AAA TACACS issue with console login

[Bilal Al-Sardar]

Hi Team,

I have AAA (TACCS+) configured between a switch and ISE. Using using the below configuration. I am trying to connect to the switch via console, what i'm getting is:

{

aaa authentication password-prompt Local-Password:

aaa authentication username-prompt Local-Username:

aaa authentication login default group ISE local

aaa authentication login console none

aaa authentication enable default group ISE enable

line con 0

login authentication console

}

Connecting via putty serial:

Switch>en

Username: local username (did not work)

Password: local password (did not work)

[enter]

Switch>en

Username: ISE local database username [e.g admin] (Works)

Password: ISE local database password of [e.g admin] user (works).

--------

Also, i have tried (local) instead of (none), it prompt to this:

username-prompt Local-Username: neither (local) nor (ISE user) works!

password-prompt Local-Password: 

The questions are:

• Why it is asking for user and password while I chose [none], am I missing something here?
• Can I used local OR none authentication?

Thanks,

[AminK]

Hi.

It is asking for user and password when you want to enter in enable mode. You didn't choose local database for that. You can set enable to read from local but a better workaround is:

username admin priv 15 secret cisco
aaa authentication login console local
line con 0
login authentication console

This way, you don't need to enter enable password everytime.

[Mancunian]

Hello,

If you want no authentication for both login and enable mode:

aaa authentication login console none
aaa authentication enable default none
line con 0
login authentication console

If you want to use locally defined accounts:

aaa authentication login console local
aaa authentication enable default local
line con 0
login authentication console

[Bilal Al-Sardar]

Hello,

The provided suggestions will not solve the issue. removing enable authentication will not only take effect on console but SSH as well. 

[Aref Alsouqi · Accepted solution]

I think the behaviour you are seeing comes from the fact that you have the enable secret managed via ISE and if you don't want to change that for the VTY lines then I think you can try to apply the command "privilege level 15" under the console line, this will take you to privilege mode right after you authenticate on the console line.

[Bilal Al-Sardar]

Voila!, it worked. Thanks a lot Aref. 

Regards,

[Aref Alsouqi]

You are very welcome, Bilal : )