Security Fundamentals Fix · Medium ~15 min · 3 devices · 5 tasks · CCNA v1.1 and v2.0

TACACS+ VTY login: fix AAA and the local fallback

R1 is a branch router. Admins must log in over SSH with their TACACS+ accounts, checked by the server TACSRV (10.0.99.10) that sits behind R2. If TACSRV stops answering, a local account on R1 must still let an admin in. The AAA setup is half done: the login list exists but no line uses it, the server entry points at the wrong address, R1 has no route to the server LAN and there is no local account to fall back to. The shared key TacKey99 is already correct. Logins here are simulated: the engine checks routing, the server address, the key and the method list, then answers the way IOS would.

R1 Gi0/0 10.0.12.1/30 to R2 Gi0/0 10.0.12.2/30
R2 Gi0/1 10.0.99.1/24 to TACSRV 10.0.99.10/24 (TACACS+ server, key TacKey99)
TACACS+ test account on TACSRV: netops, password Ops2026

Topology

Tasks

○R1 reaches the TACACS+ server: ping 10.0.99.10 succeeds
○The TACSRV server entry points at 10.0.99.10
○The VTY lines use list VTY-LOGIN (TACGROUP first, then local) and accept SSH only
○A local privilege 15 account exists for the fallback
○test aaa group TACGROUP netops Ops2026 legacy succeeds

Hints (open one at a time)

Hint 1: where to start

On R1 run show running-config | section aaa, then show aaa servers. Note the server address, the list name and whether the server shows as UP or DEAD.

Hint 2: reach the server

R1 only knows its connected link. Add ip route 10.0.99.0 255.255.255.0 10.0.12.2 and test with ping 10.0.99.10. R2 is connected to the server LAN, so the return path already works.

Hint 3: the server entry

TACSRV lives at 10.0.99.10. Run tacacs server TACSRV, then address ipv4 10.0.99.10. The key stays the same.

Hint 4: the login list

A named list does nothing until a line uses it. Under line vty 0 4 add login authentication VTY-LOGIN. Without it the lines use the default list, and there is none, so only local accounts would work.

Hint 5: the fallback

The word local in the list only helps if a local account exists. Add username netadmin privilege 15 secret Local2026, then prove the server path with test aaa group TACGROUP netops Ops2026 legacy.

Full solution

R1# configure terminal
R1(config)# ip route 10.0.99.0 255.255.255.0 10.0.12.2
R1(config)# tacacs server TACSRV
R1(config-server-tacacs)# address ipv4 10.0.99.10
R1(config-server-tacacs)# exit
R1(config)# username netadmin privilege 15 secret Local2026
R1(config)# line vty 0 4
R1(config-line)# login authentication VTY-LOGIN
R1(config-line)# end
R1# ping 10.0.99.10
R1# test aaa group TACGROUP netops Ops2026 legacy

IOS tries the next method only when no server answers. A reject from TACACS+ ends the login, it never falls back to local.

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book a free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA

Network+

NSE 4

CCNP

TACACS+ VTY login: fix AAA and the local fallback

Stuck on a lab, or not sure what to practice next?