Device Policy Sets - tacacs ports 443 and 22

[creserva1]

Hi

The version of ISE 2.3.0.298 that I am using. I have two policy first one is ASDM-Policy so when we use port 443 we want that policy and the second policy is ASA-Policy this is for SSH that will use port 22.

The ASDM-Policy worked except the authentication policy it uses some random ports example is 59502592 and second for authorization it uses port 0. Does anyone had similar issues? Thanks

[hslai]

Yes, I've seen the same. That is one reason why the ASDM policy set is for T+ Authorization only in How To: ISE TACACS+ Configuration for ASA Network Devices. If you need it differ from SSH, you might consider a catch-all policy set.

[creserva1]

I would like to use different command sets and different shell profile for asdm and ssh. I am using internal and AD for authentication. I have tried different policy combination that policy asdm will use this command sets and profile if using 443 ports. And if using port 22 use different command sets and shell profile.

[hslai]

Granting command sets and shell profiles are part of T+ authorization so you should be all set.

[creserva1]

I followed that steps. When the asdm policy cathed, applied authorization for asdm command sets. When that takes placed, the authorization for ssh does not get apply.

[hslai · Accepted solution]

In the how-to guide, I am using two policy sets:

1. ASDM Authz
   • Conditions (AND together):
     • DEVICE:Device Type EQUALS Device#All Device Types#ASA
     • TACACS:Type EQUALS Authorization
     • TACACS:Port EQUALS 443
2. ASA Regular (Catch All)
   • Condition:
     • DEVICE:Device Type EQUALS Device#All Device Types#ASA

It's this way because only the ADSM authorization needs special treatment or at least in my logics. The authentications for both SSH and ASDM and the authorization for SSH may share the same policy set.

If you need to make other exceptions by creating another policy set, then it has to be above the Catch-All one. Please use the T+ live logs and authentication details report to troubleshoot.

[creserva1]

I got it all figured out. The default policy does share it asdm policy for authentication. It is sourcing with random ports when it does it uses the default policy auth then sourcing with 443 then that uses authorization for asdm.