CCNP AAA, RADIUS, and TACACS+ — 10 Questions

Question 1

A network engineer is configuring AAA on a Cisco ISR router to authenticate administrative users via a RADIUS server. The engineer configures the router with the command 'aaa new-model' and then 'aaa authentication login default group radius local'. When the engineer attempts to SSH to the router using a username that exists only on the RADIUS server, the authentication fails. The RADIUS server is reachable and the shared secret is correct. What is the most likely cause of the failure?

Accepted Answer

The RADIUS server is rejecting the authentication because the user is not defined on the server, and the 'local' fallback only applies if the server is unreachable.. The RADIUS server is not configured to authenticate the user, or the RADIUS server is not responding correctly. The 'local' fallback is only used if the RADIUS server does not respond, not if it rejects the authentication. The issue is that the RADIUS server is rejecting the authentication, possibly because the user is not defined on the server or the server's configuration does not match the router's request.

Answer

The router's SSH service is not enabled.

Answer

The 'aaa new-model' command must be followed by a 'aaa authentication login default local' command to use local authentication.

Answer

The router's VTY lines are not configured to use the default authentication list.

Question 2

An enterprise network uses TACACS+ for device administration and RADIUS for network access (VPN and wireless). The TACACS+ server is configured to authorize commands. A network engineer notices that after a recent upgrade of the TACACS+ server software, some commands that were previously authorized are now being denied. The engineer checks the router configuration and sees 'aaa authorization commands 15 default group tacacs+'. The TACACS+ server logs show that the authorization requests are being sent and responded to. What is the most likely cause?

Accepted Answer

The TACACS+ server upgrade changed the default authorization behavior from permissive to restrictive, requiring explicit 'permit' statements for each command, and the existing rules may not cover all commands.. The TACACS+ server software upgrade likely changed the authorization model or the way commands are matched. The router sends the full command string to the TACACS+ server, and the server must have a matching rule. If the server's configuration now requires exact matching or has stricter parsing, previously allowed commands may be denied.

Answer

The router's 'aaa authorization commands 15 default group tacacs+' command is missing the 'local' keyword, so if TACACS+ denies, there is no fallback.

Answer

The router's privilege level 15 is not correctly assigned to the user.

Answer

The TACACS+ server is not reachable due to a firewall change, causing the router to deny all commands.

Question 3

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Accepted Answer

The interface needs the 'authentication guest-vlan <vlan-id>' command to specify the VLAN for non-802.1X devices.. For a port to move to a guest VLAN when authentication fails, the switch must be configured with a guest VLAN on that interface. The 'authentication port-control auto' enables 802.1X, but without a guest VLAN defined, the port stays unauthorized on failure.

Answer

The switch must have 'aaa authentication dot1x default group radius' configured globally.

Answer

The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.

Answer

The port must be configured as a trunk port to allow the guest VLAN.

Question 4

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Accepted Answer

The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.. The WLC is interpreting the 'Access-Reject' as a non-response because the RADIUS server is using a different source port for the response, or the WLC is not configured to accept responses from the server's source IP. However, the most common cause is that the RADIUS server is sending the response from a different IP address than the one configured on the WLC, or the WLC has a mismatch in the shared secret. But since the server logs show requests are received and rejected, the shared secret is likely correct. The issue is that the WLC might be expecting the response on a different port or from a different IP, but the scenario says 'RADIUS server not responding' which typically means the WLC did not receive a response. This could be due to the RADIUS server sending the response from a different source IP (e.g., a secondary IP) than the one configured on the WLC, or a firewall blocking the response. However, the most plausible cause is that the RADIUS server is configured to use a different source IP for RADIUS traffic than the one the WLC expects.

Answer

The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.

Answer

The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.

Answer

The WLC is not configured with a valid management interface IP address to reach the RADIUS server.

Question 5

A network engineer is configuring a Cisco router to use TACACS+ for authentication and authorization of EXEC sessions. The engineer configures 'aaa new-model', 'aaa authentication login default group tacacs+ local', and 'aaa authorization exec default group tacacs+ local'. When a user tries to log in via SSH, the router prompts for username and password, but after entering correct credentials, the user is immediately disconnected. The TACACS+ server logs show that the authentication was successful. What is the most likely cause?

Accepted Answer

The TACACS+ server is not configured to authorize the user for EXEC access, so it sends a 'deny' response, causing the router to disconnect the user.. The user is authenticated successfully, but the authorization for EXEC (shell) is failing. The 'aaa authorization exec default group tacacs+ local' command means the router will first try TACACS+ for EXEC authorization; if TACACS+ does not respond, it falls back to local. However, if TACACS+ responds with a deny for EXEC authorization, the user is denied access and disconnected. The TACACS+ server may not have a shell profile for the user, or the authorization rule denies EXEC access.

Answer

The 'aaa authorization exec' command should be 'aaa authorization commands 15' to allow the user to execute commands after login.

Answer

The router's SSH configuration is missing the 'ip ssh authentication-retries' command.

Answer

The 'local' fallback in the authorization command is overriding the TACACS+ response.

Question 6

A network engineer is configuring a Cisco switch for 802.1X with RADIUS authentication. The switch is also configured with 'aaa authentication dot1x default group radius'. The engineer wants to use a single RADIUS server for both authentication and accounting. The RADIUS server is configured with the same shared secret for both services. The engineer configures 'radius-server host 10.1.1.1 auth-port 1812 acct-port 1813 key cisco123'. However, accounting records are not being sent to the server. The engineer verifies that the RADIUS server is reachable and that accounting is enabled on the server. What is the most likely cause?

