TACACS+ for Cisco ASA with ISE 3.5: Command Authorization, Console Lockout and LOCAL Fallback

In the IOS XE TACACS+ lab I built an ISE Device Admin policy with an admin group, a help desk group and command sets. This post points a Cisco ASA firewall at the same policy and looks at what is different on the ASA side: how it gets to privilege 15, how command authorization is turned on, and how the LOCAL fallback behaves when ISE stops answering.

Four results, all from real sessions:

1. Admin na-01 logs in at privilege 15 with no enable and can enter configuration mode.
2. Help desk hd-11 can run show version but gets Command authorization failed for show running-config and configure terminal.
3. Console lockout: turning on command authorization locked out a local admin who doesn't exist in ISE. ISE logged 22056 Subject not found.
4. Fault: a wrong shared secret produced 13011, the ASA marked ISE FAILED, and only then did the local fallback user get in.

I built this in my home lab with Cisco ISE 3.5.0.527 and a Cisco ASAv 9.24(1) (ASDM 7.24(1)), managed over SSH from a Linux jump host. All output is real. Addresses are documentation values, and secrets and passwords are placeholders.

For the theory, see AAA, TACACS+ and RADIUS for Device Administration. If ISE isn't installed yet, start with Cisco ISE 3.5 Initial Setup.

Topology

TACACS+ runs on TCP 49 from the ASA management interface to ISE.

Step 1: Reuse the ISE Device Admin policy

Nothing new was needed in ISE except the network device. The IOS-Device-Admin policy set from the IOS XE lab matches on DEVICE:Device Type EQUALS All Device Types, so it matched the ASA as it was:

CS-Helpdesk-Show has a DENY_ALWAYS rule for show running-config.* and PERMIT rules for show, ping, traceroute, terminal length and exit. Everything else is denied.

That reuse is convenient, but it's also a warning. A policy set matching All Device Types catches every TACACS+ device you add, firewalls included. If firewalls should get a different policy, give them their own Network Device Group and policy set. The next post in this series covers policy sets by device type.

Add the ASA under Administration > Network Resources > Network Devices: name edge-fw7, IP 10.86.249.10, and under TACACS Authentication Settings a shared secret (<TACACS_KEY> here).

Step 2: ASA configuration

aaa-server ISE-TAC protocol tacacs+
aaa-server ISE-TAC (management) host 192.0.2.10
 key <TACACS_KEY>
!
username fw-local password <LOCAL_PASSWORD> privilege 15
!
aaa authentication ssh console ISE-TAC LOCAL
aaa authentication enable console LOCAL
aaa authorization exec authentication-server auto-enable
aaa authorization command ISE-TAC LOCAL
aaa accounting command ISE-TAC

What each line does:

• aaa authentication ssh console ISE-TAC LOCAL sends SSH logins to ISE and uses the local database only if the ISE server group is unavailable.
• aaa authorization exec authentication-server auto-enable applies the privilege level from the ISE shell profile (IOS_Priv15) and drops the user straight into privileged mode, with no enable prompt.
• aaa authorization command ISE-TAC LOCAL sends every command to ISE for a permit or deny decision.
• aaa accounting command ISE-TAC records each command in ISE.

On ASA 9.24, a newly created local user has to change its password at first login. Plan for that before you depend on fw-local in an outage.

Step 3: Admin login

User na-01 logged in to edge-fw7
edge-fw7# show curpriv
Username : na-01
Current privilege level : 15
Current Mode/s : P_PRIV

edge-fw7# configure terminal
edge-fw7(config)# exit

There's no enable prompt: auto-enable placed na-01 in privileged mode at level 15.

Step 4: Help desk login

User hd-11 logged in to edge-fw7
edge-fw7# show curpriv
Username : hd-11
Current privilege level : 15
Current Mode/s : P_PRIV

edge-fw7# show version | include Software
Cisco Adaptive Security Appliance Software Version 9.24(1)

edge-fw7# show running-config
Command authorization failed

edge-fw7# configure terminal
Command authorization failed

hd-11 is also at privilege 15, but every command still goes to ISE. show running-config hit the DENY_ALWAYS rule:

Both users and their command decisions show up in Operations > TACACS > Live Logs:

Step 5: The console lockout

Right after I entered aaa authorization command ISE-TAC LOCAL, my next command on the serial console was rejected. Command authorization applies to the console as well as SSH, and the console session belonged to a local admin that doesn't exist in ISE. The ASA asked ISE to authorize the command, ISE couldn't find the user, and the ASA used that reject as final.

That's the key point about the fallback: LOCAL is used only when the server group can't be reached, not when ISE says no. A reject from ISE is a valid answer.

To avoid locking yourself out:

• Log in as an ISE user, such as na-01, before turning on command authorization, and keep that session open.
• Don't rely on a local-only account while ISE is reachable.
• Save the configuration only after you've tested a fresh login.

Step 6: Fault, a wrong shared secret

I changed the shared secret on the ISE network device so it no longer matched the ASA. The next login attempt failed:

$ ssh hd-11@10.86.249.10
Permission denied, please try again.

ISE logged 13011 Invalid TACACS+ request packet - possibly mismatched Shared Secrets, with no username, because it couldn't decrypt the packet:

The ASA marked the server as failed, and only then did the local fallback user get in:

User fw-local logged in to edge-fw7
edge-fw7# show curpriv
Username : fw-local
Current privilege level : 15

edge-fw7# show aaa-server ISE-TAC
Server Group:    ISE-TAC
Server Protocol: tacacs+
Server Address:  192.0.2.10
Server port:     49
Server status:   FAILED, Server disabled at 15:01:14 UTC Sat Oct 31 2026
...
Number of rejects                       5
Number of timeouts                      3

The fix, and the 10-minute wait

I put the correct secret back in ISE and ran aaa-server ISE-TAC active host 192.0.2.10. Logins still failed for about ten minutes. The group stayed in its failed state for the depletion deadtime (10 minutes by default), so the ASA kept using LOCAL, and the ISE users aren't in LOCAL. Once the group recovered, na-01 and hd-11 worked again and fw-local was rejected by ISE with 22056, as in step 5.

edge-fw7# show aaa-server ISE-TAC
Server status:   ACTIVE, Last transaction at 15:25:43 UTC Sat Oct 31 2026

If you need faster recovery during a change window, lower the deadtime with reactivation-mode depletion deadtime <minutes> under the server group, or use reactivation-mode timed.

Failure codes seen

Takeaways

• The ASA needs aaa authorization exec authentication-server auto-enable to use the ISE shell profile privilege without an enable prompt.
• Command authorization covers the console too. Test from an ISE account before you turn it on.
• LOCAL fallback works only while the server group is down. An ISE reject is final.
• After an outage, the group can stay on LOCAL for the deadtime even once ISE is healthy.
• A policy set matching All Device Types catches firewalls as well as routers. Split it by device type if they need different rules.

Related: TACACS+ for Cisco IOS XE with ISE 3.5 and ISE Live Logs failure codes.