Cisco 8000 XR7 Password Locked out

[mahdihabashi]

hi guys, i have cisco 8102H series router with XR7.8.2 software.it seems when i was configuring my aaa configurations i had a mistake and my 8000 series router is giving me authorization failed. i know the local users password with root privilege but when i login with them it still shows me authorization failed even when i disconnect all cables including mgmt from it . how can gain access to this device again ?!
and also i can login to it when i connect mgmt with my ISE user/password but it still sends me authorization fail...

Command authorization failed

[Flavio Miranda]

@mahdihabashi 

If you did not configure any fallback to local user on tacacs failure, I believe you need to run recovery procedure as describded on the link below.

https://www.cisco.com/c/en/us/td/docs/iosxr/cisco8000/b-setup-and-upgrade-cisco8k/troubleshoot.html 

[mahdihabashi]

hi dear flavio,
i have root users on this router and i can login with them in priviledge mode but when i try to go to configuration terminal it says authorization failed ... it seems i didnt configure any fallback to tacacs cause when i disconnect mgmt it still says authorization failed ...

[mahdihabashi]

@Flavio Miranda  and also i did not enable that system recovery on it ... how is it even possible that i can authenticate to the device using my local users but i cant get authorization ... what do you suggest mate?

[Flavio Miranda]

@mahdihabashi 

This related to misconfiguration of tacacs. 

The device is being controlled by tacacs partially. 

[mahdihabashi]

yes and the problem is that there is no password recovery mechanism on this router. The only way seems to be re-imaging the device.

also there is a command system recovery on this routers but it is disabled by default so you must enable it manually before this kind of incidents happening

[decode.chr13]

@mahdihabashi 

If you didn't try so far, I would configure ISE to allow command authorization for any command for this device.

Otherwise, if you have the configuration saved, the other possibility is to turboboot the device and put back the config.

[mahdihabashi]

Hi dear , the problem is that the router is not sending radius packets to my ISE and it seems there is a misconfiguration there too!