topic Re: roll back operation : AAA deployment in Network Access Control

roll back operation : AAA deployment

xine xine — Sun, 10 Mar 2019 23:58:53 GMT

Hi !

we plan to deploy AAA function on our production network as requested by our policy (and by any good pratice) I had to plan a roll back plan is case of problem. After deployed command on our Core Catalyst switch in lab and successfully authenticate my user session it's looklike impossible to roll back and disable AAA function without reload the switch.

when I using the command

no aaa new-model
Active AAA sessions present
Cannot change to no aaa new-model while sessions still active

before I had issue this command I had removed all other AAA command from the configuration. I know if we reload the switch I will be able to removed aaa new-model command. I would like to avoid to reload the switch to undeploy this command. Someone could help me ?

Re: roll back operation : AAA deployment

Panos Kampanakis — Mon, 01 Mar 2010 16:19:31 GMT

This relates to defect CSCsu32327 and I am afraid there is nothing to do get rid of it other than rebooting.

The disabling of aaa new model has been deprecated.  New-model is a superset of old-model which is 15 years old.


I hope it helps.

PK

Re: roll back operation : AAA deployment

xine xine — Mon, 01 Mar 2010 16:38:35 GMT

Hi !

I had search in bug tool kit to view a description and patch availibility for this issue, that bug is not available to public only Cisco employes can view this bug description... is it exist some special reason to this ?

is a patch is plan to be available ?

Thanks a lot

Re: roll back operation : AAA deployment

Panos Kampanakis — Mon, 01 Mar 2010 16:58:02 GMT

It is already fixed in 12.2(33)SXI02.

So I guess an upgrade would fix it. But an upgrade would still reboot the switch.

So either of them will solve your problem.

I apologize for the bug not being external. The reason is that this is mostly a command design issue to fix since the command needs to be deprecated.

I hope it helps.

Re: roll back operation : AAA deployment

xine xine — Mon, 01 Mar 2010 17:10:32 GMT

Hi !

our 6509 currently running IOS s72033-ipservicesk9_wan-mz.122-33.SXI2a.bin, so it's looklike not fixed already ? or I miss understanding something in IOS naming version.....

Re: roll back operation : AAA deployment

Panos Kampanakis — Mon, 01 Mar 2010 17:36:05 GMT

Hmm, 2a is not the same as .2.

The command should be deprecated so if it exists in .2a probably it was not integrated in it, I believe.

Re: roll back operation : AAA deployment

xine xine — Mon, 01 Mar 2010 17:40:27 GMT

I know, but 2a should not suppose to include all patch on 2 ? Should I open a case with the TAC for that issue ?

Re: roll back operation : AAA deployment

Panos Kampanakis — Wed, 03 Mar 2010 01:41:01 GMT

I guess they are the only ones that can verify for sure.