topic unable to go to enable mode of ASA via console in Network Security

unable to go to enable mode of ASA via console

mahesh18 — Tue, 12 Mar 2019 03:49:45 GMT

Hi everyone,

I can login to ASA fine via ssh.

When i console in it straight away gives me prompt

asa>

now when i press en

it ask for username and password but does not take it what i type.

Need to confirm

aaa authentication enable console DCNetwork LOCAL************************************is this enablle password config of ASA?

aaa authentication serial console LOCAL****************************console connection authen of asa?

i try to change the enable password via command

enable password but still no luck

Regards

MAhesh

unable to go to enable mode of ASA via console

Richard Burts — Mon, 24 Feb 2014 21:31:58 GMT

Mahesh

Can you tell us what is the reference to DCNetwork in the aaa authentication command? It looks like it might be a reference to some authentication server (Radius or something). In that case it will attempt to authenticate enable access using that authentication server - which would be consistent with getting a prompt for username and password when you enter the enable command.

My guess is that when you use the command to change the enable password that you are indeed changing the configured password on the ASA but that it is using the authentication server to authenticate enable access.

HTH

Rick

unable to go to enable mode of ASA via console

mahesh18 — Mon, 24 Feb 2014 22:10:46 GMT

Hi Rick,

DCNetwork in the aaa authentication command refer to the authen server radius.

When i remove the command --aaa authentication serial console LOCAL

then when i console in it take me straight to hostname and propmt and when i enter en then it ask me for username and

password and thats the radius authen that it uses.

So you are right in this case enable access uses the radius auth server.

so my question remains if i config the command

aaa authentication serial console LOCAL

then if i console in and want to use the enable password i need to change

aaa authentication enable console DCNetwork LOCAL to

aaa authentication enable console LOCAL ???????

This change will not impact ssh access for enable pasword right?

Regards

MAhesh

unable to go to enable mode of ASA via console

John Blakley — Tue, 25 Feb 2014 03:19:43 GMT

Mahesh,

Rick seems to have hit the nail on the head. The aaa authentication that you're using is trying to authenticate against the backend radius server for you to be able to use the enable prompt.

Personally, if you want to just use the local enable password, you can remove the aaa authentication enable line altogether and use the local enable password on the appliance. Make sure that you have one "enable password " before removing your aaa authentication. If you don't have any reference to "aaa authentication enable", all logins - telnet, ssh, serial - will use the local enable password.

HTH,
John

*** Please rate all useful posts ***

unable to go to enable mode of ASA via console

mahesh18 — Tue, 25 Feb 2014 04:22:08 GMT

Hi Rick & John,

I got it now.Took little longer to understand but ok now.

Best regards

Mahesh

unable to go to enable mode of ASA via console

prakashpunio — Tue, 25 Feb 2014 05:19:48 GMT

Can you provied me your total sh run file so may i can helo you that where is problem

you need to remove AAA or acl base AAA from console as well form vty mode