Unable to remove radius-server attribute command

[Massimo Baschieri]

Hi all,

taking advantage of cisco prime I issued by mistake on several switches the folowing command:

radius-server attribute 32 include-in-access-req

Strangely enough now I'm unable to remove the command on all ios switch models, I tried the obvious "no" form of the command with no luck, I also tried to completely remove "aaa new-model" on the switch, which completely removes any aaa command from the switch, but once reapplied aaa new model the command is still there, that's kinda of a nightmare.

The only working way I've found is to copy startup-config to ftp server, edit the file and send it back to the switch startup-config, then reload the switct, but honestly I'd like to avoid such an annoying and risky task.

This happens on almost all switch models with ios 15.2.7(Ex).

Any idea?

Thanks.  

[MHM Cisco World]

...
after I read your post you use cisco Prime no direct console to SW and config it ??
If yes then let me more check how solve this issue.

[Massimo Baschieri]

@MHM Cisco World 

Can you please elaborate step 1?

I'm not sure I understood your instructions.

Thanks.

[MHM Cisco World]

...

[Massimo Baschieri]

Got it, I'll give it a try this weekend.

[MHM Cisco World]

please wait I will do more check for cisco prime and reply later.

[Flavio Miranda]

I dont have solution for your case and I just want to share something similar that happen to me and it was a bug. I try to setup Catalyst Access Point using Prime 3.8 and after I reload the AP using Prime GUI, the AP died.  Working with TAC, they have found a bug candidate for WLC 9800 that could explain the behavior. This Bug dont have an ID  yet as far as I know but I never did such activity using Prime anymore.

 And I did it many time in AIROS WLC like 5508 and 8540 with no problem.

[Massimo Baschieri]

@Flavio Miranda 

In my case cisco prime was responsible only for the massive deployment, the error was mine and the same would have happened if I entered the command manually on cli, except that I could have noticed the mistake after a few switches