SWITCH LOCAL USERS Failed auth when Server ISE is UP

[nzangba]

Hi guys, I'm currently configuring TACACS with ISE and running some integration tests. How do you handle switch access using local credentials? The switch rejects the local credentials as long as ISE is up. In the authentication configuration, I specified aaa authentication login default group TACACS_TEST local.

[Arne Bier]

That expected behaviour. What's the point of having AAA when you can bypass it with local creds?

Local creds ("local") or the enable password ("enable") are the final parameters of the aaa authentication command and indicate how to handle Authentication when none of the aaa group RADIUS servers respond.

[nzangba]

Thanks for your reply. I thought that if the user is not found in the ISE internal database, it would then check the switch’s local database and grant access if the user exists there.

[Arne Bier · Accepted solution]

Nope - if the IOS AAA succeeds in getting a response from any of the AAA servers in the AAA group, then the local IOS usernames or enable password will never be used.  AAA is regarded as better for security, because it allows centralised control and visibility. If you could get around it by logging in with local creds, then it would end in a catastrophe.

The AAA device admin server (e.g. ISE) can lookup credentials from many resources. such as its own local database, Active Directory, LDAP, ODBC, remote RADIUS servers. That's quite a lot.