AAA = Authentication (who are you?), Authorization (what may you do?), Accounting (what did you do?) — with local AAA the users are validated against the router/switch’s own username/password database (no external AAA server).

Facts

• AAA functions used against the local database — alternative to RADIUS (UDP 1812/1813) and TACACS+ (TCP 49)
• AAA is disabled by default → enabled with aaa new-model
• ⚠️ Enabling AAA can lock you out if no local user exists for remote access
• CCNA: local users + login local on VTY/SSH · CCNP: method lists, exec/command authorization, accounting, lockout scenarios, debug

Why does it exist?

Device access control in small environments, labs and break-glass when there is no central AAA. Without it you end up with a plain line password — poor accountability and weaker security.

How it works

1. Enable AAA: aaa new-model
2. Create local users: username … secret …
3. Choose method: implicit local DB, or a method list aaa authentication login … local
4. Apply on lines: login authentication <list> or login local
5. Normal operation: SSH/telnet/console logins validated locally

Term	Explanation
aaa new-model	Enables AAA (otherwise legacy line login)
Method list	Order of authentication methods (left→right), bound to specific lines
login local	VTY uses the local user DB (simple/local)
if-authenticated	“Fail-open” authorization once the user is authenticated – avoids lockout

Dependencies & considerations

• Lockout risk: at least one local user must exist before enabling AAA for remote access
• The console often remains available as the rescue path
• Local DB must be maintained per device → fits small environments best

Configuration

Basic (CCNA) – local database + SSH:

username admin privilege 15 secret Str0ngP@ss
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
 transport input ssh
 login local

Advanced (CCNP) – method list, still local only:

aaa new-model
username admin privilege 15 secret Str0ngP@ss
aaa authentication login VTY_ACCESS local
!
line vty 0 4
 login authentication VTY_ACCESS
 transport input ssh

Tip: when you start using authorization (exec/commands), think lockout — books recommend if-authenticated as the last authorization method.

Verification & troubleshooting

show running-config | section username|aaa|line
show privilege
debug aaa protocol local
debug aaa authentication

Typical faults: can’t log in via SSH after aaa new-model → no local user / wrong method list on the line; method list not working → wrong service type or not applied to the line.

Exam tip ⚠️: see aaa new-model in a task → immediately think lockout risk — verify a local user exists before you apply anything.