Enabling local console access when TACACS is enabled

[aniket0422]

Hi All,

I am configuring new switch. i have done basis line vty configuration as below. 

#username cisco password cisco
#enable secret cisco
#service password-encryption
#line vty 0 4
#login local
#transport input all
#save

When i logged in next time switch asked me for username and password. I entered cisco cisco and i was able to logged into the switch.

Then i enabled TACACS and entered all the TACACS configuration as per customer requirement. I am able to log into the switch through telnet/ssh using TACACS username and password. But i lost my console access using local username and password i.e. cisco cisco.

I want my local username and password i have created i.e cisco cisco to work on telnet/ssh/console even whren TACACS is enable. How can i achieve this ? 

Atleast when my TACACS login not working i should be able to console log into the switch using local username and password. 

[Richard Burts]

Thanks for the additional information. If the tech user is able to login when the authentication server is not available and not able to login when the authentication server is available it suggests that the issue may be with the authentication server and not with your switch. I have several questions and suggestions:

- is the problem just with the tech user? Are other users successful to login to the switch when the authentication server is available?

- at a time when the authentication server is available have the tech user attempt to login and then check the logs from the authentication server and see if any logs are generated relating to this attempt.

- check in the authentication server and verify whether the tech user has an appropriate entry in the authentication server.

[BNedved]

The Tech user doesn't have an entry on the authentication server. I wanted it to be an account separate from the server. None of the local users work unless the server is unavailable. 

[Richard Burts]

This clarification is helpful. Normally when you implement tacacs you would put most of the user IDs into the authentication server (with perhaps one or two IDs configured locally to use if tacacs is not available). But you want some users to authenticate using tacacs while other users authenticate locally.

In one of your posts I see

line con 0
login authentication local-auth

In this case local-auth would be an alternative method for authenticating. Have you configured an authentication list local-auth? If so what is in it?

As a first step in finding a solution I suggest that you change your default authentication to be something like this

aaa authentication login default local group tacacs+ enable

Try that and let us know if the tech user is able to login. (they probably can not get into privilege mode but that would be another step and lets make sure that the first one works)