Option 1:-

I have already configured AD user with netwok-admin role who are able to login after successfull authentication by TACACS. It is ben configured to check TACACS first and then local.

I just want to be able to login as default "admin" user via telnet. I am able to login as "admin" via FM/DM

Option 2:-

I need to have telnet/ssh access uaing locally residing and default user "admin". I am able to login as other locally created users with "network-admin" role. Since the switches are located 1000's of miles

away, I need telnet access for admin in case tacacs server goes down.

I am stilll confused why the default "admin" user is not woking via telnet but everything else whether local/tacacs user.

--Mohan

Your configuration says that only console access is configured to check local. The first method is only configured to use the Tacacs+ group. If you add a local statement to end of the first line, it will allow you to get in ONLY if the tacacs+ server is down.

Try to keep in mind that AAA groups are processed in the same config line. If you don't have a valid auth method by the end of the line, you are out of luck.

Well, the thing about the AAA order is that you only go and check the next resource in the event your primary resource is unavailable.

It is likely since you do not have the "admin" account in your AD that the TACACS+ server is returning a message to deny access.

When the MDS observes the message to deny access to a user, then that is that. It will not go further down the list to say its local database.

--Colin

Thanks guys ...it worked after adding "local" at the end of the line.

Kudos to you guys....

Mohan