Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA 5540 running the following Software/Manager version:

  • Cisco Adaptive Security Appliance Software Version 8.2(2)17
  • Device Manager Version 6.3(2)

I use ASDM to make changes to the firewall on a constant basis with no issues. Recently, I needed to SSH into the firewall to make some more technical changes and after login with my ACS credentials I go ahead and try to enable (priv mode) and get a Access Denied.

I know the password I am using is correct... but I figure I'll just change it rq. So I decide to login to the ASDM and change the password through the [Configuration > Device Setup > Device Name/Password] section.

I put in the old password followed by the new password and the confirmed NEW password. Apply the configuration and save it to the flash memory (No errors that the old password was wrong). Everything saves fine and the new password has been changed. I can even use ASDM's CLI to issue a show running-config enable and see my newly encrypted password. Mind you I have the following in my running-config:

enable password xxxx1HNMUkxxxx encrypted
passwd xxxxaUTcbVSxxxxx encrypted

So I changed the enable password, not the normal passwd. I again SSH into the firewall with my ACS credentials and proceed to issue the enable command followed by the newly set password. Access Denied!

Any insight, suggestions, even jokes... I'm really looking at any feedback at this point.

share|improve this question
Isn't it enable secret? – Lucas Kauffman Jul 31 '12 at 21:38
Enable secret doesnt work on the ASA 5540. Result of the command: "enable secret" enable secret ^ ERROR: % Invalid input detected at '^' marker. Result of the command: "enable ?" configure mode commands/options: password Configure password for the enable command – Anonymous Jul 31 '12 at 22:31

The password you need to use to login / enable entirely depends on the configuration of your ASA... For instance this configuration requires that you enable with the local login password of the user who logged in...

aaa authentication ssh console LOCAL
! enable console LOCAL requires the user's password for enable
aaa authentication enable console LOCAL 
aaa authentication http console LOCAL 
aaa authorization command LOCAL
username mpenning password <some_hashed_password> encrypted privilege 15

If your enable password is not working, I assume someone has configured the system to use the local / Cisco ACS user's password to enable.

share|improve this answer

Your enable password will not be the enable password you specified in the config, it should be the user's password provided that user has privilege level 15 access.

share|improve this answer
If there are usernames entered in the config or an external auth server, the pix will use their password for the enable secret. They did change something a while back where ssh was concerned requiring a user account. In older ASA/PIX code you could ssh to the device without a user account and use the password and enable secret combo but this is no longer possible with current versions. – Bad Dos Aug 1 '12 at 18:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.