Hi Najaf,

Thanks for your help.

what about if i want to ssh into my device ?

many thanks,

kamran.

Hi,

The above suggestion was to test if local  credentials are working...

So now are you looking for how to enable ssh in to your devices? Or you want to test the how the radius fall back will work for ssh?

Sorry i didnt really get your question :-(

Regards

Najaf

Please rate when applicable or helpful !!!

Hi Najaf,

Yes I want to have access to switch if the radius server is not available.

many thanks.

Hi Kamran,

Could you please share your exsisting aaa configuration?

If you want to test if your configuration is working, then try replacing the exsisting radius server ip (on your switch configuration through console) with a dummy ip address. Then radius server will not respond and then u can try ssh to device using your local credentials..Easiest way to make radius server un available other wise would be to shut the port where radius server is connected. In that case you will have trouble in accessing other devices if local logins are not working :-(

Regards

Najaf

Please rate when applicable or helpful !!!

Hi Najaf,

aaa new-model

aaa authentication login default group radius

aaa authentication login VTY group radius local

aaa authentication login ssh group radius

aaa authentication login CONSOLE local

aaa authentication ppp default if-needed group radius local

aaa authorization exec default group radius local

aaa authorization exec VTY group radius local

aaa accounting exec default start-stop group radius

many thanks.

Hi Kamran,

Try this

aaa authentication login default group radius local

This will fall back to local authentication if your radius server is not reachable.

Hope you are not currently calling any specific group under your line 0 4. If it is there remove it...

Hope that helps

Regards

Najaf

Please rate when applicable or helpful !!!

Hi Najaf,

The console bit u mentioned earlier should i remove that from aaa and from lines.

line con 0

login authentication CONSOLE

line vty 0 4

access-class 1 in

authorization exec VTY

login authentication CONSOLE

transport input telnet ssh

line vty 5 15

access-class 1 in

authorization exec VTY

login authentication CONSOLE

transport input telnet ssh

many thanks.

Hi Kamran

Try this..

line vty 0 4

access-class 1 in

authorization exec VTY

transport input telnet ssh

Hope that helps

Regards

Najaf

Please rate when applicable or helpful !!!

Hi Najaf,

No its not letting me in through RADIUS.

Should i remove the following lines from my configuration:

aaa authentication login CONSOLE local

line con 0

login authentication CONSOLE

line vty 0 4

login authentication CONSOLE

line vty 5 15

login authentication CONSOLE

many thanks,

Hi Najaf,

Thank you ever so much its working !!!

much appricated for your time.

how long you been working on cisco devices ?

kind regards,

kamran

Hi,

I have also similar configuration on my Cisco 2960 switch where i am unable to logging using by my local account. i can login switch using by my radius account but not local switch account, configuration is below: 

aaa new-model

aaa group server radius RADIUS-SERVER
server-private 10.200.62.xx key abcdefghijkl123

aaa authentication login default group RADIUS-SERVER local

aaa authorization exec default group RADIUS-SERVER local

aaa accounting exec default start-stop group RADIUS-SERVER

************************
line vty 0 4

authorization exec default

transport input telnet ssh

line vty 5 15

authorization exec default

transport input telnet ssh

Could you please give me some suggestion why it is not working for me.