02-05-2004 11:20 AM - edited 03-10-2019 07:39 AM
I have IOS switches that I would like to use tacacs for authentication of the network admins.
That is cionfigured and working.
I am having trouble configuring a second form of authentication if TACACS servers aren't available.
I would like to use the telnet and enable passwords that are already on the switches for this.
However I can't get that to work. I disable the ACS server and try to login to the switch, but the switch responds "access denied" after I enter the line password.
Here is my config and a debug of a failed attempt.
the xxx.xxx.xxx.xxx are my ACS servers and yyy.yyy.yyy.yyy is my laptop.
Any help would be appreciated!
aaa new-model
aaa authentication login default group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
Feb 5 14:06:14: AAA: parse name=tty2 idb type=-1 tty=-1
Feb 5 14:06:14: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=
2 channel=0
Feb 5 14:06:14: AAA/MEMORY: create_user (0x80CD9D78) user='' ruser='' port='tty
2' rem_addr='yyy.yyy.yyy.yyy' authen_type=ASCII service=LOGIN priv=1
Feb 5 14:06:14: AAA/AUTHEN/START (223853451): port='tty2' list='' action=LOGIN
service=LOGIN
Feb 5 14:06:14: AAA/AUTHEN/START (223853451): using "default" list
Feb 5 14:06:14: AAA/AUTHEN/START (223853451): Method=tacacs+ (tacacs+)
Feb 5 14:06:14: TAC+: send AUTHEN/START packet ver=192 id=223853451
Feb 5 14:06:14: TAC+: Using default tacacs server-group "tacacs+" list.
Feb 5 14:06:14: TAC+: Opening TCP/IP to xxx.xxx.xxx.xxx/49 timeout=5
Feb 5 14:06:19: TAC+: TCP/IP open to xxx.xxx.xxx.xxx/49 failed -- Connection tim
ed out; remote host not responding
Feb 5 14:06:19: TAC+: Opening TCP/IP to xxx.xxx.xxx.xxx/49 timeout=5
Feb 5 14:06:27: TAC+: TCP/IP open to xxx.xxx.xxx.xxx/49 failed -- Connection tim
ed out; remote host not responding
Feb 5 14:06:27: AAA/AUTHEN (223853451): status = ERROR
Feb 5 14:06:27: AAA/AUTHEN/START (223853451): Method=LINE
Feb 5 14:06:27: AAA/AUTHEN (223853451): status = GETPASS
Feb 5 14:06:36: AAA/AUTHEN/ABORT: (223853451) because Carrier dropped.
Feb 5 14:06:36: AAA/MEMORY: free_user (0x80CD9D78) user='' ruser='' port='tty2'
rem_addr='yyy.yyy.yyy.yyy' authen_type=ASCII service=LOGIN p
02-05-2004 01:39 PM
This line:
"aaa authorization exec default group tacacs+ local"
is stopping you from creating telnet session.
The "local" at the end of that line refers to the local user database which can be created on the router. Here's an example:
!
username john password xxxx
!
To use the line password as fallback change that line to:
"aaa authorization exec default group tacacs+ none"
The main problem with using a local userdatabase as a fallback is that the prompt looks exactly the same as tacacs, so you wouldn't know if the ACS tacacs server is up or not.
Cheers
02-06-2004 06:07 AM
Thanks!
Worked perfect.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide