After recycling an old M3 3650 IBM X Series server the other week, I was stuck trying to get into the IMM, because no one knew what the password was.
The default username of USERID and password of PASSW0RD (with a zero) didn’t work either.
Solution
For me it was OK because I could reboot the server and get directly into the BIOS , (Press F1 at boot)
System settings.
Integrated Management Module.
Reset IMM to defaults.
REMEMBER this will reset the name and IP settings, so you need to update them, and DON’T FORGET to press ‘Save Network Settings’, or nothing happens!
You can now use the default username USERID and default password (PASSW0RD).
Reset IMM Password Remotely
Remotely connect to your IBM server Download the IBM ASU Utility (Note: There’s an x64 bit version, and an x32 bit version, run the correct one to extract the tools).
Run the following command to ensure that the USERID account exists
[box]
asu64.exe show IMM.LoginID.1
OR
asu.exe show IMM.LoginID.1
[/box]
It should detect the IMM by IP address and return IMM.LoginID.1=USERID
Note: If it returns a different username you can check each login ID and reset them one by one.
[box]
asu64.exe set IMM.password.1 Password123
OR
asu.exe set IMM.password.1 Password123
[/box]
Related Articles, References, Credits, or External Links
Both the 5506-X (rugged version and wireless), and 5508-X now come with a FirePOWER services module inside them. This can be managed from either ASDM* (with OS and ASDM upgraded to the latest version), and via the FireSIGHT management software/appliance.
Related Articles, References, Credits, or External Links
*UPDATE: All ASA ‘Next-Gen’ firewalls can now have their Firepower Service Module managed from the ASDM.
Solution
1. The first thing to do is cable the management interface and the interface you are going to use as the ‘inside’ (LAN) into the same network (VLAN).
2. The next step might seem strange if you are used to working with Cisco firewalls, but you need to make sure there is no IP address configured on the management interface. Try to think of it as just the hole that the FirePOWER services module (which will get its own IP) speaks out though.
[box]
Petes-ASA# configure terminal
Petes-ASA(config)# interface Management1/1
Petes-ASA(config-if)# no nameif
WARNING: DHCPD bindings cleared on interface 'management', address pool removed
Petes-ASA(config-if)# no security-level
Petes-ASA(config-if)# no ip address
[/box]
3. So it should look like this;
[box]
Petes-ASA(config-if)# show run
: Saved
ASA Version 9.3(2)2
!
----Output removed for the sake of brevity----
!
interface Management1/1
management-only
no nameif
no security-level
!
----Output removed for the sake of brevity----
[/box]
4. Lets make sure the FirePOWER service module is ‘up’ and healthy.
[box]
Petes-ASA(config)# show module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with FirePOWER services, 8GE, AC, ASA5506 JAD19090XXX
sfr FirePOWER Services Software Module ASA5506 JAD19090XXX
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 a46c.2a99.eec5 to a46c.2a99.eece 1.0 1.1.1 9.3(2)2
sfr a46c.2a99.eec4 to a46c.2a99.eec4 N/A N/A 5.4.1-211
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER Up 5.4.1-211
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Up Up
[/box]
5. The SFR module is actually a Linux box that’s running within the firewall, to connect to it you issue a ‘session sfr’ command.
Default Username: admin
Default Password: Sourcefire (capital S)
Default Password (after version 6.0.0): Admin123 (capital A)
As this is the first time you have entered the SFR you need to page down (press space) though the sizable EULA, then accept it.
[box]
Petes-ASA(config)# session sfr
Opening command session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Cisco ASA5506 v5.4.1 (build 211)
Sourcefire3D login: admin
Password: Sourcefire
Copyright 2004-2015, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.
Cisco Linux OS v5.4.1 (build 12)
Cisco ASA5506 v5.4.1 (build 211)
You must accept the EULA to continue.
Press <ENTER> to display the EULA:
END USER LICENSE AGREEMENTIMPORTANT: PLEASE READ THIS END USER LICENSE AGREEMENT CAREFULLY. IT IS VERY
----Output removed for the sake of brevity----
Product warranty terms and other information applicable to Cisco products are
available at the following URL: http://www.cisco.com/go/warranty.
----Output removed for the sake of brevity----
Please enter 'YES' or press <ENTER> to AGREE to the EULA: YES
[/box]
6. Set a new password.
[box]
System initialization in progress. Please stand by.
