ASDM (ASA9.1) won't fully initiated when configured AAA command authorization

[a12288]

ASA doesn't have any local account, all authentications is done via AAA.

On AAA, we have two "groups" both assigned to privilege_15, one group (A) can issue all commands, another group (B) only can issue command sets we defined.

Group A can login to ASDM without any problems.

Group B can pass the login pop up, then start to load ASDM window, at the bottom it does show login user has privilede 15, then it's stopped at "parsing running configuration..." asd login screen pops up again, and I cannot pass it.

I suspect it's somewhere in permisssion, can someone help? thanks.

Leo Song

[Julio Carvajal]

Hello,

There are some commands that are required in order to load the ASDM

privilege show level 3 mode exec command logging

privilege show level 3 mode exec command blocks

Make sure you have them

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[a12288]

I dived into the AAA log, and found out I need to add this into AAA comand_set:

CmdSet=[ CmdAV=read ]

But command 'read' is not even in ASA CLI or documentation, does anyone know what it is for?

Leo Song