topic Re: AAA and Cisco MDS switches......... in Network Access Control

AAA and Cisco MDS switches.........

SAK_Mohan — Sun, 10 Mar 2019 22:05:28 GMT

have configured Cisco ACS 4.0 (TACACS) with Windows AD for all Cisco MDS switches and it is working fine. But local "admin" access to the Cisco MDS switches via telnet is not working. At the same time , if I create a user with "network-admin" role locally, that works but not the default admin user.

Could anyone help me in this regard.

Re: AAA and Cisco MDS switches.........

hegleran — Thu, 12 Apr 2007 14:22:51 GMT

SAK Mohan,

Are you authenticating against local or line after tacacs? Local will authenticate to a local username/password. Line will authenticate to the password on the vty line.

Re: AAA and Cisco MDS switches.........

SAK_Mohan — Thu, 12 Apr 2007 14:31:01 GMT

blank

Re: AAA and Cisco MDS switches.........

SAK_Mohan — Thu, 12 Apr 2007 14:32:41 GMT

local. Below is the script I used to configure TACACS (Cisco ACS 4.0) on Cisco MDS switches.

----------------------------------------

config t

#---------------------------------------

# Enable TACACS+

#---------------------------------------

tacacs+ enable

tacacs-server host nnn.nnn.nnn.nnn key 0 xxxxxx

tacacs-server host mmm.mmm.mmm.mmm key 0 xxxxx

#--------------------------------------

# Specify TACACS+ Server groups

#---------------------------------------

aaa group server tacacs+ tacgrp

server nnn.nnn.nnn.nnn

server mmm.mmm.mmm.mmm

#---------------------------------------

aaa authentication login default group tacgrp

aaa authentication login console local

#---------------------------------------

# Enable TACACS+ Accounting

#---------------------------------------

aaa accounting default group tacgrp local

#---------------------------------------

end

copy running-config startup-config

----------------------------------------

Thanks

MOhan

Re: AAA and Cisco MDS switches.........

hegleran — Thu, 12 Apr 2007 14:44:52 GMT

Mohan,

Do you have a local username called admin created? Or are you trying to login as admin, and then using the vty password when there is no admin account created?

Re: AAA and Cisco MDS switches.........

SAK_Mohan — Thu, 12 Apr 2007 14:49:02 GMT

Thanks.....

Yes....it is there which is the default/local "admin" user that comes with Cisco MDS switches. I am using the right password.

This we need as a backdoor to Switches in case TACACS fails for some reason.

Thanks

MOhan

Re: AAA and Cisco MDS switches.........

colin.mcnamara — Thu, 12 Apr 2007 21:13:31 GMT

if you want it as a backdoor (for default login)

you need to add local at the end of your statement.

the following statement

aaa authentication login default group tacgrp

should be modified to

aaa authentication login default group tacgrp local

That will enable you to authenticate with a local account (assuming you have configured a local cli user) in the event of a AAA server outage.

--Colin

Re: AAA and Cisco MDS switches.........

SAK_Mohan — Thu, 12 Apr 2007 22:17:21 GMT

THat is what I haebeen tying to configure....but unfortunately "local" option after "aaa authentication login default group tacgrp" is not available in Cisco MDS if i press Tab.

One more thing is..without the local option , I am able to login using locally created users with "netwok-admin" role but not the default "admin" user.......

--Mohan