local username and password if ACS server fails

[ohareka70]

Hello,

I have every router and switch setup for login authentication via the ACS server.  I have used these 12 lines below and it is working fine.  Every engineer has their own account.

aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authorization exec default if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa session-id common

tacacs-server host x.x.x.x
tacacs-server directed-request
tacacs-server key WHATEVER

----------------------------------------------

I would like to add to this a local username and password so that if the ACS server was offline the engineers would still have to login with a default username and password i.e

username MYUSERNAME privilege 15 secret mypassword

line vty 0 4
login local

Q.  How do i do this so ACS server has first preference and users only login with local username and password if the ACS server is down?

regards,

Kevin

[Javier Henderson · Accepted solution]

Right now you have the enable password as the fall back method:

aaa authentication login default group tacacs+ enable

Change "enable" to "local" and the local (on the router) database of usernames and passwords will be used.

The same works for enable authentication (the second "aaa authentication ..." line in the config you posted).

[ohareka70]

Javier,

I did try this and what this does is let me login with the local account but bypasses the tacacs account.  I want it to use the Tacacs account first and only use the local account when the Tacacs account fails.  Maybe this is not possible.

If i put it back to the way it was and stop the ACS server then it falls back to the enable password on the router.

thanks

Kevin

[andamani · Accepted solution]

Hi Kevin,

Please do the following:

line vty 0 4

no login local

no aaa authentication login default group tacacs+ enable
no aaa  authentication enable default group tacacs+ enable

aaa authentication login default group tacacs+ local
aaa  authentication enable default group tacacs+ local

In this case the authentication will head to your tacacs server first and then to local only if the TACACS server is down.

Hope this helps.

Regards,

Anisha

P.S.: Please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

[ohareka70]

Anisha,

The first line was ok but it wont accept the second line: aaa  authentication enable default group tacacs+ local

so i have had to leave it as aaa  authentication enable default group tacacs+ enable until i work out why its wont accept the command.

I tested the config on one switch by turning off Tacacs for that one switch.  It prompted me for the local username and password and i logged in ok.  But i had to login with the enable password on the router until i work why the line above in bold wont go on the switch.

The switch involved is a C2960 Software (C2960-LANBASE-M), Version 12.2(35)SE5.

Any ideas why it wont accept aaa  authentication enable default group tacacs+ local

Did that line work ok on your switch / router config?

regards,

Kevin

[andamani · Accepted solution]

Hi Kevin,

My apologizes.. the command you have is correct . The local option is not present for enable authentication.

hope this helps.

Regards,

Anisha

[ohareka70]

Happy enough now that i have a config that will do the job.

thanks

Kevin