topic AAA has slow login when device is not attached to network in Network Access Control

AAA has slow login when device is not attached to network

bret — Mon, 11 Mar 2019 01:57:57 GMT

I'm sure something is missing, but I've given it a stab and cant figure it out. Scenario: I am configuring a switch to be sent to a site. I have my cookie cutter config on it and its not connected to the network. When I login via ssh cable between laptop and switch - in it takes a really long time before I can get to privileged EXEC mode. I'm sure it is because the request to login can not communicate with the tacacs server. So I ask given the below config. What can I change to speed up the login for a device that can not communicate with tacacs?

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication enable default group tacacs+ enable

aaa authorization config-commands

aaa authorization exec default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa session-id common

Thanks!

AAA has slow login when device is not attached to network

Nicolas Darchis — Mon, 02 Apr 2012 18:41:46 GMT

I suggest reducing "tacacs-server timeout" and "tacacs-server retransmits".

It takes a long time because the IOS will retry and wait before declaring tacacs server dead. Reducing those timers, will reduce wait time.

Nicolas

AAA has slow login when device is not attached to network

bret — Mon, 02 Apr 2012 19:45:38 GMT

That didnt work Nicholas. I think the "tacacs-server retransmit" was depricated in 12.2 its not an option. I have tried the following and still nogo.

tacacs-server host x.x.x.x single-connection timeout 3

tacacs-server timeout 3

I timed it and it takes 10-30 seconds after I login before I get password prompt

when i put the password in it takes 10 seconds and puts me in user EXEC mode

I type enable and it takes 1 minute before I get a login prompt.

I thought since this was a new switch with time not configured that was the problem, so I configured it and still nogo. This is not a big deal it just bothers me not having an answer. Thanks for your help.

AAA has slow login when device is not attached to network

Eduardo Aliaga — Mon, 02 Apr 2012 21:02:57 GMT

You should try the "deadtime" command, by default = 0.

aaa group server tacacs ACS

server 10.10.10.10

deadtime 1

Please rate if it helps. Kind regards

Re: AAA has slow login when device is not attached to network

naivel.molewa — Mon, 09 Jul 2018 14:29:49 GMT

Since the device is not yet in the network, it's obvious that it wont reach tacacs servers specified(if specified, i don't see commands tacacs-server host x.x.x.x that specifies the servers) , the device will then hang till the it reaches tacacs timeout. i prefer leaving tacacs out until i confirm that i can reach tacacs servers when the device in the network.