Hands-On Lab: Configuring AAA with a RADIUS Server

Lab Objective

Configure a router to authenticate VTY access against an external RADIUS server, define a method list with local authentication as a fallback, and verify both the primary RADIUS path and the fallback path function correctly.

Lab Purpose

Centralized authentication against a RADIUS server allows an organization to manage credentials for potentially hundreds of network devices from one place, rather than maintaining separate local username databases on every device, discussed in the previous lab, which becomes unmanageable at scale.

Lab Topology

R1 ---- Gi0/0: 192.168.62.1/24

RADIUS server: 192.168.62.100
Shared secret: RadiusKey2026

Local fallback username already configured
from the previous lab: netadmin

Task 1: Configure the RADIUS Server

Configure R1 with the RADIUS server's address and shared secret.

Task 2: Create a Method List Using RADIUS with Local Fallback

Create a method list named MGMT-RADIUS trying RADIUS first, falling back to local if RADIUS is unreachable.

Task 3: Apply the Method List to the VTY Lines

Apply MGMT-RADIUS to the VTY lines.

Task 4: Verify Authentication via RADIUS

Confirm a login attempt with valid RADIUS credentials succeeds and is authenticated by the RADIUS server.

Task 5: Simulate RADIUS Server Failure and Verify Fallback

Make the RADIUS server unreachable, then confirm login still succeeds using the local username as a fallback.

Solution and Verification

R1(config)# radius server MAIN-RADIUS
R1(config-radius-server)# address ipv4 192.168.62.100
R1(config-radius-server)# key RadiusKey2026

R1(config)# aaa authentication login MGMT-RADIUS group radius local

-- This tries the "radius" group first; if
-- and only if the RADIUS server is entirely
-- unreachable (not simply rejecting bad
-- credentials), it falls back to "local"

R1(config)# line vty 0 15
R1(config-line)# login authentication MGMT-RADIUS

ManagementPC> ssh -l raduser 192.168.62.1

Password: [valid RADIUS password]
R1>
-- Login succeeded, authenticated against
-- the RADIUS server

R1# debug aaa authentication

-- (during the successful login above)
AAA/AUTHEN: Method=RADIUS
RADIUS: Received from id 21 ... Access-Accept

-- Simulating RADIUS unreachability by
-- shutting down the interface facing it,
-- or by configuring an incorrect server
-- address temporarily:

R1(config)# radius server MAIN-RADIUS
R1(config-radius-server)# address ipv4 192.168.62.199

ManagementPC> ssh -l netadmin 192.168.62.1

Password: NetAdmin2026
R1>
-- Login still succeeded, this time via the
-- local fallback, since RADIUS at the now-
-- incorrect address never responded at all

Key Takeaway

The fallback to local authentication only activates when the RADIUS server is genuinely unreachable (no response at all), not when it actively rejects invalid credentials — this distinction matters because a user mistyping their RADIUS password should be denied access, not silently authenticated instead through the local fallback, and AAA's method list design correctly preserves this distinction.