Cant enter enable mode after TACACS+ basic configuration - % Error in authentication

[prabhatei7]

Hello,

I have recently tried to configure TACACS+ on one of my Cisco switch WS-C3850-48T through remote login. After configuration I logged out of the switch and later when I was trying to login again it was showing enable password error. We have never set any enable password.

Below is the config done:-

aaa new-model
tacacs-server host 10.xx.xx.xx
tacacs-server key XXXXXXX
aaa authentication login default group tacacs+ local
line vty 0 15
login authentication default

Now today when I am again trying to login its now showing "% error in authentication". Yesterday it was giving enable password prompt but today its not even giving us password prompt. We have switched off our TACACS+ server and still not getting enable password prompt. Our environment is setup in a way that in every switch it doesnt asks for enable password.

Switch01>enable
% Error in authentication.

Now we just want to remove the above done configuration. Please suggest in order to resolve the above issue. And please let us know if there is any other solution apart from console login and how to do it ?

[andrewswanson]

Hi

If you can't access the switch terminal and have snmp enabled, you can try using "snmpset" to upload a new startip-config to the switch and then reload it.

Details are here:

https://www.ciscozine.com/send-cisco-commands-via-snmp/

I've used snmpset in the past to reload switches - only catch was that the soucre ip used to send the command must be permitted in any snmp acl on the switch.

hth
Andy

[prabhatei7]

Hi Andy,

Thank you for your swift response.

I just wanted to know that will I be able to use the command without enable mode. Because I'm not able to get into enable mode since I have configured tacacs on it.

I dont know why it's not allowing me to enter into enable mode and all passwords are failing.

I m able to login to the device but when I'm trying to get into enable mode it's not accepting any password. I just wanted to reload it because I have not saved the configuration for tacacs+ 

Switch is running fine and only problem is enable mode 

[Colby LeMaire · Accepted solution]

The "error in authentication" issue is related to authorization not being configured.  You configured aaa authentication but you also have to configure authorization so the switch knows what privilege level to put the user into.  The command you need is the "aaa authorization exec" method list.  You can point that to TACACS as well and just make sure your policy in ISE is returning an appropriate privilege level such as 15.