topic ASA 5520 Failover Exec AAA Authorization Failed in Network Access Control

ASA 5520 Failover Exec AAA Authorization Failed

Darren Roback — Mon, 11 Mar 2019 03:12:23 GMT

Hello -

I have a pair of ASA 5520 firewalls running in active/standby mode on 8.3.2.34 code. My configuration performs authentication/authorization into ACS 5.1, however command authorization is failing when I try to execute a command on the standby from the active unit...

failover exec standby dir disk0:/

Fallback authorization. Username 'adminuser' not in LOCAL database

Command authorization failed

I don't even see the authentication attempt going into ACS. Any ideas?

Thanks!

Darren

ASA 5520 Failover Exec AAA Authorization Failed

Darren Roback — Fri, 15 Mar 2013 22:05:09 GMT

Here's my AAA configuration:

aaa authentication ssh console TACACS LOCAL

aaa authentication http console TACACS LOCAL

aaa authentication enable console TACACS LOCAL

aaa authorization command TACACS LOCAL

aaa accounting ssh console TACACS

aaa accounting enable console TACACS

aaa accounting command TACACS

aaa authorization exec authentication-server

ASA 5520 Failover Exec AAA Authorization Failed

Tarik Admani — Mon, 18 Mar 2013 07:32:21 GMT

Darren,

This bug looks like it is resolved in version 8.4(1), here is a bug that matches your symptom:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?caller=pluginredirector&method=fetchBugDetails&bugId=CSCti22636

"failover exec standby" TACACS+ authorization failure

Symptom:

Currently Standby ASA uses "enable_1" username for authorization requests when "failover exec standby" command is run on the Active ASA in failover pair. This leads to authorization failures on TACACS+ server unless the "enable_1" user is created there and privilege 15 is granted to this user.

Conditions:

This is a limitation of all software releases where the "failover exec standby" feature is implemented.

Workaround:

The workaround is:
- create a user account "enable_1" on TACACS+ server with any random password;
- grant "privilege = 15" and full access on all commands to this user.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: ASA 5520 Failover Exec AAA Authorization Failed

NSutfin — Fri, 15 May 2020 13:48:16 GMT

If your running the REST API on your firewall, this fix exposes the API and will not allow upstream TACACS auth on the API due to the local enable_1 user.