Lab Objective
Configure a router to authenticate VTY access against an external RADIUS server, define a method list with local authentication as a fallback, and verify both the primary RADIUS path and the fallback path function correctly.
Lab Purpose
Centralized authentication against a RADIUS server allows an organization to manage credentials for potentially hundreds of network devices from one place, rather than maintaining separate local username databases on every device, discussed in the previous lab, which becomes unmanageable at scale.
Lab Topology
R1 ---- Gi0/0: 192.168.62.1/24
RADIUS server: 192.168.62.100
Shared secret: RadiusKey2026
Local fallback username already configured
from the previous lab: netadminTask 1: Configure the RADIUS Server
Configure R1 with the RADIUS server's address and shared secret.
Task 2: Create a Method List Using RADIUS with Local Fallback
Create a method list named MGMT-RADIUS trying RADIUS first, falling back to local if RADIUS is unreachable.
Task 3: Apply the Method List to the VTY Lines
Apply MGMT-RADIUS to the VTY lines.
Task 4: Verify Authentication via RADIUS
Confirm a login attempt with valid RADIUS credentials succeeds and is authenticated by the RADIUS server.
Task 5: Simulate RADIUS Server Failure and Verify Fallback
Make the RADIUS server unreachable, then confirm login still succeeds using the local username as a fallback.
Solution and Verification
R1(config)# radius server MAIN-RADIUS
R1(config-radius-server)# address ipv4 192.168.62.100
R1(config-radius-server)# key RadiusKey2026R1(config)# aaa authentication login MGMT-RADIUS group radius local
-- This tries the "radius" group first; if
-- and only if the RADIUS server is entirely
-- unreachable (not simply rejecting bad
-- credentials), it falls back to "local"R1(config)# line vty 0 15
R1(config-line)# login authentication MGMT-RADIUSManagementPC> ssh -l raduser 192.168.62.1
Password: [valid RADIUS password]
R1>
-- Login succeeded, authenticated against
-- the RADIUS serverR1# debug aaa authentication
-- (during the successful login above)
AAA/AUTHEN: Method=RADIUS
RADIUS: Received from id 21 ... Access-Accept-- Simulating RADIUS unreachability by
-- shutting down the interface facing it,
-- or by configuring an incorrect server
-- address temporarily:
R1(config)# radius server MAIN-RADIUS
R1(config-radius-server)# address ipv4 192.168.62.199
ManagementPC> ssh -l netadmin 192.168.62.1
Password: NetAdmin2026
R1>
-- Login still succeeded, this time via the
-- local fallback, since RADIUS at the now-
-- incorrect address never responded at allKey Takeaway
The fallback to local authentication only activates when the RADIUS server is genuinely unreachable (no response at all), not when it actively rejects invalid credentials — this distinction matters because a user mistyping their RADIUS password should be denied access, not silently authenticated instead through the local fallback, and AAA's method list design correctly preserves this distinction.