Lab Objective
Enable the AAA framework on a router, create a named authentication method list using the local database, apply it to the VTY lines, and verify login behavior including the fallback method if the primary fails.
Lab Purpose
The login local command, used in the previous SSH lab, provides simple local authentication but offers no flexibility for combining multiple authentication sources or applying different policies to different lines. AAA (Authentication, Authorization, and Accounting) is the framework underlying more advanced authentication scenarios, including those covered in later labs involving external servers.
Lab Topology
R1 ---- Gi0/0: 192.168.61.1/24
Management PC: 192.168.61.50/24Task 1: Configure Basic Addressing and a Local User
Configure R1's interface and create a local username for authentication.
Task 2: Enable the AAA Framework
Enable AAA services globally on the router.
Task 3: Create a Named Authentication Method List
Create a login authentication method list named MGMT-AUTH using the local database.
Task 4: Apply the Method List to the VTY Lines
Apply MGMT-AUTH to the VTY lines instead of the default login method.
Task 5: Verify Authentication Works
Confirm a management station can successfully log in using the local username, now authenticated through the AAA method list.
Solution and Verification
R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.61.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# username netadmin secret NetAdmin2026R1(config)# aaa new-model
-- This single command switches the router
-- from legacy line-based authentication to
-- the AAA framework -- once enabled, VTY
-- lines require an explicit AAA method list
-- rather than the older login local command
-- aloneR1(config)# aaa authentication login MGMT-AUTH local
-- "MGMT-AUTH" is an administrator-chosen
-- name for this method list -- "local"
-- specifies the local username database
-- as the authentication sourceR1(config)# line vty 0 15
R1(config-line)# login authentication MGMT-AUTH
R1(config-line)# transport input sshManagementPC (192.168.61.50)> ssh -l netadmin 192.168.61.1
Password: NetAdmin2026
R1>
-- Successful login, authenticated through
-- the named AAA method list rather than a
-- direct login local referenceR1# show running-config | include aaa|login authentication
aaa new-model
aaa authentication login MGMT-AUTH local
login authentication MGMT-AUTHKey Takeaway
Once aaa new-model is enabled, every line requires an explicit method list reference (or the implicit "default" list) rather than relying on the older login local command directly — this is a common source of unexpected lockouts when enabling AAA on a live device without first confirming a working method list is applied everywhere authentication is needed, since a line left without one can end up completely inaccessible.