Contents

Introduction

Prerequisites

Requirements

Components used

Configure

Verify

Conclusion

Introduction

This document explains the behavior of "login local" command when Authentication, Authorization Accounting (AAA) is enabled or disabled on a router.

Prerequisites

Requirements

Cisco recommends that you have basic knowledge of following topics:

- AAA Configuration on Cisco Routers

- Radius/TACACS

Components used

The information in this document is based on the testing carried out in various Cisco IOS version 12.2(22), 12.4T, 15.1M, 15.3M etc. However, this document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Configure

Following is the minimum required configuration to verify this behavior:

- At least one Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System (TACACS+) server is reachable from router under test.

- Router under test is recognized as a client of the AAA server.

- Same pre-shared secret key is configured on the Cisco router/switch and the remote AAA servers.

- Global pool of RADIUS servers or Named subset of RADIUS or TACACS+ servers configured on the router under test.

- Local User database configured on the router under test.

Verify

When 'login local' is configured under 'line vty x', users will be able to login using local username and password configured on the router. But when 'aaa new-model' is configured, there is no configuration under 'line vty x' because now the default login method is AAA.

Once the configuration is saved and AAA is removed using 'no aaa-new model', the login method will switch back to line authentication. Line authenticaltion is when router just checks for the line password and not the configured global username password. Now you wont see 'login local' under 'line vty x' which was configured prior enabling AAA, instead you would see 'login'.

Note: Disabling AAA with "no aaa new-model" is not recommended.

Following steps will show this behavior in detail:

Login local configured on router:

Router#show run | begin line vty

line vty 0 4

login local

Enable AAA on router:

Router(config)#aaa new-model

Router#show run | begin line vty

line vty 0 4

Save the configuration

Router#wr

Building configuration...

[OK]

Disable AAA

Router#conf t

Router(config)#no aaa new-model

Changing configuration back to no aaa new-model is not supported.

Continue?[confirm]

Check login method

Router#show run | begin line vty

line vty 0 4

login

Conclusion

When you remove "AAA new-model", the default method will be "login" under line and not “login local”. This behavior is seen on all Cisco IOS versions.