topic AAA authentication preference in Network Access Control

AAA authentication preference

bapatsubodh — Mon, 11 Mar 2019 02:24:34 GMT

We have AAA configured as follows

aaa new-model

aaa authentication login default local group radius

aaa authentication enable default enable

aaa authorization exec default group radius if-authenticated

aaa session-id common

It was expected that switch will check the local username first and then Radius server. But it is not checking local username it's getting authenticated by RADUIS. even though default priority is for "local" and then "Radius group".

Please share the experience.

Thanks,

-Subodh

AAA authentication preference

Karsten Iwen — Fri, 10 Aug 2012 19:09:35 GMT

With the command "aaa authentication login default local group radius" the local database is checked first and RADIUS is the fallback. But there is a "feature" that is sometimes not expected. If the user is not found in the local database the authentication is not rejected, but passed to the next method which is RADIUS.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni