topic AAA unknown user behaviour in Network Access Control

AAA unknown user behaviour

syedaltaf.shah — Mon, 11 Mar 2019 02:00:30 GMT

Hello,

we have setup of AAA Cisco ACS 4.2, have noticed unusual behaviour of authentication,

When the user tries to authenticate using unknown username and password, the first time it will say fail and prompts for Enable Password.

but if the user is correct and password is not correct it asks for the username and password again.

Can any one help.?

Javier Henderson — Sun, 15 Apr 2012 16:25:46 GMT

Could you please post the router/switch configuration (at least the AAA relevant portions), and console output with the following debugs enabled:

debug aaa authentication

debug tacacs (or debug radius, depending on what protocol you're using)

syedaltaf.shah — Mon, 16 Apr 2012 04:20:00 GMT

Hi Javier,

here is the config,

aaa group server tacacs+ TACSRV

aaa authentication login default group TACSRV enable

aaa authentication login console none

aaa accouting exec default start-stop group TACSRV

aaa session-id common

i cannot see anything unusuall in debug,

you want me to paste the debug output also "??

syedaltaf.shah — Mon, 16 Apr 2012 05:48:19 GMT

Ok Thank you . i got the answer.

tacacs-server timeout 30

default is 5 sec, due to which it thinks the ACS Server is not reachable and prompts for enable password as per my config.