Troubleshooting Guide

Parameter Description
pass-auth Specifies if password authentication is enabled or
disabled. The default is enabled.
enable Specifies if SSH secure mode is enabled. False is
disabled. Secure is enabled.
Unable to log on by any means (Telnet, rlogin, or SSH)
If you cannot log on by any means, perform the following steps.
Procedure
1. Check whether the TACACS+ server runs properly and try to restart the TACACS+ server.
2. Check whether you enabled both TACACS+ and RADIUS on the switch.
show radius
show tacacs
If TACACS+ fails, RADIUS can take over the authentication, authorization, and accounting
(AAA) process.
3. Check whether you configured the TACACS+ server to unencrypted mode, as the switch
always sends encrypted TACACS+ messages.
4. Check whether you configured the switch properly. In particular, check the IP address and
key.
show tacacs
5. Check whether you configured the encryption key, connection mode (single connection or
per-session connection), and TCP port number the same on the TACACS+ server and
switch.
6. If the server connects directly, check whether the administrative and operation status of the
port is up:
show interface gigabitethernet {slot/port[/sub-port][-slot/port[/
sub-port]][,...]}
7. If the server is connected in a network, check whether the switch has a route configured to
the server network:
show ip route
Example
Check whether you enabled both TACACS+ and RADIUS on the switch:
Switch:1>enable
Switch:1(config)#show tacacs
Global Status:
Upper layer troubleshooting
January 2017 Troubleshooting 242
Comments on this document? [e-mail]