Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Test local authentication when TACACS is active

Hi all,


we have a lot of devices here configured to authenticate using TACACS. This all works fine. The documentation covering these devices could be improved however. One thing I was thinking of putting in that documentation, is the passwords that are configured when TACACS is not available.

Is there a way to test the local login credentials, without altering anything on the TACACS configuration? 


Kind regards,



Community Member

Hi Tom, i configure a NULL0

Hi Tom,


i configure a NULL0 route on the Layer 3 device.

ip route w.x.y.z Null0 (ip address of your TACACS)


Regards Horst

Hall of Fame Super Silver

I have used a similar

I have used a similar approach to Horst's suggestion except with an upstream ACL blocking access to the TACACS server(s). The device should try and fail to authenticate via TACACS and then fall back to local authentication.

If I recall correctly, it takes about 30 seconds per configured TACACS server to mark it failed so be patient.

Cisco Employee

Both valid solutions to the

Both valid solutions to the question! I have always changed the aaa shared secret or other part of my config but I like what you guys are suggesting! 

CreatePlease to create content