I deployed a Cisco ASA at a location and couldn’t get logged in via SSH. I would get prompted, but, no matter what username/password I put in, it would just reject me. After some digging, it turns out that I forgot this command.
aaa authentication ssh console LOCAL
When I put this in, it let me right in as expected. I have no clue what the deal was. I guess I assumed that the ASA would use the local userbase if a AAA service wasn’t configured. I guessed wrong.
I’m sure this will apply to telnet sessions as well. I’d also bet money that equivalent PIX OS versions do that same, so keep an eye out.
This is normal and logical behavior. If you don’t put any aaa statement in your config console (and telnet) only ask for password and not the username. This is the “global” password not the password associated with a user. In case of http (asdm) you can leave the username empty and only provide the enable password. In case of ssh the username is mandatory so ASA/PIX require you to use the special (“magic”) username “pix”. This is documented by Cisco.
Heres some more information that might be helpfull,
Cisco ASA Allow Management
Pete
PeteNetLive
v helpful. thanks.
Thankx alot, saved my travel back to office.
Awesome thanks, this was driving me bonkers.
helped me out today. Thank you very much for your post!
My ASA was almost out of the window. This post saved it. Thanks!