removing ACS from authenticating to allow local account

[iceman6684]

i currently have ACS enabled but, would like to test local account. i wanted to verify that removing aaa authentication ssh console TACACS+ LOCAL would allow me to login with the local account.  i was not sure if i should remove the ACS box instead from the running config.  please advise on best practice.                  

[Julio Carvajal · Accepted solution]

Hello Jason,

You do not need to remove it from the configuration, the whole purpose of have both of them is to failover that particular scenario ( where the ACS goes down as an example)

Regards,

Julio

[nkarthikeyan · Accepted solution]

Hi Jason,

Just remove the TACACS server host in the config

no tacacs-server host 10.18.220.45 (example) from the device. So that automatically it will take the local login when no tacacs server defined.

Please do rate if the given information helps.

By

Karthik

[iceman6684]

thanks everyone.

[jaredlynn]

I see the point in both scenarios but for the purpose of the failover statement yes that is true but what if your testing situation doesn't allow you to down the interface of this device maybe it's a remote device and important.  I agree with the removal of the server but I do a different strategy I take all the AAA statements that are Group TACACS local copy them and move the local in from of group to make local group TACACS and also the enable statement from group TACACS enable to enable group TACACS.   Before pasting in do a conf t revert timer 10 to activate the revert option on the device if available.

aaa authentication enable default enable group TACACS

aaa authentication login NAMED-LIST local group TACACS

aaa authentication enable default group TACACS enable

aaa authentication login NAMED-LIST group TACACS local

Some people just remove everything from the list besides local as a temporary test then reapply the original syntax but I like the failover option of having two methods.

Another option I haven't tested but if your using an alias for tacacs+ with a aaa group server tacacs+ TACACS you may be able to remove just that line if all you statements are pointing to the alias and not the tacacs+ built in group name.