Removing TACACS Configuration - Very Quick Question...

[mattipler]

Hello guys,

Very quick question. I've two remote 2960 stacks upon which I want to safely remove TACACS configuration, so future authentication is done against local usernames / passwords. My TACACS configuration is as displayed below... 

Switch(config)#aaa new-model
Switch(config)#tacacs server TACACSSERVER1
Switch(config-server-tacacs)#address ipv4 10.X.X.15
Switch(config-server-tacacs)#key TACACSKEY
Switch(config-server-tacacs)#ex
Switch(config)#tacacs server TACACSSERVER2
Switch(config-server-tacacs)#address ipv4 10.X.X.15
Switch(config-server-tacacs)#key TACACSKEY
Switch(config-server-tacacs)#ex
Switch(config)#aaa authentication login default group tacacs+ local
Switch(config)#aaa authorization commands 15 default group tacacs+ if-authenticated
Switch(config)#aaa accounting exec default start-stop group tacacs+
Switch(config)#aaa accounting network default start-stop group tacacs+
Switch(config)#aaa accounting connection default start-stop group tacacs+
Switch(config)#aaa accounting system default start-stop group tacacs+

Would I be correct in saying that a safe way in which to remotely remove this configuration would be as followings... 

Switch(config)#no aaa authentication login default group tacacs+ local
Switch(config)#no aaa authorization commands 15 default group tacacs+ if-authenticated
Switch(config)#no aaa accounting exec default start-stop group tacacs+
Switch(config)#no aaa accounting network default start-stop group tacacs+
Switch(config)#no aaa accounting connection default start-stop group tacacs+
Switch(config)#no aaa accounting system default start-stop group tacacs+

Switch(config)#tacacs server TACACSSERVER1
Switch(config-server-tacacs)#no address ipv4 10.X.X.15
Switch(config-server-tacacs)#no key TACACSKEY
Switch(config)#no tacacs server TACACSSERVER1

Switch(config)#tacacs server TACACSSERVER2
Switch(config-server-tacacs)#no address ipv4 10.X.X.16
Switch(config-server-tacacs)#no key TACACSKEY
Switch(config)#no tacacs server TACACSSERVER2

Apologies, my lab environment does not include a TACACS server otherwise I would have played this out in my lab. 

Thank you in advance for anyone who takes the time to read this post. 

[Mark Malone]

Hi

yes or below should do it too
no aaa-new model
no tacacs server xxxxxxnamexxxxx

[Richard Burts]

I agree with @Mark Malone that no aaa new-model is the quick (and comprehensive) way to eliminate most of your tacacs configuration. But leaving it that way might - or might not leave the device using local usernames and passwords for authentication ( would very much depend on how con0 and vty are configured (do they specify login local or something else). The easy way to assure that authentication on those devices would be that after you complete removing all traces of tacacs that you configure aaa new-model. In this mode the default is to authenticate using local username and password.

HTH

Rick