login local
Configures the line to require local username/password authentication using the local database, typically applied to console, vty, or aux lines for secure access.
Definition: login local is a Cisco IOS line config command. Configures the line to require local username/password authentication using the local database, typically applied to console, vty, or aux lines for secure access.
Overview
The `login local` command is a fundamental security configuration in Cisco IOS that enforces local authentication on a line (console, vty, or aux). When applied, it requires users to provide a valid username and password stored in the router's local database (configured via `username` commands) before gaining access to the line. This command is critical for securing administrative access, especially on remote management lines (vty) where Telnet or SSH connections are used.
Without it, lines default to no authentication (or password-only if `password` is set), which is a significant security risk. The concept behind `login local` is to leverage the local user database for authentication, as opposed to using a simple password (via `login` or `password`) or an external AAA server (via `login authentication`). It is typically used in small-to-medium networks where a central authentication server is not available or desired.
The command fits into the broader security workflow: after creating local usernames with `username name secret password`, you apply `login local` on the desired lines to enforce authentication. Important IOS behaviors: the command is applied in line configuration mode (e.g., `line console 0`, `line vty 0 4`). It does not affect privilege levels; after successful login, the user enters user EXEC mode (privilege level 1) unless `privilege level` is set.
The command is saved to the running configuration and can be verified with `show running-config | section line`. If no local usernames are configured, `login local` will still prompt for credentials but authentication will fail for any user, effectively locking out access—a common mistake. The command is available in all IOS versions and is a cornerstone of device hardening.
login localWhen to Use This Command
- Securing remote SSH/Telnet access to a router by requiring local credentials on VTY lines.
- Restricting console access to authorized users with individual usernames and passwords.
- Implementing basic AAA without an external server by using the local user database.
- Enforcing authentication for auxiliary (AUX) modem or dial-in connections.
Command Examples
Enabling local authentication on VTY lines
Router(config)# line vty 0 4
Router(config-line)# login localRouter(config-line)#
The command is entered without any immediate output. It configures all five VTY lines (0-4) to use local authentication. Users must provide a valid username and password configured via 'username' global command.
Verifying local login configuration on console line
Router(config)# line console 0
Router(config-line)# login local
Router(config-line)# end
Router# show running-config | section line conline con 0 login local
The output confirms that the console line is configured with 'login local'. The 'show running-config' command displays the relevant configuration snippet.
Understanding the Output
The 'login local' command itself produces no direct output when entered. To verify its application, use 'show running-config | section line' to see the line configuration. The output will show 'login local' under the specific line (e.g., 'line vty 0 4').
If the line shows 'login' without 'local', it means password-only authentication (using the 'password' command) is in effect. A missing 'login' statement implies no authentication, which is a security risk. Always ensure 'login local' is present for secure access.
Configuration Scenarios
Secure Console Access with Local Authentication
A network administrator wants to ensure that physical console access to a router requires a username and password, preventing unauthorized personnel from gaining EXEC access even if they have physical access.
Topology
R1 (Console) --- Admin PCSteps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Create a local user account: Router(config)# username admin secret Cisco123
- 3.Step 3: Enter console line configuration: Router(config)# line console 0
- 4.Step 4: Enable local authentication: Router(config-line)# login local
- 5.Step 5: Optionally set exec timeout: Router(config-line)# exec-timeout 5 0
- 6.Step 6: Exit and verify: Router(config-line)# end
! Full IOS config block Router(config)# username admin secret Cisco123 Router(config)# line console 0 Router(config-line)# login local Router(config-line)# exec-timeout 5 0 Router(config-line)# end
Verify: Command: show running-config | section line con 0 Expected output: line con 0 login local exec-timeout 5 0 Also test by disconnecting and reconnecting console; you should be prompted for username and password.
Watch out: If no username is configured, login local will still prompt but authentication will always fail, locking out console access. Always create at least one user before applying login local on console.
Restrict Telnet/SSH Access to VTY Lines with Local Authentication
A network engineer needs to allow remote management via Telnet or SSH but only for authenticated users. The router has multiple VTY lines (0-4) that must all require local credentials.
Topology
R1 (Gi0/0) --- 192.168.1.0/24 --- Admin PCSteps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Create local users: Router(config)# username admin secret Cisco123 Router(config)# username operator secret Pass456
- 3.Step 3: Enter VTY line configuration for all lines: Router(config)# line vty 0 4
- 4.Step 4: Enable local authentication: Router(config-line)# login local
- 5.Step 5: Set transport input to allow SSH and Telnet: Router(config-line)# transport input ssh telnet
- 6.Step 6: Optionally set exec timeout: Router(config-line)# exec-timeout 10 0
- 7.Step 7: Exit and verify: Router(config-line)# end
! Full IOS config block Router(config)# username admin secret Cisco123 Router(config)# username operator secret Pass456 Router(config)# line vty 0 4 Router(config-line)# login local Router(config-line)# transport input ssh telnet Router(config-line)# exec-timeout 10 0 Router(config-line)# end
Verify: Command: show running-config | section line vty Expected output: line vty 0 4 login local transport input ssh telnet exec-timeout 10 0 Also test by Telnetting from admin PC; you should be prompted for username and password.
