aaa new-model
Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.
Definition: aaa new-model is a Cisco IOS global config command. Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.
Overview
The `aaa new-model` command is the foundational command for enabling Authentication, Authorization, and Accounting (AAA) security services on Cisco IOS devices. Without this command, no other AAA commands (like `aaa authentication login`, `aaa authorization exec`, or `aaa accounting exec`) are available in the configuration. AAA provides a modular framework for controlling access to network devices, ensuring that users are authenticated (who they are), authorized (what they can do), and that their actions are logged for auditing.
This command is critical in enterprise environments where centralized authentication servers (like RADIUS or TACACS+) are used to manage device access, replacing legacy local username/password databases or simple line passwords. When you enable `aaa new-model`, the device immediately changes its default behavior: all login methods (console, VTY, AUX) are affected, and you must explicitly configure authentication methods to avoid being locked out. This is a common pitfall for beginners.
The command fits into the broader workflow of securing a network device: after initial IP connectivity and basic configuration, you typically enable AAA, then define authentication lists, authorization policies, and accounting rules. It is also a prerequisite for features like 802.1X, RADIUS-based VPN authentication, and command authorization. In terms of IOS behavior, `aaa new-model` is a global configuration command that, once entered, modifies the running configuration immediately.
It does not require a reload, but it does change the default authentication behavior: without further configuration, all login attempts will fail because no default authentication method is defined. This is why it is crucial to configure at least one authentication method (e.g., `aaa authentication login default local`) immediately after enabling AAA. The command is available in all IOS versions (12.x, 15.x, 16.x) and is the standard for modern Cisco devices.
It is also supported in IOS-XE and IOS-XR, though the syntax for subsequent AAA commands may vary slightly. In NX-OS, the equivalent is `feature tacacs+` or `feature radius` depending on the protocol. The command has no parameters; it is simply `aaa new-model` in global configuration mode.
Once enabled, you can verify its status with `show running-config | include aaa` or `show aaa sessions`. The impact on the running config is immediate and persistent if saved. It is a one-way command: to disable AAA, you must remove all AAA commands and then issue `no aaa new-model`, but this is rarely done in production.
Understanding this command is essential for CCNA and CCNP candidates because it is the gateway to all AAA functionality, which is a core topic in the security and network management domains.
aaa new-modelWhen to Use This Command
- Enabling AAA to configure local authentication for console and VTY lines on a small office router.
- Setting up AAA with a RADIUS server for centralized user authentication in an enterprise network.
- Enabling AAA to implement command authorization for privilege levels on a production router.
- Preparing to configure accounting to log user commands for compliance auditing.
Command Examples
Enable AAA and configure local authentication
aaa new-modelRouter(config)# aaa new-model Router(config)#
The command enables AAA. No output is shown if successful; the prompt returns to global config mode. After this, AAA commands become available.
Enable AAA with a warning about default login
aaa new-modelRouter(config)# aaa new-model WARNING: Default login authentication list is now 'default'. Use 'login authentication default' to configure. Router(config)#
The warning indicates that after enabling AAA, the default login authentication method changes. You must configure an authentication list to avoid lockout.
Understanding the Output
The 'aaa new-model' command itself produces no persistent output. However, it immediately changes the device's behavior: all login authentication defaults to a local database or configured method. The warning message (if seen) reminds you to define an authentication list.
After enabling, you must configure at least one authentication method (e.g., 'aaa authentication login default local') or risk being locked out. Always verify with 'show running-config | include aaa' to confirm AAA is enabled.
Configuration Scenarios
Configure AAA with local authentication for console and VTY lines
A small office router needs to secure administrative access using local usernames stored on the device. No external AAA server is available. The goal is to require username/password for both console and remote SSH access.
