4

I have set the username **** privilege 5 secret **** & applied aaa via console. now unable to access switch through console. After entering enable showing authentication error.

can someone help me to resolve the issue.

Configuration:

config for console:

username cisco privilege 5 secret cisco 
line vty 0 4 login local 
end 

config for aaa

aaa new-model 
aaa authentication login default group tacacs+ local 
aaa authentication enable default group tacacs+ enable 
aaa authorization commands 1 default group tacacs+ local 
aaa authorization commands 15 default group tacacs+ local 
aaa accounting exec default start-stop group tacacs+ 
aaa accounting commands 1 default start-stop group tacacs+ 
aaa accounting commands 15 default start-stop group tacacs+ 

aaa accounting network default start-stop group tacacs+

  • Please upload the AAA commands in your running-config, your privilege/authentication commands, and the config on your console port. Without that we can only guess. – Zack Scaringello Sep 6 '16 at 13:33
  • config for console username cisco privilege 5 secret cisco line vty 0 4 login local end config for aaa aaa new-model aaa authentication login default group tacacs+ local aaa authentication enable default group tacacs+ enable aaa authorization commands 1 default group tacacs+ local aaa authorization commands 15 default group tacacs+ local aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ – Suvi Sep 6 '16 at 13:44
  • When you login via console are you using a AAA username or the local username? – Zack Scaringello Sep 6 '16 at 13:52
  • 2
    you need to ensure the command "login local" in on line con 0. Right now you appear to only have it on your VTY lines. – Zack Scaringello Sep 6 '16 at 13:55
  • 2
    You will need to bypass the password just as if you were doing a password recovery. cisco.com/c/en/us/support/docs/switches/… This will get you into the switch. – Zack Scaringello Sep 6 '16 at 14:01
2

After reviewing your configuration it appears that you applied login local only the VTY lines and not the console port.

Since you no longer have access to the device you will need to initate a password recovery for the device following the instructions listed here. This will allow you to log into the device and make changes.

You will then need to add the following configurations:

line con 0

login local

Once that has been added you should be able to login via the console port using a locally created account.

Two more small pieces of advice:

  1. Don't use Cisco as your username. Always create a unique username for your organization. This adds a small layer of obscurity to your security posture.
  2. Don't forget to perform a copy run start after you apply login local to your console port. You don't want to reboot later on and realize that you can no longer console in.
  • hi Zack, my issue is resolved now.. I have applied privileged 5 for username & password.so, I had only read only access..i have reset the switch – Suvi Sep 7 '16 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.