“I am slightly puzzled. In the original post I thought you were pretty clear about what you wanted to accomplish "So ultimately the switch can only be logged into with an account that only exists on said switch"”
-Yes, that would be the ultimate objective. I understand why you are confused. There are some aspects to my situation that I did not mention. Essentially, we need what you have described done. The trick is, I need to make sure that the local accounts are setup correctly before removing the ability to access the switch via RADIUS. The switches are located offsite and there are no personnel at that location who we can work with, should an access issue occur.
I was hoping to create the local user account and test local access before cutting RADIUS access. If something with the local account is wrong and I cut RADIUS, it’s basically good game.
“The switch is currently configured so that access to the vty requires SSH and is authenticated using Radius with local authentication as a backup in the event that Radius is not available.”
-I concur sir
“Your objective in the original post would need for you to remove the Radius authentication and use only local authentication. (I note that currently the config has a single user ID configured). This change would certainly have an impact on remote access.”
-Is there any way we can implement a local access configuration and test said access before completely cutting RADIUS?
“Assuming that currently there are multiple people who access the switch and that each person has their own user ID and password through Radius after the change every one would need to use the single ID that is configured - or you need to add additional user IDs to the configuration.”
-Correct, that is essentially what we are looking at. But this becomes moot due to anyone that has RADIUS with our company will have no business logging into the switch, since it will not be part of our environment anymore.
“For a switch that is deployed in a production network changing it to use only a locally configured user ID would seem to be a pretty drastic step.”
-I totally agree but this is based on a scenario where the remote site is being separated entirely from our main office. They are effectively to be treated as a separate company. As such, we must remove RADIUS and some other configurations for security reasons.
