AAA failover configuration

ronald.change · ‎02-05-2004

I have IOS switches that I would like to use tacacs for authentication of the network admins.

That is cionfigured and working.

I am having trouble configuring a second form of authentication if TACACS servers aren't available.

I would like to use the telnet and enable passwords that are already on the switches for this.

However I can't get that to work. I disable the ACS server and try to login to the switch, but the switch responds "access denied" after I enter the line password.

Here is my config and a debug of a failed attempt.

the xxx.xxx.xxx.xxx are my ACS servers and yyy.yyy.yyy.yyy is my laptop.

Any help would be appreciated!

aaa new-model

aaa authentication login default group tacacs+ line

aaa authentication enable default group tacacs+ enable

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

Feb 5 14:06:14: AAA: parse name=tty2 idb type=-1 tty=-1

Feb 5 14:06:14: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=

2 channel=0

Feb 5 14:06:14: AAA/MEMORY: create_user (0x80CD9D78) user='' ruser='' port='tty

2' rem_addr='yyy.yyy.yyy.yyy' authen_type=ASCII service=LOGIN priv=1

Feb 5 14:06:14: AAA/AUTHEN/START (223853451): port='tty2' list='' action=LOGIN

service=LOGIN

Feb 5 14:06:14: AAA/AUTHEN/START (223853451): using "default" list

Feb 5 14:06:14: AAA/AUTHEN/START (223853451): Method=tacacs+ (tacacs+)

Feb 5 14:06:14: TAC+: send AUTHEN/START packet ver=192 id=223853451

Feb 5 14:06:14: TAC+: Using default tacacs server-group "tacacs+" list.

Feb 5 14:06:14: TAC+: Opening TCP/IP to xxx.xxx.xxx.xxx/49 timeout=5

Feb 5 14:06:19: TAC+: TCP/IP open to xxx.xxx.xxx.xxx/49 failed -- Connection tim

ed out; remote host not responding

Feb 5 14:06:19: TAC+: Opening TCP/IP to xxx.xxx.xxx.xxx/49 timeout=5

Feb 5 14:06:27: TAC+: TCP/IP open to xxx.xxx.xxx.xxx/49 failed -- Connection tim

ed out; remote host not responding

Feb 5 14:06:27: AAA/AUTHEN (223853451): status = ERROR

Feb 5 14:06:27: AAA/AUTHEN/START (223853451): Method=LINE

Feb 5 14:06:27: AAA/AUTHEN (223853451): status = GETPASS

Feb 5 14:06:36: AAA/AUTHEN/ABORT: (223853451) because Carrier dropped.

Feb 5 14:06:36: AAA/MEMORY: free_user (0x80CD9D78) user='' ruser='' port='tty2'

rem_addr='yyy.yyy.yyy.yyy' authen_type=ASCII service=LOGIN p

pvanvuuren · ‎02-05-2004

This line:

"aaa authorization exec default group tacacs+ local"

is stopping you from creating telnet session.

The "local" at the end of that line refers to the local user database which can be created on the router. Here's an example:

!

username john password xxxx

!

To use the line password as fallback change that line to:

"aaa authorization exec default group tacacs+ none"

The main problem with using a local userdatabase as a fallback is that the prompt looks exactly the same as tacacs, so you wouldn't know if the ACS tacacs server is up or not.

Cheers

ronald.change · ‎02-06-2004

Thanks!

Worked perfect.