CCNA AAA and Secure File Transfer: Local Users, TACACS+, RADIUS, SCP and SFTP

Create them with username NAME privilege LEVEL secret PASSWORD. The secret keyword stores a one-way hash, and the privilege keyword sets the level the user is given at login (1 = user EXEC >, 15 = privileged EXEC #). Local accounts are the whole login database on a device without AAA, and the fallback (break-glass) database on a device that uses AAA servers.

service password-encryption only turns clear-text password entries into type 7. It hides passwords from someone glancing over your shoulder; it does not make them a hash. The fix for a reversible password entry is to re-create the account with secret and a new credential (the old one has been exposed). The enable secret protects the enable command only; changing it does nothing for a username's stored password.

username netops privilege 15 algorithm-type scrypt secret Long-Passphrase-1
username noc-viewer privilege 1 secret Long-Passphrase-2

Without AAA, the line itself decides how logins are checked: login local prompts for a username and checks the local username database, while plain login asks only for the shared line password. Which protocols may connect is a separate setting, transport input.

Configure every VTY range. Many switches have line vty 0 4 and line vty 5 15 as separate blocks; securing only 0–4 leaves the remaining lines on the old password and Telnet. Using line vty 0 15 sets lines 0 to 15 at once; check show line in case the platform has further VTY lines beyond 15. SSH itself also needs a hostname, a domain name and RSA keys of an adequate size, and best practice adds ip ssh version 2 so only SSHv2 is accepted; SSH setup is covered in the device-management lessons, and filtering which source addresses may reach the VTY lines belongs to the ACL lesson.

line vty 0 15
 login local
 transport input ssh

aaa new-model turns on the AAA framework; until it is entered, IOS rejects every other aaa command, including aaa authentication, aaa authorization, aaa accounting and aaa group server. It also changes how lines authenticate immediately: login, login local and line passwords stop being used, and each line is checked by an AAA method list instead.

• A line with no list applied uses the default list.
• If no default list has been defined yet, VTY (remote) logins are checked against the local username database.
• The console is the exception: with no default list and no named list applied to line con 0, console login succeeds without any authentication check. Defining a default list, or applying a named list to the console, closes that gap.

The practical consequence: the moment you type aaa new-model on a remote device, the next Telnet or SSH login asks for a username, and the old VTY password no longer works. Create a local privileged account before enabling AAA on a device you reach remotely, or you can lock yourself out. Server definitions (tacacs server, radius server) and the domain name are independent of AAA and can be entered in any order; every command that starts with aaa, server groups included, needs aaa new-model first.

A method list is an ordered list of ways to check a login, for example aaa authentication login default group tacacs+ local. The default list applies automatically to every line that has no other list; a named list does nothing until you apply it to a line with login authentication NAME.

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login LOCAL-ONLY local
!
line con 0
 login authentication LOCAL-ONLY
line vty 0 15
 transport input ssh

Here the VTY lines use the default list (TACACS+, then local), while the console uses only local accounts, so engineers at the console never wait for server timeouts during a WAN outage. To give one line different behaviour, define a named list and apply it to that line; changing the default list would change every line at once.

A common mistake is defining a named list for SSH and never applying it under line vty: the lines keep using the default list (or, for VTY lines, the local database if there is none), and the AAA server sees no requests.

The device moves to the next server or method only when there is no answer (an error: timeout, unreachable server). If a server answers with a reject (a fail), the login is denied and nothing further in the list is tried.

This is why the order matters. Listing the server group before local makes local accounts a pure outage fallback: while any server answers, local credentials do not work. Putting local first reverses that, so a valid local account always works and the servers are consulted only for users the local database cannot check. Using line or enable as the last method still lets admins in during an outage, but with a shared password and no username.

The same rule explains a group that contains a dead server: with group tacacs+, every defined TACACS+ server is tried in order, so a powered-off lab server adds a timeout to every login. Build a server group that lists only the production servers and reference it with group NAME.

Both are AAA protocols a network device uses as a client of a central server, but TACACS+ is built for device administration and RADIUS for network access. The differences the CCNA expects you to know:

The underlying facts drive every design choice: because TACACS+ obfuscates the whole body, a packet capture shows nothing but the header; because it runs authorization as its own exchange, policy can be checked command by command after login. RADIUS exposes usernames and attributes on the wire and ties authorization to the authentication reply, but it is the vendor-neutral standard that switches, wireless controllers and VPN gateways all speak for end-user access.

