Cisco ACS for ASA Firewalls with multiple contexts.

[BrunoLopes]

Hi Guys, I'm new here.

So, I Hope you can help with this doubt.

I would like to know if it is possible to configure Cisco ACS for ASA Firewalls (5585) with access segregation / access level for each context in the firewall.

For example:
User Operator, can access context 1, but is cannot allowed to change the ACL-List, in Context 2 it could change the acl-list.

is it possible to configure ACS to segregate context access?

[Francesco Molino]

Hi

You have to define aaa into each context which means you would be able to do separate rules on ACS to define different policies per context.
Source IP of the ASA context reaching tacacs server are different per context and based on this information, you can have different policies like you wanted.

[BrunoLopes]

Hi Francesco, thank you very much for the idea, I'm going to work on this tomorrow and I'll let you know if it worked.

[BrunoLopes]

Good afternoon Francesco, We noticed that when User Operator uses the changeto command to access another context it gets privileged access (same as the admin context), in this case you said it would work if the SSH function was enabled in the contexts and the Changeto command locked in the Context Admin. Any other ideas?

[Francesco Molino]

Sorry for my late answer, lot of work these past days.

I'll need to do some testing to see what other solution can for your requirements.