HP ProCurve 2520 ping, show, tacacs-server

Troubleshooting

Unusual Network Activity

■Disconnect the switch from network access to any TACACS+ servers and then log in to the switch using either Telnet or direct console port access. Because the switch cannot access a TACACS+ server, it will default to local authentication. You can then use the switch’s local Operator or Manager username/password pair to log on.

■As a last resort, use the Clear/Reset button combination to reset the switch to its factory default boot-up configuration. Taking this step means you will have to reconfigure the switch to return it to operation in your network.

No Communication Between the Switch and the TACACS+ Server Application. If the switch can access the server device (that is, it can ping the server), then a configuration error may be the problem. Some possibilities include:

■The server IP address configured with the switch’s tacacs-server host command may not be correct. (Use the switch’s show tacacs-servercommand to list the TACACS+ server IP address.)

■The encryption key configured in the server does not match the encryption key configured in the switch (by using the tacacs-server key command). Verify the key in the server and compare it to the key configured in the switch. (Use show tacacs-serverto list the global key. Use show config or show config running to list any server-specific keys.)

■The accessible TACACS+ servers are not configured to provide service to the switch.

Access Is Denied Even Though the Username/Password Pair Is Correct. Some reasons for denial include the following parameters controlled by your TACACS+ server application:

■The account has expired.

■The access attempt is through a port that is not allowed for the account.

■The time quota for the account has been exhausted.

■The time credit for the account has expired.

■The access attempt is outside of the time frame allowed for the account.

■The allowed number of concurrent logins for the account has been exceeded

C-18