topic Local Account Works on Member But Not on Master of Stack in ICX Switches

Local Account Works on Member But Not on Master of Stack

chell_7zwe — Tue, 06 Dec 2022 19:25:04 GMT

Hello. I was testing my local account today via console, aaa server not being available, and could only logon if I connected to the member switch. I have a stack with an ICX7450-48P and ICX7450-24P. If I issue the show stack the 48P is the role of active and the 24P is the role of standby. Both are running 8095G switch code and both have the same boot monitor of 10.1.24. Any ideas why I'm only able to logon with the local account if I'm consoled into the member switch? Thanks.

Re: Local Account Works on Member But Not on Master of Stack

BenBeck — Tue, 06 Dec 2022 19:31:02 GMT

What does your aaa configuration look like? It sounds like the master may think the aaa server is available. You may want to open a support case to get this looked at (see my signature).

Re: Local Account Works on Member But Not on Master of Stack

chell_7zwe — Tue, 06 Dec 2022 19:35:19 GMT

Hello. This is the output of the AAA.

#sh run | i aaa
aaa authentication web-server default local
aaa authentication enable default tacacs+ local
aaa authentication dot1x default radius
aaa authentication login default tacacs+ local
aaa authentication login privilege-mode
aaa authorization commands 0 default tacacs+ none
aaa authorization coa enable
aaa authorization exec default tacacs+ none
aaa accounting commands 0 default start-stop tacacs+ none
aaa accounting exec default start-stop tacacs+ none
aaa accounting dot1x default start-stop radius
aaa accounting mac-auth default start-stop radius
aaa accounting system default start-stop tacacs+ none
enable aaa console

tacacs-server host 1.1.1.1
tacacs-server host 2.2.2.2
tacacs-server key 2 y7y7y7y7y7y7y7y7y7y7y

Re: Local Account Works on Member But Not on Master of Stack

BenBeck — Tue, 06 Dec 2022 20:28:21 GMT

Got it. It's hard to say what is happening there. It would seem the active unit likely still trying to use first method of auth. Please open a case and an engineer can help deep-dive into this for you.