In LAB i am working on Cisco authentication with freeradius and everything works but i want my cisco switch first lookup in radius and if user didn't find then it go to local database.
currently i am seeing cisco switch asking radius and if no-user found then its not looking into local database.
Reason i need local account incase anything go wrong with radius or any condition players not able to login, i want atleast admin can login on switch and perform network activity.
following is my config:
radius-server host 10.10.10.10 key 7 "supersecter" authentication accounting aaa group server radius FREERADIUS server 10.10.10.10 use-vrf management source-interface mgmt0
in radius i have following config:
ops Cleartext-Password := 123456 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:roles=network-operator", Cisco-AVPair += "shell:priv-lvl=1"
I am successfully able to login with
ops account but not able to login with local account like
EDIT: I have tested if radius is fail/dead then it will go to local account but i want both working together not just in dead senario.
is it possible or not to have fallback to local?