topic Can't Console to device after configuration AAA in Network Access Control

Can't Console to device after configuration AAA

Jason Regan — Mon, 11 Mar 2019 03:30:12 GMT

I've been implementing ISE into my environment and since configuring my devices to authenticate against the server I h ave not been able to connect to the devices using the Console connection.

Below is a snippet of the config for the device.

username local-admin privilege 15 password 7 06205F334868591A1004

aaa new-model

aaa group server radius ISE_Servers

server 10.200.1.19 auth-port 1645 acct-port 1646

server 10.200.2.19 auth-port 1645 acct-port 1646

aaa authentication login default group ISE_Servers local

aaa authentication enable default group ISE_Servers enable

aaa authorization exec default group ISE_Servers local if-authenticated

aaa accounting send stop-record authentication failure

aaa accounting exec default start-stop group ISE_Servers

aaa accounting connection default start-stop group ISE_Servers

radius-server host 10.200.1.19 auth-port 1645 acct-port 1646 key 7 0231504919570126581E0754241411585951

radius-server host 10.200.2.19 auth-port 1645 acct-port 1646 key 7 097B1A1B0B5419151F5C0A670A272B606077

line con 0

exec-timeout 0 0

password 7 1068590B013142081917

line vty 0 4

password 7 096A1E1B1D2347111E1F

length 0

line vty 5 15

password 7 096A1E1B1D2347111E1F

Any assistance and/or advice would be greatly appreciated.

Thanks

Can't Console to device after configuration AAA

Jatin Katyal — Tue, 04 Jun 2013 13:23:00 GMT

What error message are you getting on ISE live authentication section?

aaa authentication login default group ISE_Servers local

The above command applies AAA on all the lines including console.

Would you like to exempt console from authentication. Do you have access to the device through telnet/ssh in case we need to make some changes or run the debugs?

Jatin Katyal
- Do rate helpful posts -

Can't Console to device after configuration AAA

nspasov — Tue, 04 Jun 2013 22:44:36 GMT

I think the problem is that you have created AAA authentication methods but you are not referencing/calling them in your console and vty sessions.

Try adding this and let me know what happens:

line con 0

login authentication ISE_Servers

Thank you for rating!

Can't Console to device after configuration AAA

Jatin Katyal — Wed, 05 Jun 2013 00:01:45 GMT

ISE_Servers is a name of radius-server group. He actually applied a default method-list.

aaa authentication login default group ISE_Servers local

Jatin Katyal
- Do rate helpful posts -

Can't Console to device after configuration AAA

nspasov — Wed, 05 Jun 2013 00:08:51 GMT

Ahh, you are absolutely correct! I misread the statement. So yes, the default group is being used. Please ignore my previous comment.

Can't Console to device after configuration AAA

Jason Regan — Wed, 05 Jun 2013 09:04:05 GMT

Thanks Jatin,

That is what the problemwas along with not applying to the VTY lines which left the Authentication as a global setting rather than per line.

Thanks agin for your help

Jason

Re: Can't Console to device after configuration AAA

Jatin Katyal — Wed, 05 Jun 2013 09:06:44 GMT

so have you now applied the method list on console line and exempt it from the AAA authentication.

Is that working now? All set?

Jatin Katyal
- Do rate helpful posts -

Can't Console to device after configuration AAA

Jason Regan — Thu, 06 Jun 2013 08:55:54 GMT

I've applied the Authentication to the VTY and just local login for the Console

All working now, many thanks

Can't Console to device after configuration AAA

Jatin Katyal — Thu, 06 Jun 2013 09:20:11 GMT

Glad. Good day ahead!

Jatin Katyal
- Do rate helpful posts -