Why "enable password" is different when I log onto ASA using telnet ?

[eigrpy]

Hi

The configuraiton in the ASA is as below:

aaa authentication enable console TACATS LOCAL
aaa authentication telnet console LOCAL 
username cisco password cisco
telnet 0.0.0.0 0.0.0.0 inside

Do you think the enable password is different when I use SSH or telnet to log onto the ASA? Both ssh and telnet can log onto the asa, and it can pass  enable password(tacacs server password and username), but enable password fail if i use telnet log onto the ASA

[Richard Bradfield]

Hi,

this is my config, which works ok  I need a local enable password for telnet/ssh

aaa authentication http console TACACS+ LOCAL
aaa authentication telnet console TACACS+ LOCAL
aaa authentication ssh console TACACS+ LOCAL

enable password .qlnV1D9xc02BByd encrypted

HTH

Richard

[Vibhor Amrodia]

Hi,

With this configuration , the Username/Password to login to the SSH.TElnet will be the TACACS credentials.

Enabled password would be the one that you have configured locally.

Thanks and Regards,

Vibhor Amrodia

[eigrpy]

After telnet log onto the ASA, it seems telnet requires the enable password which is different with ssh' enable password. Do you agree ? Thanks

[Vibhor Amrodia]

Hi,

No , The enable password would be the same for both as that is a global password to move into the Enable mode.

Thanks and Regards,

Vibhor Amrodia

[eigrpy]

Thanks for your reply. I think you are right. 

Now, It is very strange regarding the command "aaa authentication enable console TACACS LOCAL", When I am using the command, ssh can pass enable password, but telnet cannot pass enable password. Then I remove TACACS from the command, the situation is reverse: telnet canpass enable password, and ssh cannot pass enable password. What is wrong ? 

Here is full config:

aaa authentication ssh console TACACS LOCAL
aaa authentication telnet console LOCAL 
aaa authentication enable console TACACS LOCAL 
aaa accounting enable console TACACS
aaa accounting ssh console TACACS

[eigrpy]

I got it. After I add TACACS to command aaa authentication telnet console LOCAL, it can work. but i do not know the reason.

[Vibhor Amrodia · Accepted solution]

Hi,

Let me try to clarify things here:-

aaa authentication ssh console TACACS LOCAL
aaa authentication telnet console LOCAL 
aaa authentication enable console TACACS LOCAL 

These commands are only to instruct the ASA device to tell the ASA where to look for the Username/Password information.

Now , as a test , try this:-

Create same username/Password in TACACS server and on the ASA LOCAL database.

Configure these commands:-

aaa authentication ssh console TACACS LOCAL
aaa authentication telnet console TACACS LOCAL 
aaa authentication enable console TACACS LOCAL 

Now , try to check if both of them works or not ?

The problem which you might be seeing was that the TACACS and LOCAL database would be having different Username/Password combinations.

Thanks and Regards,

Vibhor Amrodia

[eigrpy]

Thank you so much. You might not have seen my updated last post. I got the same as you suggested. 

aaa authentication ssh console TACACS LOCAL
aaa authentication telnet console TACACS LOCAL 
aaa authentication enable console TACACS LOCAL 

These can work well. Thank you