# Create a read-only account on Cisco IOS-XE

> Create a privilege level and account that let ITVA collect data from a Cisco IOS-XE device without permission to change it.

Section: Devices / Vendors / Cisco IOS-XE  
Source: https://www.itva.com/docs/cisco-ios-xe/create-a-read-only-account-on-cisco-ios-xe  
Last updated: 2026-11-02

A read-only account lets ITVA collect data from a Cisco IOS-XE device without the permission to change it. In this guide, you create a privilege level for ITVA and an account that uses it, then connect the device to ITVA.

## Before you begin

- SSH is on, and the VTY lines use local login (`login local`).
- You can sign in to the device at privilege level 15.
- This guide uses a local account. If you use TACACS+ or RADIUS, set the privilege level on that server instead.

## What ITVA needs

ITVA signs in with SSH and runs `show` commands, such as `show interfaces` and `show running-config view full`. It never enters configuration mode.

ITVA needs the privileged prompt, which ends in `#`. If the account starts at the `>` prompt, ITVA sends `enable` with the account's password. So give the account a privilege level from 2 to 14. At these levels the prompt ends in `#`, but the account cannot change the configuration.

## Allow show commands at level 5

1. Enter configuration mode.

```
configure terminal
```

2. Make all `show` commands available at privilege level 5.

```
privilege exec all level 5 show
```

## Create the account

1. Create the account at privilege level 5. Replace `<USERNAME>` and `<PASSWORD>` with the account's name and password.

```
username <USERNAME> privilege 5 algorithm-type scrypt secret <PASSWORD>
```

2. Leave configuration mode and save the configuration.

```
end
write memory
```

## Set up the device in ITVA

1. In the portal, open the device and select **Edit**.
2. In **Credentials**, add a credential with the **Username** and **Password** of the new account.
3. Set **Admin** to **No** for this credential, because the account cannot change the device.
4. Make sure **Management Port** is 22, or the SSH port that you set on the device.
5. Select **Save**.

## Check that it worked

1. Sign in to the device with SSH as the new account.
2. Make sure the prompt ends in `#`.
3. Run `configure terminal`. Make sure the device refuses the command.
4. In the portal, open the device's actions menu and select **Sync Data**, then select **Sync**.
5. Make sure the log shows `sync succeeded` lines and no `sync failed` lines.

## Troubleshooting

If the log shows `enable authentication failed`, the account starts at the `>` prompt. Make sure the account has `privilege 5`.

If the log shows `Command authorization failed`, AAA command authorization blocks the commands. Allow the `show` commands for this account on your AAA server.

If the configuration in ITVA is empty or partial, the account cannot see the full running configuration. Make sure `show running-config view full` works when you sign in as the account.