topic Hi Michael, for me more in Network Security

How do I find the preshared key value on an ASA Firewall?

Mike Keenan — Tue, 12 Mar 2019 04:34:32 GMT

How do I locate the preshared key on an ASA firewall. Specifically, how do I find out what ***** is in the below configuration within my config file on my ASA firewall running 8.4(4)1?

aaa-server xxxxxxx (MGMT) host xxx.xxx.xxx.xxx
timeout 30
key *****

Hi Michael,You could use the

johnlloyd_13 — Mon, 04 Aug 2014 13:23:17 GMT

Hi Michael,

You could use the 'more system:running-config' command.

Please find useful link:

http://ccnpsecuritywannabe.blogspot.com/2014/03/backup-asa-configuration.html?m=0

The "more system: running

Mike Keenan — Mon, 04 Aug 2014 19:31:44 GMT

The "more system: running-config command" only gives me the "Failover Key". The key that I referenced above has something to do with the AAA server group. How do I find this other pre shared key associated with the AAA server group?

I just checked and on mine it

burleyman — Mon, 04 Aug 2014 19:39:47 GMT

I just checked and on mine it gave me the key.

more system:run

no spaces

Mike

Hi Michael, for me more

nkarthikeyan — Tue, 05 Aug 2014 09:03:44 GMT

Hi Michael,

for me more system:running-config gives the key in clear text associated with aaa server group.

ciscoasa# more system:running-config | in key
key unique
ciscoasa# sh runn | in key
key *****
ciscoasa#

You can try one more option... this will give you the desired result.

write net <tftp server>

You need to set the tctp server to do this which will give you all passowrds in clear text.

Regards

Karthik

You most likely have the

Marius Gunnerud — Wed, 06 Aug 2014 12:29:42 GMT

You most likely have the following command enabled:

key config-key password-encryption

you can remove it by using the no version of the command but you will need the "master passphrase" password that was used to create the encryption to be able to decrypt it.

ciscoasa(config)# more system:running-config | in key
key CISCO

ciscoasa(config)# key config-key password-encryption
New key: ********
Confirm key: ********
ciscoasa(config)#
ciscoasa(config)# more system:running-config | in key
key 8 J3z3YkeRt3Ciw/ZIpRu93MGHEMM2

There is no easy way to remove it if you do not have the master key...If you MUST have the aaa key you will need to backup your configuration, issue a write erase, and reload. Then load your configuration again.

Please remember to select a correct answer and rate helpful post