I'm wanting to limit login access to my ASA5515 by changing the priv level for LOCAL user accts Quoting Cisco: If you do not use command authorization (the aaa authorization console LOCAL command), then the default level 2 allows management access to privileged EXEC mode. If you want to limit access to privileged EXEC mode, either set the privilege level to 0 or 1, or use the service-type command. So I add a user to LOCAL database username MyUser password cisco privilege 0 And I have AAA to LOCAL aaa authentication ssh console LOCAL aaa authentication http console LOCAL aaa authentication serial console LOCAL When I SSH to ASA I can login as MyUser Granted MyUser still has to know enable password, but why wasn't MyUser denied login? ASA5515 v9.4(3)12 What did I miss in this? Thanks ... View more

         Could I get a validation that this config is correct in that it allows inbound access to the web server and that I should be able to ping it from my inside interface. I tried to use the example code from Cisco DocID: 115904 for DMZ WebServer, but I found the object NAT parts did not work with my 8.6 IOS so I modified them as shown in my config. Example from 115904 doc. !!!! object network WebServerPublic host 24.25.26.80 object network WebServerPrivate host 192.168.1.80 nat(dmz,outside) static WebServerPublic service tcp www www ---> this does not code !!!! With the below code I do not get a ping reply sourcing from a 10.1.0.X host to 192.168.1.80 web server. And I cannot browse in from the outside to it either. I do see the MAC for 192.168.1.80 in the ASA's arp cache for the dmz interface. The web server is on a VMware ESX environment and I'm not sure it is set up correctly. ! ASA Version 8.6(1)2 ! hostname A5515 ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 24.25.26.254 255.255.255.240 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.1.0.252 255.255.240.0 ! interface GigabitEthernet0/2 nameif dmz security-level 50 ip address 192.168.1.254 255.255.255.0 ! object network N_OBJ_10.1.0.0_20 subnet 10.1.0.0 255.255.240.0 object network N_OBJ_10.24.0.0_18 subnet 10.24.0.0 255.255.192.0 object network DNSServer host 10.24.0.86 object network WebServerPrivate host 192.168.1.80 object network WebServerPublic host 24.25.26.246 object network N_OBJ_DMZ_24 subnet 192.168.1.0 255.255.255.0 ! object-group network CampusNetworks network-object 10.1.0.0 255.255.240.0 network-object 10.24.0.0 255.255.192.0 ! access-list outside_access_in extended permit tcp any object WebServerPrivate eq https access-list outside_access_in extended permit tcp any object WebServerPrivate eq www ! access-list dmz_access_in extended permit icmp object WebServerPrivate object-group CampusNetworks echo-reply access-list dmz_access_in extended permit icmp object WebServerPrivate object-group CampusNetworks unreachable access-list dmz_access_in extended permit icmp object WebServerPrivate object-group CampusNetworks time-exceeded access-list dmz_access_in extended permit udp any object DNSServer eq domain access-list dmz_access_in extended deny ip any object-group CampusNetworks access-list dmz_access_in extended permit ip any any ! nat (dmz,outside) source dynamic N_OBJ_DMZ_24 interface nat (dmz,outside) source static WebServerPrivate WebServerPublic nat (inside,dmz) source static CampusNetworks CampusNetworks ! nat (inside,outside) after-auto source dynamic CampusNetworks interface ! access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz ! route outside 0.0.0.0 0.0.0.0 24.25.26.241 1 route inside 10.24.0.0 255.255.192.0 10.1.0.254 1 ! Thanks ... View more