2

I hope you are well.

I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "wrong password". Surprisingly, I can access the switch via HTTP and make/save changes (using the same TACACS acc.). Also I can login and access the Privileged EXEC mode with another account.

This problem repeated on two other switches (both SF300-48P): first I had had the access to Privileged EXEC mode and after the upgrade it stopped working for the account that made the upgrade.

When I check the logs (they are quite limited) I see my account being authorised by TACACS server (when I ssh) and when I try enter Privileged EXEC mode - it says it has been rejected. On any other switches this account works fine.

Any suggestions what might be the cause of this bizarre behaviour?

AAA/TACACAS before the change:

aaa authentication enable Console enable
aaa authentication enable SSH tacacs enable
aaa authentication enable Telnet enable
aaa authentication enable default tacacs enable
ip http authentication aaa login-authentication https tacacs local
aaa authentication login Console local
aaa authentication login SSH tacacs local
aaa authentication login Telnet local
aaa authentication login default tacacs local
tacacs-server host x.x.x.x    priority 2
tacacs-server host x.x.x.x  priority 1
tacacs-server key xyz
tacacs-server timeout 3

After the change:

ip http authentication aaa login-authentication https tacacs local
aaa authentication login SSH tacacs local
aaa authentication enable SSH tacacs enable
aaa authentication login Telnet local
aaa authentication enable Telnet enable
aaa authentication login Console local
aaa authentication enable Console enable
aaa authentication login default tacacs local
aaa authentication enable default tacacs enable
tacacs-server host x.x.x.x priority 2
tacacs-server host x.x.x.x priority 1
encrypted tacacs-server key 123456 (encrypted xyz)
tacacs-server timeout 3
  • Can you share the aaa portions of your config before/after the upgrade (sanitized, naturally)? I have a few ideas, but anything would be a stab in the dark without more information. – YLearn Dec 17 '14 at 23:06
  • I've updated the original post with aaa portions before/after. – micmis Dec 18 '14 at 9:57
0

I've recreated my TACACS account with the same settings and it's working now. Strange...

| improve this answer | |
  • thanks for following up. (seriously, many people just wander away when they get it working.) Can you "accept" your answer so the Q isn't laying around "unanswered", or you can just delete the whole question since none else contributed an answers. Thanks! – Craig Constantine Dec 19 '14 at 1:38
0

I came across exactly the same problem after upgrading to 1.4.5.02. The ACS logs were showing error"13037 Shell Profile Privilege Level not configured correctly". After a long struggle we manage to fix it by setting the "Maximum privilege level" on the ACS shell Profile to 15. Initially we did not have this set it was not in use, we only had the "Default Privilege level" set to 15. It looks like this firmware version is buggy, it's looking at the wrong attribute.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.