Nexus 3k not falling back to local when RADIUS is down

[Bradley Fox]

I've configured my Nexus 3172 for RADIUS authentication which is working, however, when I make the NPS (RADIUS) server unavailable either by stopping NPS service or disabling the RADIUS Client for this switch the fallback to local login isn't working.  The NPS server requires MFA push notification on my phone which is why I have the timeout set to 60 seconds.

Relevant config (sanitized):

username admin password 5 <PWD HASH> role network-admin

radius-server host 1.1.1.1 key 7 "MYKEY" authentication accounting timeout 60 retransmit 1

aaa group server radius NPSMFA
    server 1.1.1.1

aaa authentication login default group NPSMFA
aaa authentication login console local
aaa authentication login error-enable

I tried issuing the following command but it never shows up in the running config; I assume because this is the default.

aaa authentication login default fallback error local

Turned on terminal logging and got the following logs when NPS disabled, however in my other session where I was trying to login as admin I either get access denied or putty disconnects with "unexpectedly closed" message.  I never receive any message about RADIUS being unreachable in the login window which I would expect with "aaa authentication login error-enable".

2022 Feb 17 11:54:21 SWHS-103 %RADIUS-3-RADIUS_ERROR_MESSAGE: RADIUS server 1.1.1.1 failed to respond

2022 Feb 17 11:55:21 SWHS-103 %RADIUS-3-RADIUS_ERROR_MESSAGE: RADIUS server 1.1.1.1 failed to respond evenafter all retries
2022 Feb 17 11:55:21 SWHS-103 %RADIUS-3-RADIUS_ERROR_MESSAGE: All RADIUS servers failed to respond after retries.

I issued "aaa authentication login default local" and was able to login as admin so I know the UID/PWD is correct.  Any ideas here?

[Reza Sharifi]

Try adding this command and test with local username and password:

aaa authentication login default group NPSMFA local

HTH

[Bradley Fox]

That command didn't work (output below).  I think this is an IOS command, this switch is running NX-OS.

<hostname>(config)# aaa authentication login default group NPSMFA local
invalid server group
could not update aaa configuration

[Bradley Fox · Accepted solution]

Upgraded switch to NX-OS 9.3(8) and the issue resolved.  Must have been a bug in the 7x firmware.

[MacGyver]

It might be related to the Radius server timeout / deadtime.
sec_radius.mif (cisco.com) pgs 3.9-10 & 3.17-18   or
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 6.x - Configuring RADIUS [Cisco Nexus 9000 Series Switches] - Cisco
Search for 'deadtime' or look under, "Configuring RADIUS Server Groups"