topic Re: add aaa authentication login default does it cancel the other line in Network Access Control

Using AAA default is enough for one server?

enzo80 — Fri, 03 Dec 2021 14:02:17 GMT

aaa authentication login default group tacacs+ local does this line cover the rest below it?
~~aaa authentication login console group tacacs+ local~~ should i delete these?
~~aaa authentication login ssh group tacacs+ local should i delete these?~~

from my understanding default covers all lines including console and vty right?

i saw this config online and wondering why they used the extra two crossed ones

never saw this one before: aaa authentication login ssh group tacacs+ local

Re: Using AAA default is enough for one server?

balaji.bandi — Fri, 03 Dec 2021 14:12:00 GMT

aaa authentication login default local group tacacs+

check below document explained :

https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/200606-aaa-authentication-login-default-local.html

If you looking different method on console - you make different options.

add aaa authentication login default does it cancel the other lines?

enzo80 — Sat, 04 Dec 2021 11:49:24 GMT

for example if i added:

aaa authentication login default group tacacs+

aaa authentication login ssh group tacacs+ local

and under line vty 0 4:

transport input ssh

if the user pass the first login line, does cisco OS read the second auth lines too?

Re: add aaa authentication login default does it cancel the other line

MHM Cisco World — Sat, 04 Dec 2021 15:52:30 GMT

...

Re: Using AAA default is enough for one server?

Rob Ingram — Sat, 04 Dec 2021 14:20:42 GMT

@enzo80 in this instance "console" and "ssh" are custom defined aaa method lists, they need to be explicitly defined under the VTY lines, if not, they will not be used. The default method list is automatically applied to the VTY line and will be used if no custom defined method list is applied. A custom defined would override the default method list only if configured on the VTY line.