Failover to local login when TACACS is reachable but not authenticating

Hello, I'm confident I already know the answer to this question but I want to be sure.
I am moving a large number of Cisco devices to a new TACACS server, is there anything that can be done to allow local login if the new TACACS server is reachable but not authenticating for some reason? For example if the Cisco source IP is not built correctly into the server or the key is not configured properly on the device; in these situations the server is reachable but will not provide authentication.
I already have AAA authentication set similar to the following:
Router1(config)#aaa authentication login default group tacacs+ line
This will allow me to use line authentication if the tacacs server is not reachable but not if the server is reachable and not authenticating properly.
Any ideas on how/if I can failover to local login for the example situation I provided above?

Looks like NX-OS will not allow me to do this.
Nexus001(config)# aaa authentication login default local group TACACS
                                                                  ^
% Invalid command at '^' marker.
Nexus001(config)# aaa authentication login default local ?
<CR>
Nexus001(config)# aaa authentication login ?
ascii-authentication Enable ascii authentication
chap                  CHAP authentication for login
console               Configure console methods
default               Configure default methods
error-enable          Enable display of error message on login failures
mschap                MSCHAP authentication for login
mschapv2              MSCHAP V2 authentication for login
Nexus001(config)# aaa authentication login default ?
fallback Configure fallback behavior
group     Specify server groups
local     Use local username authentication
none      No authentication
Nexus001(config)# aaa authentication login default local ?
<CR>

Similar Messages

How do I set a specific page to open when I open a new tab in Firefox? I can open the page when initially opening Firefox, but not for subsequent tabs/pages.

How do I set a specific page to open when I open a new tab in Firefox? I can open the page when initially opening Firefox, but not for subsequent tabs/pages.

You can use an extension to set which page to open in a new tab:
*NewTabURL : https://addons.mozilla.org/firefox/addon/newtaburl/
*My Homepage: https://addons.mozilla.org/firefox/addon/my-homepage/

What do you do when ipod is detected but not identified?

What do you do when ipod is detected but not identified?

Hi there schnee2,
You may find the troubleshooting steps in the article below helpful.
iPod not recognized in My Computer and in iTunes for Windows
http://support.apple.com/kb/ts1369
-Griff W.

I have an iphone 4s and the speaker has stpped working when I play music with i tunes or you fox. It works when they ring me but not when i want to listen to music :( do you know how I fix this?

I have an iphone 4s and the speaker has stpped working when I play music with i tunes or you fox. It works when they ring me but not when i want to listen to music :( do you know how I fix this?

Go to settings/music/volume limit tap on that. Make sure it is set to OFF and when you tap it that the slider is at max

AAA and TACACS on everything BUT NOT console

Would like to enable login authentication AND enable authentication on VTY but NOT console. Console should authenticate locally for both user and privilige modes ... I can't seem to seperate the 'enable' piece ... any thoughts?

I do not think you can separate method list for
the enable piece. I've asked Cisco about this
in the past and they told me that it is not
possible. You can have a different method list
for the console for the "exec" mode but not
the enable or privilege mode. It is either
"tacacs" or "enable" or some other
combinations but not a separate method list for "enable" by itself. Maybe cisco added
this new feature in 12.4. I've my my testing
on both 12.2T and 12.3T and, IMHO, it is not
possible to separate the enable piece. Here
is my config:
username cisco password cisco
enable secret cisco
aaa authentication login notac local
aaa authentication login VTY group tacacs+ local
aaa authentication login web local enable
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec notac none
aaa authorization exec VTY group tacacs+ if-authenticated none
aaa authorization commands 0 VTY group tacacs+ if-authenticated none
aaa authorization commands 1 VTY group tacacs+ if-authenticated none
aaa authorization commands 15 VTY group tacacs+ if-authenticated none
aaa authorization network VTY group tacacs+ if-authenticated none
aaa accounting exec TAC start-stop group tacacs+
aaa accounting exec VTY start-stop group tacacs+
aaa accounting commands 0 TAC start-stop group tacacs+
aaa accounting commands 0 VTY start-stop group tacacs+
aaa accounting commands 1 TAC start-stop group tacacs+
aaa accounting commands 1 VTY start-stop group tacacs+
aaa accounting commands 10 TAC start-stop group tacacs+
aaa accounting commands 15 TAC start-stop group tacacs+
aaa accounting commands 15 VTY start-stop group tacacs+
aaa accounting network VTY start-stop group tacacs+
aaa accounting connection TAC start-stop group tacacs+
aaa session-id common
line con 0
exec-timeout 0 0
authorization exec notac
accounting commands 0 VTY
accounting commands 1 VTY
accounting commands 15 VTY
accounting exec VTY
logging synchronous
login authentication notac
line vty 0 15
exec-timeout 0 0
authorization commands 0 VTY
authorization commands 1 VTY
authorization commands 15 VTY
authorization exec VTY
accounting commands 0 VTY
accounting commands 1 VTY
accounting commands 15 VTY
accounting exec VTY
login authentication VTY