You must change the password for 'admin' to continue.
Enter new password: Password123
Confirm new password: Password123
[/box]
7. Set up all the IP and DNS settings, then exit from the module session.
[box]
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Do you want to configure IPv4? (y/n) [y]: y
Do you want to configure IPv6? (y/n) [n]: n
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]: manual
Enter an IPv4 address for the management interface [192.168.45.45]: 192.168.100.22
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.0
Enter the IPv4 default gateway for the management interface []: 192.168.100.1
Enter a fully qualified hostname for this system [Sourcefire3D]: SFire
Enter a comma-separated list of DNS servers or 'none' []: 192.168.100.10,192.168.100.11
Enter a comma-separated list of search domains or 'none' [example.net]: petenetlive.com,pnl.net
If your networking information has changed, you will need to reconnect.
For HTTP Proxy configuration, run 'configure network http-proxy'
Applying 'Default Allow All Traffic' access control policy.
You can register the sensor to a Defense Center and use the Defense Center
----Output removed for the sake of brevity----
sensor to the Defense Center.
> exit
Remote card closed command session. Press any key to continue.
[/box]
8. Now you need to ‘send’ traffic though the module, in this case I’m going to send all IP traffic though, I’m also going to set it to ‘fail open’, If you set it to fail closed then traffic will cease to flow though the firewall if the FirePOWER services module goes off-line. I’m making the assumption you have a default policy-map applied.
[box]
Petes-ASA(config)# access-list SFR extended permit ip any any
Petes-ASA(config)# class-map SFR
Petes-ASA(config-cmap)# match access-list SFR
Petes-ASA(config-cmap)# exit
[/box]
9. Add that new class-map to the default policy-map.
WARNING: If you are going to set ‘fail-close‘ then make sure your SFR module is operating normally, or you will cause downtime, best to do this in a maintenance window!)
Petes-ASA(config)# write mem
Building configuration...
Cryptochecksum: 72c138e3 1fa6ec32 31c35497 621cff02
35819 bytes copied in 0.210 secs
[OK]
[/box]
11. At this point the firewall should be able to ping the management IP of the SFR module.
[box]
Petes-ASA# ping 192.168.100.22
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.22, timeout is 2 seconds:
!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
Petes-ASA#
[/box]
12. Now when you connect to the ASDM you can manage the FirePOWER services module.Note: I have seen some firewalls that flatly refuse to connect to the Firepower Services Module, and give an error ‘unable to connect on port 443’ every time you launch ASDM. I just re-image the module and load in a fresh install (40 mins to an hour), and start again.
Code to Copy & Paste
If you are lazy like me!
[box]
access-list ACL-FirePOWER extended permit ip any any
class-map CM-SFR
match access-list ACL-FirePOWER
exit
policy-map global_policy
class CM-SFR
sfr fail-open
exit
exit
write mem
[/box]
Note If you get an unable to connect error see the following article;
13. I suggest you update everything first, the ASA will configure an access control policy set to allow and inspect all traffic by default, which we will edit, set everything to update on a schedule, (rule updates and geolocation info).
Cisco FirePOWER Services Adding Licences (ASDM)
In the box with the firewall, you will have an envelope, you don’t need to open it (as below) because the PAK number you need is printed on the outside anyway. This is the firewalls CONTROL LICENCE, it allows it to be managed, we will install it into the ASDM, if you have a SourceFIRE appliance to manage the firewall you would install it there. You need two bits of information the PAK and the LICENCE KEY of the FirePOWER module, (See Below).
The Licence Key is the MAC address of the Module, (Not the ASA). You can find it at Configuration > ASA FirePOWER Configuration > Licence. This is also where you will add all the licences. Go to www.cisco.com/go/licence and register the licence (and any additional licences i.e. AMP, Web filtering, etc.)
The Licence(s) will be emailed to you open them in a text editor and copy the text of each licence. You can see I’ve indicated below what you should be copying.
Paste that into the ASDM > Submit Licence.
It should say success, if it fails you’ve pasted to much text, or there’s a problem with the licence.
Review you licences, here Ive added AMP and web filtering but Ive yet to add the control licence. If you don’t add the control licence then when you try and edit the access control policy it will say you need a PROTECTION LICENCE (confusingly!)
