FMC external authentication for CLI access to managed devices.

[revenant]

Hi all, I need some confirmation or experience sharing regarding FMC external authentication for CLI access to managed devices.

It seems that starting from FTD 7.x the only way to get this working is to specify the list of users for CLI access in FMC under Configuration -> Users -> given External Authentication Object -> CLI Access Filter. 

In the past, I was able to get this working be returning Radius AV pair Service-Type = 6. I still have some FTD 6.6.x devices in the LAB and indeed it is working without specifying anything in the FMC. 

I just want to double check with the community if this is by design or I missed something in the documentation.

Honestly this is weird and it completely beats the principle of single point of policy definition (AAA server). 

Thank you.

[Marvin Rhoads]

Yes - you must create the accounts in FMC and designate them as having external authentication.

[Eric R. Jones]

Interesting, that's the only way we got it to work. We started on 6.6.X and without the local usernames it failed.