AAA authentication for all users and a single user for local only?

Question

Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses the local devices auth only?

I'd like to avoid the emergency backup user from having to time out to the remote auth server in the event the network is having issues.

Ideally, this could be over VTY as well as console.

emergencyUser doesn't have a remote auth account it's only a local account.

standardUser has only a remote auth account.

If the remote auth server is accessible standardUser and emergencyUser could log in to the device via SSH. standardUser would hit the remote auth server and the emergencyUser would auth to the local device.

If the remote auth server isn't accessible standardUser fails to login but emergencyUser can log in via SSH and/or console still.

Answer 1

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.

username localadmin password xyz priv 15
aaa authentication login CONSOLE local
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY if-authenticated 
aaa authorization exec CONSOLE if-authenticated 
aaa authorization commands 15 default group tacacs+ if-authenticated 
aaa accounting commands 15 default start-stop group tacacs+
!
line con 0
 exec-timeout 5 0
 logging synchronous
 login authentication CONSOLE
 stopbits 1
line vty 0 4
 access-class MANAGEMENT-ACL in
 exec-timeout 5 0
 login authentication VTY

EDIT:

If the remote auth server is accessible standardUser and emergencyUser could log in to the device via SSH. standardUser would hit the remote auth server and the emergencyUser would auth to the local device.

I don't know of a way to do that, other than adding the emergency user to the auth server as well as being configured locally.

I'd like to avoid the emergency backup user from having to time out to the remote auth server in the event the network is having issues.

You can shorten the timeout. I believe the default is 5 seconds for newer IOS and 1 second for NX-OS.
Use the command

tacacs-server timeout x

Answer 2

This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens):

aaa authentication login default local group radius

That tries the local database first, then tries the RADIUS authentication group. You can use TACACS+ instead of RADIUS.

If the username submitted over SSH isn't present in the local database, this configuration would go to the RADIUS servers and successfully authenticate. But if the account is local, it will be found in the local accounts database and authenticated locally.

Of course this requires that the local username be distinct from any of the domain/RADIUS usernames.

I believe I had a similar config working correctly on IOS-XE also. Not sure about NX-OS or CatOS.