tacacs+ authorization

[adamgibs7]

Dears,

whenever a ISE server fails I am able to login in the switches and firewall but I m not able to change any configuration becz it says me that authorization failed,

so I have to configure the privilege level commands in the switch and firewall also for successful authorization , If so then what is the use of ISE working as central place of authentication & authorization

Thanks

[Francesco Molino]

The config looks like ok but we need to troubleshoot when you've the issue.
Let me know when we can TS your issue in PM. We can do a webex.

[adamgibs7]

Dear Francesco

I'm in the country with time zone GMT +4, I can arrange according to your timezone, can i know your time zone and are you working for Cisco TAC, i have case opened for the EAP chaining and the TAC is not able to solve since one month has passed, if you are in Cisco TAC i can provide you the case number.

thanks

[Francesco Molino]

I'm not working for Cisco TAC.
I'm also within the same timezone (EST). If you're available this WE, send me a PM and we will do a webex.

[adamgibs7]

Dears

WebEx will not be possible in EST time hence I don't have full access to the devices, but instead you can instruct me for the future actions that I can be carried out by me,

so you are confirming that with ASA I shld not fall into the case that when the ISE is not reachable and when I m trying to do any changes on the ASA it shld not prompt me with an authorization failed error.

thanks

[Francesco Molino]

Here the config I would do for ASA:

aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ (INSIDE) host 1.1.1.
!
aaa authentication ssh console TACACS+ LOCAL
aaa authentication http console TACACS+ LOCAL
aaa authentication serial console TACACS+ LOCAL --> Do you want serial connections being allowed through tacacs+?
aaa authentication secure-http-client
aaa authentication enable console TACACS+ LOCAL
!
aaa authorization exec authentication-server auto-enable --> is ASA 9.2(1) and above
aaa authorization http console TACACS+ --> If ASA 9.4 and above because since them exec is separated for ASDM from other types of connections.
aaa authorization command TACACS+ LOCAL
aaa accounting ssh console TACACS+
aaa accounting command privilege 15 TACACS+
aaa local authentication attempts max-fail 5
aaa authentication login-history

This config should work and not giving you any authorization failure when ISE is down/not reachable.