topic Hi, in Network Access Control

Best practice for reenabling AAA

raaffffii — Mon, 11 Mar 2019 06:38:14 GMT

Hi,

My question is about reenabling AAA on a device. I have a company A that had their devices and their AAA configuration. Now company A was bought by company B and the devices of company A are migrating to configuration standard of B. Network engineers of B receive access to A with line password and when they do aaa new-model they lock themselves as configuration of aaa was not removed but only turned of by "no aaa new-model".

I assume that best practice would be to instruct guys from A to remove whole config of AAA but lets say that I cannot do it. What's the best method to migrate to new aaa configuration?

Hi,

Aditya Ganjoo — Sun, 03 Apr 2016 07:59:36 GMT

Hi,

Could you share the sh run | in aaa output of the device ?

If not then you can go ahead and remove the aaa config for the A company and configure the new one for company B.

Since you have already used no aaa new-model that means you have turned off the AAA on the device.

Not sure why did you get lock out on the device ?

Regards,

Aditya

Please rate helpful posts.

Hi Aditya,

raaffffii — Sun, 03 Apr 2016 08:07:20 GMT

Hi Aditya,

Thank you for the answer. Both companies have their own ACS servers engineer from B has account only on ACS B. So when he enables aaa new-model when being logged in locally with a password old configuration takes into place. Old with aaa authorization so he now is unauthorized to do anything.

Hi,

Aditya Ganjoo — Sun, 03 Apr 2016 08:09:40 GMT

Hi,

Yes you are correct.

So you can go ahead with removing the aaa authorization command.

Regards,

Aditya

please rate helpful posts.

I don't know if you see this

raaffffii — Sun, 03 Apr 2016 08:19:57 GMT

I don't know if you see this but when you do "no aaa new-model" then all the commens that you configured aaa authentication, authorization are somehow hidden and not removed. When you reenable aaa by "aaa new-model" then they apear once again in config. So the engineer does not have a chance to remove them as he locks himself just after enabling aaa.

Hi,

Aditya Ganjoo — Sun, 03 Apr 2016 09:03:21 GMT

Hi,

How do you access the device ?

Is it via SSH/telnet/console ?

Regards,

Aditya

via telnet

raaffffii — Sun, 03 Apr 2016 11:06:53 GMT

via telnet

Hi,

Aditya Ganjoo — Sun, 03 Apr 2016 11:28:26 GMT

Hi,

Could you share the show run | in aaa and show run | sec vty config from the device ?

Regards,

Aditya