Cisco Radius Authentication using Windows 2012 NPS

Ivan Rivai — Fri, 21 Feb 2020 18:56:56 GMT

Hello.

I'm curious about something. I'm going to apply radius authentication using windows NPS, due to the easiness of password policy. The authentication works perfectly, but i got something in mind.

I configured aaa authentication fallback to local at the cisco devices when the radius server is unreachable. But i have a policy that the users have to change the password every 3 months. So when the user expires, we can't ssh to the devices. How can we make it fallback to local authentication, when the radius is reachable? because what i understand is that the authentication will fallback to local only when the radius server is unreachable.

Thank you.

Regards,

Ivan

Re: Cisco Radius Authentication using Windows 2012 NPS

RichardAtkin — Fri, 25 May 2018 08:20:23 GMT

You can make it check the local DB first, then RADIUS second... but I think that's about as close as you can get to your use case.

Discussion about that approach here;

https://supportforums.cisco.com/t5/wan-routing-and-switching/auth-radius-fallback-to-local/td-p/2111292

topic Cisco Radius Authentication using Windows 2012 NPS in Network Access Control

Cisco Radius Authentication using Windows 2012 NPS

Re: Cisco Radius Authentication using Windows 2012 NPS