AAA Named Method Lists with Fallback (VTY vs Console)

Bundle lab

Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.

Learning objectives

• Enable AAA on IOS and design named authentication method lists
• Apply different AAA login policies to VTY and console lines
• Use enable as a safe fallback in the VTY method list to avoid lockouts
• Confirm line bindings and AAA behavior using show commands
• Validate SSH readiness and test both primary and fallback authentication paths

Troubleshooting focus

• VTY still uses login local instead of the named method list
• Named list defined but not applied to the correct line
• Enable secret missing, causing fallback to fail
• RSA key not generated, so SSH cannot start despite config
• ip domain name missing, preventing RSA key generation