FirePOWER Services Setup IPS
Disclaimer: These settings, (and allotters below,) are to get you up and running, As with any security device, you need to tune settings accordingly. Please don’t follow these instructions, then email me with complaints that you been attacked by ISIS/Scammers/Bots etc.
You get an IPS/IDS Licence with any of the subscription based licences, its less hassle to set this up before the the access control policy. Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Create Policy > Give it a name > I tend to use ‘Balanced Security and connectivity’ look at the other options and choose whichever you prefer > Create and Edit Policy.
Give the policy a name > Commit changes (I accept all the defaults).
FirePOWER Services Enable Malware Inspection and Protection
Note: Obviously this needs you to have added an AMP Licence!
Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Files > New File Policy > Give it a name > Store FirePOWER Changes.
Add new file rule > I add everything > and Set it to ‘Block Malware’ > Store FirePOWER Changes.
“Store ASA FirePOWER Changes”.
Warning: Nothing will be inspected, until you add this file policy to an access control policy.
ASA FirePOWER Services Edit / Create Access Control Policy
I renamed the default policy, Note: Even though I’ve called it ‘Base-Access-Control-Policy’ you can only apply one policy, you just add different rules to the policy as required. Add Rule.
In Source Networks > Add in ‘Private Networks’ (See Warning Below).
Inspection Tab > Add in the IPS and file policy you created above (That’s why I’ve done it in this order).
I set it to log at the end of the connection > Add.
“Store ASA FirePOWER Changes”.
FirePOWER Private Networks Warning
Private networks only cover RFC1918 addresses, if you LAN/DMZ etc subnets are different you should create a new Network object, then add the subnets for your network. If you do this, then substitute your network object every time I mention the Private Networks object.
Blocking a Particular URL with FirePOWER Services
Even if you don’t have a Web Filtering licence you can block particular URL’s here Im going to block access to Facebook. Configuration > ASA FirePOWER Configuration > Object Management > URL > Individual Objects > Add URL > Note Im adding http and https.
Then add a rule to your existing access control policy ABOVE the permit all rule, (they are processed like ACLS from the top down). Set the source network to your private subnets.
On the URLs tab add in your URL objects and set the action to block with reset, or Interactive block with reset if you want to let the users proceed to Facebook after a warning.
Note: If you have a Web filtering Licence you can select ‘Social Networking’ from the Categories tab, and that would also block Facebook, and Twitter etc.
ASA FirePOWER Services Commit and Deploy The Changes
FirePOWER services behaves the same on-box as it does when you use the SourceFIRE Appliance, you can make changes but nothing gets deployed until you commit the changes. If you have made a change then there will be a ‘Store ASA FirePOWER services button active. Then you need to select File > Deploy FirePOWER Changes.
Note: You will only see the Deploy option on SFR modules running 6.0.0 or newer.
Deploy.
Even now its not deployed, it takes a while, to see progress navigate to Monitoring > ASA FirePOWER Monitoring > Task Status > It will probably have a ‘running’ task.
Wait until the policy deployment says completed before testing.
Related Articles, References, Credits, or External Links
This little NAS box is a cheap way of adding a large amount of storage. Below I’m going to configure it as an iSCSI target, then connect my ESX5 host to it.
I’m not setting up any CHAP authentication, but I’ll show you where it’s configured, if you want to deploy yours a little more securely.
Also it’s considered good practice to separate your storage network traffic, from your actual network traffic (either physically or via VLANs). Here I’m also NOT doing that.
Solution
Initial Configuration of the TS5000
If you connect either of the NAS box’s NICs to your network they will pick up an IP address via DHCP (You will see it in your DHCP leases).
1. Connect to the NAS with a web browser, the default password is ‘password’.
2. To change the default password: Enter Easy Admin mode > Reset Password > Follow the instructions.
3. Team / Trunk The NICs: You can have each NIC with its own IP address, but I prefer to aggregate them > Network > Port Trunking > Configure port trunking.
4. Select ‘Link 1’.
5. Select All > Assign.
6. It may take a few seconds.
Configure iSCSI
7. First enable iSCSI > Drives > iSCSI > Click the switch to enable.
10. Give the volume a name, description, and specify the volume size > OK.
Note: If you wanted to configure authentication select enabled, and set accordingly.
