Role-Based CLI Access

Although users can control CLI access via both privilege levels and enable mode passwords, these functions do not provide network administrators with the necessary level of detail needed when working with Cisco IOS routers and switches. CLI views provide a more detailed access control capability for network administrators, thereby, improving the overall security and accountability of Cisco IOS software.

As of Cisco IOS Release 12.3(11)T, network administrators can also specify an interface or a group of interfaces to a view; thereby, allowing access on the basis of specified interfaces.

When a system is in "root view," it has all of the access privileges as a user who has level 15 privileges. If the administrator wishes to configure any view to the system (such as a CLI view, a superview, or a lawful intercept view), the system must be in root view.

The difference between a user who has level 15 privileges and a root view user is that a root view user can configure a new view and add or remove commands from the view. Also, when you are in a CLI view, you have access only to the commands that have been added to that view by the root view user.

Like a CLI view, a lawful intercept view restricts access to specified commands and configuration information. Specifically, a lawful intercept view allows a user to secure access to lawful intercept commands that are held within the TAP-MIB, which is a special set of simple network management protocol (SNMP) commands that store information about calls and users.

Commands available in lawful intercept view belong to one of the these categories:

• Lawful intercept commands that should not be made available to any other view or privilege level
• CLI views that are useful for lawful intercept users but do not have to be excluded from other views or privilege levels

A superview consists of one or more CLI views, which allow users to define what commands are accepted and what configuration information is visible. Superviews allow a network administrator to easily assign all users within configured CLI views to a superview instead of having to assign multiple CLI views to a group of users.

Superviews contain these characteristics:

• A CLI view can be shared among multiple superviews.
• Commands cannot be configured for a superview; that is, you must add commands to the CLI view and add that CLI view to the superview.
• Users who are logged into a superview can access all of the commands that are configured for any of the CLI views that are part of the superview.
• Each superview has a password that is used to switch between superviews or from a CLI view to a superview.
• If a superview is deleted, all CLI views associated with that superview will not be deleted too.

View authentication is performed by an external authentication, authorization, and accounting (AAA) server via the new attribute "cli-view-name."

AAA authentication associates only one view name to a particular user; that is, only one view name can be configured for a user in an authentication server.

SUMMARY STEPS

1.    enable view

2.    configure terminal

3.    parser view view-name

4.    secret 5 encrypted-password

5.    commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command]

6.    exit

7.    exit

8.    enable [privilege-level] [view view-name

9.    show parser view all

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable view Example: Router> enable view	Enables root view. Enter your privilege level 15 password (for example, root password) if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	parser view view-name Example: Router(config)# parser view first	Creates a view and enters view configuration mode.
Step 4	secret 5 encrypted-password Example: Router(config-view)# secret 5 secret	Associates a command-line interface (CLI) view or superview with a password. Note    You must issue this command before you can configure additional attributes for the view.
Step 5	commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command] Example: Router(config-view)# commands exec include show version	Adds commands or interfaces to a view. parser-mode --The mode in which the specified command exists. include --Adds a command or an interface to the view and allows the same command or interface to be added to an additional view. include-exclusive --Adds a command or an interface to the view and excludes the same command or interface from being added to all other views. exclude --Excludes a command or an interface from the view; that is, customers cannot access a command or an interface. all --A "wildcard" that allows every command in a specified configuration mode that begins with the same keyword or every subinterface for a specified interface to be part of the view. interface interface-name -- Interface that is added to the view. command --Command that is added to the view.
Step 6	exit Example: Router(config-view)# exit	Exits view configuration mode.
Step 7	exit Example: Router(config)# exit	Exits global configuration mode.
Step 8	enable [privilege-level] [view view-name Example: Router# enable view first	Prompts the user for a password, which allows the user to access a configured CLI view, and is used to switch from one view to another view. After the correct password is given, the user can access the view.
Step 9	show parser view all Example: Router# show parser view	(Optional) Displays information about the view that the user is currently in. all --Displays information for all views that are configured on the router. Note    Although this command is available for both root and lawful intercept users, the all keyword is available only to root users. However, the all keyword can be configured by a user in root view to be available for users in lawful intercept view and CLI view.

• Troubleshooting Tips
  

%PARSER-6-VIEW_CREATED: view 'first' successfully created.

%Password not set for view <viewname>.

SUMMARY STEPS

1.    enable view

2.    configure terminal

3.    li-view li-password user username password password

4.    username lawful-intercept [name] [privilege privilege-level | view view-name] password password

5.    parser view view-name

6.    secret 5 encrypted-password

7.    name new-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable view Example: Router> enable view	Enables root view. Enter your privilege level 15 password (for example, root password) if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	li-view li-password user username password password Example: Router(config)# li-view lipass user li_admin password li_adminpass	Initializes a lawful intercept view. After the li-view is initialized, you must specify at least one user via user username password password options.
Step 4	username lawful-intercept [name] [privilege privilege-level | view view-name] password password Example: Router(config)# username lawful-intercept li-user1 password li-user1pass	Configures lawful intercept users on a Cisco device.
Step 5	parser view view-name Example: Router(config)# parser view li view name	(Optional) Enters view configuration mode, which allows you to change the lawful intercept view password or the lawful intercept view name.
Step 6	secret 5 encrypted-password Example: Router(config-view)# secret 5 secret	(Optional) Changes an existing password for a lawful intercept view.
Step 7	name new-name Example: Router(config-view)# name second	(Optional) Changes the name of a lawful intercept view. If this command is not issued, the default name of the lawful intercept view is "li-view."

• Troubleshooting Tips
  

SUMMARY STEPS

1.    enable view

2.    configure terminal

3.    parser view superview-name superview

4.    secret 5 encrypted-password

5.    view view-name

6.    exit

7.    exit

8.    show parser view all

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable view Example: Router> enable view	Enables root view. Enter your privilege level 15 password (for example, root password) if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	parser view superview-name superview Example: Router(config)# parser view su_view1 superview	Creates a superview and enters view configuration mode.
Step 4	secret 5 encrypted-password Example: Router(config-view)# secret 5 secret	Associates a CLI view or superview with a password. Note    You must issue this command before you can configure additional attributes for the view.
Step 5	view view-name Example: Router(config-view)# view view_three	Adds a normal CLI view to a superview. Issue this command for each CLI view that is to be added to a given superview.
Step 6	exit Example: Router(config-view)# exit	Exits view configuration mode.
Step 7	exit Example: Router(config)# exit	Exits global configuration mode.
Step 8	show parser view all Example: Router# show parser view	(Optional) Displays information about the view that the user is currently in. all --Displays information for all views that are configured on the router. Note    Although this command is available for both root and lawful intercept users, the all keyword is available only to root users. However, the all keyword can be configured by a user in root view to be available for users in lawful intercept view and CLI view.

To display debug messages for all views--root, CLI, lawful intercept, and super--use the debug parser view command in privileged EXEC mode.