In LAB i am working on Cisco authentication with freeradius and everything works but i want my cisco switch first lookup in radius and if user didn't find then it go to local database.
currently i am seeing cisco switch asking radius and if no-user found then its not looking into local database.
Reason i need local account incase anything go wrong with radius or any condition players not able to login, i want atleast admin can login on switch and perform network activity.
following is my config:
radius-server host 10.10.10.10 key 7 "supersecter" authentication accounting
aaa group server radius FREERADIUS
in radius i have following config:
ops Cleartext-Password := 123456
Service-Type = NAS-Prompt-User,
Cisco-AVPair = "shell:roles=network-operator",
Cisco-AVPair += "shell:priv-lvl=1"
I am successfully able to login with
ops account but not able to login with local account like
EDIT: I have tested if radius is fail/dead then it will go to local account but i want both working together not just in dead senario.
is it possible or not to have fallback to local?