Why this behavor with "login tacacs"?

Answered Question
May 29th, 2009

On my 3750 switch, I create:

#username local secret cisco

#line console 0

password ciscoline

login tacacs

Then I telnet into the switch (via a terminal server).

I get prompt:

Username:

I type "local".

I do not even have a chance to type the password, and then I get:

Username:local

Password:

% Login invalid

Anyone has seen this before?

My intention is that if there is no tacacs system configured, then I would automatically authenticate using the 'local' user and password 'cisco'.

I have this problem too.
0 votes
Correct Answer by Edison Ortiz about 7 years 7 months ago

If that's your intention, you should use aaa new-model instead.

For instance:

aaa new-model

aaa authentication login default group tacacs+ local

The 'login tacacs' procedure you have, does not have the failover mechanism provided on aaa new-model.

HTH,

__

Edison.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Edison Ortiz Fri, 05/29/2009 - 15:55

If that's your intention, you should use aaa new-model instead.

For instance:

aaa new-model

aaa authentication login default group tacacs+ local

The 'login tacacs' procedure you have, does not have the failover mechanism provided on aaa new-model.

HTH,

__

Edison.

Actions

This Discussion