11. Enter the numbers as requested > OK.
12. This can take a couple of minutes also.
Configure ESX For iSCSI
13. Connect to either your ESX host or vCenter > Select a host > Configuration > Networking > Add Networking > Create a new vSwitch > Add a VMkernel port group (called iSCSI or something sensible) > Assign a free NIC, and give it an IP address on the same range as the NAS box.
14. Storage Adaptors > If you do not see any, select ‘Add’ and add in a software iSCSI Adapter.
15. Right click your iSCSI Adapter > Network configuration > Bind it to the port group you created in step 13.
16. Then on either the Dynamic or the Static discovery tab, enter the IP address of the NAS box.
17. Storage > Add Storage > Disk/LUN > Select the iSCSI storage > Follow the instructions.
18. Repeat the process on your remaining ESX hosts. (Note: You will only need to create the VMFS volume(s) for the first one).
Related Articles, References, Credits, or External Links
If you cannot get access to your router, or you have bought, found or been given one, and you cannot access it. The simplest thing to do it to reset to to factory settings. Once the Router has been reset its settings will be as follows;
DrayTek Default Username and Passwords
Model
Username
Password
Vigor Rev. ALL
admin
admin
Vigor 2600
admin
{blank}
Vigor 2800
{blank}
{blank}
Vigor 2900+
admin
admin
Vigor 3300
draytek
1234
Note: The Router will set itself up with a static IP address http://192.168.1.1) and will act as a DHCP server (Make sure your network card it set to get its address automatically.
Solution
Warning: Make sure you have all your Routers settings, before you start, especially your ADSL username and password (ring your ISP and confirm) before resetting the Router as all these settings will be WIPED!
Factory Reset DrayTek Vigor: Option 1 (If you do not know the password)
Note: Model shown is a DrayTek Vigor 2800
1. with the router powered on in normal operation the power light should be blinking (slowly)
2. Use a pen, to depress the factory reset button on the rear of the device.
3. The power light will blink rapidly.
4. Release the factory reset button.
Factory Reset DrayTek Vigor: Option 2 (If you know the password)
If you can log in but just want to wipe the settings, and revert to factory defaults.
1. Connect to the web management console and navigate to, System Maintenance > Reboot system > Tick “Using factory default configuration”.
Factory Reset DrayTek Vigor: Option 3 (If you know the password)
If you can log in but just want to wipe the settings, and revert to factory defaults.
1. Familiarise yourself with the DrayTek Vigor firmware upgrade procedure. But use the firmware that ends in .RST NOT the firmware that ends in .ALL. (Note: The .all firmware just updates the firmware but keeps the settings).
Related Articles, References, Credits, or External Links
I’m more used to HP servers with iLO’s and Dell servers with DRAC’s, but today I had to put in an IBM System X (now Lenovo) Server with an IMM on it. Once I’d got its IP address from my DHCP servers list of leases I was faced with a logon screen.
Solution
Took some hunting, but the credentials are as follows;
Username: USERID
Password: PASSW0RD (That’s a zero, not an ‘O’ for Oscar).
Note: They are case sensitive also.
With iLO I would leave the default username and password setup, (because it’s written on the chassis, and if someone needed to get in they could, (if they had local access to the server).</p?
However for the IMM I would suggest at least changing the default password.
And if it’s internet facing I’d remove/rename that account completely.</p?
Related Articles, References, Credits, or External Links
I installed one of these a couple of weeks ago, and there’s some good documentation with the module itself so installing it into the UPS and giving it an IP address was easy, getting the right client software to talk to it was a pain.
Solution
Configure the Network Module
1. Physically install the module in the UPS, it’s fixed with two screws and you can install it with the UPS powered on.
2. It takes a while for the card to boot, pop in the console cable that came with it (into the Settings/AUX socket – see above). Fire up PuTTy and connect via serial.
Note: Standard Serial Settings,
Bits per second—9600
Data bits—8
Parity—None
Stop bits—1
Flow control—None
3. The default password is ‘admin’
4. Use the menus presented to change the IP details, you MUST restart the module when you are finished or the IP address WONT change.
5. Once its rebooted (again this takes a while) you can login with a web browser, (username admin password admin).
Configure the Client Machines.
1. Download HP Power Protector, (Note: there is no client and administrator software any more, this software will do BOTH. The network module has the administration software built in).
