Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Cisco ASA 5510

We have a Cisco ASA 5510 and it doesn't respond to a loign in the usual manner. When you telnet to it you login with a name and then a password. Then you must type "login" and enter your name and password again to gain full access. I can't figure out how to get NCM to do this. Any tips?

Find more posts tagged with

Accepted answers

rcahill

If you are able to telnet/ssh to the firewall you may only need one ACS Setting change to get to level 15.
In my version 6 and 7 families the following ACS changes were required.

Access ACS
Select the User Setting Button
[List all Users]
Select a test account or your account to validate these settings.
Scroll 3/4 of the way down the user setting to "Advanced TACACS+ Settings"

Under "TACACS+ Enable Password"
Elect the "Use external database password" radio button
Select the "Windows Database" drop down
Press Submit.

Telnet / SSH to the firewall

User: [AD Account]
Password: [AD Password]
>en
Password: [AD Password]
#

Frustrating Notes regrding ACS:
These changes are needed for each user account that access a firewall.
- There may be two accounts for each user (one with the Domain\id, one without)
These settings will need to be updated if someone removes [Dynaminc Users]
These settings will need to be updated post upgrade.

All comments

FormerMember

NCM logs into ours just fine but we use SSH for the login process on the ASA. COuld swear we did it with Telnet before changing to SSH, but I could be mistaken.

rcahill

We are using Cirrus to log into our 5505 and 5520 devices without any problems. Our access is through TACACS and AD authentication. The only issue is with ACS requiring you to enable console passwords to an external database for each firewall user.

So authentication becomes:

User id: AD\User
Password: ADPassword
enable
ADPassword.

Cirrus handles this just fine.

This authentication mechanism is independent of SSH or Telnet.
If you are using ACS, could this be an AAA config. issue? particularly TELNET/SSH LOCAL (Flames are a-coming)

jasonshiffler

I have the same problem and am using TACACS+ to authenticate users. When you SSH into an ASA the enable command doesn't work. (Opened a ticket with Cisco, running 8.0(4). In order to get into enable mode I have to login as a local user. Any ideas?

rcahill

If you are able to telnet/ssh to the firewall you may only need one ACS Setting change to get to level 15.
In my version 6 and 7 families the following ACS changes were required.

Under "TACACS+ Enable Password"
Elect the "Use external database password" radio button
Select the "Windows Database" drop down
Press Submit.

Telnet / SSH to the firewall

User: [AD Account]
Password: [AD Password]
>en
Password: [AD Password]
#

jasonshiffler

You are right on the money. Thanks for the help.