ICX SWITCH LOCAL ACCOUNT USER

Question

After configuring aaa on my icx 7450 switch, I can't login on switch any more using the local account user.The logging request is rejected by SSH, How can I solve this please?

ben_beck_9x9gzf7d7ijfv · Answer

Can you show us your 'aaa authentication' statement in your configuration?

whisler_soineus · Answer

sure, here it is:aaa authentication web-server default localaaa authentication enable default radius localaaa authentication login default radius localaaa authentication login privilege-modeaaa accounting commands 0 default start-stop radiusaaa accounting exec default start-stop radiusaaa accounting system default start-stop radius

ben_beck_9x9gzf7d7ijfv · Answer

'aaa authentication login default radius local'This statement makes radius the first authentication method. You will need to use an account defined on your radius server. The local accounts will only be backup in case radius fails.

whisler_soineus · Answer

but the local account is created on the icx switch...  Do you think that I have to create it on radius server preferably? cause if the connection is lost with radius sever, and the account is defined on it, we will don't have any backup account to login on icx switch. What do you think?

ben_beck_9x9gzf7d7ijfv · Answer

Yes, you will need to create the accounts on the radius server. Those accounts will then be used to log in to the switch. With your current configuration, the local user accounts are only backup if radius fails. If you prefer to use local accounts, you would need to change your statement to something like this:

aaa authentication login default local

Support - 1-855-782-5871
https://support.ruckuswireless.com/contact-us

whisler_soineus · Answer

The thing is, we would like to have a backup local user account if radius fails. But normally, we use radius authentication with windows account to login on icx switch all the time. Now, is there something that I have to modify on aaa statement to have these two options working, please?

ben_beck_9x9gzf7d7ijfv · Answer

You won't be able to have them both actively working at the same time. The first authentication method would need to fail before the second can be used. Your initial configuration statement is pretty common. If your radius server ever goes down or becomes unreachable, you will then be able to use your local accounts.

Support - 1-855-782-5871
https://support.ruckuswireless.com/contact-us

whisler_soineus · Answer

Ok now I would like to test the connection to the switch using the local account user created on the switch without using radius authentication, but it's not working. So if radius server fails, we will have big trouble.... Here is our problem...

ben_beck_9x9gzf7d7ijfv · Answer

How are you testing it? Are you removing the radius server from the network or shutting it down?

whisler_soineus · Answer

no, the server is still working  on the network while I'm testing.

ben_beck_9x9gzf7d7ijfv · Answer

You will need to simulate a radius failure (disconnect server, make it unreachable, etc.) to test your local user accounts with your current configuration.

whisler_soineus · Answer

okay, I will do this test and will let you know ..... Thanks again

whisler_soineus

ICX SWITCH LOCAL ACCOUNT USER

Responses

ben_beck_9x9gzf7d7ijfv

whisler_soineus

ben_beck_9x9gzf7d7ijfv

whisler_soineus

ben_beck_9x9gzf7d7ijfv

whisler_soineus

ben_beck_9x9gzf7d7ijfv

whisler_soineus

ben_beck_9x9gzf7d7ijfv

whisler_soineus

ben_beck_9x9gzf7d7ijfv

whisler_soineus

Was this helpful?