Topology
R1 (Console, VTY lines) --- Management PCSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enable AAA: aaa new-model
- 3.Step 3: Create a local user: username admin secret cisco123
- 4.Step 4: Define an authentication list for login: aaa authentication login default local
- 5.Step 5: Apply the authentication list to console and VTY lines: line console 0, login authentication default; line vty 0 4, login authentication default
- 6.Step 6: Optionally, set exec authorization: aaa authorization exec default local
- 7.Step 7: Exit and save: end, write memory
! username admin secret cisco123 ! aaa new-model aaa authentication login default local aaa authorization exec default local ! line console 0 login authentication default line vty 0 4 login authentication default transport input ssh !
Verify: show running-config | section aaa show running-config | include username Attempt SSH or console login with username 'admin' and password 'cisco123'.
Watch out: If you enable `aaa new-model` without first configuring an authentication method, you will be locked out of the device. Always configure `aaa authentication login default local` (or another method) immediately after enabling AAA.
Configure AAA with TACACS+ server for centralized authentication and command authorization
A medium-sized enterprise uses a Cisco ISE or ACS server for centralized AAA. The router must authenticate users via TACACS+, authorize which commands they can execute, and log all exec commands for auditing.
Topology
R1 (Gi0/0) --- 192.168.1.0/24 --- TACACS+ Server (192.168.1.100)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enable AAA: aaa new-model
- 3.Step 3: Configure TACACS+ server: tacacs server ISE, address ipv4 192.168.1.100, key cisco123
- 4.Step 4: Define authentication list: aaa authentication login default group tacacs+ local
- 5.Step 5: Define exec authorization: aaa authorization exec default group tacacs+ local
- 6.Step 6: Define command authorization for privilege levels: aaa authorization commands 15 default group tacacs+ local
- 7.Step 7: Define accounting for exec and commands: aaa accounting exec default start-stop group tacacs+, aaa accounting commands 15 default start-stop group tacacs+
- 8.Step 8: Apply authentication to VTY lines: line vty 0 4, login authentication default
- 9.Step 9: Exit and save: end, write memory
! tacacs server ISE address ipv4 192.168.1.100 key cisco123 ! aaa new-model aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa authorization commands 15 default group tacacs+ local aaa accounting exec default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ ! line vty 0 4 login authentication default transport input ssh !
Verify: show aaa servers show running-config | section aaa Test by SSHing to the router and verifying that commands are authorized and logged on the TACACS+ server.
Watch out: Ensure the TACACS+ server IP and key match exactly. If the server is unreachable, the 'local' fallback method will be used. Also, command authorization can lock out users if not configured correctly; always test with a privileged account first.
Troubleshooting with This Command
When troubleshooting AAA issues, the first step is to verify that `aaa new-model` is enabled. Use `show running-config | include aaa new-model` to confirm. If it is missing, AAA commands will not take effect.
Next, check the authentication method lists with `show running-config | section aaa authentication`. A common problem is that the authentication list is not applied to the lines. Use `show running-config | section line` to verify that `login authentication` is configured on console and VTY lines.
If you are using an external AAA server, verify connectivity with `test aaa group tacacs+ username password` or `test aaa group radius username password`. This command simulates an authentication request and shows success or failure. For TACACS+, use `debug tacacs` and `debug aaa authentication` to see the exchange.
Healthy output shows 'PASS' or 'Success' for authentication. Problem indicators include 'FAIL' or 'Server not reachable'. Check the server IP and shared secret.
For authorization issues, use `debug aaa authorization` to see what attributes the server returns. If commands are not authorized, verify the `aaa authorization commands` configuration and the server's command authorization rules. Accounting issues can be debugged with `debug aaa accounting`.
Look for 'Accounting start' and 'Accounting stop' messages. If accounting records are missing, check the server configuration and ensure the accounting method list is applied. Another common symptom is that users are prompted for a password but authentication fails even with correct credentials.
