TACACS+ configuration for Cisco ASA

[siva_mps]

I tired configuring TACACS+ configuration for ASA but unable to complete it. I have ACS 3.3 for all other Cisco Routers and Switches

[francisco_1]

see this http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807349e7.shtml#configure-server

[Tshi M]

Please see below:

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ host x.x.x.x

key test

aaa authentication ssh console TACACS+

aaa authentication enable console TACACS+

aaa authentication http console TACACS+

[dphills18]

Is there some type of access list that needs to be inserted or something. I can't get this to work. It should be that difficult. I keep getting "Password authentication failed."

[Richard Burts]

Dwayne

There is not an access list that is required to authenticate from the ASA. Perhaps we could find your problem if you would post your configuration.

HTH

Rick

[dphills18]

Hey Rick, thanks. I finally figured out what was going on. We use RSA tokens for authentication. It would allow me to log into the ASA, however, when I would try to log into the enable mode, I would have complications.

What I learned as that I needed to wait for the key on the RSA token to change to the next code and use that. The ASA will not let me use the same code to log into enable mode.

Does anyone know if this feature can be bypassed to where I can use the same token key code for both prompts?

Dwayne

[Richard Burts]

Dwayne

I am glad that you have figured out what the issue is. I believe that it is a fundamental concept of RSA tokens that you can only use a token once. Any attempt to authenticate a second time with the same token will be rejected.

So authenticate once (with the first token) and then wait till the new token is generated before you attempt to authenticate to enable mode.

HTH

Rick

[ysantizo1]

Hi Everyone

Does anyone know why the tacacts key appears in plain text?

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ host x.x.x.x

key "test"<---------------------

Is it possible to hide it?

I'm using asa 8.0(4)

Thanks in advance.

Best regards

[Daniel Laden]

Unlike a router or switch, you cannot go straight to enable mode on an ASA.  You will need to authenticate twice.

[oscarpirez]

Hello,

do you know if there is any cisco official document where clarify this point?

I need the document to show my customer that it is not possible at the moment.

Thanks and regards,

Oscar Pirez

opirez@satec.es

[Jagdeep Gambhir]

Oscar,

If you want to know about logging to enable mode directly then here is the link,

http://www.ciscotaccc.com/kaidara-advisor/security/showcase?case=K25224726

Regards,

~JG

Do rate helpful posts

[oscarpirez]

Hello Jagdeep,

thank you very much for the info.

Regards,

Oscar

[oscarpirez]

Sorry,

is this valid for ASA 8.0 as well?

regards,

Oscar

[Jagdeep Gambhir]

Yes.

Regards,

~JG

Do rate helpful posts

[leo_zidane]

Hi all,

I am unable to login into ASA ADSM through RSA tokens but SSH can. What setting do i miss out?

Thanks