Question

An engineer configures AAA on a router with the following: 'aaa new-model', 'aaa authentication login default group tacacs+', and a TACACS+ server that is fully reachable. After saving, remote SSH logins work correctly using TACACS+ credentials, but the engineer notices that when logging in through the physical console port, the router still prompts for and accepts credentials against the TACACS+ server rather than allowing local-only access. The console line has no 'login authentication' command applied. Why is the console being authenticated against TACACS+?

Accepted Answer

The 'default' method list is automatically applied to all lines, including the console, unless a named method list is explicitly applied to the console line

Answer

Console authentication always falls back to local by default and cannot use TACACS+ without a AAA server group defined on the line

Answer

The console line uses TACACS+ only because 'aaa authorization console' is enabled, which forces the console to inherit the default group

Answer

Enabling 'aaa new-model' disables all console authentication until 'login authentication default' is manually applied to line con 0