Drag and Drop Question Refer to the exhibit. An engineer must configure a Cisco switch to perform PPP authentication via a TACACS server located at IP address 10.1.1.10. Authentication must fall…

Question

Exhibit

Answer Area

Explanation

PPP Authentication via TACACS+ - Configuration Order Explained

This question tests knowledge of Cisco AAA (Authentication, Authorization, Accounting) configuration for PPP.

Why This Order?

The sequence follows a logical dependency chain: you must enable the framework before configuring its components, and define servers before referencing them in policies.

Item-by-Item Breakdown

1. aaa new-model

• Why first: This is the master switch that enables the AAA framework on the device. Nothing else works without it. Cisco IOS ignores or rejects subsequent AAA commands if this isn't set first.
• Common mistake: Trying to configure aaa authentication lines before this - the commands may appear to accept but the policy won't apply.

2. tacacs-server key

• Why second: This sets the shared secret key used to encrypt communication between the switch and the TACACS+ server. It must be configured before or alongside the host, so the device knows how to authenticate to the server when it's defined.
• Note: In modern IOS, tacacs server (named config) replaces the legacy tacacs-server host/key syntax, but the legacy form is still tested on exams.

3. tacacs-server host 10.1.1.10

• Why third: This tells the switch where the TACACS+ server is. The key (step 2) is logically tied to this - together they define a usable TACACS+ server entry. Some configs combine these steps, but the key must be present for the host to be usable.
• Common mistake: Confusing this with a RADIUS command (radius-server host). TACACS+ uses TCP port 49; RADIUS uses UDP 1645/1812.

4. aaa authentication ppp test group tacacs+ local

• Why last: This is the policy that references everything configured above. Breaking it down:
  • ppp - applies to PPP connections
  • test - the named method list (applied to an interface with ppp authentication chap test)
  • group tacacs+ - try the TACACS+ server(s) first
  • local - fallback to local database if TACACS+ is unreachable (satisfies the LocalUser/C1$c0445915422! requirement)
• Common mistake: Putting local before group tacacs+ - this would check local first and never use TACACS+ under normal conditions, defeating the purpose.

Key Takeaway

The ordering reflects a prerequisite dependency:

Enable AAA -> Define credentials for server -> Define server location -> Apply authentication policy

The fallback (local) works automatically when the TACACS+ server is unreachable - no extra config needed beyond the ordering of methods in the aaa authentication command.

No community discussion yet for this question.