topic Re: ASA 8.0 and Microsoft ISA (local user backup) in Network Access Control

ASA 8.0 and Microsoft ISA (local user backup)

vtra — Sun, 10 Mar 2019 22:43:12 GMT

What is the command so that when the username + password cannot be found in the microsoft isa server, the pix will look at the local database?

This command works in the router, but I cannot seem to find the equivlant for the pix.

aaa authentication login default local group tacacs+

Basically does the pix asa 8.0 support Multiple authorization commands?

Thank you very much for your help.

Re: ASA 8.0 and Microsoft ISA (local user backup)

Herbert Baerten — Fri, 14 Mar 2008 11:35:39 GMT

On a router, "aaa authentication login default local group tacacs+ " will ALWAYS use the local user DB, never tacacs.

"aaa authentication login default group tacacs+ local" will first try tacacs and only if the tacacs server is not responding, use the local DB. Note that if the tacacs DOES respond but rejects the authentication attempt (user does not exist or wrong password), that the router will NOT use the local DB.

That said, on pix/asa you can do the same, e.g.:

aaa-server TPLUS protocol tacacs+

aaa-server TPLUS (management) host 10.0.0.1

aaa authentication telnet console TPLUS LOCAL

hth

Re: ASA 8.0 and Microsoft ISA (local user backup)

vtra — Thu, 27 Mar 2008 19:06:26 GMT

Thank you very much, that helped a lot!