AAA: Locked Out When TACACS+ Goes Down
A local admin account exists and still cannot log in. Read the method list and find the missing fallback, live, right below.
Symptom
The TACACS+ server is down, and even the local emergency account cannot log in. Read the method list and find the fallback that was never written.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Create a free account to open AAA: Locked Out When TACACS+ Goes Down. You get the root cause and the full step-by-step fix.
No spam. The fix lands in your inbox too. Your account includes 5 guided labs free. After that, the Learning Pass unlocks every remaining lab.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
The TACACS+ server ISE (10.1.1.50) is offline for maintenance. Every SSH login to R1 fails, including the local emergency account netadmin. An engineer is still on the console.
What you'll practice
- Read TACACS+ server health from show tacacs
- Read an AAA login method list and predict its behaviour
- Explain the difference between a server error and a server reject
- Add the local database as a fallback method
The topology
R1 authenticates administrators against the TACACS+ server group TACACS-GRP, which contains server ISE at 10.1.1.50. A local user, netadmin, exists for emergencies.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show tacacsshow running-config | include aaashow running-config | include usernameTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why doesn't IOS use the local account automatically?
IOS only uses the methods listed, in order. The login list names the TACACS+ group and nothing else, so when that group returns an error there is no method left to try.
If TACACS+ rejects my password, will local be tried?
No. The next method is used only when the current one returns an error, such as an unreachable server. A reject is a final answer. This is deliberate: otherwise anyone could bypass central policy with a local password.
Should the console use the same list?
Many designs give the console its own list that ends in local, so a network outage can never lock out the console. The key point is that every list that matters should end in a method that works without the network.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.