topic Re: local username and password if ACS server fails in Network Access Control

local username and password if ACS server fails

ohareka70 — Mon, 11 Mar 2019 00:59:17 GMT

Hello,

I have every router and switch setup for login authentication via the ACS server. I have used these 12 lines below and it is working fine. Every engineer has their own account.

aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authorization exec default if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa session-id common

tacacs-server host x.x.x.x
tacacs-server directed-request
tacacs-server key WHATEVER

----------------------------------------------

I would like to add to this a local username and password so that if the ACS server was offline the engineers would still have to login with a default username and password i.e

username MYUSERNAME privilege 15 secret mypassword

line vty 0 4
login local

Q. How do i do this so ACS server has first preference and users only login with local username and password if the ACS server is down?

regards,

Kevin

Re: local username and password if ACS server fails

Javier Henderson — Wed, 13 Apr 2011 16:46:52 GMT

Right now you have the enable password as the fall back method:

aaa authentication login default group tacacs+ enable

Change "enable" to "local" and the local (on the router) database of usernames and passwords will be used.

The same works for enable authentication (the second "aaa authentication ..." line in the config you posted).

Re: local username and password if ACS server fails

ohareka70 — Tue, 19 Apr 2011 10:48:05 GMT

Javier,

I did try this and what this does is let me login with the local account but bypasses the tacacs account. I want it to use the Tacacs account first and only use the local account when the Tacacs account fails. Maybe this is not possible.

If i put it back to the way it was and stop the ACS server then it falls back to the enable password on the router.

thanks

Kevin

Re: local username and password if ACS server fails

andamani — Wed, 20 Apr 2011 13:59:12 GMT

Hi Kevin,

Please do the following:

line vty 0 4

no login local

no aaa authentication login default group tacacs+ enable
no aaa authentication enable default group tacacs+ enable

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ local

In this case the authentication will head to your tacacs server first and then to local only if the TACACS server is down.

Hope this helps.

Regards,

Anisha

P.S.: Please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

Re: local username and password if ACS server fails

ohareka70 — Wed, 20 Apr 2011 15:40:38 GMT

Anisha,

The first line was ok but it wont accept the second line: aaa authentication enable default group tacacs+ local

so i have had to leave it as aaa authentication enable default group tacacs+ enable until i work out why its wont accept the command.

I tested the config on one switch by turning off Tacacs for that one switch. It prompted me for the local username and password and i logged in ok. But i had to login with the enable password on the router until i work why the line above in bold wont go on the switch.

The switch involved is a C2960 Software (C2960-LANBASE-M), Version 12.2(35)SE5.

Any ideas why it wont accept aaa authentication enable default group tacacs+ local

Did that line work ok on your switch / router config?

regards,

Kevin

Re: local username and password if ACS server fails

andamani — Wed, 20 Apr 2011 16:27:10 GMT

Hi Kevin,

My apologizes.. the command you have is correct . The local option is not present for enable authentication.

hope this helps.

Regards,

Anisha

Re: local username and password if ACS server fails

ohareka70 — Thu, 21 Apr 2011 08:40:31 GMT

Happy enough now that i have a config that will do the job.

thanks

Kevin