> ## Content Index
> Fetch the complete content index at: https://www.pinglabz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TACACS+ for Cisco ASA with ISE 3.5: Command Authorization, Console Lockout and LOCAL Fallback
- URL: https://www.pinglabz.com/ise-tacacs-asa-admin-command-authorization/
- Published: 2026-10-31T15:27:29.000Z
- Updated: 2026-10-31T15:52:40.000Z
- Description: I pointed a Cisco ASAv 9.24 at ISE 3.5 for TACACS+ device admin: auto-enable to privilege 15, per-command authorization, a console admin locked out by 22056, a 13011 shared secret fault, and when the LOCAL fallback user can and can't log in.
- Author: Jaime
- Tags: Network Security, Troubleshooting, Labs, 802.1X

In the [IOS XE TACACS+ lab](https://www.pinglabz.com/ise-tacacs-ios-device-admin-command-sets/) I built an ISE Device Admin policy with an admin group, a help desk group and command sets. This post points a Cisco ASA firewall at the same policy and looks at what is different on the ASA side: how it gets to privilege 15, how command authorization is turned on, and how the `LOCAL` fallback behaves when ISE stops answering.

Four results, all from real sessions:

1. **Admin** `na-01` logs in at privilege 15 with no `enable` and can enter configuration mode.
2. **Help desk** `hd-11` can run `show version` but gets `Command authorization failed` for `show running-config` and `configure terminal`.
3. **Console lockout**: turning on command authorization locked out a local admin who doesn't exist in ISE. ISE logged **22056 Subject not found**.
4. **Fault**: a wrong shared secret produced **13011**, the ASA marked ISE `FAILED`, and only then did the local fallback user get in.

I built this in my home lab with **Cisco ISE 3.5.0.527** and a **Cisco ASAv 9.24(1)** (ASDM 7.24(1)), managed over SSH from a Linux jump host. All output is real. Addresses are documentation values, and secrets and passwords are placeholders.

For the theory, see [AAA, TACACS+ and RADIUS for Device Administration](https://www.pinglabz.com/aaa-tacacs-radius-device-administration/). If ISE isn't installed yet, start with [Cisco ISE 3.5 Initial Setup](https://www.pinglabz.com/cisco-ise-3-5-initial-setup/).

## Topology

| Device   | Role                                     | Address      |
| -------- | ---------------------------------------- | ------------ |
| ise35    | Cisco ISE 3.5, Device Admin (TACACS+)    | 192.0.2.10   |
| edge-fw7 | Cisco ASAv 9.24(1), management interface | 10.86.249.10 |
| ops-71   | Linux jump host for SSH                  | 10.86.249.21 |

[![Lab diagram: ops-71 connects by SSH to edge-fw7 (ASAv), which uses TACACS+ TCP 49 to ise35 for login and command authorization. na-01 gets priv 15, hd-11 show running-config is denied (13023), console local admin fails (22056), and a wrong secret (13011) marks the server FAILED so LOCAL fw-local is used.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/ise-tacacs-asa-topology.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/ise-tacacs-asa-topology.png?ref=pinglabz.com)

Lab topology: edge-fw7 sends admin logins and commands to ise35 over TACACS+

TACACS+ runs on TCP 49 from the ASA management interface to ISE.

| User     | Where it lives             | Expected result                   |
| -------- | -------------------------- | --------------------------------- |
| na-01    | ISE, group NetOps-Admins   | Privilege 15, every command       |
| hd-11    | ISE, group NetOps-Helpdesk | Privilege 15, read-only commands  |
| fw-local | ASA local database only    | Emergency access when ISE is down |

## Step 1: Reuse the ISE Device Admin policy

Nothing new was needed in ISE except the network device. The **IOS-Device-Admin** policy set from the IOS XE lab matches on **DEVICE:Device Type EQUALS All Device Types**, so it matched the ASA as it was:

| Rule                     | Condition                     | Command set      | Shell profile          |
| ------------------------ | ----------------------------- | ---------------- | ---------------------- |
| NetOps-Admins-Priv15     | IdentityGroup NetOps-Admins   | CS-Permit-All    | IOS\_Priv15            |
| NetOps-Helpdesk-ReadOnly | IdentityGroup NetOps-Helpdesk | CS-Helpdesk-Show | IOS\_Priv15            |
| Default                  | (none)                        | DenyAllCommands  | Deny All Shell Profile |

`CS-Helpdesk-Show` has a DENY\_ALWAYS rule for `show running-config.*` and PERMIT rules for `show`, `ping`, `traceroute`, `terminal length` and `exit`. Everything else is denied.

