When does a router fall back from the TACACS+ servers to the local user database?
Show the answer
Say this first
Only when the servers do not answer: timeout, connection refused, no route. If a server answers and rejects the user, that is a final answer and the router does not try the local database. That is why the break-glass account works during a server outage, but not while the server is up. I also give the console its own method list that uses local only, so an AAA problem can never lock me out of the console.
Go deeper
Three results, not two
Each method returns pass, fail or error. Pass logs you in, fail stops the list, and only error moves
on to the next method. debug aaa authentication shows which method was tried and what it returned.
Console safety net
aaa authentication login CONSOLE local
line con 0
login authentication CONSOLELockouts and odd fallbacks seen in real life
aaa new-modelbefore a local user exists. New sessions have no working method.- Wrong source address. The server does not know the request's source IP, so it ignores it. The router sees no answer and falls back to local, which looks like "TACACS+ is not working, but local logins work".
- Shared secret mismatch. The server cannot validate the request, or the device cannot decrypt the reply. Check the server's logs, which usually name the problem directly.
- Command authorization with no fallback. With
aaa authorization commands 15 default group TAC-SERVERSand nothing after it, a server outage means you can log in but not run commands. Addlocalorif-authenticated.
Change discipline
Keep a second session open while changing AAA, test a new login before closing it, and on remote
devices schedule reload in 10 first.
They will ask next
What does
if-authenticateddo at the end of an authorization list?If every earlier method errors, authorization passes as long as the user authenticated successfully. It keeps admins working during a server outage.
How do you test the servers without logging out?
The
test aaa groupcommand sends a real request with a username and password from the device and reports pass or fail, andshow aaa serversshows each server's state, response times and counters.
Traps
- Expecting a rejected password to fall through to the local database.
- Applying the default login list to the console with no local-only alternative.