Solved: aaa new model vs. Login Local?

JoshGarmonCiscoCCNA · ‎08-27-2016

taking Cisco Security in school

i still don't understand the difference between aaa-new model and the login local feature

there was a moment in my study where it felt like they were the SAME thing...only when you configured "aaa new-model", you didn't have to go through as many explicit steps as you would for login local.

?

Rolf Fischer · ‎08-29-2016

Another advantage of the aaa new-model is that it provides more flexibility, such as defining different methods for vty- and console-access etc.:

aaa new-model
!
aaa authentication login AAA_VTY group tacacs+ (...)
aaa authentication login AAA_CONSOLE group local
!
line con 0
 login authentication AAA_CONSOLE 
!
line vty 0 4
 login authentication AAA_VTY

HTH
Rolf

View solution in original post

Joseph W. Doherty · ‎08-29-2016

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Local login relies on passwords, and additionally UserIDs, stored in the device config. AAA is usually configured to verify against an external RADIUS or TACACS server. AAA can also keep an audit of what's being done to the device and can also validate every individual command that is trying to be invoked.

JoshGarmonCiscoCCNA · ‎08-30-2016

do you need to configure transport input ssh when utilizing aaa new-model?

Rolf Fischer · ‎08-30-2016

Defining allowed protocols to vty lines is independent of the aaa models.

According to the Command Reference the default behavior has changed in recent IOS versions:

"Cisco devices do not accept incoming network connections to tty lines by default. You must specify an incoming transport protocol or specify the transport input all command before the line will accept incoming connections. (...) This behavior is new as of Cisco IOS Release 15.4(3)M4. Previous to Cisco IOS Release 15.4(3)M4, the default was the transport input all command."

HTH
Rolf

Joseph W. Doherty · ‎08-31-2016