Local authentication config

[Bab L]

Hi.

We currently configure our switches as below:

aaa authentication login SW-ACS group tacacs+ local
aaa authorization console
aaa authorization exec EXEC-ACS group tacacs+ local
aaa authorization commands 1 CLI-ACS group tacacs+ local
aaa accounting exec EXEC-ACC start-stop group tacacs+
aaa accounting commands 1 CLI-ACC stop-only group tacacs+

--------------------------------------------------------------------

line con 0
 authorization exec EXEC-ACS
 logging synchronous
 login authentication SW-ACS
line vty 0 4
 access-class vty-in in
 authorization commands 1 CLI-ACS
 authorization exec EXEC-ACS
 accounting commands 1 CLI-ACC
 accounting exec EXEC-ACC
 logging synchronous
 login authentication SW-ACS
 length 0
 transport input ssh
line vty 5 15
 access-class vty-in in
 authorization commands 1 CLI-ACS
 authorization exec EXEC-ACS
 accounting commands 1 CLI-ACC
 accounting exec EXEC-ACC
 logging synchronous
 login authentication SW-ACS
 transport input ssh

ip access-list standard vty-in
 permit 10.0.0.0 0.255.255.255

---------------------------------------------------------------

We would like to add a local username and password that has exec  privileges, and it works with or without tacacs connection. We would like that username and password to get into config mode without having to add an additional enable password. 

We have tried the username *****  privilege 15 secret/password ******    but it doesn't work.

Any ideas?

[Mark Malone · Accepted solution]

Hi you could try adding enable to the end of your authentication line , the issue is as aaa is enabled it well try get authentication off the group first then if not available it will use the local username password, im not sure if you can have it that it bypasses aaa first and only uses the username, you have applied aaa which is higher security so I think it will always try that first once set

aaa authentication login SW-ACS group tacacs+ local enable

[Bab L]

Thanks Mark.

I thought that is the case, that there isn't a way for a local username to by pass tacacacs. 

I'll keep this open for a while just in case someone has done any funky things .

[Mark Malone]

Ye you never know someone may have gotten around this, thats just from my own experience using aaa