01-11-2019 07:27 AM - edited 02-21-2020 08:39 AM
Does the aaa commands/configuration copy to standby firewall? I can't seem to get to my secondary ASA.
Message Text | Failed-Attempt: Session Authorization encountered an error |
Failure Reason | 15020 Could not find selected Shell Profiles |
Resolution | Add a shell profile to the result of the rule, or modify the rule condition so that this rule is not selected for session authorisation |
Root Cause | Could not find selected Shell Profiles |
Username | stevenwilliams |
01-11-2019 07:48 AM
hmm..... they should be.
stupid question does your asa configured with active standby ip addresses?
01-11-2019 07:55 AM
01-11-2019 08:50 AM
What ASA code on it?
01-11-2019 10:56 AM
01-11-2019 10:58 AM
curious does the ISE in network devices have a standby ip address of this ASA?
01-11-2019 01:15 PM
01-11-2019 01:24 PM
Run 'test aaa-server authentication ' on the Standby unit and check what the reason for the failure is.
Enable 'debug aaa authentication' on the Standby unit and watch the output when you try to authenticate.
01-11-2019 01:25 PM
01-12-2019 09:17 PM
ISE seems to indicate that the Authorization result is looking for an undefined shell profile.
Does the detail report from ISE Live logs shed any more light?
01-13-2019 07:50 AM
I agree with Marvin here that there is an issue with the ISE authorization profile configuration, however it is a bit strange that you are unable to access the secondary ASA via SSH or HTTPS. Have you tried to power-cycle the standby ASA?
01-14-2019 08:56 AM
01-14-2019 09:04 AM
I agree with @Steven Williams. As he done all from the active ASA to figure out what could be the issue.
thanks for the update.
01-14-2019 09:11 AM
You do know you can check the configuration on the standby ASA from the primary ASA, right?
for example you can issue the following command to se the AAA configuration on the standby
failover exec standby show run aaa
As long as failover is configured correctly I am having a hard time believing there is an issue with the configuration on the standby device. I am leaning towards either a process that is hanging on the standby which will be solved by rebooting the standby device, or an issue with configuration on ISE.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide