Create local backdoor switch admin account in case NPS / Radius is down

[Keith9]

Hello,

I’m testing enabling active directory login using windows NPS servers.  The thing is although this appears to be working, the switch no longer accepts the “admin” password.  The concern is if the NPS servers were down for some reason (like a network issue) and you want to troubleshoot that network issue so you go to the network (switch) and then you woudn’t have a backdoor way in from another location.

Here is the config added to the switch

configure radius mgmt-access primary server 10.1.1.1 1645 client-ip 10.1.0.111 vr VR-Default
configure radius mgmt-access primary shared-secret Secrethere

configure radius mgmt-access secondary server 10.1.1.2 1645 client-ip 10.1.0.111 vr VR-Default
configure radius mgmt-access secondary shared-secret Secrethere
 

enable radius mgmt-access

Followed these two articles:
https://extremeportal.force.com/ExtrArticleDetail?an=000074221

https://extremeportal.force.com/ExtrArticleDetail?an=000078945

Also notice regular AD users can log in, but thankfully they do not have any admin rights of the switch.

[BradP]

The switch is not accepting the “admin” login anymore, because its trying to authenticate that “admin” user against RADIUS, and if one isn’t present in RADIUS, then the RADIUS server is sending an access-reject.

[BradP]

Hi Keith,

If the RADIUS servers are unavailable, the switch should default to the on-switch database. If you are still nervous, you can configure a failsafe account on the switches that can be used that don’t get authenticated against RADIUS.

Brad