Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Testing local username

Hello,

We have configured AAA authentication on our routers with RADIUS server authentication. As a backup option  a local user and enable secret password has been configured.

So far RADIUS server is working fine so there was case to test the locally configured username and enable password.

Is there any way to test the local username/ pasword and enable password. Even when the RADIUS server is reachable.

Without changing any of the existing AAA configuration as below.

aaa authentication login default group radius local -- first preference to RADUIS group and second is for local user.

Last option is to configure a new local user or overwrite the existing username password.

Please share the experience.

Thanks

Subodh

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Gold

Testing local username

Subodh

As long as your router can communicate with the Radius server and can get a response to its request for login authentication then the router will never check the local username. If you want to test the local user name then you must do something that will prevent communication between the router and the Radius server.

Perhaps the easiest test is to change the aaa authentication login parameters. But if you do not want to do this there are several alternatives that you might consider:

- you might disconnect the network connection of the router to the Radius server and then attempt login through the console. That should test the local user.

- You might re-configure the key that is configured for the Radius server. That should prevent communication with the Radius server and allow testing of the local user name. (be sure to maintain an active session in enable mode during the test so that you can set the key back to its original value if there is some problem during the test).

- you might configure a static host route for the address of the Radius server which has null 0 as the next hop. This would prevent  communication with the server (but not impact anything else) and allow you to test the local user name. (as before I suggest that you maintain an active session in enable mode during the test so that you can remove the static host router if there is any problem during the test).

- you might configure an alternative aaa authentication named method which uses only local, assign it to the console, and then login to the console. That should allow the router to test the local user name without impacting any sessions over vty etc.

HTH

Rick

1 REPLY
Hall of Fame Super Gold

Testing local username

Subodh

As long as your router can communicate with the Radius server and can get a response to its request for login authentication then the router will never check the local username. If you want to test the local user name then you must do something that will prevent communication between the router and the Radius server.

Perhaps the easiest test is to change the aaa authentication login parameters. But if you do not want to do this there are several alternatives that you might consider:

- you might disconnect the network connection of the router to the Radius server and then attempt login through the console. That should test the local user.

- You might re-configure the key that is configured for the Radius server. That should prevent communication with the Radius server and allow testing of the local user name. (be sure to maintain an active session in enable mode during the test so that you can set the key back to its original value if there is some problem during the test).

- you might configure a static host route for the address of the Radius server which has null 0 as the next hop. This would prevent  communication with the server (but not impact anything else) and allow you to test the local user name. (as before I suggest that you maintain an active session in enable mode during the test so that you can remove the static host router if there is any problem during the test).

- you might configure an alternative aaa authentication named method which uses only local, assign it to the console, and then login to the console. That should allow the router to test the local user name without impacting any sessions over vty etc.

HTH

Rick

1063
Views
0
Helpful
1
Replies
CreatePlease to create content