Cisco IOS XE¶
IOS XE does not fall to its local method when port49 answers ERROR: the login is refused, and break-glass fails too, so keep a path that does not depend on port49 answering (the console, or a second reachable server) for the time port49's store is down (L4-error-cisco_iosxe.md; over TLS it was final too, L73-cisco_iosxe.md, cell i). Measured on Catalyst 8000V 17.13.01a (TCP) and 17.18.02 (TCP and RFC 9887); the page also names IOL-XE 17.18.02, which has no TLS client.
Reference configuration¶
Load cisco_iosxe.cfg (TACACS+ on port 49) or cisco_iosxe-tls.cfg (RFC 9887, IOS XE 17.18.1 or later). The placeholders table says what each placeholder is. Create the break-glass account by hand, with a password only you know. The lines that matter, quoted from the files:
aaa group server tacacs+ port49
server name port49-1
server name port49-2
ip vrf forwarding <MGMT_VRF>
ip tacacs source-interface <SOURCE_INTERFACE>
aaa authentication login default group port49 local
aaa authorization exec default group port49 local
aaa authorization commands 15 default group port49 local
aaa authorization config-commands
Over TLS each server object carries these instead of a key:
tacacs server port49-1
address ipv4 <PORT49_1>
tls port <TLS_PORT>
tls trustpoint client <CERT_ID>
tls trustpoint server port49-root
single-connection
What the lab measured¶
- A deny port49 answers is never tried locally: break-glass is not a way around it (L4-cisco_iosxe.md).
- With port49d stopped, break-glass logs in in 20 to 30 ms, and with port49d dark in 780 ms. Commands in sessions that were already open are refused with
% Authorization failed.(L88-cisco_iosxe.md, cells b and d; L41-cisco_iosxe.md; L35-cisco_iosxe.md). - While port49 answers ERROR, break-glass is refused; with port49d's listener closed it logs in in 60 ms (L4-error-cisco_iosxe.md, cells a and c). Troubleshooting says what to do while you wait.
- Over TCP the device answers locally for 30 to 39 s after port49d returns from a stop, or after the first server fails: a token login in that window is refused with nothing sent to port49, and break-glass works (L88-cisco_iosxe.md, cells f2 and f3). The device has no configurable dead time: the lab's image offered no setting (L4-error-cisco_iosxe.md).
- Over TLS on 17.18.02, after port49d declined or reset the handshakes, the client sent port49d nothing and answered locally for 57 to 67 s. This was measured once (L73-cisco_iosxe.md, cell i).
- With the first server resetting at accept, a token login reached the second in under 3 s on a fresh device, and in 790 ms over TLS (L88-cisco_iosxe.md, cell f; L88-cisco_iosxe-iosxe1718-tls.md).
- Over TLS with no port set the device dials 6049, it sends no server name, and it sends its leaf and its intermediate (L73-cisco_iosxe.md, cells a, c, e).
- IOS XE accepts a server certificate that names only a DNS name, and one that names another IP address, though it was configured by address. It refuses an expired certificate and one from an unknown CA with a
bad_certificatealert (L73-cisco_iosxe.md, cell d). - With
single-connectionon, break-glass after port49d reset a de-admitted device's connection was analysed from earlier runs and closed with the fix: on every declined path it logged in within 0.5 s of the key miss (L31-breakglass-cisco-singleconnection.md). - IOL-XE 17.18.02 offers no RFC 9887 client in its configuration help:
tacacs-server host <address>lists<cr>only (L71-cisco_iol-xe.md).
Traps¶
- Keep a console path. An ERROR gives no break-glass over TCP until port49d closes its listener (L4-error-cisco_iosxe.md), and gave none over TLS in the one measured run (L73-cisco_iosxe.md, cell i).
- A refused token login right after port49d returns is the device's own dead window, not port49: wait it out, or use break-glass (L88-cisco_iosxe.md, cell f2).
- Set the TLS
port: with none the device dials 6049, not port49d's listener (L73-cisco_iosxe.md, cell a). - The device accepts a server certificate naming another address, so it does not check what port49d's certificate names: keep the trust to your own CA (L73-cisco_iosxe.md, cell d).
- The revocation settings are left to you: the lab used
revocation-check nonebecause its CAs publish no CRL (L88-cisco_iosxe-iosxe1718-tls.md).
