topic Hi, Don't exactly know if in Network Access Control

Cannot remove radius server from Nexus

craig.petty — Mon, 11 Mar 2019 05:11:52 GMT

I'm trying to remove a radius server from a nexus switch, but it won't allow me.

My config

aaa authentication login default group radius 
no aaa user default-role 
aaa authentication login error-enable 
aaa authentication login mschapv2 enable 
radius-server key 7 "xxxxxxxxxx"
radius-server host 10.14.206.209 authentication accounting 
radius-server host 10.14.206.210 authentication accounting

When I try to remove a server

Nexus3K(config)# no radius-server host 10.14.206.210 authentication accounting
As this operation causes both accounting and authentication to be disabled for the server, it is denied.

Nexus3K(config)# no radius-server host 10.14.206.210 
server either belongs to group in use or default group
configuration for 10.14.206.210 could not be removed

I also tried doing a "no aaa authentication login default group radius" to disable radius authentication, and then removing the radius server, but that didn't work.

What am I doing wrong? thanks

Hi, Don't exactly know if

Robenneke — Wed, 19 Nov 2014 20:50:56 GMT

Hi,

Don't exactly know if this is the right way but tested it and managed to delete the radius server:

Enter configuration commands, one per line. End with CNTL/Z.
N7K-2(config)# aaa authentication login default group radius
N7K-2(config)# no aaa user default-role
N7K-2(config)# aaa authentication login error-enable
N7K-2(config)# aaa authentication login mschapv2 enable
N7K-2(config)# radius-server key 7 "xxxxxxxxxx"
N7K-2(config)# radius-server host 10.14.206.209 authentication accounting
N7K-2(config)# radius-server host 10.14.206.210 authentication accounting
N7K-2(config)#
N7K-2(config)#
N7K-2(config)# end
N7K-2#
N7K-2# conf t
Enter configuration commands, one per line. End with CNTL/Z.
N7K-2(config)# no radius-server host 10.14.206.210 authentication accounting
As this operation causes both accounting and authentication to be disabled for the server, it is denied.
N7K-2(config)#
N7K-2(config)# no aaa authentication login default group radius
N7K-2(config)#
N7K-2(config)# no radius-server host 10.14.206.210
N7K-2(config)#
N7K-2(config)# aaa authentication login default group radius
N7K-2(config)#
N7K-2(config)#
N7K-2(config)# sh run | i radius
radius-server key 7 "xxxxxxxxxx"
radius-server host 10.14.206.209 authentication accounting
aaa authentication login default group radius
N7K-2(config)#
N7K-2(config)# sh run | i aaa
aaa authentication login default group radius
no aaa user default-role
aaa authentication login error-enable
aaa authentication login mschapv2 enable
N7K-2(config)#

Kind regards...

Thanks, that worked. I

craig.petty — Wed, 19 Nov 2014 21:46:14 GMT

Thanks, that worked. I thought I had tried that, but I must have done this instead.

Nexus3K(config)# no aaa authentication login default group radius 
Nexus3K(config)# no radius-server host 10.14.206.210 authentication accounting
As this operation causes both accounting and authentication to be disabled for the server, it is denied.

If I remove the "authentication accounting" from my commend, then it works fine.

I had this problem and

Logan Kampsnider — Thu, 23 Jul 2015 14:46:32 GMT

I had this problem and removing the "aaa authentication login default group radius", as well as any other radius-related commands, did not work. I also verified that the default accounting and authentication mechanism was "local."

After some troubleshooting I found that you can remove the radius-server configurations by simply trying to only remove the host IP portion. So, instead of typing this:

no radius-server host 10.14.206.210 authentication accounting

you would type this:

no radius-server host 10.14.206.210

It worked for me. May help others.

Thanks,

Logan