Cisco ASA 5505 Configuration Manual page 688

Configuring AAA for System Administrators
•
•
•
Local Command Authorization Prerequisites
Complete the following tasks as part of your command authorization configuration:
•
•
Default Command Privilege Levels
By default, the following commands are assigned to privilege level 0. All other commands are at
level 15.
•
•
•
•
•
•
•
•
•
•
•
•
If you move any configure mode commands to a lower level than 15, be sure to move the configure
command to that level as well, otherwise, the user will not be able to enter configuration mode.
To view all privilege levels, see the
Cisco ASA 5500 Series Configuration Guide using ASDM
32-16
Default Command Privilege Levels, page 32-16
Assigning Privilege Levels to Commands and Enabling Authorization, page 32-17
Viewing Command Privilege Levels, page 32-18
Configure enable authentication. (See the
command Access" section on page
enable authentication is essential to maintain the username after the user accesses the enable
command.
Alternatively, you can use the login command (which is the same as the enable command with
authentication; for the local database only), which requires no configuration. We do not recommend
this option because it is not as secure as enable authentication.
You can also use CLI authentication, but it is not required.
See the following prerequisites for each user type:
Local database users—Configure each user in the local database at a privilege level from 0 to 15.
–
To configure the local database, see the
RADIUS users—Configure the user with Cisco VSA CVPN3000-Privilege-Level with a value
–
between 0 and 15.
LDAP users—Configure the user with a privilege level between 0 and 15, and then map the
–
LDAP attribute to Cisco VAS CVPN3000-Privilege-Level according to the
Attribute Maps" section on page
show checksum
show curpriv
enable
help
show history
login
logout
pager
show pager
clear pager
quit
show version
"Configuring Authentication for CLI, ASDM, and enable
32-11.)
"Adding a User Account" section on page
31-22.
"Viewing Command Privilege Levels" section on page
Chapter 32 Configuring Management Access
"Configuring LDAP
31-18.
32-18.
OL-20339-01