A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
The `>` to `#` transition isn't cosmetic — it's the primary security boundary in IOS. User EXEC users can run a handful of `show` commands; privileged EXEC users can see configs, copy files, reload devices, and enter config mode. Getting that boundary right is the first thing every network engineer learns about device hardening.
| Level | Default access | Notes |
|---|---|---|
| 0 | 5 commands (logout, enable, disable, help, exit) | Almost useless |
| 1 | User EXEC — limited show commands | Default login level |
| 2–14 | Custom — assign as needed | Used for role-based CLI views |
| 15 | Privileged EXEC — full access | Equivalent to `enable` |
By default, `enable` takes you to level 15. You can configure different passwords to reach different levels — e.g., a NOC operator password that lands at level 5 with only monitoring commands available.
! Enter privileged EXEC (level 15)Router1> enablePassword:Router1#! Leave privileged EXECRouter1# disableRouter1>! Enter global config from privileged EXECRouter1# configure terminalRouter1(config)#! Exit one level with exit, or jump to privileged EXEC with end/Ctrl+ZRouter1(config-if)# exitRouter1(config)# exitRouter1#! From anywhere, Ctrl+Z or end takes you to privileged EXECRouter1(config-if)# endRouter1#
`exit` moves up one level. `end` (or `Ctrl+Z`) jumps straight back to privileged EXEC from any config submode. Learn the difference — you'll use `end` constantly once you're comfortable.
! Set a level-5 password for monitoring-only accessRouter1(config)# enable secret level 5 MonitorPass! Assign specific commands to level 5Router1(config)# privilege exec level 5 show interfacesRouter1(config)# privilege exec level 5 show ip routeRouter1(config)# privilege exec level 5 show version! Assign a user to that levelRouter1(config)# username monitor privilege 5 secret MonPass123
That gives a user named `monitor` a password that lands them at privilege level 5, where only the three assigned `show` commands work. Any command outside their level returns `% Invalid input` — the CLI simply doesn't know about commands above your level.
Do not share the level-15 enable password with NOC staff who only need to monitor. Every credential on a network device should be scoped to what that person needs. Level 15 gives config access — equivalent to root on a server.
You can navigate IOS confidently. Next lesson: making your first real configuration changes.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.