Creating a Custom Privilege LevelCustom privilege levels start with the default EXEC mode command set. You can then customize privilege levels 2-14 by:• restricting access to an EXEC mode command• moving commands from EXEC Privilege to EXEC mode• restricting accessA user can access all commands at his privilege level and below.Removing a Command from EXEC ModeTo remove a command from the list of available commands in EXEC mode for a specific privilege level, use the privilege execcommand from CONFIGURATION mode.In the command, specify a level greater than the level given to a user or terminal line, then the first keyword of each command you wish torestrict.Moving a Command from EXEC Privilege Mode to EXEC ModeTo move a command from EXEC Privilege to EXEC mode for a privilege level, use the privilege exec command fromCONFIGURATION mode.In the command, specify the privilege level of the user or terminal line and specify all keywords in the command to which you want to allowaccess.Allowing Access to CONFIGURATION Mode CommandsTo allow access to CONFIGURATION mode, use the privilege exec level level configure command fromCONFIGURATION mode.A user that enters CONFIGURATION mode remains at his privilege level and has access to only two commands, end and exit. You mustindividually specify each CONFIGURATION mode command you want to allow access to using the privilege configure levellevel command. In the command, specify the privilege level of the user or terminal line and specify all the keywords in the command towhich you want to allow access.Allowing Access to Different ModesThis section describes how to allow access to the INTERFACE, LINE, ROUTE-MAP, and ROUTER modes.Similar to allowing access to CONFIGURATION mode, to allow access to INTERFACE, LINE, ROUTE-MAP, and ROUTER modes, you mustfirst allow access to the command that enters you into the mode. For example, to allow a user to enter INTERFACE mode, use theprivilege configure level level interface tengigabitethernet command.Next, individually identify the INTERFACE, LINE, ROUTE-MAP or ROUTER commands to which you want to allow access using theprivilege {interface | line | route-map | router} level level command. In the command, specify the privilegelevel of the user or terminal line and specify all the keywords in the command to which you want to allow access.To remove, move or allow access, use the following commands.The configuration in the following example creates privilege level 3. This level:Management 59
