Remote/saved commands not working if IOS privilege level 15 is required

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

Remote/saved commands not working if IOS privilege level 15 is required
Some remote commands report "% Invalid input detected at '^' marker"

Cisco IOS privilege level is 15 and in enable mode

SND> show run
RCV-1000>show run
         ^
         % Invalid input detected at '^' marker.

 

Environment

All supported NCM versions

Cause

This is a security feature introduced several releases ago to disallow migrating a session to user level ('disable') if there is no privilege password defined. Cisco devices have a default non-privilege mode prompt ending in '>'. This device does not: '#' indicates what NCM considers privilege mode. The incoming command is defined to be issued in user mode, so the code is migrating the session from privilege to user mode, and first checking if there is a privilege password defined in the event it needs to return in subsequent operations.

If the account has been created at above default privilege, then a privilege password for the device in NCM must be defined or the attempt to go to user/disable mode will fail before the command is ever issued.

Resolution

Product is working as designed, users are expected to set right user level to user that is configured in NCM.