2. Install the software on your machine, and login (again username admin password admin).
3. Select client > Save.
4. Select the Device Discovery tab. The software usually detects the network module on its own quite quickly, if it does not you can use the options on right to do a scan.
Ports Required for HP UPS Network Module
If you are connecting through a firewall (or you machine has a software firewall), make sure the following six ports are open.
5. When it’s fully detected, select the network module and select ‘Configure power source’, supply the login credentials for the network module, and the load segment the machine is plugged into (see below) > Save.
6. Back in the web console of the network module > Open ‘Notified Applications’ and in about 5-10 minutes your server should appear.
Related Articles, References, Credits, or External Links
For such a ‘baby’ switch this has a LOT of features, I had to lock down the speed and duplex settings on one of the switch ports today. The main details you will be looking for are,
Default IP address = 192.168.2.10
Default Password = blank
Solution
1. Put yourself on the same network: Windows Key+R > ncpa.cpl {enter} > Right click your network connection > Properties > Internet Protocol Version 4 (TCP/IP) > properties > Set yout IP to 192.168.2.11 and set the subnet mask to 255.255.255.0 > OK > OK.
2. Open a web browser and navigate to http://192.186.2.10 log in with a blank password.
3. To Change the Switches IP: Setup Network
4. To change Speed/Duplex Settings: Switching > Port Configuration
5. To change the password: Maintenance > Password Manager.
Related Articles, References, Credits, or External Links
Essentially you can unbox this switch, plug it in and it will do what you want (unless you have VLANS, or trunks (port-channels)). Which is what my client had done, but I needed to get on the web console and have a look at what was going on, and there is NO CONSOLE socket on this unit at all.
Solution
1. Don’t bother looking in DHCP, it’s NOT set to DHCP by default. From the factory the switch will have the following IP address; 192.168.2.10 (255.255.255.0). So put yourself on the same network segment and connect to the switch via a normal network cable.
Note: Start > Run > ncpa.cpl will get you there.
2. Now open a browser window and connect to https://192.168.2.10 by default the password will be blank.
3. To change the IP address, navigate to System > IP Address > Set accordingly > Apply.
Note: Obviously this will kick you off, and you will need to change your IP address again to reconnect.
4. To change the password navigate to System > Password > change accordingly > Apply.
Related Articles, References, Credits, or External Links
Normally I simply connect a new MSA to a clients network, and it gets it’s address from DHCP. Then I can get the address for the DHCP Scope, and point my web browser at it.
Yesterday I was starting with new virtual infrastructure and had no DHCP. With the G1 and G2 models, you got a console/serial cable and could just terminal in. With the G3 they have replaced the serial socket with a mini USB socket. Each time I put in a new P2000, I think “I wonder how that USBCLI socket works?” Yesterday I had to find out.
Solution
The Quickest Solution – is to connect the MSA to the network, and if it cannot get a DHCP address it automatically gives itself 10.0.0.2/24 on controller A and 10.0.0.3/24 on controller B.
1. If you do have DHCP running, connect your MSA and run the MSA Device Discovery Tool, (On the CD that came with the device).
2. Once you know the IP address, you can connect with your web browser.
Connect to and Manage your MSA via the USB/CLI Cable
1. For your machine to see the MSA as a device, you need to install a driver, there is a copy of the drivers on the CD that came with the device.
Note: Windows 7 users, use the Windows 2008 Drivers or use this one.
2. Install the driver.
3. Connect the USB lead from the MSA controller to your machine, TAKE NOTE of the COM port number it’s using.
4. Now you can use whatever terminal emulation program you prefer to connect to that COM port. (I prefer HyperTerminal, or you can use Putty if you want something a bit lighter).
5. Set the following, Bits per second = 115200, Data bits = 8, Parity = None, Stop bits = 1, and Flow control = None.
6. You will need to press {enter} to connect, then login.
For network identification I have tended to use RADIUS (in a Windows NPS or IAS flavour), in the past. I turned my back on Cisco TACACS+ back in my ‘Studying for CCNA’ days, because back then it was clunky and awful. I have a client that will be installing ACS in the near future, so I thought I would take a look at it again, and was surprised at how much more polished it is. As Cisco plans to roll ACS into Cisco ISE in the future, I’m not sure if it will remain as a separate product. So we may find people using version 5 for a long time yet.
