| 13.5 |  | Command Authorization |
| 13.5.2 |  | (Method 1) enable level command authorization |

| The first method of command authorization is called enable level command authorization. Enable level command authorization works by creating various privilege levels and assigning each of these privilege levels a password. The administrator is then allowed to assign commands to these different levels. This means that for a user to be able to use a particular command on the PIX Security Appliance, that user must know the password of the privilege level of the command, or of a higher privilege level. Note that in order for this feature to work properly, the PIX Security Appliance must be configured to support Authentication, Authorization, and Accounting (AAA) authorization.

Creating privilege levels and assigning commands to them
The PIX Security Appliance supports up to sixteen privilege levels, ranging from from zero to level fifteen. Privilege levels are created and secured by using the

enable password command. Access can then be gained to a particular privilege level from the > prompt by entering the enable command with a privilege level designation, and entering the password for that level when prompted.

After entering a privilege level, it is possible to execute the commands assigned to that level as well as commands assigned to lower privilege levels. For example, from privilege level 15 it is possible to execute every command, because this is the highest privilege level. If a privilege level is not specified when entering enable mode, the default of 15 is used. Therefore, creating a strong password for level 15 is important.

The Command Reference examines the

enable and enable password commands in more detail.

Once the desired privilege levels have been created, the next step in configuring enable level authorization is to assign commands to the privilege levels. To do this, the administrator uses the

privilege command. The privilege command allows the administrator to specify commands and then attach them to a specific privilege level. Any user at or above this level will be able to access the given command, and all others will be denied access to it. After completing the assignment of privilege, issue the aaa authorization local command to enable the command authorization feature on the PIX Security Appliance.

The Command Reference examines both the

privilege and aaa authorization local commands in more detail. An explanation of their syntaxes is also provided.