300-440 Question 207
Select 3A network administrator has configured AAA on a Cisco router to authenticate administrative access using TACACS+. However, after configuration, the router fails to authenticate users and reverts to the local database for authentication. Upon investigation, you find that the TACACS+ server is reachable, but the issue persists. Which of the following could be the cause of this issue?
- A
The TACACS+ server key configured on the router does not match the key on the TACACS+ server.
- B
The local database username and password are not configured on the router.
- C
The router is not configured with the correct TACACS+ server IP address.
- D
The router is missing the AAA authentication login method list configuration.
- E
The TACACS+ server is using the wrong port for authentication.
Show answer and explanation
Correct answers: A, C, D
Explanation
For TACACS+ authentication to work properly, the TACACS+ server key on the router must match the key on the server, the router must be configured with the correct server IP address, and an AAA authentication login method list must be defined to specify that TACACS+ is to be used for authentication. If any of these configurations are missing or incorrect, the router will fail to authenticate users via TACACS+ and may fall back to the local database as described in the scenario.
- A. Correct.
If the TACACS+ key on the router does not match the key on the TACACS+ server, the authentication will fail as the router will not be able to establish a secure connection with the server.
- B. Incorrect.
While the local database is used as a fallback, the absence of a configured local database username and password does not cause TACACS+ authentication to fail. This is unrelated to the issue described.
- C. Correct.
If the TACACS+ server is configured with an incorrect IP address, the router will fail to reach the intended server for authentication.
- D. Correct.
The AAA authentication login method list specifies the authentication methods (e.g., TACACS+, local) to use for user login. Without this configuration, the router will not know to use TACACS+ for authentication.
- E. Incorrect.
The TACACS+ server typically defaults to port 49 for authentication. If the wrong port is being used, communication between the router and TACACS+ server might fail. However, the scenario specifies that the TACACS+ server is reachable, which makes this less likely to be the issue.