Hands-On Lab: Configuring Local AAA Authentication

Lab Objective

Enable the AAA framework on a router, create a named authentication method list using the local database, apply it to the VTY lines, and verify login behavior including the fallback method if the primary fails.

Lab Purpose

The login local command, used in the previous SSH lab, provides simple local authentication but offers no flexibility for combining multiple authentication sources or applying different policies to different lines. AAA (Authentication, Authorization, and Accounting) is the framework underlying more advanced authentication scenarios, including those covered in later labs involving external servers.

Lab Topology

R1 ---- Gi0/0: 192.168.61.1/24

Management PC: 192.168.61.50/24

Task 1: Configure Basic Addressing and a Local User

Configure R1's interface and create a local username for authentication.

Task 2: Enable the AAA Framework

Enable AAA services globally on the router.

Task 3: Create a Named Authentication Method List

Create a login authentication method list named MGMT-AUTH using the local database.

Task 4: Apply the Method List to the VTY Lines

Apply MGMT-AUTH to the VTY lines instead of the default login method.

Task 5: Verify Authentication Works

Confirm a management station can successfully log in using the local username, now authenticated through the AAA method list.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.61.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# username netadmin secret NetAdmin2026

R1(config)# aaa new-model

-- This single command switches the router
-- from legacy line-based authentication to
-- the AAA framework -- once enabled, VTY
-- lines require an explicit AAA method list
-- rather than the older login local command
-- alone

R1(config)# aaa authentication login MGMT-AUTH local

-- "MGMT-AUTH" is an administrator-chosen
-- name for this method list -- "local"
-- specifies the local username database
-- as the authentication source

R1(config)# line vty 0 15
R1(config-line)# login authentication MGMT-AUTH
R1(config-line)# transport input ssh

ManagementPC (192.168.61.50)> ssh -l netadmin 192.168.61.1

Password: NetAdmin2026
R1>
-- Successful login, authenticated through
-- the named AAA method list rather than a
-- direct login local reference

R1# show running-config | include aaa|login authentication

aaa new-model
aaa authentication login MGMT-AUTH local
 login authentication MGMT-AUTH

Key Takeaway

Once aaa new-model is enabled, every line requires an explicit method list reference (or the implicit "default" list) rather than relying on the older login local command directly — this is a common source of unexpected lockouts when enabling AAA on a live device without first confirming a working method list is applied everywhere authentication is needed, since a line left without one can end up completely inaccessible.