topic Re: Exception for AAA in Network Access Control

Exception for AAA

rishikesh_khedkar — Sun, 10 Mar 2019 22:34:21 GMT

Hi, I am using RADIUS for AAA authentication. Authentication is configured for device access. I want to know if i will be able to put an exception i.e. i want one user to be authenticated locally (local username and passwowrd) on a firewall(ASA 5500), while others to be authenticated by AAA. If it is possible, how do it do it?

Re: Exception for AAA

Collin Clark — Tue, 18 Dec 2007 15:29:26 GMT

AFAIK no. Why would you want to do that anyway? That's a security hole.

Re: Exception for AAA

rishikesh_khedkar — Tue, 18 Dec 2007 17:44:27 GMT

Ok. I have Cisco Security Manager, Cisco MARS, LMS and VMS in my network. Now, the requirement is something like this:

Everyone (including CSM) accessing devices like firewalls, routers, switchces, IPS Sensors should be authenticated by the ACS.

But when I went throught the CSM documentation I understood that the best way for CSM to logon to the firewall is by a local user.

Hence I an looking for a mechanism for the CSM only to bypass the AAA authentication while the network administrators being authenticated by the AAA.

Regards,

Rishikesh Khedkar

Re: Exception for AAA

Collin Clark — Tue, 18 Dec 2007 18:25:53 GMT

What we did was create a local user account in ACS. That way the user account is still AAA'd and you can set the password to no expiry, limit the access, etc.

HTH

Re: Exception for AAA

rishikesh_khedkar — Wed, 19 Dec 2007 09:26:23 GMT

Thanks,

Regards,

Rishikesh Khedkar