Watch out: If transport input is not set, default allows all protocols including Telnet, which sends passwords in clear text. Always use SSH when possible. Also, ensure usernames have secrets (not passwords) for encrypted storage.
Troubleshooting with This Command
When troubleshooting authentication issues related to `login local`, the first step is to verify that the command is applied on the correct line. Use `show running-config | section line` to confirm that `login local` appears under the intended line (console, vty, aux). If the command is missing, authentication may fall back to no authentication or a simple password.
Next, check the local user database with `show running-config | include username` or `show username`. Ensure that at least one username is configured and that the secret is correctly set (use `secret` not `password` for encryption). A common symptom is repeated login failures even with correct credentials; this can happen if the username database is empty or if the user is using a password instead of a secret.
Another issue is that the line may be configured with `login local` but the transport input is restricted (e.g., only SSH allowed) and the client is using Telnet; in that case, the connection will be rejected before authentication. Use `show line` to see line status and protocol. If debugging is needed, use `debug aaa authentication` to see detailed authentication steps.
For example, a successful login will show `AAA: parse name=tty1 idb type=1 tty=-1` followed by `AAA/AUTHEN/LOGIN (0000000A): Pick method list 'default'` and then `AAA/AUTHEN/LOGIN: User authenticated`. Failure messages like `AAA/AUTHEN/LOGIN: User not authenticated` indicate credential mismatch. Also, ensure that the line is not configured with `no login` or `login` (which uses only password).
If you are locked out, you may need to perform password recovery via ROMMON. Correlate with `show users` to see active sessions; if an unauthorized user is connected, use `clear line` to disconnect them. In summary, systematic verification of line configuration, user database, and transport settings will resolve most issues.
CCNA Exam Tips
CCNA exam tip: 'login local' requires a username database; without configured usernames, access is denied.
CCNA exam tip: The 'login' command alone (without 'local') uses the line password; 'login local' uses local usernames.
CCNA exam tip: For SSH, you must also configure 'transport input ssh' on the VTY lines.
CCNA exam tip: The 'username' command must be global; example: 'username admin secret cisco'.
Common Mistakes
Mistake 1: Forgetting to create local usernames before applying 'login local', locking out all users.
Mistake 2: Using 'login' instead of 'login local', relying on a shared line password instead of individual credentials.
Mistake 3: Applying 'login local' to the console line without also configuring 'exec-timeout' to auto-logout idle sessions.
login local vs transport input ssh
Both 'login local' and 'transport input ssh' are line configuration commands used to secure remote management access, which can cause confusion. However, they address different aspects: 'login local' controls how users are authenticated (against the local database), while 'transport input ssh' restricts the allowed transport protocols (only SSH). They are often used together on VTY lines but serve distinct roles.
| Aspect | login local | transport input ssh |
|---|---|---|
| Scope | Authentication method for the line | Allowed transport protocols on the line |
| Mode | Line configuration (config-line) | Line configuration (config-line) |
| Effect on Access | Requires local username/password; no access without valid credentials | Only allows SSH connections; Telnet is rejected |
| Security Benefit | Prevents unauthorized access even if password is guessed via other methods | Blocks unencrypted Telnet, protecting against eavesdropping |
| Dependencies | Requires usernames configured globally with 'username' command | Requires SSH server configuration (crypto key, hostname, domain) |
| Typical Use | All lines (console, vty, aux) for local authentication | VTY lines only, to enforce SSH-only remote access |
Use login local when you want to authenticate users against the local username database, typically on console or VTY lines for environments without AAA.
Use transport input ssh when you want to enforce SSH-only remote management, blocking unencrypted Telnet, typically on VTY lines.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 routers), the `login local` command behaves identically to classic IOS. However, the default authentication method list may be different; in some IOS-XE versions, the default method list includes local if no AAA is configured. The command syntax is the same.
In NX-OS (e.g., Nexus switches), the equivalent is `login local` under line configuration, but NX-OS uses a different user database structure (configured via `username` commands with role-based access). The command is `line console` or `line vty`, then `login local`. In ASA firewalls, the equivalent is `login local` under the `line` subcommand, but ASA uses a different configuration model (e.g., `username` commands are under `configure`).
In IOS-XR, the equivalent is `login local` under `line` configuration, but IOS-XR uses a hierarchical configuration and the command is `login local` as well. There are no significant syntax differences between IOS versions 12.x, 15.x, and 16.x for this command. However, in older IOS (12.x), the `username` command used `password` instead of `secret`; using `secret` is recommended for encryption.
The command exists in all IOS platforms and versions.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions