AAA and local user authentication

[ismailfayaz]

Hi,

I already have AAA authentication setup on my switch. And I can use local users to login when the AAA server is unreachable.

But I want to know if it is possible to use local users even when the AAA server is reachable. Something like first it checks the local users databse and if the user does not exists then fallback to AAA or vice versa.

Thanks.

[parsahoo]

Ismail, the authentication method you define act as a service. So only when the service is not avilable the method fallback to the next methond you define.

So in your case if the user account is not present in the local data base it will not fallback to aaa server.

aaa authentication login default local group radius

The same holds true if the user account is not there in the aaa server

aaa authentication login default group radius local

Only when the aaa server is not responding (service downe or not reachable) it will fallback to the local database.

Hope this helps!

[edwjames · Accepted solution]

Ismail,

This is your answer:

aaa authentication login default local group radius/tacacs

Parthapratim - A little correction,it will go to radius or tacacs + if the user is not present locally.

The local DB differs in the way fallback works which is the exception.

**Share your knowledge. It’s a way to achieve immortality.
--Dalai Lama**

Please Rate if helpful.
Regards
Ed

[ismailfayaz]

Edward,

Thanks for your reply.

It works perfectly.