HI Friends,
we have two ISG2000 firewalls in active/passive mode installed, Yesterday by mistake while creating a new user, we changed the admin user from NetScreen to new user jams, and this is only admin user on firewall now i.e. jams.
as our firewall authentication mode is tacaces/LDAP, and jams name is same as LDAP and local, so when we try to authenticate firewall, it tries to authenticate from AAA instead of a local password. when we enter LDAP password it works but that user is not the admin.
if someone faced this issue, kindly assist how to force firewall to authenticate locally with user jams instead of LDAP, we are afraid if change tacaces conifguration, if will force to logout and no one will be able to login again if local user not worked ![Smiley Sad]( "Smiley Sad")
below are the conguration before and after change.
----------------------------before change------------
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth-server "aruba-tacacs" id 1
set auth-server "aruba-tacacs" server-name "10.XX.XX.XX"
set auth-server "aruba-tacacs" backup1 "10.XX.XX.XX"
set auth-server "aruba-tacacs" account-type admin
set auth-server "aruba-tacacs" fail-over revert-interval 5
set auth-server "aruba-tacacs" type tacacs
set auth-server "aruba-tacacs" tacacs secret "abc-xyz"
set auth-server "aruba-tacacs" tacacs port 49
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "netscreen"
set admin password "abc-xyz"
set admin auth web timeout 0
set admin auth server "aruba-tacacs"
set admin auth remote root
set admin privilege get-external
set admin format dos
set auth-server "Local" server-name "Local"
set auth-server "aruba-tacacs" id 1
set auth-server "aruba-tacacs" server-name "10.XX.XX.XX"
set auth-server "aruba-tacacs" backup1 "10.XX.XX.XX"
set auth-server "aruba-tacacs" account-type admin
set auth-server "aruba-tacacs" fail-over revert-interval 5
set auth-server "aruba-tacacs" type tacacs
set auth-server "aruba-tacacs" tacacs secret "abc-xyz"
set auth-server "aruba-tacacs" tacacs port 49
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "netscreen"
set admin password "abc-xyz"
set admin auth web timeout 0
set admin auth server "aruba-tacacs"
set admin auth remote root
set admin privilege get-external
set admin format dos
set user "netscreen" uid 2
set user "netscreen" type auth
set user "netscreen" remote ipaddr "10.xx.xx.xx"
set user "netscreen" hash-password "0abc-xyz"
set user "netscreen" type auth
set user "netscreen" remote ipaddr "10.xx.xx.xx"
set user "netscreen" hash-password "0abc-xyz"
----------------------------after change-------------------
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth-server "aruba-tacacs" id 1
set auth-server "aruba-tacacs" server-name "10.XX.XX.XX"
set auth-server "aruba-tacacs" backup1 "10.XX.XX.XX"
set auth-server "aruba-tacacs" account-type admin
set auth-server "aruba-tacacs" fail-over revert-interval 5
set auth-server "aruba-tacacs" type tacacs
set auth-server "aruba-tacacs" tacacs secret "abc-xyz"
set auth-server "aruba-tacacs" tacacs port 49
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "jams"
set admin password "abc-xyz"
set admin auth web timeout 0
set admin auth server "aruba-tacacs"
set admin auth remote root
set admin privilege get-external
set admin format dos
set auth-server "Local" server-name "Local"
set auth-server "aruba-tacacs" id 1
set auth-server "aruba-tacacs" server-name "10.XX.XX.XX"
set auth-server "aruba-tacacs" backup1 "10.XX.XX.XX"
set auth-server "aruba-tacacs" account-type admin
set auth-server "aruba-tacacs" fail-over revert-interval 5
set auth-server "aruba-tacacs" type tacacs
set auth-server "aruba-tacacs" tacacs secret "abc-xyz"
set auth-server "aruba-tacacs" tacacs port 49
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "jams"
set admin password "abc-xyz"
set admin auth web timeout 0
set admin auth server "aruba-tacacs"
set admin auth remote root
set admin privilege get-external
set admin format dos
set user "netscreen" uid 2
set user "netscreen" type auth
set user "netscreen" remote ipaddr "10.xx.xx.xx"
set user "netscreen" hash-password "0abc-xyz"
set user "netscreen" type auth
set user "netscreen" remote ipaddr "10.xx.xx.xx"
set user "netscreen" hash-password "0abc-xyz"
set user "jams" uid 3
set user "jams" type auth
set user "jams" remote ipaddr "10.xx.xx.xx"
set user "jams" hash-password "0abc-xyz"
set user "jams" type auth
set user "jams" remote ipaddr "10.xx.xx.xx"
set user "jams" hash-password "0abc-xyz"