This often indicates a misconfiguration in the authentication list order (e.g., 'local' before 'group tacacs+') or a missing fallback method. Use `show aaa sessions` to see active AAA sessions and their status. If a user is locked out, you may need to access the device via console (which might have a separate authentication method) or use the 'password recovery' procedure.
Always ensure that the console line has a fallback method (like 'local') to prevent lockout. Correlate AAA debug output with `show log` to see system messages. For example, if the TACACS+ server is down, you will see '%TACACS+ server not reachable' messages.
In summary, a systematic approach: verify AAA is enabled, check authentication lists, test server connectivity, debug the specific AAA phase (authentication, authorization, accounting), and review logs.
CCNA Exam Tips
CCNA exam tip: 'aaa new-model' must be entered before any other AAA command; it's a prerequisite.
CCNA exam tip: After enabling AAA, the default login authentication becomes 'default' — if not configured, you may be locked out.
CCNA exam tip: The exam may test that 'aaa new-model' is required for RADIUS/TACACS+ configuration.
CCNA exam tip: Remember that 'aaa new-model' affects all lines (console, VTY, AUX) immediately.
Common Mistakes
Mistake 1: Forgetting to configure an authentication list after 'aaa new-model', causing lockout.
Mistake 2: Enabling AAA but not applying 'login authentication' to lines, leaving them with no authentication.
Mistake 3: Using 'aaa new-model' without understanding it changes default login behavior, leading to unexpected access issues.
aaa new-model vs aaa authentication login default group radius local
These two commands are often confused because both are part of the AAA configuration, but they serve fundamentally different purposes. 'aaa new-model' globally enables the AAA security framework, while 'aaa authentication login default group radius local' defines a specific authentication method for login access.
| Aspect | aaa new-model | aaa authentication login default group radius local |
|---|---|---|
| Scope | Enables entire AAA subsystem globally | Configures authentication method list for login |
| Configuration mode | Global configuration | Global configuration |
| Persistence | Persists in running-config as a single line | Persists in running-config only if 'aaa new-model' is present |
| Precedence | Must be configured first before other AAA commands | Depends on 'aaa new-model' being enabled to take effect |
| Typical use | Initial step to enable AAA security services | Specifies RADIUS with local backup for login authentication |
Use aaa new-model when you need to enable AAA security services on the device, which is a prerequisite for any AAA-related configuration.
Use aaa authentication login default group radius local when you want to authenticate login users first via a RADIUS server, and fall back to the local user database if the RADIUS server is unreachable.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 routers), the `aaa new-model` command behaves identically to classic IOS. However, the syntax for defining TACACS+ servers changed in IOS-XE 16.x: use `tacacs server <name>` instead of the older `tacacs-server host <ip>`. The older syntax is deprecated but still accepted.
In NX-OS (e.g., Nexus 9000), AAA is enabled differently. There is no `aaa new-model` command. Instead, you enable the TACACS+ or RADIUS feature: `feature tacacs+` or `feature radius`.
Then you configure servers under `tacacs-server host <ip> key <key>` and create authentication lists with `aaa authentication login default group tacacs+ local`. The concept is similar but the command structure is distinct. For ASA firewalls, AAA is configured via `aaa authentication enable console LOCAL` or `aaa authentication ssh console LOCAL`, and there is no `aaa new-model`.
Instead, AAA is implicitly available. In IOS-XR (e.g., ASR 9000), AAA is enabled by default, and you configure it under `aaa` configuration mode: `aaa authentication login default local`. There is no `aaa new-model` command.
For CCNA/CCNP candidates, be aware that while the core concept of AAA is universal, the exact command syntax varies by platform. Always check the specific platform documentation. In IOS 12.x and 15.x, the `aaa new-model` command is identical, but the server configuration commands differ (e.g., `tacacs-server host` vs `tacacs server`).
In IOS 16.x, the newer syntax is preferred. The command is not available in IOS-XR or NX-OS, but the equivalent functionality exists.
Related Commands
aaa authentication login default group radius local
Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions