Deploying AAA Radius on working infrastructure

[from88]

Hello,

Getting ready to deploy radius centralized authentication and authorization model to current DC network which now is based on local auth. I've some thoughts how to enable ir safely and not end into lockout situation. For example on different IOS devices make sure that i've console connection. Configure AAA methods not with default lists, but with explicitly named and enable it first on VTY lines and see If's working correctly. Also, always leave one session open and try to do new session with new tab. If everything is OK, do it on console line. Also IOS XRs've commit confirmed options.
Maybe you've some other practical advices ?


Thanks

[Georg Pauwen]

Hello,

a local username and password in combination with a fallback to local should prevent any lockout:

username username password password
aaa authentication login default group radius local

Additonally, you can configure the console and/or vty to use a predefined password:

aaa authentication login CONSOLE line

line con 0
exec-timeout 0 0
password password
login authentication CONSOLE

Or use the locally defined username and password to authenticate:

aaa authentication login CONSOLE local