Radius verus local user auth. on switch

[marce1000]

  I would like to use radius authentication for network managers accessing (IOS based) switches.

  This works, but I wonder wether is it possible to make a local user ALWAYS authenticate as a

  fall-back mechanism, regardless of the state of the RADIUS servers and/or wether proper radius credentials

  are used or not ?

  The idea is to have basic fallback login mechanism on the switch.

  I have been playing around with 'aaa authentication...' ; command sequences, but I can't seem to get this going

(if radius=OK, I can not use the local user,but I want to be able to use the local account,even then).

                                 How can I realize  this ?

Tx,

Marc.

[John Blakley · Accepted solution]

Marc,

As far as I know, if you have aaa configured with radius first, it will use that and not roll over to the local database if the radius server is responding. If you have users configured on the device that will not be using the radius server, and you have network managers that will be using the radius server, you can configure the local database as the first option.

Alice - local

Bob - radius

For example, if Bob is a network manager and he will only be listed on the radius server, you could do something like the following:

username Alice secre password

aaa authentication login default local group radius

If Bob tried to log in, the local database would fail and would roll over to the radius server.

HTH,
John

*** Please rate all useful posts ***

[cadet alain]

Hi,

if the authentication is on a line vty then you could reserve some lines with authentication with local database only and some other lines with the radius and local as fallback. You can do this by applying a named list on some lines(on others the default list will be used).

As explained by John fallback method only gets tried if there is an ERROR message when trying to communicate with authentication server not an authentication failure message sent by this server.

Regards.

Alain

Don't forget to rate helpful posts.