Enable password on ASA 5516 version 9.5

[Lakeram Harrypersaud]

Hi Guys,

Is it possible to have a second enable password on a Cisco ASA5516 firewall running version 9.5? If so, please provide me with the commands to do it on the CLI?

Any help would be greatly appreciated.

Thanks,

Lake

[Maykol Rojas]

Hello;

What do you mean by a second enable password? What would be the use of that? Would that be for another user? 

Mike. 

[Lakeram Harrypersaud]

It is for another user? Is it possible to do that?

Thanks,

Lake

[Maykol Rojas]

Hello; 

Not other enable password, but you can create a user and password and that would get him directly to the enable mode. 

The bad thing with this is that all users with Privilege 15 will have full access to the device without the use of enable password. 

Let me know if that suits the need. 

Mike. 

[Lakeram Harrypersaud]

Can you please provide me with the command to give a second user access to the asa console without the enable password?

Thanks,

Lake

[Maykol Rojas · Accepted solution]

Hello; 

Here it is: 

aaa authentication ssh console LOCAL
aaa authorization exec authentication-server auto-enable

VERY IMPORTANT!!!! This is for users trying to access SSH and being authenticated against the local database. You need to understand that any other user with Priv 15 user will be automatically allowed to enable mode. 

You can modify the above commands to suit your needs, example for telnet, console or using your authentication server. 

If you have any questions, let me know 

Mike. 

[Lakeram Harrypersaud]

Hi Maykol,

It worked like a charm. Thank you very much.

Regards,

Lake

[Maykol Rojas]

Awesome. 

Glad that it worked. 

If you have any other questions, let me know. 

Mike.