1

We have Radius authentication setup on a number of CISCO devices.

Each device also has a local account.

Is it possible to make it so you can only use the local account when the radius server is unreachable?

Currently, both Radius accounts and the Local account are usable.

  • 1
    Can you please post your current AAA configuration, it should be working as you said by default – Mr.lock Mar 8 '17 at 9:16
  • Is there an account in the radius database with the same name/password as the local default? – cpt_fink Mar 8 '17 at 21:16
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 17 '17 at 4:47
-1

Try the below configuration and note the "local" keyword after aaa configuration.

aaa group server radius <group-name>

server-private ip-address [ auth-port port-number | acct-port port-number ] [non-standard] [ timeout seconds ] [ retransmit retries ] [ key string ]

exit

!

aaa authentication login default group <group-name> local

hope that help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.