I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured with privilege level 15. I can login with this user, but I can issue no command, the ASA sends the request to the TACACS server which for sure does not know the username.

ASA configuration:

aaa-server TACACS protocol tacacs+
aaa-server TACACS (interface-oob) host xx.xx.xx.xx
 timeout 5
 key *****
aaa-server TACACS (interface-oob) host xx.xx.xx.xx
 timeout 5
 key *****
aaa authentication serial console LOCAL 
aaa authentication enable console LOCAL 
aaa authentication ssh console TACACS LOCAL
aaa authentication http console TACACS LOCAL
aaa authorization command TACACS LOCAL
aaa authorization exec authentication-server auto-enable
username fallbackadm password xxxxxxxxx encrypted privilege 15
username fallbackadm attributes
 group-lock value NOACCESS
 service-type admin

In Cisco IOS I would just swap both parameters of the aaa authorization command line, but that does not work on ASA, LOCAL has to be last one.

How can I achieve a local fallback user, which can be used to login and work on the CLI even when TACACS server is reachable?

  • AFAIK you can't, i.e. the fallback method (LOCAL) is only invoked when the Tacacs servers are unreachable (and I'm surprised you say this is possible on IOS). And when you say you can log in with this user, you mean on the console, right? Not via ssh or http? – hertitu Sep 30 '16 at 19:13
  • TACACS server which for sure does not know the username => well why not create that user on the Tacacs server then? – hertitu Sep 30 '16 at 19:14
  • Thank you for your thoughts! Sorry I did not come back for this question earlier. In IOS you can out the local keyword in front of any AAA groups, which the ASA does not allow. Putting the user to tacacs may not ne the best option, as certain devices throughout the topology need to have different passwords... but still that is at least a possibility. – waza-ari Oct 29 '16 at 19:32
  • But on IOS if you put LOCAL first then it will never go to TACACS, so I think that's why ASA doesn't allow it, because it doesn't make sense... – hertitu Oct 29 '16 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.