topic ASDM Privilege Level default 15 for Radius users in Network Access Control

ASDM Privilege Level default 15 for Radius users

John LeCoque — Mon, 11 Mar 2019 03:04:58 GMT

So this may be a bit of a dumb question...

I stumbled upon an ASA today that is configured to authenticate against a Radius server for SSH and HTTPS connections. If I log in via SSH, I can't gain a privilege level of more than 1 (tried login command, etc).

However, if I log in with ASDM, I always have privilege level 15.

Command authorization is not enabled.

Is this default behavior. If so, why? Do I need to enable command authorization to override this behavior?

FYI, the system in question is running ASA 8.3(1)

Thanks much

ASDM Privilege Level default 15 for Radius users

shekharmore003 — Fri, 22 Feb 2013 21:31:38 GMT

Can you please provide the AAA configuration

ASDM Privilege Level default 15 for Radius users

Peter Koltl — Wed, 27 Feb 2013 08:05:26 GMT

aaa-server RADGR protocol radius

aaa-server RADGR host 10.2.2.2

timeout 4

key cisco123

aaa authentication enable console RADGR LOCAL

After logging in, use the enable command with your user password.

http://www.cisco.com/en/US/partner/docs/security/asa/asa83/configuration/guide/access_management.html#wp1145571

ASDM Privilege Level default 15 for Radius users

Jatin Katyal — Wed, 27 Feb 2013 09:34:39 GMT

In ASA you can't land directly to privilege exec mode after enetring your login password. You have to enter the enable password too. This is only designed for IOS where you can directly land to( # ) by-passing the enable passowrd mode.

Jatin Katyal

- Do rate helpful posts -