Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

aaa question for Cisco 4948

Please take a look at the below commands entered on a 4948 Catalyst.  Will this prompt me to use <root> as the username and whatever password I decide to use when logging into the switch?  I'm guessing the "default group local" portion of the CL below points to root as the username in this case.

!
username root password 7 1524020217252574611E34301A0913104007
!
aaa new-model
aaa authentication login default group root local
aaa authentication fail-message ^You have failed to pass AAA login requirements!^
!
!

In other words there will be no TACACS or Radius involved with this.

Thanks,

Charlie

2 ACCEPTED SOLUTIONS

Accepted Solutions

Re: aaa question for Cisco 4948

That doesn't look right to me, unless Cisco has changed the way they've done AAA on the 4900 series (which I've never used). The "group" usually indicates a radius or tacacs server, not a username. I think what's happening is that it's trying to hit a server group called root, which is assigned to some ip address, it's failing and rolling over to local which would allow you to log in as root. If you aren't using a tacacs or radius server, you should be safe in removing the group portion and using just:

aaa authentication login default local

I would HIGHLY recommend doing this in one window, and then telnetting into the device from another window to test. When messing with AAA, never make a change and logout before testing in another window; you could lock yourself out.

HTH,

John

HTH, John *** Please rate all useful posts ***

Re: aaa question for Cisco 4948

Hi

You have to use  "aaa authentication login default local" to point all authenticaiton to its local database.

Regards

Chetan Kumar

4 REPLIES

Re: aaa question for Cisco 4948

That doesn't look right to me, unless Cisco has changed the way they've done AAA on the 4900 series (which I've never used). The "group" usually indicates a radius or tacacs server, not a username. I think what's happening is that it's trying to hit a server group called root, which is assigned to some ip address, it's failing and rolling over to local which would allow you to log in as root. If you aren't using a tacacs or radius server, you should be safe in removing the group portion and using just:

aaa authentication login default local

I would HIGHLY recommend doing this in one window, and then telnetting into the device from another window to test. When messing with AAA, never make a change and logout before testing in another window; you could lock yourself out.

HTH,

John

HTH, John *** Please rate all useful posts ***
New Member

Re: aaa question for Cisco 4948

I will give this a try and reply back to you.

Thank you!

Charlie

New Member

Re: aaa question for Cisco 4948

Your suggestions were "Spot on".  Thank you.  Now we will satisfy our Risk Assessment Scans by having AAA configured without having to have a TACACS or Radius.  Also, thanks for the heads-up with the multiple terminal session suggestion.  I locked myself out yesterday and had to break in.  All is good now.

Charlie

Re: aaa question for Cisco 4948

Hi

You have to use  "aaa authentication login default local" to point all authenticaiton to its local database.

Regards

Chetan Kumar

646
Views
0
Helpful
4
Replies