That reuse is convenient, but it's also a warning. A policy set matching *All Device Types* catches every TACACS+ device you add, firewalls included. If firewalls should get a different policy, give them their own Network Device Group and policy set. The next post in this series covers policy sets by device type.

Add the ASA under **Administration > Network Resources > Network Devices**: name `edge-fw7`, IP `10.86.249.10`, and under **TACACS Authentication Settings** a shared secret (`<TACACS_KEY>` here).

## Step 2: ASA configuration

```
aaa-server ISE-TAC protocol tacacs+
aaa-server ISE-TAC (management) host 192.0.2.10
 key <TACACS_KEY>
!
username fw-local password <LOCAL_PASSWORD> privilege 15
!
aaa authentication ssh console ISE-TAC LOCAL
aaa authentication enable console LOCAL
aaa authorization exec authentication-server auto-enable
aaa authorization command ISE-TAC LOCAL
aaa accounting command ISE-TAC

```

What each line does:

- `aaa authentication ssh console ISE-TAC LOCAL` sends SSH logins to ISE and uses the local database only if the ISE server group is unavailable.
- `aaa authorization exec authentication-server auto-enable` applies the privilege level from the ISE shell profile (`IOS_Priv15`) and drops the user straight into privileged mode, with no `enable` prompt.
- `aaa authorization command ISE-TAC LOCAL` sends every command to ISE for a permit or deny decision.
- `aaa accounting command ISE-TAC` records each command in ISE.

On ASA 9.24, a newly created local user has to change its password at first login. Plan for that before you depend on `fw-local` in an outage.

## Step 3: Admin login

```
User na-01 logged in to edge-fw7
edge-fw7# show curpriv
Username : na-01
Current privilege level : 15
Current Mode/s : P_PRIV

edge-fw7# configure terminal
edge-fw7(config)# exit

```

There's no `enable` prompt: auto-enable placed na-01 in privileged mode at level 15.

## Step 4: Help desk login

```
User hd-11 logged in to edge-fw7
edge-fw7# show curpriv
Username : hd-11
Current privilege level : 15
Current Mode/s : P_PRIV

edge-fw7# show version | include Software
Cisco Adaptive Security Appliance Software Version 9.24(1)

edge-fw7# show running-config
Command authorization failed

edge-fw7# configure terminal
Command authorization failed

```

hd-11 is also at privilege 15, but every command still goes to ISE. `show running-config` hit the DENY\_ALWAYS rule:

[![TACACS authorization detail for hd-11 on edge-fw7: 13023 Command matched a Deny-Always rule for show running-config](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/02-hd11-showrun-denied.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/02-hd11-showrun-denied.png?ref=pinglabz.com)

TACACS authorization detail for hd-11 on edge-fw7: 13023 Command matched a Deny-Always rule for show running-config

Both users and their command decisions show up in **Operations > TACACS > Live Logs**:

[![ISE TACACS Live Logs with na-01 and hd-11 sessions from the ASA](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/01-tacacs-livelogs.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/01-tacacs-livelogs.png?ref=pinglabz.com)

ISE TACACS Live Logs with na-01 and hd-11 sessions from the ASA

## Step 5: The console lockout

Right after I entered `aaa authorization command ISE-TAC LOCAL`, my next command on the serial console was rejected. Command authorization applies to the console as well as SSH, and the console session belonged to a local admin that doesn't exist in ISE. The ASA asked ISE to authorize the command, ISE couldn't find the user, and the ASA used that reject as final.

