I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured with privilege level 15. I can login with this user, but I can issue no command, the ASA sends the request to the TACACS server which for sure does not know the username.
aaa-server TACACS protocol tacacs+ aaa-server TACACS (interface-oob) host xx.xx.xx.xx timeout 5 key ***** aaa-server TACACS (interface-oob) host xx.xx.xx.xx timeout 5 key ***** ! aaa authentication serial console LOCAL aaa authentication enable console LOCAL aaa authentication ssh console TACACS LOCAL aaa authentication http console TACACS LOCAL aaa authorization command TACACS LOCAL aaa authorization exec authentication-server auto-enable ! username fallbackadm password xxxxxxxxx encrypted privilege 15 username fallbackadm attributes group-lock value NOACCESS service-type admin
In Cisco IOS I would just swap both parameters of the aaa authorization command line, but that does not work on ASA, LOCAL has to be last one.
How can I achieve a local fallback user, which can be used to login and work on the CLI even when TACACS server is reachable?