Cisco CCNA (200-301)Security FundamentalsMedium
A router is configured with the following under the VTY lines: aaa authentication login VTY_AUTH group TACACS+ local line vty 0 4 login authentication VTY_AUTH If all configured TACACS+ servers become unreachable, what will happen when an administrator attempts to log in via SSH?
- AThe login attempt will fail immediately with no further authentication attempted
- BThe router will automatically switch to RADIUS for authentication
- CThe router will fall back and authenticate the user against the local username database
- DThe router will permit access without requiring any authentication
Show answer & explanationAnswer & explanation
Correct answer: C. The router will fall back and authenticate the user against the local username database
AAA method lists are processed in order, and the router only moves to the next method if the previous one is unavailable (not simply if authentication fails). Since TACACS+ is unreachable, the router falls back to the 'local' method and checks the local username database for authentication.
Why the other options are wrong
- A. This would only happen if 'local' were not included as a fallback method in the list.
- B. RADIUS is not listed in this method list, so it will not be used as a fallback.
- D. There is no method in the list that allows unauthenticated access.
AAA Method List Fallback
An AAA authentication method list is tried in order; the router moves to the next method only when the current method is unavailable (e.g., server unreachable), not merely on a failed login.
- Order in the method list matters
- 'local' is commonly used as a fallback for server outages
- Method lists are applied to lines/interfaces separately from being defined globally
Memory trick: No response, not no access — TACACS+ down means try local next.