CISCO Management Console and RADIUS

[BKGarry]

Hello oh wise and wonderful CISCO people.

 

I am currently decommissioning old 2k3 DCs but I am stuck at the moment with the last one, this one has IAS with RADIUS on it that all of the management consoles on our CISCO switches use to be able to login to them.

 

I am thinking about removing that and just going to a plain username and password held on the switch but is this for the best?

 

Also, I take it I will have to do this on each switch, which isn't a problem I can just do it one evening.

 

Last question, anyone also know how I can get my switches working with the CISCO network assistant GUI thingy? Would just be nice to use that sometimes but it never seems to detect them, something must be disabled.

 

All of our switches are running iOS and are either 3750 or various forms of the 2960 (some 48 port 10/100 and some 24 port 10/100/100 )

 

Thank you all in advance

[BKGarry]

A little morning bump to see if anyone can help.

 

Googlefu is not strong with me at the moment

[Wave9_Lee]

Not sure if these help?

 

How to configure local login on a cisco switch (and stop radius auth)

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1 - Configuring Local Authentication and Authorization [Cisco Catalyst 2960-XR Series Switches] - Cisco

 

configure CNA to talk to a device

Getting Started with Cisco Network Assistant - Installing, Launching, and Connecting Network Assistant [Cisco Network Assistant] - Cisco

 

CNA uses HTTP 80 unless configured otherwise so this will need the local access granting on the switch

https://supportforums.cisco.com/document/17691/how-configure-http-access-router-using-local-authentication

[FN-GM]

I am thinking about removing that and just going to a plain username and password held on the switch but is this for the best?

 

Thats what I do. Unless you have a really large organisation.

 

Also, I take it I will have to do this on each switch, which isn't a problem I can just do it one evening.

 

Yep

 

Last question, anyone also know how I can get my switches working with the CISCO network assistant GUI thingy? Would just be nice to use that sometimes but it never seems to detect them, something must be disabled.

 

You need to have http and https running. It could be disabled. Try running these commands in global config mode:

 

 

ip http server

ip http secure-server

[ellsandell]

Using RADIUS/TACAS really depends on how many devices you are using? Nothing stopping you setting RADIUS up on a new server?

Create local accounts then do a no before each of your radius and aaa config statements to remove them. Pretty easy.

[BKGarry]

Is global config different to config terminal?

[FN-GM]

Is global config different to config terminal?

 

They are the same

[BKGarry]

Thank you all,

I will practice on an edge switch tomorrow, as I don't want to do this on the core switch straight away do I hehehehe

[ITGURU]

I always used to just use Local logins on all switches set up the same. However over the years I decided to implement RADIUS switch authentication for logging in as it meant I could easily assign AD credentials to the logins for different levels of access - Admin, View Only, etc.

 

I have it set so authentication order is RADIUS then local, so if for any reason the RADIUS is unavailable I would still be able to login with at least the local login.