AAA = who are you (Authentication), what may you do (Authorization), what did you do (Accounting) — all three served locally from the router’s own user database when no AAA server exists.

username admin privilege 15 secret Str0ngP@ss
ip domain-name example.com
crypto key generate rsa modulus 2048
line vty 0 4
 transport input ssh
 login local          ! simple form
!
! CCNP form with an explicit method list:
aaa new-model
aaa authentication login VTY_ACCESS local
line vty 0 4
 login authentication VTY_ACCESS

• aaa new-model changes behaviour immediately — the classic self-lockout: have a local user configured first; the console is your last rescue path.
• Method lists evaluate left→right (group radius local as fallback pattern); if-authenticated is the anti-lockout authorization backstop.
• Debug: debug aaa authentication, debug aaa protocol local.