Test local authentication when TACACS is active

[Tom Ribbens]

Hi all,

we have a lot of devices here configured to authenticate using TACACS. This all works fine. The documentation covering these devices could be improved however. One thing I was thinking of putting in that documentation, is the passwords that are configured when TACACS is not available.

Is there a way to test the local login credentials, without altering anything on the TACACS configuration? 

Kind regards,

Tom

[hdussa]

Hi Tom,

i configure a NULL0 route on the Layer 3 device.

ip route w.x.y.z 255.255.255.255 Null0 (ip address of your TACACS)

Regards Horst

[Marvin Rhoads]

I have used a similar approach to Horst's suggestion except with an upstream ACL blocking access to the TACACS server(s). The device should try and fail to authenticate via TACACS and then fall back to local authentication.

If I recall correctly, it takes about 30 seconds per configured TACACS server to mark it failed so be patient.

[nspasov]

Both valid solutions to the question! I have always changed the aaa shared secret or other part of my config but I like what you guys are suggesting!