38-22
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter38 Configuring AAA Servers and the Local Database
Configuring AAA
The value mappings are saved to the running configuration.
Adding a User Account to the Local Database
This section describes how to manage users in the local database and includes the following topics:
•Adding a User, page38-23
•Configuring VPN Policy Attributes for a User, page38-24

Guidelines

The local database is used for the following features:
•ASDM per-user access
By default, you can log into ASDM with a blank username and the enable password (see the
“Configuring the Hostname, Domain Name, and Passwords” section on page17-1). However, if you
enter a username and password at the login screen (instead of leaving the username blank), ASDM
checks the local database for a match.
•Console authentication
•Telnet and SSH authentication.
•enable command authentication
This setting is for CLI-access only and does not affect the ASDM login.
•Command authorization
If you turn on command authorization using the local database, then the ASA refers to the user
privilege level to determine which commands are available. Otherwise, the privilege level is not
generally used. By default, all commands are either privilege level 0 or level 15. ASDM allows you
to enable three predefined privilege levels, with commands assigned to level 15 (Admin), level 5
(Read Only), and level 3 (Monitor Only). If you use the predefined levels, then assign users to one
of these three privilege levels.
•Network access authentication
•VPN client authentication
For multiple context mode, you can configure usernames in the system execution space to provide
individual logins at the CLI using the login command; however, you cannot configure any AAA rules
that use the local database in the system execution space.

Limitations

You cannot use the local database for network access authorization.