300-410 Question 206
Select 3A network engineer has configured AAA on a Cisco router to authenticate administrative access using a RADIUS server. However, users are unable to log in when the RADIUS server is unavailable. To resolve this issue, the engineer decides to configure a local fallback authentication method. Which of the following steps should the engineer take to troubleshoot and implement the local fallback mechanism?
- A
Ensure the local database is configured with valid usernames and passwords.
- B
Add the 'local' keyword to the authentication method list after the RADIUS method.
- C
Verify that the RADIUS server is configured in the AAA server group.
- D
Ensure the router is configured with the 'aaa new-model' command.
- E
Replace the 'local' keyword in the method list with 'none' to bypass authentication.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement a local fallback mechanism for AAA authentication, the local database must be properly configured, the 'local' keyword must be included in the authentication method list after the RADIUS method, and the 'aaa new-model' command must be enabled. These steps ensure that when the RADIUS server is unavailable, the router can fall back to the local database for authentication instead of failing entirely.
- A. Correct.
The local database must be configured with valid usernames and passwords for fallback authentication to work. This ensures users can log in when the RADIUS server is unreachable.
- B. Correct.
Adding the 'local' keyword to the method list after the RADIUS method allows the router to fall back to the local database if the RADIUS server fails.
- C. Incorrect.
While configuring the RADIUS server in an AAA server group is necessary for RADIUS authentication, it does not address the issue of local fallback.
- D. Correct.
The 'aaa new-model' command enables the AAA feature on the router, which is a prerequisite for AAA authentication methods to function.
- E. Incorrect.
Replacing 'local' with 'none' disables authentication entirely, which is not a secure solution and does not align with the requirement for fallback authentication.