Hello All,
I am haveing some truble with my ASA getting authentication from one of my Tacacs Servers. I have two diffrent ethernet handofs to two diffrent Routers of the ASA that are getting the Tacacs Authenticatrion. One is on the DMZ interface and the other is on the Inside. However I am not able to get the ASA to authenticate against the Tacacs server
Here is what I have so far:
ASA Version 9.1(2)
!
hostname ASA1
enable password Ev0iTru97MKu8IiT encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 10.250.0.1 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/1
nameif DMZ
security-level 75
ip address 10.250.0.5 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
nameif outside
security-level 0
ip address dhcp setroute
!
ftp mode passive
object-group service DM_INLINE_TCP_2 tcp
port-object eq ssh
port-object eq telnet
access-list inside_access_in extended permit ip any4 any4
access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2
access-list DMZ_access_in extended permit ip any4 any4
access-list global_access extended permit ip any4 any4
pager lines 24
logging enable
logging buffered informational
mtu inside 1500
mtu DMZ 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (DMZ,outside) source dynamic any interface
nat (inside,outside) source dynamic any interface
access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ
access-group global_access global
!
router eigrp 99
no auto-summary
eigrp router-id 10.250.0.5
network 10.250.0.0 255.255.255.252
network 10.250.0.4 255.255.255.252
passive-interface default
no passive-interface inside
no passive-interface DMZ
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BiHTac protocol tacacs+
accounting-mode simultaneous
aaa-server BiHTac (DMZ) host 10.250.100.142 >>>>>>>>>>>>>>>> Tacacs Server
key ********
user-identity default-domain LOCAL
aaa authentication http console BiHTac LOCAL
aaa authentication ssh console BiHTac LOCAL
aaa authentication enable console BiHTac LOCAL
aaa authentication serial console BiHTac LOCAL
aaa authentication telnet console BiHTac LOCAL
aaa authorization command BiHTac LOCAL
http server enable
http 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
http 10.250.0.6 255.255.255.255 DMZ
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
ssh 10.250.0.6 255.255.255.255 DMZ
ssh timeout 20
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http
https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email
callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05
: end ASA Version 9.1(2)
!
hostname ASA1
enable password Ev0iTru97MKu8IiT encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 10.250.0.1 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/1
nameif DMZ
security-level 75
ip address 10.250.0.5 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
nameif outside
security-level 0
ip address dhcp setroute
!
ftp mode passive
object-group service DM_INLINE_TCP_2 tcp
port-object eq ssh
port-object eq telnet
access-list inside_access_in extended permit ip any4 any4
access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2
access-list DMZ_access_in extended permit ip any4 any4
access-list global_access extended permit ip any4 any4
pager lines 24
logging enable
logging buffered informational
mtu inside 1500
mtu DMZ 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (DMZ,outside) source dynamic any interface
nat (inside,outside) source dynamic any interface
access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ
access-group global_access global
!
router eigrp 99
no auto-summary
eigrp router-id 10.250.0.5
network 10.250.0.0 255.255.255.252
network 10.250.0.4 255.255.255.252
passive-interface default
no passive-interface inside
no passive-interface DMZ
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BiHTac protocol tacacs+
accounting-mode simultaneous
aaa-server BiHTac (DMZ) host 10.250.100.142 >>>>>>>>>>>>>>>> Tacacs Server
key ********
user-identity default-domain LOCAL
aaa authentication http console BiHTac LOCAL
aaa authentication ssh console BiHTac LOCAL
aaa authentication enable console BiHTac LOCAL
aaa authentication serial console BiHTac LOCAL
aaa authentication telnet console BiHTac LOCAL
aaa authorization command BiHTac LOCAL
http server enable
http 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
http 10.250.0.6 255.255.255.255 DMZ
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
ssh 10.250.0.6 255.255.255.255 DMZ
ssh timeout 20
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05
: end
I am not quite sure how the router on the (INSIDE) interface is able to get Tacacs Authentication and the ASA itself is not. I have followed the exact steps that I found on cisco.com for tacacs authentication
Any help is greatly appreciated
Thanks
Zipp
