topic If I issue the commandno aaa in Network Security

AAA authentication on ASA

Colin Higgins — Tue, 12 Mar 2019 05:12:37 GMT

I am trying to configure an ASA 5545X running 8.3+ to use a tacacs+ server for authentication, but to failover to local authentication if the tacacs+ server is not available.

when I use the command aaa authentication ssh console TACACS+ LOCAL

it tells me "range already exists" and it doesn't take

What is the command for this? Can't seem to find it in documentation

Hi,If you are seeing this

Vibhor Amrodia — Thu, 11 Dec 2014 10:29:31 GMT

Hi,

If you are seeing this prompt , it means that the configuration is already there.

Can you check using this command from the Privilege mode on ASA:-

"show run aaa" and you should see the command in the configuration.

Thanks and Regards,

Vibhor Amrodia

I type the command aaa

Colin Higgins — Thu, 11 Dec 2014 18:44:16 GMT

I type the command

aaa authentication ssh console TACACS+ LOCAL

and it tells me "range already exists"

If I do a show run aaa I get

aaa authentication ssh console TACACS+

no LOCAL.

I should point out that this is an ASA blade for a 6500 switch running 8.5(1)

Hi,Okay , just remove this

Vibhor Amrodia — Fri, 12 Dec 2014 07:28:46 GMT

Hi,

Okay , just remove this command:-

no aaa authentication ssh console TACACS+

and then add the required one:-

aaa authentication ssh console TACACS+ LOCAL

Thanks and Regards,

Vibhor Amrodia

If I issue the commandno aaa

Colin Higgins — Fri, 12 Dec 2014 16:54:15 GMT

If I issue the command

no aaa authentication ssh console TACACS+

while ssh'd into the device, will it lock me out?

Hi,I don't think it should.

Vibhor Amrodia — Sat, 13 Dec 2014 12:37:26 GMT

Hi,

I don't think it should. As the SSH connection is already established on the ASA device.

Still , you can try to add the other command using some other management access like telnet or ASDM if possible.

Thanks and Regards,

Vibhor Amrodia