Cisco ACS 5.2 looses connectivity to AD - are there any ways to make this choose local?

[golly_wog]

Hi

I'm trying to configure ACS 5.2 so that should it loose connectivity to Active Directory it chooses the local authentication, however I can't seem to make this work.

Within ACS 5.2, Access-Policies, Access Services, Default Device Admin, Identity,

I have a single rule configured for any device that matches tacacs to use the identity source of Active Directory,

If authentication failed: Reject

If user not found: Reject

If process failed: Drop

When the ACS can not access Active Directory, when I debug TACACS authentication on any 65k or 2921 device I get "Received Authen status error"

According to the RFC this should try the next configued TACACS server, but it doesn't.

If the status equals TAC_PLUS_AUTHEN_STATUS_ERROR, then the host is indicating that it is experiencing an 
unrecoverable error and the authentication should proceed as if that host could not be contacted.

I want to make it clear, if the ACS device is un-available then the Cisco switch will choose local authentication, but if the ACS is available but it's link to AD is broken it seems there doesn't seem to be a way to get the device to timeout and fail over to local.

cheers

[jrabinow · Accepted solution]

In general this issue can be addressed by defining an identity sequence containing Active Directory and internal user data base so that if user is not found the internal user definition will be used. Problem will this approach is that is active directory is not accessible this is defined as a process failure and the identity sequence is existed and so the internal user record will not be accessed. In this case can configure the identity policy to proceed to authorization and can detect the case that a process failure has occured but the user has not yet been authenticated.

There is a CDETS opened on this issue and a feature defined for ACS 5.3 that will allow the authentication to continue to access the internal user database after a process error. ACS 5.3 will be available later in the year

[golly_wog]

Hi jrabinow

Many thanks for the excellent reply. Thank you so much, that clears it up.

cheers