Cisco Systems How Fallback Works with Multiple Servers in a Group, Using Certificates and User Login Credentials

38-8
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter38 Configuring AAA Servers and the Local Database
Information About AAA
providing the service, using usernames and passwords on AAA servers that are different than the
usernames and passwords in the local database means that the user cannot be certain which username
and password should be given.
The local database supports the following fallback functions:
•Console and enable password authentication—If the servers in the group are all unavailable, the
ASA uses the local database to authenticate administrative access, which can also include enable
password authentication.
•Command authorization—If the TACACS+ servers in the group are all unavailable, the local
database is used to authorize commands based on privilege levels.
•VPN authentication and authorization—VPN authentication and authorization are supported to
enable remote access to the ASA if AAA servers that normally support these VPN services are
unavailable. When a VPN client of an administrator specifies a tunnel group configured to fallback
to the local database, the VPN tunnel can be established even if the AAA server group is unavailable,
provided that the local database is configured with the necessary attributes.
How Fallback Works with Multiple Servers in a Group
If you configure multiple servers in a server group and you enable fallback to the local database for the
server group, fallback occurs when no server in the group responds to the authentication request from
the ASA. To illustrate, consider this scenario:
You configure an LDAP server group with two Active Directory servers, server 1 and server 2, in that
order. When the remote user logs in, the ASA attempts to authenticate to server1.
If server 1 responds with an authentication failure (such as user not found), the ASA does not attempt to
authenticate to server 2.
If server 1 does not respond within the timeout period (or the number of authentication attempts exceeds
the configured maximum), the ASA tries server 2.
If both servers in the group do not respond, and the ASA is configured to fall back to the local database,
the ASA tries to authenticate to the local database.
Using Certificates and User Login Credentials
The following section describes the different methods of using certificates and user login credentials
(username and password) for authentication and authorization. These methods apply to IPsec,
AnyConnect, and Clientless SSL VPN.
In all cases, LDAP authorization does not use the password as a credential. RADIUS authorization uses
either a common password for all users or the username as a password.
This section includes the following topics:
•Using User Login Credentials, page38-8
•Using Certificates, page 38-9
Using User Login Credentials
The default method for authentication and authorization uses the user login credentials.
•Authentication