I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured with privilege level 15. I can login with this user, but I can issue no command, the ASA sends the request to the TACACS server which for sure does not know the username.

ASA configuration:

aaa-server TACACS protocol tacacs+
aaa-server TACACS (interface-oob) host xx.xx.xx.xx
 timeout 5
 key *****
aaa-server TACACS (interface-oob) host xx.xx.xx.xx
 timeout 5
 key *****
aaa authentication serial console LOCAL 
aaa authentication enable console LOCAL 
aaa authentication ssh console TACACS LOCAL
aaa authentication http console TACACS LOCAL
aaa authorization command TACACS LOCAL
aaa authorization exec authentication-server auto-enable
username fallbackadm password xxxxxxxxx encrypted privilege 15
username fallbackadm attributes
 group-lock value NOACCESS
 service-type admin

In Cisco IOS I would just swap both parameters of the aaa authorization command line, but that does not work on ASA, LOCAL has to be last one.

How can I achieve a local fallback user, which can be used to login and work on the CLI even when TACACS server is reachable?

  • 1
    AFAIK you can't, i.e. the fallback method (LOCAL) is only invoked when the Tacacs servers are unreachable (and I'm surprised you say this is possible on IOS). And when you say you can log in with this user, you mean on the console, right? Not via ssh or http?
    – hertitu
    Commented Sep 30, 2016 at 19:13
  • 2
    TACACS server which for sure does not know the username => well why not create that user on the Tacacs server then?
    – hertitu
    Commented Sep 30, 2016 at 19:14
  • Thank you for your thoughts! Sorry I did not come back for this question earlier. In IOS you can out the local keyword in front of any AAA groups, which the ASA does not allow. Putting the user to tacacs may not ne the best option, as certain devices throughout the topology need to have different passwords... but still that is at least a possibility.
    – Daniel
    Commented Oct 29, 2016 at 19:32
  • 1
    But on IOS if you put LOCAL first then it will never go to TACACS, so I think that's why ASA doesn't allow it, because it doesn't make sense...
    – hertitu
    Commented Oct 29, 2016 at 22:43
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Nov 19, 2022 at 21:47

1 Answer 1


On the ASA platform, each "A" in AAA is processed independently. Furthermore, each entry method for authentication is processed independently. So, you have TACACS setup for SSH and ASDM, but Local setup for Serial, and nothing set for Telnet. Now, once you're on the system, each command you type will be filtered according to Command Authorization. Regardless of how you authenticated (Local via Serial, or TACACS via SSH), commands will be sent to the TACACS server for approval before being executed. This is how you are hitting this problem.

The simple answer to How can I have a fallback user when TACACS is up? is You can't. By definition, fallback is for when a certain method isn't functional.

What you can do, however, if you feel like poking your eyes out, is to setup a lower privilege level in TACACS that contains all the permissions. This will cause you to have multiple aaa authorization levels. Then, if the local user logs in and goes to priv 15, you can forego command authorization; while if an SSH user escalates to, for example, level 14, then require command authorization. Warning: this solution sounds like something they would put on a CCIE exam. This may leave you with only one eye and less hair than currently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.