topic ASA- aaa authentication enable console LOCAL in Network Security

ASA- aaa authentication enable console LOCAL

Praveen Kumar — Fri, 21 Feb 2020 15:23:59 GMT

I want configure ASA, so it requires local username and password for enable mode.

Command: aaa authentication enable console LOCAL

When I configure this command, I am not able to login even though the following configuration already exists:

username xxxxxx password xxxxxxxxxxxxxxxxxxx encrypted privilege 15

enable password xxxxxxxxxxxxxxxxxx encrypted

when I configure the following it works:

username xxxxxx password xxxxxxxxxxxxxxxxxxx

aaa authentication enable console LOCAL

Question:

Why “username xxxxxx password xxxxxxxxxxxxxxxxxxx encrypted privilege 15” username and password is not used, when configure aaa authentication enable console LOCAL?

Re: ASA- aaa authentication enable console LOCAL

johnd2310 — Fri, 23 Feb 2018 03:01:00 GMT

Hi,

How are you logging on to the firewall initially, via console or ssh\telnet. What asa software version are you using? Are you using aaa authorization?

Thanks

John

Re: ASA- aaa authentication enable console LOCAL

Praveen Kumar — Fri, 23 Feb 2018 22:24:17 GMT

1. SSH

2. Software Version 9.6(4)3

3. no authorization

Re: ASA- aaa authentication enable console LOCAL

mls577 — Sat, 24 Feb 2018 00:12:33 GMT

@Praveen Kumar wrote:

1. SSH

2. Software Version 9.6(4)3

3. no authorization

If you're using ssh, you'll need to do a couple of things.
1. Create a user. (seems like you have this covered already).

2. Enabled ssh for local authentication:

aaa authentication ssh console LOCAL

3. generate the crypto keys for ssh:

crypto key generate rsa modulus <modulus number>

4. allow management access via ssh from a certain interface and network:

ssh 192.168.1.0 255.255.255.0 inside

5. open your terminal emulation software and try to ssh to an ASA interface ip (the one specified in step 4). You should now be able to login.

Re: ASA- aaa authentication enable console LOCAL

Praveen Kumar — Thu, 01 Mar 2018 21:39:28 GMT

That is not really my question- my question is:

If we already have this (see below) user account, why doesn't it work when we configure "aaa authentication ssh console LOCAL"?

username xxxxxx password xxxxxxxxxxxxxxxxxxx encrypted privilege 15