is a vty password requierd if i have login local set with a username and a password

Question

i am trying to configure the switch to have both telnet and ssh.
from what i understand the "login local" command will tell the switch to ask for the user name and password i've configured using

username {name} secret {password}

from what i've learned about vty if no password is configured in (config-line)# mode (in vty)
i will get an error

so my questions are:

• will i get an error if i am using "login local" + username & secret without a configured vty password?
• assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

so basiclly the subject is "does the login local command in the vty lines set all (in telnet and ssh) login requirments to be the username & secret and if so do i need to give the vty line a password in order for it to work.

Answer 1

line vty 0 4
  login
  password vtypw

The login command tells the Router to authenticate all incoming virtual terminal sessions (telnet, ssh, etc) via the password set within line vty 0 4. In the case above, it means use vtypw.

username teddy password teddybear

line vty 0 4
  login local

The login local command tells the Router to authenticate all incoming virtual terminal sessions via the local username database -- aka, users created using the username XXX password YYY command.

Using login local skips the checking and validating against the VTY password set within line vty 0 4. Therefore, you do not need a password within line vty 0 4 if you have login local set.

---

will i get an error if i am using "login local" + username & secret without a configured vty password?

No, no errors. I just tested it in GNS3.

assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

It will ask you for a username and expect the one from the local username database. Using the vty line password will not allow you access to the device.

Answer 2

Eddie's answer is 100% correct. I just want to add that you can also use this technique:

Router(config)# username teddy password teddybear    
Router(config)# aaa new-model
Router(config)# aaa authentication login default local

Answer 3

1. No. You can set only username without password. This means the password is empty string / characters. If login local is used, it will require a password during login. Just 'Press Enter' only and you will be granted access.

Router(config)#username Jon

2. Regardless if 'vty access' set to SSH or/and Telnet, so long 'login local' is applied, it will ask for username and password.