ASDM read only using ACS

noliveira — Tue, 14 Dec 2021 09:44:19 GMT

Hi,

I use to have ACS working fine with ASDM for read only accounts, but it stopped working I believe it might have been a recent ASA upgrade that changed something. I'm running IOS Version 9.14(2)15

ACS is configured with a shell profile privilege level 5 and command set.

I ran a debug tacacs while trying to login with the read only user on asdm and it looks like asdm is trying to run a "write net" command

mk_pkt - type: 0x2, session_id: 484054
mkpkt - authorize user: testro
cmd=write
cmd-arg=net Tacacs packet sent
Sending TACACS Authorization message. Session id: 484054, seq no:1
Received TACACS packet. Session id:1060479447 seq no:2
tacp_procpkt_author: FAIL
TACACS Session finished. Session id: 484054, seq no: 1

Cli read only works fine.

Why would asdm try to run that command?

Any ideas how I can make read only work again with ACS?

Thanks

Re: ASDM read only using ACS

hslai — Tue, 14 Dec 2021 03:46:19 GMT

CSCvq20174 looks similar to what you are reporting here, but it has been open since 2019.

topic Re: ASDM read only using ACS in Network Access Control

ASDM read only using ACS

Re: ASDM read only using ACS