So i tried it with an condition and still devices are accessible with the local account even if ldap is running. so basically i can login to routers either using my AD account or the local account in the users file. how can i restrict this behavior to ldap failure only. below is my if statement in the &#39;default&#39; file and the users &#39;file&#39; config<div>
<br></div><div><div>        ldap</div><div>        if (fail) {</div><div>               files</div><div>       }</div><div><br></div><div><div>DEFAULT         Huntgroup-Name == &quot;network-admin&quot;, Ldap-Group == &quot;networkadmins&quot;</div>
<div>                Service-Type := NAS-Prompt-User,</div><div>                cisco-avpair := &quot;shell:priv-lvl=15&quot;,</div><div> #               Auth-Type := LDAP</div><div><br></div><div>#admin           Huntgroup-Name == &quot;network-admin&quot;, Cleartext-Password := &quot;xxxxxxxx&quot;</div>
<div>admin           Cleartext-Password := &quot;xxxxxxxx&quot;</div><div>               Service-Type := NAS-Prompt-User,</div><div>               cisco-avpair := &quot;shell:priv-lvl=15&quot;</div><div><br></div><div>DEFAULT         Auth-Type := Reject</div>
<div>                Reply-Message := &quot;Access Denied. Your attemp has been logged.&quot;</div></div><br><div class="gmail_quote">On Thu, Aug 12, 2010 at 4:34 AM, Alan DeKok <span dir="ltr">&lt;<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><div></div><div class="h5">Aqdas Muneer wrote:<br>
&gt; i would like to configure freeradius so that it can failover to a local<br>
&gt; password when the ldap server cannot be contacted. i was able to create<br>
&gt; a admin account in the users file with cleartext password, but when i<br>
&gt; enable it, it becomes accessible even when ldap is up and running. we<br>
&gt; are running version 2.1.7 of freeradius.<br>
<br>
</div></div>  Read &quot;man unlang&quot;.  Configure a section to do something if the ldap<br>
module returns &quot;fail&quot;.<br>
<font color="#888888"><br>
  Alan DeKok.<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</font></blockquote></div><br></div>