Greetings to all,

I have come to the realization that I can't do it all. I know, I know it's a sad day for me too. So I'm looking for a way that I can appoint someone to do port changes (Desc, VLAN, M/A/Cs, etc) without giving them access to the bare IOS. Has anyone written or seem something that can do this?

Thanks, Tom

The easiest way (if it's a single device) is to: setup a privilege level (from 2 to 14, inclusive), define the commands available at that level, and create a username/password for that user at the privilege level you setup.

The example in this link pertains to an issue with doing just this, but should help you get to where you're going: Cisco

If it's for a large number of devices, then you're probably going to want to look at implementing something like TACACS+.

Good luck!

No, not exactly.

Here is what I mean... All of my ports are shutdown unless they are in use, but it's part of our daily lives that users or departments move around our building. Because we have the policy that everything stays shutdown until used, when out desktop tech goes and moves a machine it actually takes 2 people to do ... One to physically move it and one to logically move it. I want to make that process WAY shorter then it's taking right now. I would like a system where I can can have someone activate and de-activate ports (Moves, Addes, Changes (MACs)) without giving them access to the actual IOS. It's almost an end user tracking system with a provisioning tie in.

Hope that explains it better...

Tom

True, but I'll still have to train people in how to login, what commands, blah, blah...

I really want this to be idiot proof as much as possible (Yes, I know the ol' saying).

Tom

Actually, that's a great idea. We're alrady working towards that... My company is typically behind in adopting technology by a longshot so we're looking for something in the mean time.

Tom

We did a simple web application for this kind of tasks some years ago. It contained a backend part (PERL), wich connects to the switch(es) and reads the config (interface status). The frontend (PHP) displays these infos on a website and allows changes (e.g. open/close ports). These changes are pushed to the devices trough the backend scripts.

If you have some coding people, this would be one possible way. :)

Try Netdisco www.netdisco.org. I use it to allow my helpdesk staff to change VLANs and up/down status of ports. It e-mails me of all changes so I still know what is going on. It also allows them to search for where a computer is plugged in by IP or MAC.

Someone else mentioned switchmap, it's a great program too, but doesn't have the change functions, much cleaner interface than netdisco though.