1

i am trying to configure the switch to have both telnet and ssh.
from what i understand the "login local" command will tell the switch to ask for the user name and password i've configured using

username {name} secret {password}

from what i've learned about vty if no password is configured in (config-line)# mode (in vty)
i will get an error

so my questions are:

  • will i get an error if i am using "login local" + username & secret without a configured vty password?
  • assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

so basiclly the subject is "does the login local command in the vty lines set all (in telnet and ssh) login requirments to be the username & secret and if so do i need to give the vty line a password in order for it to work.

1
line vty 0 4
  login
  password vtypw

The login command tells the Router to authenticate all incoming virtual terminal sessions (telnet, ssh, etc) via the password set within line vty 0 4. In the case above, it means use vtypw.

username teddy password teddybear

line vty 0 4
  login local

The login local command tells the Router to authenticate all incoming virtual terminal sessions via the local username database -- aka, users created using the username XXX password YYY command.

Using login local skips the checking and validating against the VTY password set within line vty 0 4. Therefore, you do not need a password within line vty 0 4 if you have login local set.


will i get an error if i am using "login local" + username & secret without a configured vty password?

No, no errors. I just tested it in GNS3.

assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

It will ask you for a username and expect the one from the local username database. Using the vty line password will not allow you access to the device.

2

Eddie's answer is 100% correct. I just want to add that you can also use this technique:

Router(config)# username teddy password teddybear    
Router(config)# aaa new-model
Router(config)# aaa authentication login default local
  • can you explain more about what exacty "aaa" means? – RedBelly Sep 23 '16 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.