[![ISE TACACS authorization failure for the console session: 22056 Subject not found in the applicable identity store(s)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/03-console-admin-22056.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/03-console-admin-22056.png?ref=pinglabz.com)

ISE TACACS authorization failure for the console session: 22056 Subject not found in the applicable identity store(s)

That's the key point about the fallback: **`LOCAL` is used only when the server group can't be reached, not when ISE says no.** A reject from ISE is a valid answer.

To avoid locking yourself out:

- Log in as an ISE user, such as na-01, *before* turning on command authorization, and keep that session open.
- Don't rely on a local-only account while ISE is reachable.
- Save the configuration only after you've tested a fresh login.

## Step 6: Fault, a wrong shared secret

I changed the shared secret on the ISE network device so it no longer matched the ASA. The next login attempt failed:

```
$ ssh hd-11@10.86.249.10
Permission denied, please try again.

```

ISE logged **13011 Invalid TACACS+ request packet - possibly mismatched Shared Secrets**, with no username, because it couldn't decrypt the packet:

[![ISE TACACS authentication failure from edge-fw7: 13011 Invalid TACACS+ request packet, possibly mismatched Shared Secrets](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/04-fault-13011.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/04-fault-13011.png?ref=pinglabz.com)

ISE TACACS authentication failure from edge-fw7: 13011 Invalid TACACS+ request packet, possibly mismatched Shared Secrets

The ASA marked the server as failed, and only then did the local fallback user get in:

```
User fw-local logged in to edge-fw7
edge-fw7# show curpriv
Username : fw-local
Current privilege level : 15

edge-fw7# show aaa-server ISE-TAC
Server Group:    ISE-TAC
Server Protocol: tacacs+
Server Address:  192.0.2.10
Server port:     49
Server status:   FAILED, Server disabled at 15:01:14 UTC Sat Oct 31 2026
...
Number of rejects                       5
Number of timeouts                      3

```

### The fix, and the 10-minute wait

I put the correct secret back in ISE and ran `aaa-server ISE-TAC active host 192.0.2.10`. Logins still failed for about ten minutes. The group stayed in its failed state for the depletion deadtime (10 minutes by default), so the ASA kept using `LOCAL`, and the ISE users aren't in `LOCAL`. Once the group recovered, na-01 and hd-11 worked again and `fw-local` was rejected by ISE with 22056, as in step 5.

```
edge-fw7# show aaa-server ISE-TAC
Server status:   ACTIVE, Last transaction at 15:25:43 UTC Sat Oct 31 2026

```

If you need faster recovery during a change window, lower the deadtime with `reactivation-mode depletion deadtime <minutes>` under the server group, or use `reactivation-mode timed`.

## Failure codes seen

| Code / message                           | Where               | Meaning                                                         | Fix                                                 |
| ---------------------------------------- | ------------------- | --------------------------------------------------------------- | --------------------------------------------------- |
| 13023 Command matched a Deny-Always rule | ISE                 | DENY\_ALWAYS in the command set                                 | Working as designed                                 |
| Command authorization failed             | ASA CLI             | ISE denied the command                                          | Check the TACACS Live Logs row for the reason       |
| 22056 Subject not found                  | ISE                 | User not in any identity store (for example a local-only admin) | Use an ISE user, or add the user to ISE             |
| 13011 Invalid TACACS+ request packet     | ISE                 | Shared secret mismatch                                          | Match the key on the ASA and the network device     |
| FAILED, Server disabled                  | ASA show aaa-server | Group unreachable or erroring                                   | Fix the cause, then wait for deadtime or reactivate |

## Takeaways

- The ASA needs `aaa authorization exec authentication-server auto-enable` to use the ISE shell profile privilege without an `enable` prompt.
- Command authorization covers the console too. Test from an ISE account before you turn it on.
- `LOCAL` fallback works only while the server group is down. An ISE reject is final.
- After an outage, the group can stay on `LOCAL` for the deadtime even once ISE is healthy.
- A policy set matching *All Device Types* catches firewalls as well as routers. Split it by device type if they need different rules.

Related: [TACACS+ for Cisco IOS XE with ISE 3.5](https://www.pinglabz.com/ise-tacacs-ios-device-admin-command-sets/) and [ISE Live Logs failure codes](https://www.pinglabz.com/ise-live-logs-802-1x-failure-codes/).