FMC external authentication for CLI access to managed devices.

revenant — Tue, 19 Sep 2023 09:45:32 GMT

Hi all, I need some confirmation or experience sharing regarding FMC external authentication for CLI access to managed devices.

It seems that starting from FTD 7.x the only way to get this working is to specify the list of users for CLI access in FMC under Configuration -> Users -> given External Authentication Object -> CLI Access Filter.

In the past, I was able to get this working be returning Radius AV pair Service-Type = 6. I still have some FTD 6.6.x devices in the LAB and indeed it is working without specifying anything in the FMC.

I just want to double check with the community if this is by design or I missed something in the documentation.

Honestly this is weird and it completely beats the principle of single point of policy definition (AAA server).

Thank you.

Re: FMC external authentication for CLI access to managed devices.

Marvin Rhoads — Tue, 19 Sep 2023 12:47:53 GMT

Yes - you must create the accounts in FMC and designate them as having external authentication.

Re: FMC external authentication for CLI access to managed devices.

Eric R. Jones — Tue, 19 Sep 2023 20:59:25 GMT

Interesting, that's the only way we got it to work. We started on 6.6.X and without the local usernames it failed.

topic Re: FMC external authentication for CLI access to managed devices. in Network Security

FMC external authentication for CLI access to managed devices.

Re: FMC external authentication for CLI access to managed devices.

Re: FMC external authentication for CLI access to managed devices.