topic Re: help with AAA config- stuck and need assistance in Network Access Control

help with AAA config- stuck and need assistance

mjsully — Sun, 10 Mar 2019 23:06:25 GMT

I have an ASA firewall in which I need these requirements.

There will be three local accounts defined on the ASA. I need one of these accounts to have to enter an enable password when accessing privileged enable mode. The other two accounts I want to take directly to privileged mode after authenticating with their local username and password. All connections to the ASA will be via SSH, if that matters. How do I set this up?

Re: help with AAA config- stuck and need assistance

Jagdeep Gambhir — Wed, 24 Sep 2008 12:01:01 GMT

In ASA user cannot fall directly to enable mode since exec authorization is not supported.

Please see this link,

http://www.ciscotaccc.com/security/showcase?case=K25224726

Regards,

~JG

Do rate helpful posts

Re: help with AAA config- stuck and need assistance

mjsully — Wed, 24 Sep 2008 13:35:50 GMT

but doesn't this pertain to TACACS+ and RADIUS authentication? All my accounts are locally defined on the ASA itself, nothing goes to an external authentication server.

Re: help with AAA config- stuck and need assistance

Jagdeep Gambhir — Wed, 24 Sep 2008 14:44:25 GMT

It also applicable for local authentication. ASA does not perform exec authorization, no matter what db or protocol we use.

Regards,

~JG

Do rate helpful posts