Cisco N5K-C5010P-BF Troubleshooting Guide - Page 135

Authentication fallback method appears inoperable, Possible Cause, Solution

Get Cisco N5K-C5010P-BF - Nexus 5010 Switch PDF manuals and user guides
UPC - 882658212208
View all Cisco N5K-C5010P-BF manuals
Add to My Manuals
Save this manual to your list of manuals

Page 135 highlights

Chapter 6 Troubleshooting Security Issues AAA Send document comments to [email protected]. If you try to configure TACACS+ along with RADIUS, syslog messages similar toto the example, as shown in the example, appear during login. Example: 2010 May 19 16:12:19 mars %$ VDC-1 %$ %RADIUS-2-RADIUS_NO_AUTHEN_INFO: ASCII authentication not supported 2010 May 19 16:12:19 mars %$ VDC-1 %$ %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user oregon-regress from 10.193.128.5 - login[5698] Authentication fallback method appears inoperable The NX-OS supported fallback method for authentication is that if all the AAA remote RADIUS or TACACS+ servers are unreachable, then the log in attempts to authenticate the SSH/Telnet user locally. However, the login to the Nexus 5000 switch might still fail with the local authentication. Possible Cause The local user database does not contain the user account that the user is using to login with. Solution Perform the following steps to check the authentication fallback method. • As a best practice, include the aaa authentication login error-enable command in the configuration. When it is included in the configuration, the login session sees whether the fallback method is operating correctly. If messages, such as "Remote AAA servers unreachable; local authentication done" or "Remote AAA servers unreachable; local authentication failed", are received, then the fallback method is operating correctly. • If the remote AAA servers are not accessible, check to see if the local user database has the user credential for local authentication. Use the show user-account command to display the credential. Note By using the show user-account command, you can determiine which user-account was created through REMOTE authentication. A user account that was created with REMOTE authentication cannot be used for a local (fallback) login. • Create local user accounts with the username password role command until the remote AAA servers become accessible. OL-25300-01 Cisco Nexus 5000 Series Troubleshooting Guide 6-7

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
Send document comments to [email protected].
6-7
Cisco Nexus 5000 Series Troubleshooting Guide
OL-25300-01
Chapter 6
Troubleshooting Security Issues
AAA
If you try to configure TACACS+ along with RADIUS, syslog messages similar toto the example, as
shown in the example, appear during login.
Example:
2010 May 19 16:12:19 mars %$ VDC-1 %$ %RADIUS-2-RADIUS_NO_AUTHEN_INFO: ASCII
authentication not supported
2010 May 19 16:12:19 mars %$ VDC-1 %$ %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication
failed for user oregon-regress from 10.193.128.5 - login[5698]
Authentication fallback method appears inoperable
The NX-OS supported fallback method for authentication is that if all the AAA remote RADIUS or
TACACS+ servers are unreachable, then the log in attempts to authenticate the SSH/Telnet user locally.
However, the login to the Nexus 5000 switch might still fail with the local authentication.
Possible Cause
The local user database does not contain the user account that the user is using to login with.
Solution
Perform the following steps to check the authentication fallback method.
•
As a best practice, include the
aaa authentication login error-enable
command in the
configuration. When it is included in the configuration, the login session sees whether the fallback
method is operating correctly. If messages, such as “Remote AAA servers unreachable; local
authentication done" or “Remote AAA servers unreachable; local authentication failed", are
received, then the fallback method is operating correctly.
•
If the remote AAA servers are not accessible, check to see if the local user database has the user
credential for local authentication. Use the
show user-account
command to display the credential.
Note
By using the
show user-account
command, you can determiine which user-account was created through
REMOTE authentication. A user account that was created with REMOTE authentication cannot be used
for a local (fallback) login.
•
Create local user accounts with the
username <username> password <password> role <role
name>
command until the remote AAA servers become accessible.