hello Experts,
Press RETURN to get started.
*May 11 15:04:18.063: AAA/BIND(00000010): Bind i/f
*May 11 15:04:18.063: AAA/AUTHEN/LOGIN (00000010): Pick method list '123'
User Access Verification
Username: john
Password:
ACS-Router>en
Password:
*May 11 15:04:41.935: AAA: parse name=tty0 idb type=-1 tty=-1
*May 11 15:04:41.935: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0
*May 11 15:04:41.935: AAA/MEMORY: create_user (0x469AA7F4) user='john' ruser='NULL' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=ENABLE priv=15 initial_task_id='0', vrf= (id=0)
*May 11 15:04:41.935: AAA/AUTHEN/START (4129385217): port='tty0' list='' action=LOGIN service=ENABLE
*May 11 15:04:41.935: AAA/AUTHEN/START (4129385217): console enable - default to enable password (if any)
*May 11 15:04:41.935: AAA/AUTHEN/START (4129385217): Method=ENABLE
*May 11 15:04:41.935: AAA/AUTHEN(4129385217): Status=GETPASS
ACS-Router#
*May 11 15:04:49.099: AAA/AUTHEN/CONT (4129385217): continue_login (user='(undef)')
*May 11 15:04:49.099: AAA/AUTHEN(4129385217): Status=GETPASS
*May 11 15:04:49.099: AAA/AUTHEN/CONT (4129385217): Method=ENABLE
*May 11 15:04:49.107: AAA/AUTHEN(4129385217): Status=PASS
*May 11 15:04:49.107: AAA/MEMORY: free_user (0x469AA7F4) user='NULL' ruser='NULL' port='tty0' rem_addr='async' authen_type=ASCII service=ENABLE priv=15 vrf= (id=0)
The output is from the console 2800 router, i m trying to authenticate a user john from the ACS server but i m not sure it is authenticating or not by the output above, when i specify a different password in the ACS and the router it does'nt accept ACS password rather it takes local password configured for john.
sh run for router 2800:
ACS-Router#sh running-config
Building configuration...
Current configuration : 1141 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ACS-Router
!
boot-start-marker
boot system flash c2800nm-ipvoicek9-mz.151-1.T.bin
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$6MYC$v0SoHopUNgCSXx08iEfcU0
!
aaa new-model
!
!
aaa authentication login 123 group tacacs+ local
!
!
aaa session-id common
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
username john password 0 cisco12345
archive
log config
hidekeys
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation dot1Q 1 native
ip address 192.168.10.1 255.255.255.0
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
!
!
!
!
tacacs-server host 192.168.10.3 port 49 timeout 2 key cisco12345
!
control-plane
!
!
line con 0
login authentication 123
line aux 0
line vty 0 4
login authentication 123
BUT
when the same configuration i did with the 2960 switch it is working fine for the user,It is accepting different password for the ACS and the local when i disconnect the ACS from the LAN.
Can anybody tellwhat i m missing here.????
Thanks
