topic Cannot login with local account when TACACS is enabled in General Network Management

Cannot login with local account when TACACS is enabled

radicvedran — Tue, 15 Nov 2022 21:31:46 GMT

When TACACS is enabled I cannot login with local account. When I disable TACACS, local login is OK. I cannot seem to find the command which would configure order of authentication, or allow both options - if there is one. I'm a beginner with Extreme devices. I'd appreciate any advice.

OS: 16.2.5.4-patch1-20

Model: X670V-48x and X670-48x

Regards,
Vedran

Re: Cannot login with local account when TACACS is enabled

Robert_Haynes — Wed, 16 Nov 2022 13:40:43 GMT

Not a switch expert.

However I think this is design intent. As long as the TACACS server is reachable local fallback will not be possible. Only if the TACACS server is actually down / fully blocked will local management authentications allow fallback to local accounts. Same for RADIUS - if the RADIUS server responds with Access-Reject / is reachable - fallback to local accounts will not work.

Re: Cannot login with local account when TACACS is enabled

WillyHe — Wed, 16 Nov 2022 20:52:04 GMT

Correct Robert.

The idea is to get authenticated by TACACS or NAC, then every network manager has his personal log-in and access level.
The local account(s) should have a difficult to remember log-in that is kept in a safe place.

When the login of a TACACS/NAC users is known by others, the login can easily be changed or blocked in the TACACS/NAC.
When the same happens with the local log-in then you must change log-in on ALL devices, when it are few it is doable but when it are hundreds ... .

hope it helps
WillyHe

Re: Cannot login with local account when TACACS is enabled

radicvedran — Thu, 17 Nov 2022 13:40:52 GMT

thx all