Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following configuration on a switch that I testing for RADIUS authentication:

aaa new-model  
aaa authenticaton login default group radius local  
aaa authentication enable default group radius enable  
aaa authorization exec default group radius local  
enable secret 5 XXXXXXXXX  
!  
username admin secret 5 XXXXXXXXX  
!  
ip radius source-interface FastEthernet0/1  
radius-server host XXX.XXX.XXX.XXX auth-port 1812 acct-port 1813 key XXXXXXXXX  
radius-server retransmit 3  
!  
line con 0  
line vty 5 15  

Radius authentication is working just fine but if the server is not available I can not log into the router with the ADMIN account.

What's wrong there?

Thanks!

share|improve this question

migrated from superuser.com Mar 21 '10 at 11:10

This question came from our site for computer enthusiasts and power users.

    
What is the error message you get when trying to login? Does it just prompt for password again? –  Joseph Mar 21 '10 at 11:55
    
The switch accepts the login command in con term mode but after exiting to normal mode it doesn't get display when a sh run is executed –  3D1L Mar 25 '10 at 16:42
    
try doing a debug aaa ... command –  MikeyB Jul 28 '11 at 0:05

1 Answer 1

Seems correct to me. From Cisco site:

Example 1: Exec Access using Radius then Local
aaa authentication login default group radius local

In the command above:
* the named list is the default one (default).
* there are two authentication methods (group radius and local).

All users are authenticated using the Radius server (the first method).
If the Radius server doesn't respond, then the router's local database
is used (the second method).

Maybe you have some kind of

login authentication <NAME>

under your line vty 0 X ?

In that case you shoud add a line:

aaa authentication login <NAME> group radius local

or simply delete the

login authentication <NAME>

line from your conf.

share|improve this answer
    
MrShunz thanks but there is no login line except for the one that I already listed: aaa authentication login default group radius local –  3d1l Mar 19 '10 at 19:38
1  
well, you can try then adding under line vty 0 X "login authentication <NAME>" and "aaa authentication login <NAME> local" to see if it works –  Mr Shunz Mar 20 '10 at 17:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.