Juniper JUNOSE 11.3, Configuration Manual

Page: 87 / 632

The CLI uses the following order of precedence:
1.
Privilege level set for all commands within a mode, including modes that are accessed
from another mode; for example, Global Configuration mode
2.
Privilege level set for all commands that begin with the same keyword; for example,
snmp commands
3.
Privilege level set for individual commands; for example, snmp-server community
NOTE: This order of precedence does not apply to privilege levels that
are set without the all keyword.
In the following example, the privilege level of the snmp-server community command
is set to level 11, the privilege level for all commands that begin with snmp is set to level
10, and the privilege level for all commands in Global Configuration mode is set to level
5.
host1(config)# privilege configure level 11 snmp-server community
host1(config)# privilege configure all level 10 snmp
host1(config)# privilege exec all level 5 configure
The following show configuration output displays the privilege levels set above. The
privilege levels for the snmp-server community command and the snmp-server group
of commands are still present in the output. However, the privilege level of Global
Configuration mode takes precedence, and the privilege levels of the other commands
are rendered ineffective. Users can access all
snmp commands at level 5 or higher.
host1# show config category management cli command-privileges
privilege configure level 11 snmp-server community
privilege configure all level 10 snmp-server
privilege exec all level 5 configure
Superseding Privilege Levels with the all Keyword
Issuing the all keyword supersedes privilege levels that were previously set without the
all keyword.
In the following example, the snmp-server-community command is set to level 7, and
the snmp keyword is set to level 6. The privilege level of the snmp keyword does not
override the snmp-server community setting, because both of these commands are set
without the all keyword.
host1(config)# privilege configure level 7 snmp-server community
host1(config)# privilege configure level 6 snmp
All snmp commands are then changed to level 5 with the all keyword.
host1(config)# privilege configure all level 5 snmp
The show configuration output displays all snmp commands at level 5, superseding the
existing level 6 setting. The snmp-server community command is still present in the
show configuration output, but it is ineffective.
57 Copyright © 2010, Juniper Networks, Inc.
Chapter 2: Command-Line Interface