topic Re: I have used a similar in Network Access Control

Test local authentication when TACACS is active

Tom Ribbens — Mon, 11 Mar 2019 05:02:47 GMT

Hi all,

we have a lot of devices here configured to authenticate using TACACS. This all works fine. The documentation covering these devices could be improved however. One thing I was thinking of putting in that documentation, is the passwords that are configured when TACACS is not available.

Is there a way to test the local login credentials, without altering anything on the TACACS configuration?

Kind regards,

Tom

Hi Tom, i configure a NULL0

hdussa — Mon, 13 Oct 2014 11:25:35 GMT

Hi Tom,

i configure a NULL0 route on the Layer 3 device.

ip route w.x.y.z 255.255.255.255 Null0 (ip address of your TACACS)

Regards Horst

I have used a similar

Marvin Rhoads — Mon, 13 Oct 2014 13:33:10 GMT

I have used a similar approach to Horst's suggestion except with an upstream ACL blocking access to the TACACS server(s). The device should try and fail to authenticate via TACACS and then fall back to local authentication.

If I recall correctly, it takes about 30 seconds per configured TACACS server to mark it failed so be patient.

Both valid solutions to the

nspasov — Wed, 15 Oct 2014 05:30:08 GMT

Both valid solutions to the question! I have always changed the aaa shared secret or other part of my config but I like what you guys are suggesting!

Re: I have used a similar

wirelesscharging — Wed, 30 Oct 2024 04:09:20 GMT

Old comment but I have to chime in and say this is a great solution thanks for sharing.