You want to disable TACACS+ authentication on your router's console interface.
You can disable TACACS+ authentication on the router's console port while leaving it active on the rest of the router lines:
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#aaa new-model Router1(config)#aaa authentication login default group tacacs+ local Router1(config)#aaa authentication login OREILLY line Router1(config)#line con 0 Router1(config-line)#login authentication OREILLY Router1(config-line)#end Router1#
By default, when you configure a router to use AAA authentication, it automatically applies this authentication method to all lines. This means that you don't have to explicitly configure each line to use AAA authentication. Normally this default behavior is useful because it requires less configuration. But there are times when you may want to use different authentication methods on different lines. For instance, in our example we wanted to be able to access the router's console line with a simple password. But we didn't want this change to affect the AAA authentication on any of the VTY or AUX lines.
The first two lines in the example simply enable TACACS+ authentication for all login access to the router:
Router1(config)#aaa new-model Router1(config)#aaa authentication login default group tacacs+ local
As soon as you enter these commands, every line on the router, including the console, will begin to use TACACS+ for authentication. The next command creates a new AAA authentication group called OREILLY that uses the local line password for authentication:
Router1(config)#aaa authentication login OREILLY line
This command doesn't do anything yet, though, because none of the router's lines belongs to this new authorization group. We have to configure the console line with the login authentication command to associate this line with the authentication group:
Router1(config)#line con 0
Router1(config-line)#login authentication OREILLY
Now, when a user connects on the console, they will use the type of authentication specified for this group. In this case, if you look back at the group definition, you will see that the OREILLY group uses line authentication. However, because we have associated only the console line with this group, all of the other lines will continue to use the TACACS+ authentication method.
If you wanted to, you could configure a different group for every line. But, in general, we recommend using the default TACACS+ authentication method on all lines, even the console, unless there is a compelling reason to do otherwise. You don't need to worry about losing console access because of a problem on the central server; you can always implement a password of last resort, as described in Recipe 4.3.
You can return the console to the default authentication group by simply changing the login authentication line again:
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#line con 0 Router1(config-line)#login authentication default Router1(config-line)#end Router1#
|
|
|
| Top |