Solution
I’m deploying ACS version 5.5 as a virtual appliance, remember to give it at least 60GB of hard drive or the install will fail. If you are installing on VMware workstation, choose the ‘I will install the operating system later’ option and manually present the CD image or it will also fail.
When you have run through the initial setup on the appliance it will set;
1. Join the ACS appliance to your domain. Users and Identity Stores > External Identity Stores > Active Directory > Join/Test Connection > Enter Domain Credentials > Join.
2. Be patient it can take a couple of minutes, wait till it says ‘Joined and Connected’.
3. Make sure you already have some groups in active directory that you want to grant access to, here I’ve got a full-access group and a read-only access group.
Note: I’m going to grant privilege level 15 to full-access, and privilege level 1 to read-only, (yes I know they can still escalate to configure terminal mode, but you can always restrict level 1 so it can only use the show command if you like).
4. Back in ACS > Directory Groups > Add > Add in your Groups > OK.
5. Create a Shell Policy: Policy Elements > Authorization and Permissions > Shell Profiles > Create > First create one for level 15 (full-access).
12. Add > Shell Profile > Select > Select the full-access profile > OK.
13. Repeat for the read-only group.
14. Set the shell profile to read-only access > OK.
15. Access Policies > Service Selection Rules > Create > Set to Match Protocol TACACS > Set the service to Default Device Admin > OK.
16. Network Resources > Network Devices and AAA Clients > Enter the details of your Cisco device and set a shared key, (here I’m using 666999) > Submit.
17. Make the necessary changes on your Cisco devices, like so;
Cisco IOS TACACS+ Config
[box]
Petes-Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Petes-Router(config)#aaa new-model
Petes-Router(config)#aaa authentication login default group tacacs+ local
Petes-Router(config)#aaa authorization exec default group tacacs+ local
Petes-Router(config)#aaa authorization console
Petes-Router(config)#tacacs-server host 10.254.254.22
Petes-Router(config)#tacacs-server key 666999
Petes-Router(config)#end
Petes-Router#
*Mar 1 00:10:24.691: %SYS-5-CONFIG_I: Configured from console by console
Petes-Router#write mem
Building configuration...
[OK]
Petes-Router#
[/box]
Cisco ASA 5500 (and Next Generation) TACACS+ Config
[box]
Petes-ASA# configure terminal
Petes-ASA(config)# aaa-server PNL-AAA-TACACS protocol tacacs+
Petes-ASA(config-aaa-server-group)# aaa-server PNL-AAA-TACACS (inside) host 10.254.254.22
Petes-ASA(config-aaa-server-host)# key 666999
Petes-ASA(config-aaa-server-host)# exit
Petes-ASA(config)#
-=-=-=-=-Authentication-=-=-=-=-ASDM Authentication
Petes-ASA(config)# aaa authentication http console PNL-AAA-TACACS LOCAL Console Authentication
Petes-ASA(config)# aaa authentication serial console PNL-AAA-TACACS LOCALSSH Authentication
Petes-ASA(config)# aaa authentication ssh console PNL-AAA-TACACS LOCALTelnet Authentication
Petes-ASA(config)# aaa authentication telnet console PNL-AAA-TACACS LOCAL
Enable Mode Command Protection Authentication
Petes-ASA(config)# aaa authentication enable console PNL-AAA-TACACS LOCAL-=-=-=-=-Authorisation-=-=-=-=-
Petes-ASA(config)# aaa authorization command PNL-AAA-TACACS LOCAL
Petes-ASA(config)# privilege show level 5 mode configure configure command aaa
<repeat as necessary - Note: Turn it on with the ASDM with command preview enables and you can copy paste all the commands out and edit them accordingly>-=-=-=-=-Accounting-=-=-=-=-
Petes-ASA(config)# aaa accounting command PNL-AAA-TACACS
[/box]
18. Now you can test, here I connect as a user with read-only access (Note: I have a greater than prompt, I’m in user EXEC mode). Then when I connect as a full-access user (Note: I have a hash prompt. I’m in privileged EXEC mode).
19. The results are the same if I connect via SSH.
Enabling TACACS+ Though a Firewall
Sometimes, e.g. you have a switch in a DMZ or a router outside your firewall that you want to secure with TACACS. To enable this you simply need to open TCP port 49, from the device you are securing with TACACS to the ACS server.
Related Articles, References, Credits, or External Links
