Cisco 5525 ASA TACACS Authentication Problem.

netbeginner — Mon, 11 Mar 2019 06:14:14 GMT

Hi Experts,

Due to some suspected recent policy implementation/changes on 5525 ASA , same is not getting autheticate on TACACs (ACS) However we are getting prompt for username/password.

We also have local username/password, through which we are able to logged into ASA but not able to execute any command , it's showing "command authorization failed". Like.

Cisco-asa> en
Password: ***********
Cisco-asa# conf t
Command authorization failed
Cisco-asa#

Due to this issue, we are also not getting authenticate on upper devices (above ASA).

Below is Configuration for ACS(TACACS) for reference (taken from old configuration backup)

aaa-server ACS protocol tacacs+
accounting-mode simultaneous
aaa-server ACS (Inside) host 10.50.10.100
key Cisco@123
aaa-server ACS (Inside) host 10.50.10.101
key Cisco@123
user-identity default-domain LOCAL
aaa authentication enable console ACS LOCAL
aaa authentication http console ACS LOCAL
aaa authentication ssh console ACS LOCAL
aaa authorization command ACS
aaa accounting enable console ACS
aaa accounting ssh console ACS
aaa accounting command ACS

Requesting to pls guide for resolving the problem.

Rgds

***

I think you could just delete

Richard Bradfield — Mon, 16 Nov 2015 06:49:12 GMT

I think you could just delete the Authorization command, in my experience if you are allowed to login then you want to be authorised automatically,authentication is usually enough.

topic Cisco 5525 ASA TACACS Authentication Problem. in Network Access Control

Cisco 5525 ASA TACACS Authentication Problem.

I think you could just delete