Tacacs+ on Line Con 0

[Steven Williams]

When configuring tacacs for a 2900 router what is the command that needs to be set to make sure console access uses tacacs first and if it cant reach tacacs server it will use local auth?

[balaji.bandi]

here is example modify as per your requirement.

aaa authentication login bb-network group tacacs+ local

ine vty 0 15

login authentication bb-network

line console 0

login authentication bb-network

[Steven Williams]

I get this error when I attempt this:

2960-01(config-line)#login authentication TACACS_SERVERS
AAA: Warning authentication list "TACACS_SERVERS" is not defined for LOGIN.

aaa group server tacacs+ TACACS_SERVERS
server-private 10.20.0.85 key ****
server-private 10.81.3.25 key ****
ip tacacs source-interface Vlan763
!
aaa authentication login default group TACACS_SERVERS local
aaa authentication login CONSOLE group TACACS_SERVERS local
aaa authentication enable default group TACACS_SERVERS enable
aaa authorization console
aaa authorization exec default group TACACS_SERVERS local
aaa authorization commands 0 15 group TACACS_SERVERS local
aaa accounting exec default start-stop group TACACS_SERVERS
aaa accounting commands 1 default start-stop group TACACS_SERVERS
aaa accounting commands 15 default start-stop group TACACS_SERVERS
aaa accounting connection default start-stop group TACACS_SERVERS

[balaji.bandi]

have you tried

login authentication default

and test and advise

[Steven Williams]

OK that worked. But why wouldnt the named instance work I wonder?

[balaji.bandi]

i had same issue some time back, the command was fixed. i could not get chance to investigate further.

Hope this is helpful, if this resolve make it as resolve for other community users can refer if this solution works.

[Richard Burts]

The original poster asks why the named method did not work. We have only partial information and there might be something that we do not know which would change the answer. But based on the information given here is my explanation. I am assuming that in the commands given that we are in ling config mode for line con 0

login authentication TACACS_SERVERS

this would be pointing to a named access method TACACS_SERVERS

But TACACS_SERVERS is a server group and not a named access method.

We are given this in the partial config

aaa authentication login CONSOLE group TACACS_SERVERS local

so we have a named access method called CONSOLE which suggests that it was intended to specify the authentication on the console. So if the command at the very beginning had been (assuming that we are in line config mode for line con 0)

login authentication CONSOLE

then I believe that it would have worked.

HTH

Rick

[edit] the suggestion from BB to use login authentication default works because the configured default authentication method has the same parameters as the CONSOLE method