Locked out of 6807 after configuring AAA and radius

[dbuckley77]

We had a local user setup on our pair of 6807s operating in VSS that we had been using for a while.  I was asked to setup radius authentication for domain users.  So I setup AAA first as it is on all our other switches on the network and then setup radius.  Now radius only lets me into the user exec mode and when I type enable I get the "error in authentication" message and the local authentication no longer seems to be working so I cannot get into the switch past user exec mode.  I have copied the exact commands for AAA and radius that I used below.  I setup a support case with cisco and they suggested, 1.  the switch is looking for radius attributes that are not configured on our Microsoft raiuds server and we should configure them to get radius working  2.  remove the switch IP from our AAA server to force the switch to use local authentication

config

[Reza Sharifi]

To get back to the switch, option 2 should work fine. Make sure the radius is not reachable from the 6807 and then login local using the local username and password.

HTH

[paul driver]

Hello

try

aaa new-model
aaa authentication login default group radius local
aaa authentication login CONSOLE local
aaa authorization console
aaa authorization exec CONSOLE local
aaa authorization commands 15 CONSOLE  local


line console 0
authorization commands 15 CONSOLE  ( interface specific)
authorization exec CONSOLE ( interface specific)
login authentication CONSOLE

res

Paul

[dbuckley77]

I can't try that because I can't get into priveledged exec or config mode.

[Reza Sharifi]

Correct., you have to be able to login first.  Try making sure that the 6800 can't reach the server.

[paul driver]

Hello

As reza  suggested either try disconnecting the switch from reaching the radius server or if applicable as I’m not so sure on the 6500’s (usually only found in rtrs) do they have a auxiliary port you could try access 

res

paul