Accepted Answer

The switch is missing the 'aaa accounting dot1x default start-stop group radius' command to enable accounting for 802.1X sessions.. The switch must have accounting enabled globally and for the specific service (dot1x). The 'radius-server host' command only defines the server; accounting is not automatically enabled. The engineer needs to configure 'aaa accounting dot1x default start-stop group radius' to send accounting records.

Answer

The RADIUS server is using a different accounting port than 1813; the switch should use port 1646.

Answer

The switch must have 'aaa new-model' configured before accounting can work.

Answer

The RADIUS server's shared secret for accounting is different from the authentication secret.

Question 7

A network engineer is configuring a Cisco router to use TACACS+ for command authorization. The engineer configures 'aaa authorization commands 15 default group tacacs+ local'. When a user with privilege level 15 tries to execute the 'reload' command, the router sends an authorization request to the TACACS+ server. The server responds with an 'Access-Accept' but the command is still denied. The engineer checks the router's configuration and sees that 'aaa accounting commands 15 default start-stop group tacacs+' is also configured. What could be the issue?

Accepted Answer

The TACACS+ server's 'Access-Accept' response does not include the necessary authorization attributes to permit the 'reload' command, so the router denies it.. The TACACS+ server response for command authorization includes attributes that specify which commands are allowed. If the server responds with an 'Access-Accept' but does not include the necessary authorization data (e.g., a list of permitted commands or a 'permit all' attribute), the router may deny the command. Alternatively, the accounting configuration might be interfering, but that is less likely. The most common cause is that the TACACS+ server's response does not include the required authorization information for the specific command.

Answer

The 'aaa accounting commands 15' command is causing the router to send accounting records before authorization, which delays the response and causes a timeout.

Answer

The router's 'aaa authorization commands 15' should use 'group tacacs+' without 'local' to ensure only TACACS+ is used.

Answer

The user's privilege level on the router is not actually 15, despite the configuration.

Question 8

An organization uses a Cisco ISE as the RADIUS server for both wired and wireless authentication. The network engineer configures a Cisco switch with 'aaa authentication dot1x default group radius' and 'aaa authorization network default group radius'. When a user connects via 802.1X, authentication succeeds, but the user is placed in the wrong VLAN. The RADIUS server sends a 'Tunnel-Private-Group-ID' attribute with the correct VLAN name. The switch has the VLAN defined. What is the most likely cause?

Accepted Answer

The switch interface is configured as a static access port, which overrides the RADIUS-supplied VLAN.. The switch must be configured to accept and apply RADIUS-supplied VLAN attributes. This requires the 'aaa authorization network default group radius' command, which is already configured. However, the switch may also need the 'radius-server attribute 6 on-for-login-auth' or similar to map the attribute to a VLAN. But the most common issue is that the switch's interface is not configured for 'authentication port-control auto' or the VLAN is not in the allowed list. However, the scenario says authentication succeeds, so the port is authorized. The likely cause is that the switch is not configured to use the RADIUS-supplied VLAN because the interface is not set to 'switchport access vlan dynamic' or the 'authentication' command is missing the 'vlan' assignment.

Answer

The RADIUS server is sending the VLAN ID as a number, but the switch expects a VLAN name.

Answer

The switch needs the 'radius-server attribute 8 include-in-access-req' command to include the calling station ID.

Answer

The switch's VLAN database does not have the VLAN created, so it defaults to the native VLAN.

Question 9

A network engineer is configuring a Cisco router for AAA using a RADIUS server. The engineer wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication for console access. The engineer configures 'aaa authentication login default group radius local' and 'aaa authentication login CONSOLE local'. The console line is configured with 'login authentication CONSOLE'. However, when the RADIUS server is down, the engineer cannot log in via the console. What is the problem?

Accepted Answer

The router has no local usernames configured, so the 'local' method has no users to authenticate against.. The console line is configured to use the 'CONSOLE' method list, which only has 'local' as the method. This is correct for fallback. However, the issue might be that the local database has no users defined, or the 'local' method is not working because the 'username' command is missing. But the scenario says the engineer cannot log in, implying that local authentication is failing. The most likely cause is that no local usernames are configured on the router.

Answer

The 'aaa authentication login CONSOLE local' command should be 'aaa authentication login CONSOLE group radius local' to include RADIUS as a fallback.

Answer

The console line should use the default authentication list instead of a named list.

Answer

The 'aaa new-model' command is missing, so AAA is not enabled.

Question 10

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reload: 5
Session Id: 1
  Unique Id: 1
  User Name: admin
  IP Address: 10.1.1.100
  Idle Time: 0
  Timeout: 0
  Type: Login
  Method: RADIUS
  Session Id: 2
  Unique Id: 2
  User Name: jdoe
  IP Address: 10.1.1.101
  Idle Time: 120
  Timeout: 0
  Type: Login
  Method: LOCAL

Based on this output, what can be concluded?

Accepted Answer

User jdoe authenticated using local authentication.. The output shows two active AAA sessions. The first session (admin) uses RADIUS authentication, while the second (jdoe) uses local authentication. This indicates that the router is configured to fall back to local authentication when RADIUS is unavailable or for certain users. The idle time for jdoe is 120 seconds, meaning the session has been idle for that long, but no timeout is configured.

Answer

All users are authenticated via RADIUS.

Answer

The RADIUS server is unreachable for all users.

Answer

Both sessions are using TACACS+ for authorization.