topic ASA AAA Authentication: adding radius server fails in Network Security

ASA AAA Authentication: adding radius server fails

jcw009 — Mon, 11 Mar 2019 16:36:13 GMT

Hi,

Here's my aaa config:

aaa-server RADIUS1 protocol radius

aaa-server RADIUS1 host 172.30.10.24

key SuperSecretKey

aaa authentication ssh console LOCAL

aaa authentication enable console LOCAL

aaa authorization command LOCAL

http server enable

Whenever I try to add the radius server to ssh console it fails:

asa1(config)# aaa authentication ssh console RADIUS1 LOCAL

Range already exists.

Any hints?

Thanks!

Jeff

Re: ASA AAA Authentication: adding radius server fails

Herbert Baerten — Thu, 05 Nov 2009 07:30:40 GMT

First remove the existing config:

no aaa authentication ssh console LOCAL

Then apply the new config:

aaa authentication ssh console RADIUS1 LOCAL

Re: ASA AAA Authentication: adding radius server fails

jcw009 — Thu, 05 Nov 2009 14:04:22 GMT

If I do this, will it mean that anyone who can be authenticated on the radius server can log into the firewall?

Re: ASA AAA Authentication: adding radius server fails

Herbert Baerten — Thu, 05 Nov 2009 14:15:05 GMT

Yes.

Depending on what Radius server it is, you may or may not be able to configure it to accept/reject the authentication based on some parameters like the ip address of the radius client.

But as far as the ASA is concerned, if the Radius server says it's ok, it lets the user in.

I assumed that that is what you wanted, since you were trying to implement this command?

Re: ASA AAA Authentication: adding radius server fails

jcw009 — Thu, 05 Nov 2009 15:24:50 GMT

I think what I was trying to do was use my radius box like a tacacs box. It doesn't seem like that would work. I'm using Windows 2003 IAS as a radius server to authenticate vpn clients, and don't want anyone who can vpn in login to the firewall. May have to look into setting up a tacas box.

Thanks for your help!

Re: ASA AAA Authentication: adding radius server fails

hdashnau — Thu, 05 Nov 2009 18:25:36 GMT

You could pass back the IETF service-type attribute on the radius server. You can then use this to restrict the access for these users.

Here is what is required for the

radius delivered service-type attribute to be enforced for CLI access:

"aaa authorization exec authentication-server" must be enabled

"aaa authentication enable console " must be enabled.

IETF RADIUS Service-Type attribute must be returned in the

access-accept packet.

Also note, make sure you are using a version of code with the fix for CSCsk89452

If you are using local authentication instead of radius this can also be done with the following commands:

username attributes

service-type <(admin,nas-prompt,remote-access)>

-heather