topic Re: Cisco FMC Cli showing Access Denied while trying SSH in Network Security

Cisco FMC Cli showing Access Denied while trying SSH

King_1988 — Mon, 21 Aug 2023 09:04:59 GMT

Hi,

We have changed the FMC password from GUI. We are not able to access CLI with local users and showing 'Access Denied'. Previously we could access with same password of GUI.

We don't have any LDAP or RADIUS. Please guide to solve this issue.

Re: Cisco FMC Cli showing Access Denied while trying SSH

Marvin Rhoads — Mon, 21 Aug 2023 11:19:06 GMT

Local FMC users other than the admin built-in user are only supported with external authentication.

Re: Cisco FMC Cli showing Access Denied while trying SSH

King_1988 — Mon, 21 Aug 2023 12:27:47 GMT

@Marvin Rhoads I understand. GUI is accessible after changing the password of local user (example: admin) but why not CLI is not accessible? Before changing the password CLI was accessible but now it is showing 'Access Denied' while trying SSH

Re: Cisco FMC Cli showing Access Denied while trying SSH

Marvin Rhoads — Mon, 21 Aug 2023 12:35:31 GMT

@King_1988 please note the following:

"admin user—The management center supports two different internal admin users: one for the web interface, and another with CLI access. The system initialization process synchronizes the passwords for these two admin accounts so they start out the same, but they are tracked by different internal mechanisms and may diverge after initial configuration. See the Getting Started Guide for your model for more information on system initialization. To change the password for the web interface admin, use System > Users > Users. To change the password for the CLI admin, use the management center CLI command configure password ."

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/720/management-center-admin-72/system-users.html#id_63534

Re: Cisco FMC Cli showing Access Denied while trying SSH

King_1988 — Mon, 21 Aug 2023 16:01:10 GMT

Hi Marvin,

The problem is i can't access the cli as it is showing 'Access Denied' after giving password.

Re: Cisco FMC Cli showing Access Denied while trying SSH

Marius Gunnerud — Mon, 21 Aug 2023 22:47:51 GMT

You would need to use the old admin password and not the new admin GUI password to access the CLI

Re: Cisco FMC Cli showing Access Denied while trying SSH

King_1988 — Tue, 22 Aug 2023 05:17:32 GMT

Tried. But still not happening. Is there any other way from GUI to solve the issue as CLI can't be accessible.

Re: Cisco FMC Cli showing Access Denied while trying SSH

Marvin Rhoads — Tue, 22 Aug 2023 13:02:56 GMT

If you no longer have the cli password then there is no way to reset it from the GUI, even as admin.

In such a case, you would need to perform password recovery from the console. Here is a link to the procedure to do that:

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118631-technote-firesight-00.html#toc-hId-241494136

Re: Cisco FMC Cli showing Access Denied while trying SSH

King_1988 — Wed, 23 Aug 2023 07:39:48 GMT

Thanks Marvin. After performing password recovery the issue solved.