cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Cisco Community Designated VIP Class of 2020

151
Views
0
Helpful
3
Replies
Highlighted
Beginner

Unable to access Cisco 2960X after the AAA new model command

Hello,

 

I am facing a big problem.

 

By following a cisco procedure to set up the secure copy, I typed the following commands on my switch:

 

1. Enable
2. configure terminal
3. aaa new-model
4. aaa authentication login default group tacacs +
5. aaa authorization exec default group tacacs +
6. ip scp server enable


Now, I can no longer connect to my switch at all. In ssh, all user accounts with privileges 15 get an "access denied". I also tried in console port, but it loops on "% authentication failed".

 

I don't know what to do anymore, I can try to restart the switches, but I don't know if I made a write memory before.

 

According to several forum readings on this subject, the only way is to break the switch.

 

What do you think ? Have you been faced with this problem? Do you have a better solution?

 

Thank you in advance and good day !

2 ACCEPTED SOLUTIONS

Accepted Solutions
Participant

Re: Unable to access Cisco 2960X after the AAA new model command

are those the ONLY commands you put in? I mean, and not to souncd condescending but you did define tacacs servers, correct?

also, and this is from past experience and going by memory at this point since I don't have my historical notes handy, I think you need an additional line or two:

 

aaa authentication enable default group tacacs enable

aaa authorization console

aaa authorization config-commands

aaa authorization commands 15 default group tacacs

 

and it's usually a good idea to use local as fallback so that if you get into this situation all you have to do is take the switch off the network for a few minutes and you should be able to get into it via a local account.

 

but at this point, yeah, I think you need to go through the password recovery procedure to get back into it and get things fixed.

View solution in original post

VIP Advisor

Re: Unable to access Cisco 2960X after the AAA new model command

Hi @Robert00509 

 

Query:

 

When you set up AAA, did you get to enter this command?

Switch(config)# tacacs-server host <tacacs server ip>

 If you entered it, then you can configure a tacacs server and assign it the configured ip, add a user on the server and try.

If you did not indicate a tacacs server, then, I think the only option is to make a factory recovery.

 

Regards

 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0101.html

http://notthenetwork.me/blog/2013/05/28/reset-a-cisco-2960-switch-to-factory-default-settings/

 

 

 

View solution in original post

3 REPLIES 3
Participant

Re: Unable to access Cisco 2960X after the AAA new model command

are those the ONLY commands you put in? I mean, and not to souncd condescending but you did define tacacs servers, correct?

also, and this is from past experience and going by memory at this point since I don't have my historical notes handy, I think you need an additional line or two:

 

aaa authentication enable default group tacacs enable

aaa authorization console

aaa authorization config-commands

aaa authorization commands 15 default group tacacs

 

and it's usually a good idea to use local as fallback so that if you get into this situation all you have to do is take the switch off the network for a few minutes and you should be able to get into it via a local account.

 

but at this point, yeah, I think you need to go through the password recovery procedure to get back into it and get things fixed.

View solution in original post

Beginner

Re: Unable to access Cisco 2960X after the AAA new model command

Thank you for your answer. Unfortunately, I don't remember typing these commands..

 

I think I have no choice, I'll have go through the password recovery procedure to get back into it and get things fixed.

VIP Advisor

Re: Unable to access Cisco 2960X after the AAA new model command

Hi @Robert00509 

 

Query:

 

When you set up AAA, did you get to enter this command?

Switch(config)# tacacs-server host <tacacs server ip>

 If you entered it, then you can configure a tacacs server and assign it the configured ip, add a user on the server and try.

If you did not indicate a tacacs server, then, I think the only option is to make a factory recovery.

 

Regards

 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0101.html

http://notthenetwork.me/blog/2013/05/28/reset-a-cisco-2960-switch-to-factory-default-settings/

 

 

 

View solution in original post

CreatePlease to create content
Content for Community-Ad