Network Services and Security practice questions

Without AAA, VTY lines authenticate with login (line password) or login local (username database); transport input chooses accepted protocols.

login local makes the VTY lines prompt for a username and check it against the local accounts. transport input ssh limits inbound sessions to SSH, so Telnet is refused. Plain login uses only the line password, and transport input telnet ssh still accepts Telnet, so each of the other options breaks at least one goal.

1. Map 'prompt for a username from the local accounts' to login local.
2. Map 'refuse Telnet' to transport input ssh.
3. Check that the chosen option gets both settings right.

Exam tip: Local accounts on VTY = login local; SSH only = transport input ssh.

aaa new-model enables AAA on IOS; it is the prerequisite for every other aaa command.

AAA is off by default on IOS. aaa new-model enables it, and only then are aaa authentication, aaa authorization, aaa accounting and aaa group server accepted. Defining a TACACS+ server or a server group does not turn AAA on, and the domain name belongs to SSH key generation.

1. Note that the error is about the aaa command itself.
2. Recall that AAA is disabled until aaa new-model.
3. Reject other AAA-related commands that also depend on AAA being enabled.

Exam tip: Nothing aaa works until aaa new-model is configured.

Enabling AAA replaces line-password authentication; with no default list, IOS uses the local user database.

After aaa new-model, VTY authentication is controlled by AAA method lists, and the old line password plus login stops applying. If no default login list exists, IOS checks only the local user database. That is why local accounts should exist before AAA is enabled on a remotely managed device: without one, the engineer can lock themselves out.

1. Recall that aaa new-model hands line authentication to AAA.
2. Recall the behaviour when no default list exists: local database only.
3. Match that to the account the engineer created.

Exam tip: aaa new-model + no login list = local usernames; create a local account before enabling AAA remotely.

Named method lists must be applied to lines; lines without one use the default list, or the local database if there is none.

aaa authentication login ADMIN-SSH defines a named list, but no line uses it, so the VTY lines fall back to the default list. There is no default list here, so IOS checks only the local database, which is exactly the symptom. Adding login authentication ADMIN-SSH under the VTY lines applies the list. Authorization and accounting lists do not change authentication, and reordering an unused list changes nothing.

1. Notice that the list is named, not default.
2. Look for a login authentication command on the lines and find none.
3. Recall that unreferenced named lists are ignored.
4. Apply the list to the VTY lines.

Exam tip: Default lists apply automatically; named lists apply only where login authentication NAME is configured.

Different lines can use different authentication lists: keep the default for VTY and apply a named list to the console.

The default list applies to every line without its own list. To give the console different behaviour, define a named list that uses only the local database and apply it under line con 0 with login authentication. Changing the default list would also change the VTY lines, and applying the console list to VTY breaks the remote requirement. The enable list controls enable authentication, not login.

1. Identify which lines currently use the default list: all of them.
2. Leave the default list for the VTY lines.
3. Create a local-only named list.
4. Apply it to line con 0 only.

Exam tip: To treat one line differently, create a named list and apply it to that line; leave the default for the rest.

In an AAA method list, the next method is tried only after an error (no response), never after a fail (reject).

IOS moves down a method list only when a method returns an error, such as every TACACS+ server timing out. When a server answers with a reject, the attempt fails and local is not consulted. jlee exists only locally, the server is reachable and rejects the unknown user, so the login fails. Local accounts here act purely as a fallback for server outages.

1. Note that the server is reachable and answering.
2. Recall that a reject is a fail, which stops the list.
3. Conclude that the local database is never consulted.

Exam tip: Fallback happens on silence, not on rejection: group tacacs+ local uses local only when no server answers.