300-410 · Question #59
Refer to the exhibit. An engineer is trying to configure local authentication on the console line, but the device is trying to authenticate using TACACS+. Which action produces the desired…
The correct answer is B. Add the login authentication Console command to the line configuration. To ensure local authentication is used on the console line when TACACS+ is being attempted, the login authentication command must be applied directly to the line configuration. This command overrides any globally defined default AAA authentication method for that specific line.
Question
Options
- AAdd the aaa authentication login default group tacacs+ local-case command to the global configuration
- BAdd the login authentication Console command to the line configuration
- CReplace the capital "C" with a lowercase "c" in the aaa authentication login Console local command
- DAdd the aaa authentication login default none command to the global configuration
How the community answered
(20 responses)- B90% (18)
- C5% (1)
- D5% (1)
Why each option
To ensure local authentication is used on the console line when TACACS+ is being attempted, the `login authentication` command must be applied directly to the line configuration. This command overrides any globally defined default AAA authentication method for that specific line.
Adding `aaa authentication login default group tacacs+ local-case` would make TACACS+ the primary authentication method for the default list, which would worsen the problem if the console is still using the default method.
By default, console lines may inherit a global AAA authentication method, such as `default`, which might be configured to use TACACS+. Applying `login authentication Console` within the `line con 0` configuration directs the console to specifically use the named authentication list 'Console', which should be defined globally as `aaa authentication login Console local` to achieve local authentication.
AAA list names are case-sensitive. Changing 'Console' to 'console' would reference a different, potentially undefined, authentication list and would not resolve the issue of the console attempting TACACS+.
Adding `aaa authentication login default none` would disable all authentication for any line using the default method, allowing unauthenticated access, which is a significant security risk and not the desired local authentication.
Concept tested: AAA Authentication Configuration on Lines
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-aaa/configuration/15-mt/sec-aaa-15-mt-book/sec-cfg-aaa.html
Topics
Community Discussion
No community discussion yet for this question.