I have a Cisco IOS router that is used for WAN access. I have 2 additional users defined with less privilege to check status and to use ssh. I wonder if it is possible to restrict certain user to only login via console port and not via VTY (ssh in my case)?

I am using aaa new-model but I don't want to use additional tacacs server.

  • 1
    Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 7, 2017 at 20:02

3 Answers 3


For console physical access control, easiest would just be to use local user logins and then SSH would still reference TACACS:

username test privilege 15 secret test
aaa authentication login console-grp local
aaa authentication login default group tacacs+ local
line con 0
    login authentication console-grp

To block certain users from SSH getting into the device, that would be a change on the TACACS+ server to not allow that authentication.

  • 1
    Thanks for the suggestion. Is there a way to avoid using tacacs+ server? Also, if my understanding on the config is correct, the user can still login via SSH if the tacacs+ server is unreachable, right?
    – some user
    Commented Jan 21, 2017 at 0:52
  • 1
    Unless you are working on a platform that doesn't support it, you really should be using local-case instead of local.
    – YLearn
    Commented Oct 11, 2017 at 6:18

You could set a diffrent password for telnet access and console access. First set the users with the privileges you want them to have.

To set a telnet password (if 15 doesn't work put highest number it offers in help)

Line vty 0 15
Password myTelnetPassword

To set console password to still use normal local passwords (or you could set a seperate password by adding the password line and removing login local)

Line con 0
Login local

Now if they telnet they won't know the password but can still use the console.


You can configure a lower privilege level directly on the console port. However, anyone who has physical access to the router/switch (the console port) actually can perform a factory reset on it. So, that kinda goes against the idea of implementing lower level access on the console port it seems.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.