Define each server with its address and shared key, optionally group the servers, then point a method list at them. Modern IOS XE uses named server blocks:

aaa new-model
tacacs server TAC-A
 address ipv4 172.16.20.11
 key Shared-Key-T
tacacs server TAC-B
 address ipv4 172.16.21.11
 key Shared-Key-T
aaa group server tacacs+ MGMT-AAA
 server name TAC-A
 server name TAC-B
!
radius server NPS-A
 address ipv4 172.16.20.31 auth-port 1812 acct-port 1813
 key Shared-Key-R
aaa group server radius RADIUS-MGMT
 server name NPS-A
!
aaa authentication login default group MGMT-AAA local
ip tacacs source-interface Loopback0

• Ports must match the server. A RADIUS entry pointing at 1645/1646 when the server listens only on 1812/1813 means the server never sees a packet; the device times out and falls back to local. If the server logs nothing at all, check address and ports before the key.
• The shared key must match on both sides. RADIUS uses it to hide the password; TACACS+ uses it to encrypt the whole body.
• The source address must match how the server knows the device. A server registers each network device by IP address. By default the request leaves from the outgoing interface, so if the server has the device registered by its Loopback0 address, set ip tacacs source-interface Loopback0 and/or ip radius source-interface Loopback0. Each protocol has its own source-interface command, and each one changes only its own traffic.

Verify with show tacacs, show aaa servers and test aaa group …, and use debug aaa authentication to see which method answered.

Authorization decides what an authenticated user may do; accounting records what they did. Neither happens unless you configure it.

Why admins land at >. With aaa new-model, authentication alone starts the session at level 1. The privilege level stored on a local account (username netops privilege 15) or returned by the TACACS+ server is applied only when aaa authorization exec is configured for that source. A privilege level set on the line itself applies one level to every user of that line, so it cannot give different administrators different levels.

start-stop sends both records; stop-only sends only the end record, so open sessions are not visible live. Command authorization applies to the console only when aaa authorization console is configured.

SCP (Secure Copy) and SFTP (SSH File Transfer Protocol) both run over SSH on TCP port 22, so the user is authenticated and the credentials and file contents are encrypted. TFTP (UDP 69, no authentication), FTP (TCP 21, credentials and data in clear text) and HTTP send everything readable. When replacing TFTP backups with SCP, the firewall must allow TCP 22 to the server.

The device as a client. When you run copy on the router or switch, it is the client; no server feature on the device is needed, and the user in the URL is an account on the remote server. The syntax is always copy SOURCE DESTINATION:

copy running-config scp://netbackup@172.16.40.10/EDGE-RTR-01.cfg
copy sftp://imgadmin@172.16.40.12//firmware/new-image.bin flash:
copy flash:EDGE-RTR-01-old.cfg sftp://imgadmin@172.16.40.12//archive/

• Back up running-config when unsaved changes must be included; startup-config is only what was last saved.
• SCP and SFTP copies leave from the address set by ip ssh source-interface. If a firewall or server only accepts the device's loopback, set that command; the source-interface settings of other protocols do not apply to SSH-based copies.
• IOS XE supports SFTP as a client only; a remote host cannot push files into the device with SFTP.

The device as an SCP server. For a laptop or backup server to push or pull files with scp, the device needs:

1. a working SSH server (keys, ip ssh version 2);
2. ip scp server enable (off by default; SSH working is not enough);
3. AAA authentication and aaa authorization exec;
4. a user who reaches privilege level 15.

SCP needs no line transport of its own: it arrives over SSH, so a line that accepts SSH already accepts it. One recent trap: OpenSSH 9.0 and later make the scp command use the SFTP protocol underneath by default. Because IOS XE does not accept inbound SFTP, the login succeeds and the transfer then closes. scp -O forces the legacy SCP protocol and the copy works again.

Verify a copied software image with verify /md5 flash:FILE before setting it as the boot image: it computes the file's MD5 hash so you can compare it with the value published on Cisco's software download page (you can also append the expected hash and IOS reports whether it matches). File listings show size and date, and version output describes the image that is running now; only a hash proves the new file's contents are intact.

verify /md5 flash:new-image.bin

For configuration files, the key distinction is merge versus replace:

To roll back a change, save a copy first (copy running-config flash:baseline-0915.cfg) and later run configure replace flash:baseline-0915.cfg. Be careful with the startup configuration as a rollback point: if anyone saved during the change, it now holds the changed configuration, not the one from before. The source of a replace can be a local file or a remote URL such as scp://.