Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Enable password stopped authenticating

A switch that I've been accessing just fine for the last 9 months stopped authenticating using the enable password. The switch displays the enable password prompt but doesn't accept the password I set originally.

Solution: Called primary network engineer of our network and started authenticating using AAA and TACACS+ within 3 minutes

Question1: What could have prevented the enable password from working besides changing the enable password or AAA default on the switch itself?

Question2: The main network engineer and I didn't have physical access to the switch 300 miles away. Why would he be able to access the same switch through telnet but not myself?

Regards,

Doug

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Enable password stopped authenticating

Hi Douglas,

Theres only a few things that I can see causing this to not work (this is assuming it is supposed to be pointed at a Tacacs+ server).

1) "aaa authentication enable" command on IOS device was not pointed at the Tacacs+ server - if someone deleted it or changed it it could have pointed to a local password on the switch.

2) On ACS your user account can be set to have a different enable password than normal login password - so if that option became enabled then it could have been looking for a password that you weren't expecting. Were there any failures on the ACS logs around those times?

As far as why he could get access, if he has "aaa authorization exec" configured on the switch then the ACS can be set to dynamically assign privilege levels, so after he logs in he gets put directy into enable mode without having to enter "enable" and another password.

Thanks,

Nate

2 REPLIES
Cisco Employee

Re: Enable password stopped authenticating

Hi Douglas,

Theres only a few things that I can see causing this to not work (this is assuming it is supposed to be pointed at a Tacacs+ server).

1) "aaa authentication enable" command on IOS device was not pointed at the Tacacs+ server - if someone deleted it or changed it it could have pointed to a local password on the switch.

2) On ACS your user account can be set to have a different enable password than normal login password - so if that option became enabled then it could have been looking for a password that you weren't expecting. Were there any failures on the ACS logs around those times?

As far as why he could get access, if he has "aaa authorization exec" configured on the switch then the ACS can be set to dynamically assign privilege levels, so after he logs in he gets put directy into enable mode without having to enter "enable" and another password.

Thanks,

Nate

New Member

Re: Enable password stopped authenticating

Nate,

Thank you for a quick and accurate response.

Doug

309
Views
0
Helpful
2
Replies