topic Re: Switch SSH access when AAA server down in Network Access Control

Switch SSH access when AAA server down

LeoMccoy — Wed, 26 Jul 2023 22:39:28 GMT

I'm able to manage the configuration of numerous switches in different buildings in our local area and have remote SSH access to them with the AAA server in another state across a WAN link for credential verification.

When, for various reasons, the AAA server or WAN link goes down, I am no longer able to access my local switches.

Is there a way to still gain management access using the switch local user database when this happens without having to travel to the switch and access via the console?

Re: Switch SSH access when AAA server down

Flavio Miranda — Wed, 26 Jul 2023 22:47:19 GMT

Hi @LeoMccoy

Yes, this is possible. Usually the first line for TACACS config looks like this

aaa authentication login default group tacacs local"

Where the local, means, local access.

Re: Switch SSH access when AAA server down

MHM Cisco World — Thu, 27 Jul 2023 21:00:21 GMT

username xxxx password xxxx << this mandatory
enable password xxxx << this mandatory

aaa authentication login default group tacacs local

Re: Switch SSH access when AAA server down

MHM Cisco World — Thu, 27 Jul 2023 21:06:26 GMT

Disconnect server and give try' and share result

Thanks

MHM

Re: Switch SSH access when AAA server down

LeoMccoy — Fri, 28 Jul 2023 18:56:25 GMT

I already had "username xxxx password xxxx" defined, this would be used for access when AAA server is down.

I agree, "enable password xxxx" should also be mandatory when AAA server is down if "aaa authentication enable default group tacacs+ enable" is also in use (which, for me, is in use).