Troubleshooting guide

1-6
Cisco Wide Area Application Services Configuration Guide
OL-26579-01
Chapter 1 Configuring Administrative Login Authentication, Authorization, and Accounting
Configuring Administrative Login Authentication and Authorization
• Configuring Windows Domain Server Authentication Settings, page 1-17
Step 4 Specify one or all of the following login authentication configuration schemes that the WAAS device
should use to process administrative login requests:
• Specify the administrative login authentication scheme.
• Specify the administrative login authorization scheme.
• Specify the failover scheme for the administrative login authentication server (optional).
For example, specify which authentication database the WAAS device should check to process an
administrative login request. See the “Enabling Administrative Login Authentication and Authorization
Schemes for WAAS Devices” section on page 1-26.
Caution Make sure that RADIUS, TACACS+, or Windows domain authentication is configured and operating
correctly before disabling local authentication and authorization. If you disable local authentication and
RADIUS, TACACS+, or Windows domain settings are not configured correctly, or if the RADIUS,
TACACS+, or Windows domain server is not online, you may be unable to log in to the WAAS device.
You can enable or disable the local and the remote databases (TACACS+, RADIUS, and Windows
domain) through the WAAS Central Manager GUI or the WAAS CLI. The WAAS device verifies
whether all databases are disabled and, if so, sets the system to the default state (see Table 1-1). If you
have configured the WAAS device to use one or more of the external third-party databases (TACACS+,
RADIUS, or Windows domain authentication) for administrative authentication and authorization, make
sure that you have also enabled the local authentication and authorization method on the WAAS device,
and that the local method is specified as the last option; otherwise, the WAAS device will not go to the
local authentication and authorization method by default if the specified external third-party databases
are not reachable.
By default, local login authentication is enabled first. Local authentication and authorization uses locally
configured login and passwords to authenticate administrative login attempts. The login and passwords
are local to each WAAS device and are not mapped to individual usernames. When local authentication
is disabled, if you disable all other authentication methods, local authentication is reenabled
automatically.
You can disable local login authentication only after enabling one or more of the other administrative
login authentication methods. However, when local login authentication is disabled, if you disable all
other administrative login authentication methods, local login authentication is reenabled automatically.
You cannot specify different administrative login authentication methods for console and Telnet
connections.
We strongly recommend that you set the administrative login authentication and authorization methods
in the same order. For example, configure the WAAS device to use RADIUS as the primary login
method, TACACS+ as the secondary login method, Windows as the tertiary method, and the local
method as the quaternary method for both administrative login authentication and authorization.
Note A TACACS+ server will not authorize a user who is authenticated by a different method. For example,
if you configure Windows as the primary authentication method, but TACACS+ as the primary
authorization method, TACACS+ authorization will fail.