topic Re: Using RADIUS and Local SSH authentication at the same time ASA5506 in Network Access Control

Using RADIUS and Local SSH authentication at the same time ASA5506

jbeach44 — Thu, 29 Feb 2024 17:23:47 GMT

Hello!

We have RADIUS via AD set up to ssh into our ASA's with a failback to local if RADIUS is down. I want to be able to use both RADIUS and LOCAL accounts at the same time, even when RADIUS is up. How can I accomplish this?

Current config:

aaa-server ConsoleAuth protocol radius
aaa-server ConsoleAuth (inside) host x.x.x.x
key *****
user-identity default-domain LOCAL
aaa authentication ssh console ConsoleAuth LOCAL
aaa authentication telnet console ConsoleAuth LOCAL
aaa authentication serial console ConsoleAuth LOCAL
aaa authentication http console ConsoleAuth LOCAL
aaa authentication enable console ConsoleAuth LOCAL
aaa authorization command LOCAL
aaa authentication login-history

Thank you!!

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

MHM Cisco World — Thu, 29 Feb 2024 17:54:56 GMT

aaa authentication ssh console ConsoleAuth LOCAL <- this is correct' the asa will check radius group ConsoleAuth then fallback to local

Sorry I missed this part ""even when RADIUS is up""' why you not add user in radius same as local (same user and password) this way if radius up then it auth by radius is down auth by local.

MHM

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

Rob Ingram — Thu, 29 Feb 2024 17:40:43 GMT

@jbeach44 unfortunately you cannot use both at the sametime, the ASA will only use the local database if all RADIUS servers are unavailable/unresponsive.

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

jbeach44 — Thu, 29 Feb 2024 18:36:04 GMT

Thank you for the reply,

Basically, we use Auvik for monitoring and config backups. Auvik needs an account to ssh into the ASA's and we have been using an AD account via RADIUS but this account keeps getting locked out. Auvik support is unable to figure out why. We have a separate account that we use for our C9300 switches and that never gets locked out. I was trying to figure out if it is possible to have both local account access and radius access at the same time but apparently it is not.

Thanks

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

MHM Cisco World — Thu, 29 Feb 2024 18:42:11 GMT

Did you check session timeout of asa ssh ?

MHM

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

jbeach44 — Thu, 29 Feb 2024 18:43:40 GMT

ssh timeout is set to 5

Re: Using RADIUS and Local SSH authentication at the same time ASA5506

MHM Cisco World — Thu, 29 Feb 2024 18:46:09 GMT

Then check if monitor loss connect in same time that session is end

MHM