CloudLabBox
Try the free demo

Cisco ASA lab 12 of 15

AAA for device access: RADIUS with local fallback, privilege levels and troubleshooting

A half-finished AAA change has locked the admins out of HQ-FW's SSH. Find and fix the faults, make RADIUS fall back to the local database while the server is down, give the helpdesk a read-only privilege level with local command authorisation, and add a lockout policy.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 12 - AAA for device access - RADIUS with local fallback privilege levels and troubleshooting

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
3 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

On Friday a contractor started moving HQ-FW's administrator logins to Kestrel's new RADIUS server (192.168.100.60, shared key Kestrel-RAD-26). The RADIUS server then failed its own deployment and is switched off, the contractor's change was left half done, and now nobody can SSH to the firewall. You have the console.

Kestrel's access standard for network devices:

  1. Admins SSH only from the management network 192.168.100.0/24.
  2. RADIUS is tried first; when it is unreachable, the local accounts work.
  3. Admins land straight in privileged mode.
  4. The helpdesk account (helpdesk, level 5) may run show commands including show running-config, and ping, but may not change anything.
  5. A local account is locked after 3 wrong passwords.

What you’ll practise

  • Troubleshoot SSH and AAA failures with test aaa-server, show aaa-server and syslog
  • Configure a RADIUS server group with timeouts, dead-time and LOCAL fallback
  • Use aaa authorization exec auto-enable and local command authorisation
  • Create a custom privilege level for a helpdesk role
  • Configure and clear local account lockout

The tasks

  1. Gather facts before changing anything
  2. Prove the RADIUS server is down
  3. Restore SSH access to the standard
  4. The helpdesk role
  5. Lockout policy

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of AAA for device access - RADIUS with local fallback privilege levels and troubleshooting3 nodes, 2 links. Every link is listed as text below the diagram.HQ-FWISPNMSGi0/1Gi0/0Mgmt0/0eth0
3 nodes, with the interface names each link uses.
Every link, as text
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Mgmt0/0 to NMS eth0
Nodes in AAA for device access: RADIUS with local fallback, privilege levels and troubleshooting, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
NMSAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 12 - AAA for device access - RADIUS with local fallback privilege levels and troubleshooting and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.