Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created a test user that is set to privilege 15 in the config:

username test password **************** encrypted privilege 15

When I log in to the ASA 5510 I am in privilege 1 according to sh curpriv:

login as: test
test@192.168.1.253's password:
Type help or '?' for a list of available commands.
asa> sh curpriv
Username : test
Current privilege level : 1
Current Mode/s : P_UNPR

Attempting enable fails even though I know I have the correct enable password:

asa> en
Password: *************************
Password: *************************
Password: *************************
Access denied.

Logging in from unprivileged puts me on privilege 15 and I can do as a please:

asa> login
Username : test
Pasword: *************************
asa> sh curpriv
Current privilege level : 15
Current Mode/s : P_PRIV
asa> 

The only thing I can track this to is a configuration change I made where I removed a VPN user we no longer needed.

Why do I start at privilege level 1 when logging into a Cisco ASA 5510?

share|improve this question
    
How are youconnecting? Telnet? SSH? I'm thinking perhaps maybe if you're using telnet (unsecure) it won't let you go to enable mode? –  SpacemanSpiff Nov 14 '11 at 14:22
    
The same behavior happens to me with a SSH connection. –  evolvd Nov 14 '11 at 14:49
add comment

2 Answers

up vote 4 down vote accepted

As of 2011.11.28 the accepted answer, while correct in some cases, is not accurate in others.

The ASA uses a slightly different model than traditional IOS routers and this where some of the confusion sits. The second piece is whether or not aaa authentication enable console LOCAL is configured.

Scenario 1 - Enable Authentication Not Configured

Relevant ASA config

enable password enablepass1
aaa authentication ssh console LOCAL
username user1 password pass1 privilege 15

Results

login as: user1
user1@ASA's password: pass1
ASA> enable
Password: enablepass1
ASA#

If enable authentication is not configured, a user with privilege 15 must still use the enable password to enter privileged exec mode if entering privileged exec mode through enable.

Scenario 2 - Enable Authentication Not Configured but using login

Relevant ASA config

enable password enablepass1
aaa authentication ssh console LOCAL
username user1 password pass1 privilege 15

Results

login as: user1
user1@ASA's password: pass1
ASA> login
Username: user1
Password: pass1
ASA#

If enable authentication is not configured, a user with privilege 15 can use the login command to enter privileged exec mode without knowing or using the enable password.

Scenario 3 - Enable Authentication Configured

Relevant ASA config

enable password enablepass1
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
username user1 password pass1 privilege 15

Results

login as: user1
user1@ASA's password: pass1
ASA> enable
Password: enablepass1
Password: pass1
ASA#

If enable authentication is configured, a user with privilege 15 can use login or enable to gain access to privileged exec mode. If using enable, the password required will be the user password and not the enable password.

share|improve this answer
add comment

I was confused by this as well but it turns out you just have to enter the password twice.

user test pass rootbeer priv 15

The user test will login and then when prompted for the enable password the user will enter rootbeer

share|improve this answer
    
Thank you very much :) That is exactly what I was missing. –  Alain O'Dea Nov 15 '11 at 12:42
    
@evolvd The "enter the password twice" is contingent on differing scenarios. I have attempted to explain the scenarios with examples in an answer. –  Weaver Nov 28 '11 at 6:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.