topic Re: Cisco ASA AAA timeout in Network Security

Cisco ASA AAA timeout

tothz — Thu, 03 Feb 2022 12:05:27 GMT

Hi everybody

I have operate Cisco asa 5506 with aaa settings. I use linux tac_plus server.

It semms to be work well, but very slow.

If I stop tacacs server the login stop inmedietly with tacacs user, and I can login with local user. Nice.

If I start again tacacs server I can not login with tacacs user . 😞 It looks like asa is still using the local database.

asa aaa config

aaa-server tacacs protocol tacacs+
reactivation-mode depletion deadtime 1
aaa-server tacacs (inside) host 1.1.1.1
timeout 5
key *****
user-identity default-domain LOCAL
aaa authentication http console tacacs LOCAL
aaa authentication ssh console tacacs LOCAL
aaa authentication enable console tacacs LOCAL
aaa authentication serial console tacacs LOCAL
aaa authorization command tacacs LOCAL
aaa accounting command tacacs
aaa accounting enable console tacacs
aaa accounting ssh console tacacs
aaa accounting serial console tacacs
aaa local authentication attempts max-fail 5
aaa authentication login-history

Any idea ?

Re: Cisco ASA AAA timeout

balaji.bandi — Thu, 03 Feb 2022 12:28:41 GMT

what is the ASA IP adress, do you have good connection betweeen ASA and Linux ?

I can login with local user

this shows its fall back to local, what Logs you see on Linux ?

Re: Cisco ASA AAA timeout

Mike.Cifelli — Thu, 03 Feb 2022 12:36:48 GMT

Is the ASA able to reach to the t+ server? Have you attempted to run a packet trace to ensure routes/acls are good? Try this from cli: #test aaa-server authentication/authorization <group_name> username <username> password <pass>

What are the results?

Re: Cisco ASA AAA timeout

tothz — Thu, 03 Feb 2022 13:43:50 GMT

test aaa-server authentication tacacs username teszt password meme
Server IP Address or name: 10.1.1.1
INFO: Attempting Authentication test to IP address (1.1.1.1) (timeout: 10 seconds)
INFO: Authentication Successful

--------

but

ssh -l teszt 10.0.1.70
teszt@10.0.1.70's password:
Permission denied, please try again.
teszt@10.0.1.70's password:

--------------------------------------------

after few minutes works well again

teszt@10.0.1.70's password:
User teszt logged in to f-pe1-13
Logins over the last 2 days: 10. Last login: 12:50:13 CEST Feb 3 2022 from console
Failed logins since the last login: 0. Last failed login: 10:22:28 CEST Feb 3 2022 from 10.0.2.4
Type help or '?' for a list of available commands.
asa>

------------------------------

my problem is the that the fallback time slow

tacacs to Local change 3 second, but Local to tacacs five minutes