Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt always fails even when the password is correct. I have to wait for the username prompt again, and must get the password correct on the first password prompt immediately following that. In other words, any time I see the second password prompt, it will not work.
See the sanitized interaction and config below.
User Access Verification Username: user-name Password: Password: (always fails here) % Access denied User Access Verification Username: user-name Password: Connected to s-site-rack-agg2.example.net on line 1 (site-name). s-site-rack-agg2#
What could be different with that second password prompt to account for this behavior?
The typical AAA and related config I have is:
aaa new-model aaa authentication login default group tacacs+ local line aaa authentication login CONSOLE none aaa authentication enable default group tacacs+ enable aaa authorization exec default group tacacs+ local if-authenticated aaa authorization commands 1 default group tacacs+ local if-authenticated aaa authorization commands 7 default group tacacs+ local if-authenticated aaa authorization commands 15 default group tacacs+ local if-authenticated aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 7 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ ! ip tacacs source-interface Loopback0 tacacs-server host -prmiaryipremoved- single-connection tacacs-server host -secondaryipremoved- single-connection tacacs-server timeout 10 tacacs-server directed-request tacacs-server key 7 -removed- ! line con 0 login authentication CONSOLE line vty 0 4 location -removed- exec-timeout 60 0 password 7 -removed- transport input telnet ssh
line
password. Correct passwords got a response from TACACS immediately. Moved to newer ACS servers resolved the issue, same config, so looks like it was an ACS issue.