We have Radius authentication setup on a number of CISCO devices.

Each device also has a local account.

Is it possible to make it so you can only use the local account when the radius server is unreachable?

Currently, both Radius accounts and the Local account are usable.

  • 1
    Can you please post your current AAA configuration, it should be working as you said by default – Mr.lock Mar 8 '17 at 9:16
  • Is there an account in the radius database with the same name/password as the local default? – cpt_fink Mar 8 '17 at 21:16

Try the below configuration and note the "local" keyword after aaa configuration.

aaa group server radius <group-name>

server-private ip-address [ auth-port port-number | acct-port port-number ] [non-standard] [ timeout seconds ] [ retransmit retries ] [ key string ]



aaa authentication login default group <group-name> local

hope that help

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.