Cisco ASA Series User Manual

1-31
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Servers and the Local Database
Monitoring AAA Servers
The following example shows how to define an LDAP attribute map. In this example, the security policy
specifies that users being authenticated through LDAP map the user record fields or parameters title and
company to the IETF-RADIUS service-type and privilege-level, respectively.
To define an LDAP attribute map, enter the following commands:
hostname(config)# ldap attribute-map admin-control
hostname(config-ldap-attribute-map)# map-name title IETF-RADIUS-Service-Type
hostname(config-ldap-attribute-map)# map-name company Privilege-Level
The following is sample output from the ldap-attribute-map command:
ldap attribute-map admin-control
map-name company Privilege-Level
map-name title IETF-Radius-Service-Type
To apply the LDAP attribute map to the LDAP AAA server, enter the following commands:
hostname(config)# aaa-server ldap-server (dmz1) host 10.20.30.1
hostname(config-aaa-server-host)# ldap-attribute-map admin-control
Note When an authenticated user tries administrative access to the ASA through ASDM, SSH, or Telnet, but
does not have the appropriate privilege level to do so, the ASA generates syslog message 113021. This
message informs the user that the attempted login failed because of inappropriate administrative
privileges.
Using TACACS+ Authentication
For information about how to configure TACACS+ authentication, see the “Configuring an External
TACACS+ Server” section on page 1-37.
Monitoring AAA Servers
To monitor AAA servers,enter one of the following commands:
Command Purpose
show aaa-server Shows the configured AAA server statistics.
To clear the AAA server configuration, enter the clear aaa-server
statistics command.
show running-config aaa-server Shows the AAA server running configuration.
To clear AAA server statistics, enter the clear configure aaa-server
command.
show running-config all ldap attribute-map Shows all LDAP attribute maps in the running configuration.
To clear all LDAP attribute maps in the running configuration, use the
clear configuration ldap attribute-map command.

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English