Firepower Shell authentication with radius

[parmsing1]

Hi All,

We are planning to implement firepower ssh login through radius server.

Currently we have SSH configured for the firepower module on ASA and we are able to login using admin account, If we configured system profile in firresight. we are still not able to login to firepower module via ssh using radius credentials, however, local "admin" account is working and we are able to login.

Please advice,

Thanks

[Tim Verscheure · Accepted solution]

To get this working, please ensure the following is configured:

1. Create External Authentication Object for the Radius server. (System > Users > external authentication). Fill in the required radius server details. IMPORTANT: configure "Administrator Shell Access User List" with the usernames that need shell access. Without it, I could not get it to work.

2. In your system policy, enable this radius server entry for external authentication. do not forget to deploy again after your change.

3. On your radius server, configure authorization to return a radius ACCESS_ACCEPT and "Administrator" class. On Cisco ISE this is using the "ASA VPN" part in the "common tasks" section of the authZ profile.

Good luck.

Tested and verified on SFR 6.1

[NeverOutofTune]

"3. On your radius server, configure authorization to return a radius ACCESS_ACCEPT and "Administrator" class. On Cisco ISE this is using the "ASA VPN" part in the "common tasks" section of the authZ profile."

Has anyone have this working on a Microsoft NPS 2012 that could share the configuration of the NPS portion?