cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
233
Views
5
Helpful
3
Replies
Highlighted
Beginner

Resetting local enable PW

I want to reset my local enable secret as it keeps denying me priv-exec mode when I console into the switch.  I know that when you need to log into a switch via console you either create a separate authentication profile or modify existing one as per below...

 

1.

aaa authentication login default group ABCD local

 

(OR)

 

2.

aaa authentication login console local

line con 0

login authentication console

 

However I see my switch actually has both of the above configured.  I believe that the first method trumps the second method.  Can I just delete the config shown in method 2 then configure enable secret Cisco1?

 

If I just configure enable secret Cisco1 (since I can still get into it when it's on the network) will this effectively change the local enable secret when logging in via console?

 

 

 

3 REPLIES 3
Highlighted
VIP Mentor

Depends on requirement, if you looking central authentication or you looking for console access to be local users ? rather radius ?

 

here is example and explained more :

 

https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html

BB
*** Rate All Helpful Responses ***
Highlighted

So if my config is as shown below, when logging in via console and successfully getting to the ROUTER> prompt, I need to enter the local enable secret password as defined below.  If what I think is the local enable secret isn't working, can I just go into it via SSH when it's online and change the enable secret?

 

enable secret 5 $1$SIGt$dNmBr.cBt8GZnI78QGNhF/
!
username engineer privilege 15 secret 5 $1$O7mK$rpO4vLzhxNeag/vcEVmIl0

!

aaa authentication login default group ABCD local
aaa authentication login CONSOLE local

aaa authentication enable default group ABCD enable

aaa authorization exec default group ABCD local if-authenticated

!

!

line con 0
exec-timeout 30 0
logging synchronous
login authentication CONSOLE
stopbits 1

Highlighted

Given the posted configuration you should be able to SSH to the device, in enable mode go into configuration mode and configure a new enable secret password. After making this change be sure to remember to copy running config to startup config.

HTH

Rick
Content for Community-Ad