/fdata%2F4342478%2Favatar-blog-1220564847-tmpphp5wM7ph.png){kind=avatar}
How to Configure AAA Authentication on Cisco ASA Firewall
AAA stands for Authentication, Authorization, and Accounting. AAA is a mechanism that is used to tell the firewall appliance who the user is (Authentication), what actions the user is authorized to perform on the network (Authorization), and what the user did on the network after connecting (Accounting). In this post we will focus on the first element of AAA (that is Authentication).
Types of Authentication supported on ASA appliances
Three types of Authentication are available for Cisco ASA firewalls:
1. User Authentication for accessing the security appliance itself.
2. User Authentication for accessing services through the security appliance. This is also called “cut-through proxy” and is used to authenticate users for accessing Telnet, FTP, HTTP, and HTTPs services located in the network through the firewall.
3. User Authentication for VPN tunnel access (IPsec or SSL VPN).
We will see a configuration example for the first type (authentication for accessing the security appliance for management using Serial Console, SSH, and Telnet access).
Authentication configuration example
In this example we assume that we have already installed and configured a AAA server (e.g Cisco ACS) running the TACACS+ authentication protocol. On the AAA server, we have configured a username/password account that the firewall administrators will use to authenticate. Assume also that the AAA server is located on our internal LAN network with address 10.1.1.1
Referring to the figure above, the firewall administrator (Admin) requests firewall access (serial console, SSH, or Telnet) (Arrow 1) for managing the appliance. The ASA firewall (Arrow 2) will request Authentication permission from the AAA server in order to prompt the admin user for Username/Password credentials. After the Admin successfully enters his credentials, the AAA server will give the permission to the Firewall to allow the user in.
Here is the configuration below:
! Specify a AAA server name (NY_AAA) and which protocol to use (Radius or TACACS+)
ASA(config)# aaa-server NY_AAA protocol tacacs+
! Designate the Authentication server IP address and the authentication secret key
ASA(config)# aaa-server NY_AAA (inside) host 10.1.1.1
ASA(config-aaa-server-host)# key secretauthkey
! Enable Authentication for management access
ASA(config)# aaa authentication serial console NY_AAA LOCAL
ASA(config)# aaa authentication telnet console NY_AAA LOCAL
ASA(config)# aaa authentication ssh console NY_AAA LOCAL
The “LOCAL” keyword at the end designates the use of the local firewall username database for authentication in case the AAA server authentication is not available (e.g AAA server is down).
Of course, to complete the scenario above, you need to properly configure the AAA Server with the internal IP address of the ASA firewall and the same authentication key (e.gsecretauthkey) as the one you configured on the ASA above.
---Article reference from http://www.tech21century.com/configuring-aaa-authentication-on-cisco-asa-firewall/
More…
Site-to-Site IPSEC VPN between Two Cisco ASA 5520
Configuring Static NAT on a Cisco ASA Security Appliance
EIGRP on a Cisco ASA Firewall Configuration
How to Set up a Cisco ASA 5505 Firewall with a Wireless Router?
/image%2F1490247%2F20190117%2Fob_9629a3_new-cisco-9000-family-members.png)
/image%2F1490247%2F20181221%2Fob_c62717_explore-the-nexus-400g-portfolio.png)
/image%2F1490247%2F20181127%2Fob_43ede7_cisco-catalyst-9800-series-wlc.jpg)
/image%2F1490247%2F20181026%2Fob_214c75_cisco-ie-series-switches.png)
