topic Cisco CDO to manage ASA when TACACS based Authentication Enabled in Network Security

Cisco CDO to manage ASA when TACACS based Authentication Enabled

networkmanagement3141 — Mon, 14 Dec 2020 09:33:35 GMT

Hello,

We are at very initial of planning to integration of Cisco ASA under Cisco Defense Orchestrator - CDO.

I am not able to find much document or section, which explains about my question and looking forward some guidance from the experts here.

Our Cisco ASAs are enabled with TACACS through ISE based AD Authentication, now we are planning to on-board this ASAs into CDO tool. My question, how does CDO get login to this ASAs ? do we need to create a separate AD Account and input into CDO for devices login ?

Re: Cisco CDO to manage ASA when TACACS based Authentication Enabled

Rob Ingram — Mon, 14 Dec 2020 10:43:59 GMT

Hi @networkmanagement3141

When it comes to onboarding the ASA in CDO, it requires valid credentials. I'd create a dedicated account in AD for CDO and use these when onboarding.

HTH

Re: Cisco CDO to manage ASA when TACACS based Authentication Enabled

Marvin Rhoads — Mon, 14 Dec 2020 18:03:33 GMT

I agree with @Rob Ingram - use a service account with a non-expiring strong password. Create an SOP to change it periodically.