Skip to main content

Devices / Vendors / Cisco IOS-XE

Create a read-only account on Cisco IOS-XE

Create a privilege level and account that let ITVA collect data from a Cisco IOS-XE device without permission to change it.

A read-only account lets ITVA collect data from a Cisco IOS-XE device without the permission to change it. In this guide, you create a privilege level for ITVA and an account that uses it, then connect the device to ITVA.

Before you begin

  • SSH is on, and the VTY lines use local login (login local).
  • You can sign in to the device at privilege level 15.
  • This guide uses a local account. If you use TACACS+ or RADIUS, set the privilege level on that server instead.

What ITVA needs

ITVA signs in with SSH and runs show commands, such as show interfaces and show running-config view full. It never enters configuration mode.

ITVA needs the privileged prompt, which ends in #. If the account starts at the > prompt, ITVA sends enable with the account's password. So give the account a privilege level from 2 to 14. At these levels the prompt ends in #, but the account cannot change the configuration.

Allow show commands at level 5

  1. Enter configuration mode.
configure terminal
  1. Make all show commands available at privilege level 5.
privilege exec all level 5 show

Create the account

  1. Create the account at privilege level 5. Replace <USERNAME> and <PASSWORD> with the account's name and password.
username <USERNAME> privilege 5 algorithm-type scrypt secret <PASSWORD>
  1. Leave configuration mode and save the configuration.
end
write memory

Set up the device in ITVA

  1. In the portal, open the device and select Edit.
  2. In Credentials, add a credential with the Username and Password of the new account.
  3. Set Admin to No for this credential, because the account cannot change the device.
  4. Make sure Management Port is 22, or the SSH port that you set on the device.
  5. Select Save.

Check that it worked

  1. Sign in to the device with SSH as the new account.
  2. Make sure the prompt ends in #.
  3. Run configure terminal. Make sure the device refuses the command.
  4. In the portal, open the device's actions menu and select Sync Data, then select Sync.
  5. Make sure the log shows sync succeeded lines and no sync failed lines.

Troubleshooting

If the log shows enable authentication failed, the account starts at the > prompt. Make sure the account has privilege 5.

If the log shows Command authorization failed, AAA command authorization blocks the commands. Allow the show commands for this account on your AAA server.

If the configuration in ITVA is empty or partial, the account cannot see the full running configuration. Make sure show running-config view full works when you sign in as the account.