create the password; for case, to create the password abc?123, practice this: Enter abc. Enter Crtl-v. Enter ?123. When the system prompts you to enter the enable password, you need non precede the question marker with the Ctrl-v; yous can just enter abc?123 at the password prompt.
Step 3	finish Example: Switch (config)# end	Returns to privileged EXEC mode.

Protecting Enable and Enable Secret Passwords with Encryption

Showtime in privileged EXEC mode, follow these steps to institute an encrypted countersign that users must enter to access privileged EXEC style (the default) or any privilege level you specify:

SUMMARY STEPS

1. configure terminal


2. Use one of the following:

• enable countersign [ level level ] { password | encryption-blazon encrypted-countersign }

• enable secret [ level level ] { password | encryption-blazon encrypted-countersign }

iii. service password-encryption


4. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Case: Switch # configure terminal	Enters the global configuration way.
Step 2	Use 1 of the post-obit: enable password [ level level ] { password | encryption-blazon encrypted-password } enable secret [ level level ] { countersign | encryption-blazon encrypted-countersign } Case: Switch (config)# enable password example102 or Switch (config)# enable secret level 1 password secret123sample	Defines a new password or changes an existing password for access to privileged EXEC way. Defines a secret countersign, which is saved using a nonreversible encryption method. (Optional) For level , the range is from 0 to 15. Level ane is normal user EXEC fashion privileges. The default level is 15 (privileged EXEC fashion privileges). For password , specify a string from 1 to 25 alphanumeric characters. The cord cannot start with a number, is case sensitive, and allows spaces simply ignores leading spaces. By default, no password is defined. (Optional) For encryption-type , only type 5, a Cisco proprietary encryption algorithm, is available. If yous specify an encryption type, yous must provide an encrypted password—an encrypted password that you lot copy from another switch configuration. Note If you specify an encryption type and and then enter a clear text password, you lot can not re-enter privileged EXEC mode. Y'all cannot recover a lost encrypted password past any method.
Step three	service password-encryption Example: Switch (config)# service password-encryption	(Optional) Encrypts the countersign when the password is defined or when the configuration is written. Encryption prevents the password from beingness readable in the configuration file.
Step 4	terminate Example: Switch (config)# finish	Returns to privileged EXEC mode.

Disabling Countersign Recovery

First in privileged EXEC manner, follow these steps to disable password recovery to protect the security of your switch:

Before You lot Begin

If you disable password recovery, we recommend that you keep a fill-in copy of the configuration file on a secure server in case the end user interrupts the boot procedure and sets the arrangement dorsum to default values. Exercise non continue a backup copy of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also keep a backup re-create of the VLAN database file on a secure server. When the switch is returned to the default system configuration, you can download the saved files to the switch by using the Xmodem protocol.

SUMMARY STEPS

1. configure terminal


2. no service password-recovery


3. stop

DETAILED STEPS

	Command or Action	Purpose
Stride ane	configure terminal Case: Switch # configure last	Enters the global configuration mode.
Pace ii	no service password-recovery Example: Switch (config)# no service password-recovery	Disables password recovery. This setting is saved in an expanse of the flash memory that is accessible past the kicking loader and the Cisco IOS image, but it is non role of the file organization and is not accessible by any user.
Pace 3	stop Example: Switch (config)# finish	Returns to privileged EXEC mode.

What to Practise Next

To re-enable password recovery, use the service password-recovery global configuration command.

Setting a Telnet Password for a Terminal Line

Beginning in user EXEC mode, follow these steps to set a Telnet countersign for the continued terminal line:

Before You Begin

Adhere a PC or workstation with emulation software to the switch panel port, or attach a PC to the Ethernet management port.

The default data characteristics of the console port are 9600, 8, 1, no parity. Yous might demand to press the Return primal several times to see the control-line prompt.

SUMMARY STEPS

1. enable


2. configure terminal


3. line vty 0 fifteen


4. password password


v. end

DETAILED STEPS

	Command or Activity	Purpose
Step 1	enable Example: Switch > enable	Note If a password is required for access to privileged EXEC way, you will be prompted for it. Enters privileged EXEC mode.
Stride 2	configure last Example: Switch # configure terminal	Enters global configuration mode.
Footstep 3	line vty 0 15 Instance: Switch (config)# line vty 0 15	Configures the number of Telnet sessions (lines), and enters line configuration mode. There are 16 possible sessions on a control-capable switch. The 0 and 15 mean that you are configuring all sixteen possible Telnet sessions.
Pace 4	countersign password Example: Switch (config-line)# countersign abcxyz543	Sets a Telnet password for the line or lines. For password , specify a string from 1 to 25 alphanumeric characters. The string cannot kickoff with a number, is case sensitive, and allows spaces but ignores leading spaces. Past default, no password is divers.
Step five	end Case: Switch (config-line)# terminate	Returns to privileged EXEC fashion.

