Core issue
This issue occurs due to the presence of Cisco bug ID CSCsc49958.
The Authentication, Authorization, and Accounting (AAA) authentication fallback method to enable a password does not work properly in this scenario. If the RADIUS server is not available, then the user password that was typed originally for RADIUS authentication is cached and automatically used for the enable password. This causes the authentication to fail for the fallback enable method. The user is prompted again for their RADIUS account information, so this user is locked out.
This issue was first found in Cisco IOS Software Releases 12.3(2) and 12.3(3.1)T. Refer to all affected versions for a list of all Cisco IOS Software releases affected by this bug.
Resolution
As a workaround, perform one of these steps:
- If the RADIUS server is unavailable, enter any username and use the enable password as the user password.
- Download and upgrade the Cisco IOS version to any one of these versions:
- 12.2(28)SB
- 12.4(5.11)T
- 12.4(5.13)
- 12.3(17.6)
- 12.3(14)T06
- 12.4(03c)
- 12.4(2)T04
- 12.2(28)ZV
- 12.4(4)T02
- 12.4(05b)
