topic hi, in Network Access Control

enable pwd for console when AAA is configured

sridhar ch — Mon, 11 Mar 2019 06:34:36 GMT

I have AAA configured on my ASA and enable pwd is configured to use tatacs authentication. If i have to access using console, enable pwd is not accepting. so had to disable tacacs for enable mode and configured to use local pwd. what should be done so that i can use tacacs for enable pwd when accessing via ASDM/SSH/Telnet and local pwd while connecting thru console? FYI, i will use my Windows AD credentials for tacacs authentication. I have a local acc configured for console connection access.

aaa authentication ssh console BR_ACS_SVR LOCAL
aaa authentication http console BR_ACS_SVR LOCAL
aaa authentication telnet console LOCAL
aaa authentication serial console LOCAL
aaa accounting enable console Accounting
aaa accounting ssh console Accounting
aaa accounting command privilege 15 Accounting
aaa accounting telnet console BR_ACS_SVR

Thx,

sridhar

Hi Sridhar,

Aditya Ganjoo — Mon, 14 Mar 2016 18:47:58 GMT

Hi Sridhar,

What is the ACS version you are using ?

Try using this command back:

aaa authentication enable console BR_ACS_SVR LOCAL

And then if it does not work check the authentication logs on the ACS.

You can also check this link as well:

https://supportforums.cisco.com/discussion/12047431/cisco-asa-tacacs-enable-mode-not-working

Regards,

Aditya

Please rate helpful posts.

Regards,

Aditya

hi,

sridhar ch — Fri, 25 Mar 2016 13:34:58 GMT

hi,

i had aaa authentication enable console BR_ACS_SVR LOCAL configured earlier, but the issue with this command is it doesnt accept local enable pwd and it will point to ACS for enable pwd. I want to use local pwd for console and use tacacs for SSH/ASDM.

if the ASA is configured for tacacs authentication, is it possible to have local pwd for console and tacacs for other authentication?

thx,

sridhar

Sridhar,

Jatin Katyal — Fri, 25 Mar 2016 17:23:50 GMT

Sridhar,

Unfortunately this is not possible on ASA. You either have to use enable password against TACACS+ or local database. The same thing can be done on IOS using method list.

Regards,

Jatin