Login on waking from sleep, but not screensaver / sleep display

Hi all, been trying to get rid of the login from screen saver / sleep display, while keeping the login on waking the computer from sleep. The reason I want to do this is because I frequently use a Hot Corner to sleep the display while listening to music etc, and having to enter a password just to change tracks etc is a pain But obviously I want to keep the password protection when the computer is put to sleep, as it always is when left unattended.
Anyway, based on initial Googling, I first tackled the problem by installing SleepWatcher from http://www.bernhard-baehr.de/, and adding this line to the global /etc/rc.wake script:
/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend
However, this wasn't very satisfactory, because after waking the computer up from sleep, you initially get a normal session, which then suspends after 3 or 4 seconds. During this time you can interact with the session as normal and move windows etc, so it kind of gives you the impression that you don't have to log in, and then you do, so it's a bit clunky, and also doesn't feel very secure.
I thought I managed to improve the situation by moving the 'suspend' command to SleepWatcher's /etc/rc.sleep script instead of the /etc/rc.wake script - meaning that your session is suspended just before sleep, so it's already suspended when you wake the computer up. But then I noticed an even worse problem - my "Sleep Display" Hot Corner stopped working after SleepWatcher suspended my session!
Yes that's right, every time the 'suspend' command ran in conjunction with SleepWatcher, my "Sleep Display" Hot Corner got disabled, and didn't get re-enabled until I completely logged out and back in (or rebooted). So I stopped using SleepWatcher, by removing the 'suspend' command from any SleepWatcher scripts, and now Hot Corners work as normal again following successive sleeps.
So next I thought, maybe I could write an AppleScript that toggles the "Require password..." checkbox in System Preferences, perhaps to use in conjunction with SleepWatcher, so that the checkbox is disabled when the display is put to sleep, and enabled when the computer is put to sleep. I actually got as far as writing an AppleScript that toggled the checkbox, and was about to attempt to integrate it with SleepWatcher...
...then I stumbled across an old thread, where they talk about updating plists under com.apple.screensaver, in order to solve a slightly different problem:
http://forums.macosxhints.com/showthread.php?t=14085
Despite the thread being a few years old and trying to solve a different problem, the following command sounded hopeful so I thought I'd try it:
defaults -currentHost write com.apple.screensaver askForPassword -int 0
...and lo and behold, it works!
My mac is now behaving exactly as I want it - prompting for password on wake from sleep in the normal way as it did before, and not prompting when I merely wake the display (or screensaver)!
This is in conjunction with having the "Require password to wake this computer from sleep or screen saver" checkbox turned ON in System Preferences.
But the puzzling thing is, why does it work? Is it safe? Are there any side-effects and am I likely to need to re-enable it following software updates? Does it work for anyone else?
When I query the values under com.apple.screensaver, I get the following... I have no way of telling what the askForPassword value was before I changed it:
$ defaults -currentHost read com.apple.screensaver
askForPassword = 0;
idleTime = 0;
moduleName = Flurry;
modulePath = "/System/Library/Screen Savers/Flurry.saver";
tokenRemovalAction = 0;
Basically I'm very surprised that a simple one-line command seems to solve the problem, when there are so many threads where people have asked the same question, and either been told it's not possible, or told you need to do weird stuff with SleepWatcher and/or Applescript, which is often incompletely explained, more complex and less effective.
So, is the one-line askForPassword solution too good to be true?

Thanks. I think for an office-type environment, it is an unusual requirement.
But let's not forget, more and more people use their computers in living-room type environments, for tasks such as playing music or watching films on a remote display. You're typically in a much darker ambience, which you don't want that to be shattered by the bright, white glare of a computer screen all the time!
So you need total control over whether the display is on or off. This has nothing to do with leaving the computer unattended. You're still there, "using" the computer, you're just not necessarily using the display.
Anyway... you are right, I toggled the "Require password..." setting in System Preferences off and then on again, and the "askForPassword" plist value changed itself to 1.
However... the behaviour of my mac has not changed. It behaves the way I want it (prompt for password on waking the compuer, but not on waking only the display), regardless whether the value of askForPassword is 0 or 1.
Even after rebooting.
Strange... what have I done?

