Filter
Top Products
16-24
Cisco ASDM User Guide
OL-16647-01
Chapter 16 Configuring Management Access
Configuring AAA for System Administrators
About Preserving User Credentials
When a user logs into the security appliance, they are required to provide a username and password for
authentication. The security appliance retains these session credentials in case further authentication is
needed later in the session.
When the following configurations are in place, a user needs only to authenticate with the local server
upon login. Subsequent serial authorization uses the saved credentials. The user is also prompted for the
privilege level 15 password. When exiting privileged mode, the user is authenticated again. User
credentials are not retained in privileged mode.
• Local server is configured to authenticate user access.
• Privilege level 15 command access is configured to require a password.
• User’s account is configured for serial only authorization (no access to console or ASDM).
• User’s account is configured for privilege level 15 command access.
The following table shows how credentials are used in this case by the security appliance.
Security Contexts and Command Authorization
The following are important points to consider when implementing command authorization with
multiple security contexts:
• AAA settings are discrete per context, not shared between contexts.
When configuring command authorization, you must configure each security context separately.
This provides you the opportunity to enforce different command authorizations for different security
contexts.
When switching between security contexts, administrators should be aware that the commands
permitted for the username specified when they login may be different in the new context session or
that command authorization may not be configured at all in the new context. Failure to understand
that command authorizations may differ between security contexts could confuse an administrator.
This behavior is further complicated by the next point.
• New context sessions started with the changeto command always use the default “enable_15”
username as the administrator identity, regardless of what username was used in the previous context
session. This behavior can lead to confusion if command authorization is not configured for the
enable_15 user or if authorizations are different for the enable_15 user than for the user in the
previous context session.
This behavior also affects command accounting, which is useful only if you can accurately associate
each command that is issued with a particular administrator. Because all administrators with
permission to use the changeto command can use the enable_15 username in other contexts,
Credentials required
Username and
Password
Authentication
Serial
Authorization
Privileged Mode
Command
Authorization
Privileged
Mode Exit
Authorization
UsernameYesNoNoYes
Password Yes No No Yes
Privileged Mode
Password
No No Yes No