FWSM, SSH and AAA authentication

So, here's the aaa setup on this firewall services module;

firewall# sho aaa
aaa authentication ssh console <tag>
aaa authentication enable console <tag>
firewall# sho aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server <tag> protocol tacacs+
aaa-server <tag> (inside) host <ip> <tag> timeout 5
aaa-server <tag> (inside) host <ip> <tag> timeout 5

That setup allows me to use SSH to access the FWSM under normal
operations. Normal being that the TACACS servers are up and operation.
Well, what about abnormal? Abnormal would be when the TACACS servers
are down and under those circumstances it seems I am *NOT* able to
loging via SSH. Since there is no username to authenticate and no
method to authenticate too other than local - would that mean that if
I have disabled all other forms of access - in this case I would be S
O L on access until the TACACS servers were available again?

There was some speculation that I could use "pix" as the username and
then the enable password as the password but that did not with either.

I'm just trying to plan for emergencies, bear in mind that in this
scenario I can still "telnet" in via the switch that the FWSM is in
via the "session" command. I was hoping to lock that down a bit as
well though.

Let me know what your experience is,

The Mikester

 

Try pix as username and the enable password for password.

 

That does not work (Tried that with our TAC Engineer).

 

Try pix and the telnet or VTY 0 4 level password.

Regards Gog

 

In regards to you getting locked out when the AAA server goes down, it's because you do not currently have your device setup to use the local username/password on your FWSM as a backup (should the FWSM lose connectivity to the AAA server).

Try this:

aaa authentication ssh console <tag> LOCAL
aaa authentication enable console <tag> LOCAL

Add the "LOCAL" (case sensitive) to the end of your "aaa authentication" commands and see if your "pix" username works. For my setup, I have to use the same password I use for user mode as I do for privileged mode. I'm not sure if your setup will function the same way or if it will require the enable password also.