Locale Currency symbol present in Win but not Linux

I am trying to get the currency symbol for the locale en_NZ (English, New Zealand), which is '$'. However, it works on Windows, but not on Linux. On linux it returns "NZD" which basically means it did not find the symbol for the locale. I am using 1.4.0 on both linux and windows, I even tried overwriting jdk/jre/lib/ext/localdata.jar on the linux system with the one on the windows system, and it still doenst find the symbol.
I have also iterated through all available locales for both the linux and Win JREs, and en_NZ is available.
Has anyone come across this problem?
Thanks
- Adam Langley

You have complete faith in that dont you?
It doesnt work. well, it works, but the Symbol is not found. Not on Linux. And the AU symbol is not fuond on Windows when it is on linux. Very annoying really.
I have quite alot of experience with i18n, and cant see why this wouldnt be found. the libraries are available, but not returning the currect data for some reason.
Try both of these.
System.out.println(java.text.NumberFormat.getCurrencyInstance(new Locale("","AU")).getCurrency().getSymbol()); // SHOULD RETURN $, but WIN=AUD, LINUX=$
System.out.println(java.text.NumberFormat.getCurrencyInstance(new Locale("","NZ")).getCurrency().getSymbol()); // SHOULD RETURN $, but WIN=$, LINUX=NZD

HP D110 AIO printer. Prints jam when printing with wireless, but not when hooked to USB cable! HELP!

I have a HP D110. It jams the paper when I print with wireless, but not when I use USB cable. Any ideas?

From what you describe you are having issues printing from MS Office. Have you had trouble printing from other resources on your computer (e.g. from the internet or another program)? The first thing I am going to suggest is that we start by uninstalling and reinstalling the printer from the resources available online.
First if you use a USB cord, make sure to remove it (this is important). Do not plug it back in until the software directs you to. Then go through the Devices and Printers, Programs and Features and Device Manager folders and insure that all copies, files, and programs related to the printer are removed. Then as directed, restart the computer.
In the START menu type "%temp%" and press ENTER. Here I want you to press Ctrl+A and hit DELETE. Some of the files will not allow you to delete them, skip those files and delete the majority that allows it.
http://h20000.www2.hp.com/bizsupport/TechSupport/DriverDownload.jsp?prodNameId=3562006&lang=en&cc=us...
Install that and let me know the result!
Have a great day!

HI I have an Iphone 3GS and the microphone jack works when I play music but not when making phone calls. please help as I use it for conference calls

Hi I use my phone for conference calls and use the microphone jack to connect to speakers. It doesnt work when making phone calls but when i play music on the phone the jack works with the external speaker.

Happy to have been of help. Hope all goes smoothly.
BTW, for the sake of others who may help you here, it's usually most polite if you mark the post that answered your question as being the one that "solves" it, not your own post. That's how people get points here, if a questioner marks their post as either "helpful" or "solving". It's not an issue for me, but for those just starting out in the forums it may be important to them. See:
https://discussions.apple.com/static/apple/tutorial/mark.html
and
https://discussions.apple.com/static/apple/tutorial/reputation.html
Regards.

My ipod touch 8gb will not sync ,computer is recognising camera wizard when i plug in but not for itunes,i have tried to de install then re install but to no avail this is a replacement ipod but the last one i had was ok syncing with the same computer

my ipod touch will not sync to itunes when i plug it in to my pc it is recognising the camera wizard but not showing up in itunes i have tried de installing and re installing but to no avail it is a replacement ipod but the last one was ok with syncing on the same usb connections can anyone help me out please

Try to disable the camera notification: http://support.apple.com/kb/TS1500
and make sure that Apple Mobile Device Service is active on your computer: http://support.apple.com/kb/TS1567

I can no longer login to receive my webmail with a second email address; i have already cleared my "saved passwords" and cleared my history, and still i can only login using one email address but not my second one, which i previously was able to do

details are listed in the question; i login using one email address to this site but not my second, which i have always been able to do
The error message is:
Login failed because your username or password was entered incorrectly.
However, all my login information is correct.

