topic Re: AAA authentication for Serial Console. in Network Security

AAA authentication for Serial Console.

Alfredcfc — Mon, 09 Mar 2020 14:38:08 GMT

Currently I am not using aaa authentication to login into serial console cable, would this mean when I login into to ASA via a serial cable I will bypass the AAA servers and use the local database ?.

Or do I have specify aaa authentication serial console LOCAL ?.

But then this would force the enable password to be sent to my TACACS+ server. since I have use

aaa authenticaion enable.

Re: AAA authentication for Serial Console.

balaji.bandi — Mon, 09 Mar 2020 14:51:49 GMT

yes you need to add enable and authentication for serial to be local example :

aaa authentication enable console LOCAL

aaa authentication serial console LOCAL

note : make sure you test with Local username and password before you write the config. or you should have alterbative method to login to box to remidate the issue.

Re: AAA authentication for Serial Console.

Alfredcfc — Mon, 09 Mar 2020 16:36:30 GMT

The current configurations is like this :

aaa authentications ssh console My_tacacs+ LOCAL

aaa authentication http console My_tacacs+ LOCAL

aaa authentication enable console My_tacacs+ LOCAL

Also I my doing accounting and authorization via tacacs+.

If I add

aaa authentication serial console LOCAL

I will be able to login into the serial cable using local credentials BUT I won't be able to enter the enable password since it will be sent to TACACS+ server and it will fail.

Could you please let me know if I can bypass sending enable passwords ? for serial login alone so that both the login and exec login password are validated since only the local database credentials.

Re: AAA authentication for Serial Console.

Sheraz.Salim — Mon, 09 Mar 2020 17:33:39 GMT

your answer is here in this post.

Re: AAA authentication for Serial Console.

Alfredcfc — Mon, 16 Mar 2020 07:58:58 GMT

HI Sheraz,

I read through the answer you have posted but that answer is for a router so can please let me know if you can help me in this problem for an ASA firewall.

Re: AAA authentication for Serial Console.

Cristian Matei — Mon, 16 Mar 2020 11:31:37 GMT

Hi,

Can you try the following:

- have a username locally configured with privilege level 15

- configure "aaa authentication enable console My_tacacs+ LOCAL and "aaa authorization exec LOCAL auto-enable"

See if you can authenticate on the console as requested, afterwards also test the remote SSH/telnet functionality.

Regards,

Cristian Matei.