Hands-On Lab: Configuring Local AAA Authentication

This hands-on lab configures the AAA framework on a router using the local username database, creating a custom authentication method list and applying it to the VTY lines, demonstrating a more flexible and scalable authentication approach than the login local command alone.

AAA Local AuthenticationMethod List Configurationaaa new-model

~3 min read · Updated Sep 23, 2026

Lab Objective

Enable the AAA framework on a router, create a named authentication method list using the local database, apply it to the VTY lines, and verify login behavior including the fallback method if the primary fails.

Lab Purpose

The login local command, used in the previous SSH lab, provides simple local authentication but offers no flexibility for combining multiple authentication sources or applying different policies to different lines. AAA (Authentication, Authorization, and Accounting) is the framework underlying more advanced authentication scenarios, including those covered in later labs involving external servers.

Lab Topology

R1 ---- Gi0/0: 192.168.61.1/24

Management PC: 192.168.61.50/24

Task 1: Configure Basic Addressing and a Local User

Configure R1's interface and create a local username for authentication.

Task 2: Enable the AAA Framework

Enable AAA services globally on the router.

Task 3: Create a Named Authentication Method List

Create a login authentication method list named MGMT-AUTH using the local database.

Task 4: Apply the Method List to the VTY Lines

Apply MGMT-AUTH to the VTY lines instead of the default login method.

Task 5: Verify Authentication Works

Confirm a management station can successfully log in using the local username, now authenticated through the AAA method list.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.61.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# username netadmin secret NetAdmin2026

R1(config)# aaa new-model

-- This single command switches the router
-- from legacy line-based authentication to
-- the AAA framework -- once enabled, VTY
-- lines require an explicit AAA method list
-- rather than the older login local command
-- alone

R1(config)# aaa authentication login MGMT-AUTH local

-- "MGMT-AUTH" is an administrator-chosen
-- name for this method list -- "local"
-- specifies the local username database
-- as the authentication source

R1(config)# line vty 0 15
R1(config-line)# login authentication MGMT-AUTH
R1(config-line)# transport input ssh

ManagementPC (192.168.61.50)> ssh -l netadmin 192.168.61.1

Password: NetAdmin2026
R1>
-- Successful login, authenticated through
-- the named AAA method list rather than a
-- direct login local reference

R1# show running-config | include aaa|login authentication

aaa new-model
aaa authentication login MGMT-AUTH local
 login authentication MGMT-AUTH

Key Takeaway

Once aaa new-model is enabled, every line requires an explicit method list reference (or the implicit "default" list) rather than relying on the older login local command directly — this is a common source of unexpected lockouts when enabling AAA on a live device without first confirming a working method list is applied everywhere authentication is needed, since a line left without one can end up completely inaccessible.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring UDLD

This hands-on lab configures UDLD in aggressive mode on a fiber link between two switches, simulating a unidirectional fiber failure and verifying UDLD detects the mismatch and shuts down the affected port before a Layer 2 loop can form.

Continue

Hands-On Lab: Configuring Loop Guard

This hands-on lab configures Loop Guard on a switch's non-designated ports to prevent a unidirectional link failure from causing a Layer 2 loop, simulating a one-way BPDU loss and verifying the affected port enters a loop-inconsistent blocking state rather than incorrectly transitioning to forwarding.

Continue

Hands-On Lab: Configuring BPDU Guard and BPDU Filter

This hands-on lab configures BPDU Guard globally for PortFast-enabled ports and demonstrates the distinct, riskier behavior of BPDU Filter, comparing how each responds when a switch is connected to an access port that should only ever see end-user devices.

Continue

Hands-On Lab: Configuring Root Guard

This hands-on lab configures Root Guard on switch ports facing access-layer switches to prevent an unauthorized or misconfigured switch from becoming the Spanning Tree root, verifying the port enters a root-inconsistent state when a superior BPDU is received.

Continue

Hands-On Lab: Comprehensive Troubleshooting Challenge

This hands-on lab presents a multi-layer connectivity failure across VLANs, trunking, routing, and NAT simultaneously, requiring systematic bottom-up troubleshooting to identify and correct three independent faults before full connectivity is restored.

Continue

Hands-On Lab: Configuring Enhanced Object Tracking with HSRP

This hands-on lab configures IP SLA-based object tracking on an HSRP-enabled router, automatically lowering its priority when its WAN uplink fails, forcing failover to the standby router without requiring a full interface shutdown.

Continue