Unmeasured¶
Unmeasured: why the second-server login once failed
One earlier full reference run failed the second-server cell without an explanation and did not repeat in the three runs after it. The cause is unknown (L52, open; the evidence run is its history).
Unmeasured: the IOS XE SSH condition after refusals
A run of refusals to an unrecognised reply attribute stopped the device answering SSH for about a minute without sending port49 a packet. Whether that is the vty pool is unknown (L18, open; the reply-attribute note).
Unmeasured: two server objects at one address, and the hang timing
The reference file says that 17.18.02 drops a second TLS server object that shares an address, so give the two servers distinct addresses; this comes from the file's own comment, and no results note shows the device doing it. How long after a store hang starts the local account first works on IOS XE is also not confirmed here: a report of about 6 s rests on the reference README, not on a note line this page can cite.
Unmeasured: other IOS XE releases and hardware
The lab ran Catalyst 8000V 17.13.01a and 17.18.02 and IOL-XE 17.18.02. What other releases and hardware do is unknown.
Lab evidence¶
| Entry | Platform | Image | Date | Note |
|---|---|---|---|---|
| L1 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-20 | L1-cisco_iosxe.md |
| L1 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-23 | L1-restconf-cisco_iosxe.md |
| L2 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-10-01 | L2-cisco_iosxe.md |
| L3 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-05 | L3-cisco_iosxe.md |
| L4 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-20 | L4-cisco_iosxe.md |
| L4 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-24 | L4-error-cisco_iosxe.md |
| L5 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-20 | L5-cisco_iosxe.md |
| L6 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-20 | L6-cisco_iosxe.md |
| L8 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-05 | L8-cisco_iosxe.md |
| L10 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-05 | L10-cisco_iosxe.md |
| L13 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-20 | L13-cisco_iosxe.md |
| L18 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-22 | L18-cisco_iosxe.md |
| L20 (open) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-24 | L20-cisco_iosxe.md |
| L21 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-24 | L21-cisco_iosxe.md |
| L22 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L22-carried-cisco_iosxe.md |
| L22 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L22-cisco_iosxe.md |
| L28 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-07 | L28-cisco_iosxe.md |
| L28 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-30 | L28-fin-cisco_iosxe.md |
| L28 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-30 | L28-held-cisco_iosxe.md |
| L29 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-30 | L29-reload-cisco_iosxe.md |
| L31 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-30 | L31-breakglass-cisco-singleconnection.md |
| L31 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-09-30 | L31-cisco_iosxe.md |
| L34 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L34-cisco_iosxe.md |
| L35 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L35-cisco_iosxe.md |
| L35 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L35-restore-cisco_iosxe.md |
| L37 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L37-cisco_iosxe.md |
| L38 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L38-cisco_iosxe.md |
| L41 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L41-cisco_iosxe.md |
| L49 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L49-oxidized-cisco_iosxe.md |
| L51 (closed) | cisco_iosxe | Catalyst 8000V autonomous, show version: Cisco IOS XE Software, Version 17.13.01a |
2026-10-09 | L51-cisco_iosxe.md |
| L53 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-06 | L53-cisco_iosxe.md |
| L54 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-10-09 | L54-cisco_iosxe.md |
| L64 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-07 | L64-cisco_iosxe.md |
| L65 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-07 | L65-cisco_iosxe.md |
| L66 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-07 | L66-cisco_iosxe.md |
| L71 (closed) | cisco_iol-xe | IOL-XE 17.18.02 | 2026-10-18 | L71-cisco_iol-xe.md |
| L71 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-05 | L71-cisco_iosxe.md |
| L73 (closed) | cisco_iosxe | Catalyst 8000V 17.18.02 | 2026-11-05 | L73-cisco_iosxe.md |
| L88 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-03 | L88-cisco_iosxe-f-evidence-run.md |
| L88 (closed) | cisco_iosxe | Catalyst 8000V 17.18.02 | 2026-11-04 | L88-cisco_iosxe-iosxe1718-tls.md |
| L88 (closed) | cisco_iosxe | Catalyst 8000V 17.18.02 | 2026-11-04 | L88-cisco_iosxe-iosxe1718.md |
| L88 (closed) | cisco_iosxe | Catalyst 8000V 17.13.01a | 2026-11-04 | L88-cisco_iosxe.md |