Locked out of MSFC

[matt.austin]

I have been sampling various configurations, and I seem to be missing something for my configuration, and now I have bigger problems. I applied the following accidently to my core router.

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication login no_tacacs enable

aaa authentication enable default group tacacs+ line

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

tacacs-server host *.*.*.*

tacacs-server key BLAH-BLAH

tacacs-server timeout 60

I currently don't have a local authentication method configured, and after entering "Exit" from the config mode, I cannot get back into the config portion of the router, and receive the message "Command authorization failed"... Anyhow, on my ACS Server I keep receiving the message "Unknown NAS" when I try to access the router. I have tried to set the router up as an AAA client, to no avail, and an ACS Server, also to no avail. Any help at all will be greatly appreciated....

Thanks You.

[sghosh]

Hi Matt,

If you try to stop the services on the ACs server and try it will try to fall back to the local username on the router database, I am not sure if you have that or not.

Otherwise if you have a copy of the config with you, you need to add all the ip addresses of the interfaces you have in the switch, like all the fe or ethernet ports which have ip address defined in it. As we might have situation where the tacacs+ packets is getting generated with an ip address which is not there in the NAS list.

Thanks

Sujit

[matt.austin]

I think the consensus here is to wait until later and reset the module, since we have 2 and this is on the primary, so the standby should work out fine and coming back online. Since no configuration files were saved after the AAA change, and I (thankfully) saved some configs to TFTP, access to the module shouldn't be a problem.

With this aside, I am still amiss as far as configuring the AAA to communicate with my ACS 3.1 Server from our routers. We are not using this tool for dial-in access, and after sampling some other configurations, I am still unable to get the 2 to communicate back and forth.

Presently I have 2 ACS Servers which replicate data, and numerous switches that are configured to use ACS to authenticate, which is working like a charm. Do you have any suggestions??? Also, no ACL's are blocking access anywhere on our network right now...

[mhoda]

Hi Matt,

As you are seeing unknown NAS as an error on the ACS server, it seems that you don't have any fw inbetween of your ACS and the router. Please enter the following command on the router to force router to source the tacacs+ authentication request using a particular interface ip address:

ip tacacs-source interface fa0/0 <--Need to change with your own actual interface.

Then make sure to define your AAA client using this ip address. It should work.

Thanks,

Mynul