Cisco ASA - User role to add and remove rules, NAT and objects only

muhtashim.ayub — Tue, 12 Mar 2019 06:10:21 GMT

I'm trying to setup a local user with limited access on a Cisco ASA firewall (5525-X running 9.4.1)

I have alread setup the firewall for the ASA default read-only (level 5) and monitor-only (level 3) User roles.

What I need to do now is to create a new User Role at Level 7.

This user needs to be able to add and remove rules, NATs and objects only.

I have set the below commands to privilege level 7.

CUSTX-HA-FW/pri/act# show run | i level 7
privilege cmd level 7 mode exec command asdm
privilege show level 7 mode exec command object-group
privilege show level 7 mode exec command nat
privilege show level 7 mode configure command object-group
privilege show level 7 mode configure command object
privilege show level 7 mode configure command nat
privilege clear level 7 mode exec command object-group
privilege clear level 7 mode exec command access-list
privilege clear level 7 mode exec command nat
privilege cmd level 7 mode configure command configure
privilege cmd level 7 mode configure command object
privilege cmd level 7 mode configure command object-group
privilege cmd level 7 mode configure command access-list
privilege cmd level 7 mode configure command asdm
privilege cmd level 7 mode configure command nat
privilege clear level 7 mode configure command nat
privilege clear level 7 mode configure command access-list
privilege clear level 7 mode configure command object-group
privilege clear level 7 mode configure command object
privilege cmd level 7 mode network-object-group command network-object
privilege cmd level 7 mode session_network-object-group command network-object

ORIGIN-HA-FW/pri/act# show run username
username test7 password XXXXXX encrypted privilege 7

When I log into the Firewall using a test account it is always in 'read-only' mode so I don't have the 'add' buttons in the configuration panes.

Can anyone point me in the right direction of what I am missing??

Hi Ayub, Try adding following

Rishabh Seth — Wed, 24 Jun 2015 09:32:30 GMT

Hi Ayub,

Try adding following command:

ciscoasa(config)# privilege cmd level 7 command configure

Hope it helps!!!

I did that alread but it's

muhtashim.ayub — Wed, 24 Jun 2015 10:29:28 GMT

I did that alread but it's not helped:

privilege cmd level 7 mode configure command configure
privilege cmd level 7 mode configure command object
privilege cmd level 7 mode configure command object-group
privilege cmd level 7 mode configure command access-list
privilege cmd level 7 mode configure command asdm
privilege cmd level 7 mode configure command nat

For anyone that finds this

muhtashim.ayub — Fri, 18 Dec 2015 09:27:49 GMT

For anyone that finds this thread.

After some further investigation I found that this requirement is not possible on the ASDM.

See this thread:

https://supportforums.cisco.com/discussion/10892336/user-role-editing-access-lists-asdm

topic I did that alread but it's in Network Security

Cisco ASA - User role to add and remove rules, NAT and objects only

Hi Ayub, Try adding following

I did that alread but it's

For anyone that finds this