topic AAA Authentication Order for FTD SSH CLI Access in Network Security

AAA Authentication Order for FTD SSH CLI Access

Serpens66 — Fri, 21 Feb 2020 16:38:46 GMT

I am thinking I need to settle with the fact the FTD-CLI seems to authenticate in this order: LOCAL then External

Anyone know if there is way to get a similar result to this command in a FTD?

aaa authentication ssh console ISE-RAD LOCAL

Or is it just not possible at the moment?

Re: AAA Authentication Order for FTD SSH CLI Access

Marius Gunnerud — Wed, 09 Jan 2019 20:26:33 GMT

I am assuming you have the same username for both Local and External authentication? In either case as of now, the Local user database is checked first.

Internal and External Users

Firepower devices support two types of users:

Internal user—The device checks a local database for user authentication. For more information about internal users, see Add an Internal User Account.
External user—If the user is not present in the local database, the system queries an external LDAP or RADIUS authentication server. For more information about external users, see Configure External Authentication.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/user_accounts_for_management_access.html

Re: AAA Authentication Order for FTD SSH CLI Access

Serpens66 — Wed, 09 Jan 2019 21:36:16 GMT

Thanks for the response! So, I have three AD users and then the default admin local user on the FTD, I want it to work where the local admin account simply won't work unless the external authentication fails, but your explanation just reinforces all the info I can find.

This doesn't work:

RADIUS Server up and working

External Users - Can log in

Internal (LOCAL) Users - Can't log in

RADIUS Server Down

External Users - Cannot log in

Internal (LOCAL) Users - Can log in

Re: AAA Authentication Order for FTD SSH CLI Access

Marius Gunnerud — Wed, 09 Jan 2019 22:14:29 GMT

Your understanding is correct. Local users will always be able to login, radius users will only be able to log in when the server is available.

Re: AAA Authentication Order for FTD SSH CLI Access

Serpens66 — Thu, 10 Jan 2019 14:37:38 GMT

Disappointing! I just wanted to be sure and have a topic for anyone else looking for a definitive answer. Thanks!