PIX backdoor login

Jan 09, 2008 2 Replies

I've a PIX 506 with OS 6.3.5. I set the PIX using Tacacs authentication. If the PIX lost connection to the TACACS, will it failover to local authentication, i.e. using local enable password ?



Here's current config aaa-server RADIUS protocol radius aaa-server LOCAL protocol local aaa-server ADMIN_In protocol tacacs+ aaa-server ADMIN_In (inside) host xx timeout 15 aaa-server ADMIN_In (inside) host xx timeout 15 aaa authentication serial console ADMIN_In aaa authentication ssh console ADMIN_In aaa authentication telnet console ADMIN_In telnet xx xx inside telnet timeout 30 ssh xx xx inside ssh timeout 30 console timeout 30



No, it will fail the way you have it, it is not pointing to local if the TACACS fails. Need to add "LOCAL" after all the ADMIN_In's. I.E: aaa authentication telnet console ADMIN_In LOCAL

On my PIX 515's (6.3.3) using the 'local' failover option with TACACS, when TACACS is inaccessible the only want to login is with username "pix" and the enable password.

Gavin Reynolds Perth, Australia

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required