In LAB i am working on Cisco authentication with freeradius and everything works but i want my cisco switch first lookup in radius and if user didn't find then it go to local database.

currently i am seeing cisco switch asking radius and if no-user found then its not looking into local database.

Reason i need local account incase anything go wrong with radius or any condition players not able to login, i want atleast admin can login on switch and perform network activity.

following is my config:

radius-server host key 7 "supersecter" authentication accounting
aaa group server radius FREERADIUS
    use-vrf management
    source-interface mgmt0

in radius i have following config:

ops             Cleartext-Password := 123456
                Service-Type = NAS-Prompt-User,
                Cisco-AVPair = "shell:roles=network-operator",
                Cisco-AVPair += "shell:priv-lvl=1"

I am successfully able to login with ops account but not able to login with local account like admin.

EDIT: I have tested if radius is fail/dead then it will go to local account but i want both working together not just in dead senario.

is it possible or not to have fallback to local?

  • If any of the answers have solved your problem, please don't forget to vote accordingly and mark a solution as accepted so this question doesn't continue to come up as unresolved.
    – Jesse P.
    Nov 21, 2019 at 20:07

1 Answer 1


It's not possible to do that. You would have to set different authentication methods for different interfaces. Something like VTY 0-4 use RADIUS, VTY 5-15 use local accounts. Normally, you'd use RADIUS or similar for VTY but then leave Console to authenticate locally since you have to be physically at the device or connected through an IP KVM/KMM to use it.

For NX-OS, you can follow the steps in the guide found here. This article is for Nexus 9k devices but the steps are the same for other models. If you click on Configuring AAA, there is a sub-link to show you how to configure Console access to use local authentication.

  • I forgot to mention in question that i am running Cisco nexus switches which doesn't have option to specify line vty 0 4
    – Satish
    Nov 21, 2019 at 19:17
  • Thanks! but one more problem we don't have console to all of the switches :( all i am trying to find best way to handle this when some case my radius go zombie or any underlying component busted in that case my NOC people can get access of switches and don't get block..
    – Satish
    Nov 21, 2019 at 19:28
  • @Satish Normally for remote Console access, you use an IP KVM/KMM solution that's connected to a different circuit (Out Of Band managment) so it isn't affected by outages affecting the rest of the network.
    – Jesse P.
    Nov 21, 2019 at 19:30
  • I can't help with simply not being allowed to access the console of some devices - that's a company policy issue.
    – Jesse P.
    Nov 21, 2019 at 19:30
  • Thanks, I believe cisco doesn't like that idea, you can't use both database same time so i think i have to live with that. Thanks for your reply.
    – Satish
    Nov 22, 2019 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.