Local login if TACACS server down

[aruzsi]

Hi,

My config is:

...

username user1 privilege 15 password 7 pwd

...

aaa authentication login vtymethod group tacacs+ local enable

...

password 7 pwd_vty

login authentication vtymethod

When the Tacacs server disappeared from the network

(because of missing route to it) I wasn't able to login by telnet so I was locked out.

What is the right config for this situation?

I thought if Tacacs server is down, next possibility will be local user DB and the last resort is the enable password.

Thanks,

Ruzsi

[Richard Burts]

The amount of config that you posted is not enough to see clearly what the problem is. Please post the complete config of aaa, the complete config of line con 0, and the complete config of the vty lines.

It looks to me like you are on the right track and it should have worked. I have configured many routers similar to this and they have worked properly (local authentication if the tacacs server was not available).

Post the configss and perhaps we can figure out why it did not work.

It might also be helpful to configure logging buffered, turn on debug aaa authentication, disable the tacacs server, attempt to telnet to the router, enable the tacacs server, telnet to the router, copy and post the debug output which will be in the logging buffer.

HTH

Rick