Configuring Username and Password Pairs

Beginning in privileged EXEC manner, follow these steps to configure username and countersign pairs:

SUMMARY STEPS

1. configure terminal


ii. username proper name [privilege level] {password encryption-type password}


3. Use one of the post-obit:

• line console 0
• line vty 0 15

4. login local


5. end

DETAILED STEPS

	Command or Action	Purpose
Pace 1	configure concluding Instance: Switch # configure terminal	Enters the global configuration style.
Step 2	username proper name [privilege level] {password encryption-type password} Example: Switch (config)# username adamsample privilege 1 password secret456	Sets the username, privilege level, and password for each user. For name , specify the user ID equally one discussion. Spaces and quotation marks are not allowed. (Optional) For level , specify the privilege level the user has after gaining access. The range is 0 to 15. Level 15 gives privileged EXEC mode access. Level 1 gives user EXEC mode access. For encryption-type , enter 0 to specify that an unencrypted countersign will follow. Enter seven to specify that a subconscious password will follow. For password , specify the password the user must enter to gain access to the switch. The password must exist from ane to 25 characters, tin contain embedded spaces, and must be the last option specified in the username control.
Step 3	Employ i of the following: line console 0 line vty 0 15 Example: Switch (config)# line console 0 or Switch (config)# line vty xv	Enters line configuration mode, and configures the console port (line 0) or the VTY lines (line 0 to xv).
Pace 4	login local Instance: Switch (config-line)# login local	Enables local password checking at login time. Authentication is based on the username specified in Step 2.
Step v	end Instance: Switch (config)# terminate	Returns to privileged EXEC fashion.

Setting the Privilege Level for a Command

Beginning in privileged EXEC manner, follow these steps to prepare the privilege level for a command:

SUMMARY STEPS

1. configure terminal


two. privilege way level level control


3. enable countersign level level countersign


4. terminate

DETAILED STEPS

	Command or Action	Purpose
Step one	configure final Example: Switch # configure terminal	Enters the global configuration mode.
Pace 2	privilege mode level level control Example: Switch (config)# privilege exec level 14 configure	Sets the privilege level for a command. For mode , enter configure for global configuration fashion, exec for EXEC manner, interface for interface configuration manner, or line for line configuration mode. For level , the range is from 0 to 15. Level one is for normal user EXEC style privileges. Level 15 is the level of access permitted by the enable password. For command , specify the command to which you desire to restrict access.
Pace three	enable password level level password Example: Switch (config)# enable password level 14 SecretPswd14	Specifies the password to enable the privilege level. For level , the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. For password , specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces merely ignores leading spaces. Past default, no password is divers.
Stride 4	terminate Instance: Switch (config)# stop	Returns to privileged EXEC way.

Changing the Default Privilege Level for Lines

Outset in privileged EXEC mode, follow these steps to change the default privilege level for the specified line:

SUMMARY STEPS

one. configure terminal


2. line vty line


three. privilege level level


4. end

DETAILED STEPS

	Command or Action	Purpose
Pace 1	configure last Example: Switch # configure concluding	Enters the global configuration mode.
Step ii	line vty line Example: Switch (config)# line vty 10	Selects the virtual last line on which to restrict access.
Footstep iii	privilege level level Instance: Switch (config)# privilege level fifteen	Changes the default privilege level for the line. For level , the range is from 0 to xv. Level 1 is for normal user EXEC manner privileges. Level 15 is the level of admission permitted by the enable password.
Footstep iv	finish Example: Switch (config)# end	Returns to privileged EXEC style.

What to Practice Adjacent

Users can override the privilege level y'all prepare using the privilege level line configuration command by logging in to the line and enabling a different privilege level. They can lower the privilege level by using the disable command. If users know the password to a higher privilege level, they can use that password to enable the higher privilege level. You lot might specify a high level or privilege level for your console line to restrict line usage.

Logging into and Exiting a Privilege Level

Beginning in user EXEC mode, follow these steps to log into a specified privilege level and exit a specified privilege level.

SUMMARY STEPS

ane. enable level


2. disable level

DETAILED STEPS

	Control or Action	Purpose
Pace 1	enable level Example: Switch > enable 15	Logs in to a specified privilege level. Following the example, Level xv is privileged EXEC mode. For level , the range is 0 to xv.
Pace 2	disable level Example: Switch # disable 1	Exits to a specified privilege level. Post-obit the instance, Level 1 is user EXEC fashion. For level , the range is 0 to fifteen.

Monitoring Switch Access

Table 2 Commands for Displaying DHCP Information

show privilege	Displays the privilege level configuration.

Configuration Examples for Setting Passwords and Privilege Levels

• Example: Setting or Changing a Static Enable Password
• Instance: Protecting Enable and Enable Secret Passwords with Encryption
• Example: Setting a Telnet Password for a Terminal Line
• Example: Setting the Privilege Level for a Command

Example: Setting or Changing a Static Enable Countersign

This example shows how to modify the enable password to l1u2c3k4y5. The countersign is not encrypted and provides admission to level 15 (traditional privileged EXEC way access):

                                                          Switch                            (config)#                                                          enable countersign l1u2c3k4y5                                                      

Example: Protecting Enable and Enable Secret Passwords with Encryption

This example shows how to configure the encrypted password $i$FaD0$Xyti5Rkls3LoyxzS8 for privilege level 2:

                                                          Switch                            (config)#                                                          enable hush-hush level 2 5 $one$FaD0$Xyti5Rkls3LoyxzS8                                                      

Example: Setting a Telnet Password for a Concluding Line

This case shows how to set the Telnet password to let45me67in89:

                                                          Switch                            (config)#                                                          line vty 10                                                                                      Switch                            (config-line)#                                                          password let45me67in89                                                      

Example: Setting the Privilege Level for a Command

This example shows how to ready the configure command to privilege level xiv and ascertain SecretPswd14 equally the password users must enter to apply level 14 commands:

                                                          Switch                            (config)#                                                          privilege exec level xiv configure                                                                                      Switch                            (config)#                                                          enable password level 14 SecretPswd14                                                      

---

Source: https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_0101101.html

Share this post