topic Re: Unable to remove radius-server attribute command in Network Access Control

Unable to remove radius-server attribute command

Massimo Baschieri — Tue, 03 May 2022 17:45:25 GMT

Hi all,

taking advantage of cisco prime I issued by mistake on several switches the folowing command:

radius-server attribute 32 include-in-access-req

Strangely enough now I'm unable to remove the command on all ios switch models, I tried the obvious "no" form of the command with no luck, I also tried to completely remove "aaa new-model" on the switch, which completely removes any aaa command from the switch, but once reapplied aaa new model the command is still there, that's kinda of a nightmare.

The only working way I've found is to copy startup-config to ftp server, edit the file and send it back to the switch startup-config, then reload the switct, but honestly I'd like to avoid such an annoying and risky task.

This happens on almost all switch models with ios 15.2.7(Ex).

Any idea?

Thanks.

Re: Unable to remove radius-server attribute command

MHM Cisco World — Tue, 03 May 2022 19:39:53 GMT

...
after I read your post you use cisco Prime no direct console to SW and config it ??
If yes then let me more check how solve this issue.

Re: Unable to remove radius-server attribute command

Flavio Miranda — Tue, 03 May 2022 18:02:43 GMT

I dont have solution for your case and I just want to share something similar that happen to me and it was a bug. I try to setup Catalyst Access Point using Prime 3.8 and after I reload the AP using Prime GUI, the AP died. Working with TAC, they have found a bug candidate for WLC 9800 that could explain the behavior. This Bug dont have an ID yet as far as I know but I never did such activity using Prime anymore.

And I did it many time in AIROS WLC like 5508 and 8540 with no problem.

Re: Unable to remove radius-server attribute command

Massimo Baschieri — Tue, 03 May 2022 18:58:53 GMT

@MHM Cisco World

Can you please elaborate step 1?

I'm not sure I understood your instructions.

Thanks.

Re: Unable to remove radius-server attribute command

MHM Cisco World — Tue, 03 May 2022 19:39:03 GMT

...

Re: Unable to remove radius-server attribute command

Massimo Baschieri — Tue, 03 May 2022 19:03:18 GMT

@Flavio Miranda

In my case cisco prime was responsible only for the massive deployment, the error was mine and the same would have happened if I entered the command manually on cli, except that I could have noticed the mistake after a few switches 🙂

Re: Unable to remove radius-server attribute command

Massimo Baschieri — Tue, 03 May 2022 19:37:01 GMT

Got it, I'll give it a try this weekend.

Re: Unable to remove radius-server attribute command

MHM Cisco World — Tue, 03 May 2022 20:10:19 GMT

please wait I will do more check for cisco prime and reply later.