topic Re: AAA Console - Prevent lockout in Network Access Control

AAA Console - Prevent lockout

manishbhanushali — Thu, 14 Nov 2019 10:39:43 GMT

Hello Team,

I have a Cisco Nexus 5k switch. Currently I have AAA configuration as below :

aaa group server tacacs+ ACS_Server
aaa authentication login default group ACS_Server local
aaa authentication login console local
aaa authorization config-commands default group ACS_Server local
aaa authorization commands default group ACS_Server local
aaa accounting default group ACS_Server local

Now my aim is to be change the TACACS+ authentication from ACS to ISE.
To facilitate this, I will login via Console, modify the ACS_Server IP address to Cisco ISE IP address. Rest configuration will remain as it is.

Now my question is : Is there a possibility that I can get locked out using the Console login?

Re: AAA Console - Prevent lockout

Jaderson Pessoa — Thu, 14 Nov 2019 11:46:47 GMT

No, if you change from ACS to ISE, console still available because will be use local authentication. Just VTY will be locked until you have rules and profile configured on ISE.

Regards,

Re: AAA Console - Prevent lockout

manishbhanushali — Thu, 14 Nov 2019 12:31:21 GMT

Thank you Jaderson for the prompt reply.
I agree that authentication will work fine, but can can there be authorization related issues for console login?
As far as I know, authorization for console login is disabled unless we explicitly mention it.
But I am not sure what affect below 2 commands will have :

aaa authorization config-commands default group ACS_Server local
aaa authorization commands default group ACS_Server local

Please advise. Thank you.

Re: AAA Console - Prevent lockout

Jaderson Pessoa — Thu, 14 Nov 2019 16:01:18 GMT

Well, if you ISE do not have configured properly... local login / authorization will be used accoding your configuration.
in short words: you'll be able to connect an change anything if your ISE do not have necessary configuration.

Re: AAA Console - Prevent lockout

farhanalikhan80 — Fri, 15 Nov 2019 09:06:07 GMT

aaa new-model

aaa authentication login NO-Auth none

line con 0