topic Re: AAA locked out telnet in Network Access Control

AAA locked out telnet

jimb — Sun, 10 Mar 2019 14:56:45 GMT

We set up aaa on a remote router, but did not establish a local logon user and password. Now when we try to telnet to the router it asks for username and password. yeah, this was a stupid move on our part, but is there anyway to get around aaa to login via telnet without having to set up a physical console session?

Help would be appreciated.

Re: AAA locked out telnet

Richard Burts — Thu, 05 Aug 2004 16:57:38 GMT

Prompting for username and password is typical of aaa and is not typical of router without aaa. So I am not clear what your problem is. Have you attempted to login at the prompt with the username and password of someone who is configured in aaa to have access to that router?

I have seen one situation where authentication for access with telnet authenticated one way and authentication for access with SSH authenticated a different way. You might try accessing the router with SSH and see if it makes any difference.

HTH

Rick

Re: AAA locked out telnet

a.awan — Thu, 05 Aug 2004 17:29:26 GMT

Can you post the exact configuration you put on the vty lines? Which vty lines did you put this configuration on? If there are some unconfigured vty lines left you might be able to get into using your old password provided you busy out the vty lines configured for AAA/local combination.

Re: AAA locked out telnet

Steve Fuller — Sun, 08 Aug 2004 07:32:30 GMT

Assuming you have SNMP access to this device you could upload a new configuration to the router with the local username you want, or without the AAA commands you entered that locked you out in the first place.

If the device is managed in RME you can use the "cwconfig" command to upload the required configuration. The command systax is:

cwconfig import -u -p -device -f

The contains the additional commands that you want added to the router configuration. This could be the required "username" command or simply "no aaa new-model".

Take a read of http://www.cisco.com/en/US/partner/products/sw/cscowork/ps2073/products_tech_note09186a0080107e05.shtml for more info.

If you don't have RME, there's also the SolarWinds Config Upload Tool(http://www.solarwindsuk.net/toolsets/solarwinds-config-uploader.htm#).

Regards

Re: AAA locked out telnet

wantechdean — Mon, 09 Aug 2004 01:20:32 GMT

If you added aaa config and then logged out (without saving) to test . You can have the PIX rebooted to revert back to previous config (no aaa).

Re: AAA locked out telnet

Steve Fuller — Thu, 12 Aug 2004 15:27:09 GMT

Again with SNMP access, you can follow the "Copy a Configuration File from the TFTP Server to the Router" procedure described at http://www.cisco.com/en/US/partner/tech/tk648/tk362/technologies_tech_note09186a008009463e.shtml#copying2

Regards