Cisco IOS Cookbook, 2nd Edition

Losing Access to the TACACS+ Server

Problem

You want to ensure that your router can still authenticate user sessions even if it loses access to the TACACS+ server.

Solution

It is important to make sure that you can still enter commands on your router if your TACACS+ server becomes unreachable for any reason. The following set of commands ensures that you don’t lose functionality just because you lose your server connection:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#aaa new-model
Router1(config)#aaa authentication login default group tacacs+ enable
Router1(config)#aaa authentication enable default group tacacs+ enable
Router1(config)#aaa authorization commands 15 default group tacacs+ if-authenticated
Router1(config)#tacacs-server host 172.25.1.1
Router1(config)#tacacs-server key COOKBOOK
Router1(config)#end
Router1#

Discussion

One of the potential problems with using a central server to authenticate user access is the issue of what happens when you lose access to that server. It would not be terribly useful if you couldn’t plug in a console device and reconfigure the router to fix the problem that caused the router to lose access in the first place. But, by default, a router that can’t communicate with its AAA server can’t authenticate or authorize users.

Fortunately, Cisco’s AAA implementation also includes the ability to do authentication locally on the router in case it can’t reach its TACACS+ server. Cisco documentation ...