No local user created after aaa configs applied and devices rebooted

[sjulien80]

Let say we are using IOS-XE image 17.16.1

We applied aaa-new model (tacas for user auth) configuration and we forgot to create local user account and password on the device, then we reload the device.

What are the rollback options:

Knowing that rommon mode with password recovery, boot from usb or tftp won't work.

Please let me know you though?

Thanks

[marce1000]

 - What device model are you talking about ?

  M.

[sjulien80]

Hi Marce 

Catalyst 9500

But, let say Catalyst 9000 in general

[Joshqun Ismayilov]

@sjulien80 
Try to connect via console during boot.

If prompted with setup dialog, answer "no" to avoid re-enabling AAA, then manually create a local user:

#enable
#configure terminal
#username admin secret <password>
#no aaa new-model ! Temporarily disable AAA
#write memory

Thanks!

[sjulien80]

@Joshqun Ismayilov 

Thanks for your reply, but it's not working that way.

You will never be able to access the device.

I already have the solution, but I want get the community involve.

It's little bit tricky and hidden

Thanks

[balaji.bandi · Accepted solution]

Again, it depends on what configuration is applied to the devices. As long as you do not apply the configuration to the VTY and console, you are safe.

If you locked out, then you need to start from the beginning wiping the config.

refer configuration guide :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-6/configuration_guide/sys_mgmt/b_176_sys_mgmt_9300_cg/troubleshooting_the_software_configuration.html?bookSearch=true#task_nzq_q4z_n1b

[sjulien80 · Accepted solution]

Hi @balaji.bandi, good point. The answer is in the link you shared.

Ignore the startup configuration with the following command: from rommon : SWITCH_IGNORE_STARTUP_CFG=1