try the hints found at
http://support.apple.com/kb/TS1417

Profile issue in export workflow when PS is editor but not within Ap

Aperture is with me on my MBP (with Elements as the external editor). My place of work is not graphics related, so it doesn't have Ap but does have PS CS8, which I've used happily for a long time, for their needs and I can use it for mine as well. So I can't use PS as the internal editor, which is OK, it's just the way it goes. I'm fine with exporting 16 bit TIFFs, using PS for all the things I can't do in Ap, and then creating 8 bit TIFFs for whoever I'm sending the images to, who will use them for the gamut of uses, both print and web, but I'm not in the loop after I hand them off. The images do not then go back into Aperture, they're archived separately.
What is the best way to workflow the color profiles in doing this? Images come RAW off a Pentax K10D and into Aperture for conversion and color and exposure, then into the pixel editor. I work in and save a set in 16 bit RGB and then hand off a set in 8 bit sRGB. Here's my problem: When I work within Aperture and Elements (internally), everything works as planned, and when I check the images but I send them they're correct in how they look and the profile as listed. But I'm not getting the same results when I export out to PS from Ap, do the same routine and check. Sometimes there is no assigned profile, and sometimes if I then assign sRGB the image goes from looking right to wrong, so I can't ignore the issue : ) No doubt it's from the external editor only being able to make one blanket profile assumption at a time, either working or exporting.
I understand that Aperture uses its own color space, wider than both. Am I correct in trying to stay RGB and then converting to sRGB? How do I achieve proper profile workflow when using Aperture and exporting to PS externally? Thanks very much for direction in this. Searches have gotten me info about what results I likely want, but not quite how to get them in this situation.

Arrg. Sorry for that typo. The sentence should have been " When I work within Aperture and Elements (internally), everything works as planned, and when I check the images they're correct in how they look and the profile as listed. "

Video file works when downloaded in IE but not when downloaded in FF

I am constantly being sent QuickTime MOV files from a client via YouSendIt. Whenever I download the file via Firefox, it appears to download fine but it will not play the video. I get the error message "Error -2048: Couldn't open the file because it is not a file that QuickTime understands." Yet whenever I download the exact same file to the exact same desktop and try to open it with the exact same QuickTime player, but using Internet Explorer to click the download link (and handle the downloading, I suppose)... it works fine and the video plays perfectly. WTF?
All other variables are identical. The only difference here is that the file is unusable when downloaded via FireFox yet perfectly fine when downloaded via Internet Explorer. Why? How is this possible?
The only difference I can see on my desktop is that the version of a test video is 39,305,216 bytes when downloaded using FF, yet the exact same file is 39,370,752 bytes when downloaded using IE. I don't know if that's relevant information but how is this even possible since they are both downloads of the exact same file? Shouldn't both browsers neither add nor remove data from the file itself, so it should be the exact same file? Yet it's obviously different in some way, and apparently different in a way that affects the ability of QuickTime to play the file. Why would this be?

If it works in IE but not FF, then it has nothing to do with the mp3s. More likely it's because of the HTML on the page.
To start, page is missing DOCTYPE declaration... a MAJOR problem. The DOCTYPE declares which set of rules the browser will use to display the page. Without it, different browsers go crazy or do not work at all.
http://www.w3schools.com/tags/tag_DOCTYPE.asp
Validate the html code here:
http://validator.w3.org/
You will have to fix all the errors if you want this to work in all browsers.
Best wishes,
Adninjastrator

HT3529 Message Notifications show up in lock mode when screen is on, but not showing on black screen (sleep mode).

My texts show up on my lock screen, but not on my black screen (sleep mode). They used to, but not anymore. I have "show messages in lock screen" turned on, but I don't see any options for sleep mode. I have banners turned on. All settings seem to be correct, but in order to see my messages I need to turn on my screen, which is frustrating b/c then I don't see messages when they are first sent. Any advice? Thanks.

Thanks for the response, but I've tried that and it doesn't work. I have friends and family who have their settings exactly the same as mine (including banner) and they get notifications in their sleep screen. It's all very odd.

Audio ok when playing on computer, but not there when playing on DVD player

I've made two DVDs on my MacBook: one where I dragged a variety of short films into iDVD (imported via iMovie but NOT edited on iMovie!) and burned it - this one plays fine on everyone's computers and DVD players. The second DVD I created with material edited in iMovie and then burned via Share -> iDVD and while that plays fine on my computer, the audio is "missing" when I play it on a regular DVD player.
I burned the DVDs the exact same way, used the exact same DVD stock, and played on the exact same DVD player, so what's going on? I don't think it's an iDVD problem, I think there's something (not) happening in iMovie...
MacBook Mac OS X (10.4.8)

What format is the original?

Failover to local login when TACACS is reachable but not authenticating

Similar Messages

Maybe you are looking for