Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Cisco ASA is there any way to provide a user with access to admin features (view/change the config) without providing the main enable password?

share|improve this question
up vote 2 down vote accepted

You could use the local user database on the ASA applicance to create usernames and passwords with the privilege levels you want the users to have upon login.

Here is how to create local users:

hostname#configure terminal
hostname(config)#username [UserName] privilege 15 password [PasswordHere]    //privilege level 15 is root (admin) access.

//The below commands make sure the username/password login method will apply to both console and vty lines. If you have an AUX port make sure to include it aswell.
hostname(config)#line con 0
hostname(config-line)#login local
hostname(config)#line vty 0 15
hostname(config-line)#login local

The above is just a sample configuration. If you are not to expirienced with the command line make sure to check the documentation if you are unsure about what a command does.

share|improve this answer
This works for router and switches but not ASAs. – evolvd Nov 14 '11 at 14:51

When you log in from a TACACS account, you have to type your own password twice (once at connection and once at enable). I imagine this works as well for RADIUS accounts.

share|improve this answer
This also applies if you use a local login – evolvd Nov 14 '11 at 14:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.