Is it possible to use tacacs and local authentication at the same time on nexus 9000 platform?

[Samuele Leardini]

Hi,

I need to configure a Nexus 9000 switch ( N9K-C9348GC-FXP - release 7.0(3)I7(3) ) to authenticate one or more users using TACACS and another user using Local authentication simultaneously.

I tried to configure "aaa authentication login default local group GROUP_NAME" but it was not possible.

How can I do it?

Thanks you,

Samuele

[Georg Pauwen]

Hello,

what do you wanto to achieve, TACACS+ first and then local ? Or  TACACS+ for some users, and local for others, at the same time ?

[Samuele Leardini]

Hello,

I want to achieve TACACS+ for some users, and local for others, at the same time.

Thanks,
Samuele

[paul driver]

Hello Samuele 

Well it seem to suggest it supports AAA and possibly rotary so I cannot see why not - have a look here 

[Samuele Leardini]

Hello,

The post in the link speaks about a 3850 switch with IOS-XE, the commands indicated don't work in Nexus 9000 with NX-OS.

Thanks,
Samuele

[Georg Pauwen]

Hello,

I think in NX-OS, the default fallback is local. So if you have configured:

aaa authentication login default group TACACS+

in case TACACS is not available or cannot authenticate, the default fallback is local. You can explicitly specify the fallback:

aaa authentication login default fallback error local

In your case, if you don't want certain users to use TACACS, just don't configure them on your TACACS server, but do configure them locally.

[Samuele Leardini]

I've already configure certain users locally on the switch, but the authentication for them fails, because the switch try to authenticate only against TACACS servers (and not against local database).

Thanks,
Samuele

[Reza Sharifi]

Not sure if you can do this since the Nexus does not support the rotary command:

This configuration example builds on the previous TACACS+ authentication example, including fallback authentication to the password that is configured locally with the enable secret command:

!
username admin password <password> role network-admin
!
aaa authentication login default group tacacs+
aaa authentication login default fallback error local

[tjbuschur1]

Check your Line vty 0 15 config.  make sure 

login authentication default  is set correctly.  if you have it set to a tacacs group it will still block you. 

Also, you will need to set  aaa authorization 

aaa authorization exec default local group tacacs+