Understanding the network.pdf - Back to Home

local-AS#config t
Enter configuration commands, one per line. End with CNTL/Z.
local-AS(config)#aaa new-mode
local-AS(config)#^Z
local-AS#
Unlike old-mode, when new-mode authentication is enabled, it is up
to the administrator to define the authentication options the router
will use.
New-mode authentication supports both a local static user table and
the security authentication protocols mentioned earlier. If you use a
remote security protocol, it is a good idea to create a local backup
account in case your authentication server fails and you need to
access the router.
It's possible to have privileged EXEC and configuration EXEC modes
authenticated remotely as well. This latter option does not work well
with RADIUS, so unless you do not have Cisco's TACACS, it should be
avoided. It is just as easy to build an enable password file and update
your router monthly using TFTP.
One other thing about new-mode is that, unlike old-mode, it can apply
authentication to all line interfaces (including the console) when using
the "default" list.
Setting Up Login Authentication
Always create the local administrative account first. Then, enable
. After AAA has been enabled, the authentication
service type and list are defined:
Router#config t
Enter configuration commands, one per line. End with CNTL/Z
Router(config)#username root! password anypass
Router(config)#aaa new-mode
Router(config)#aaa authentication login default radius local