300-440 Question 208
Single answerA network engineer has configured AAA on a Cisco router to use a TACACS+ server for authentication. However, users are unable to authenticate, and fallback to the local database is not working. Upon reviewing the configuration, the engineer notices the following:
aaa new-model
aaa authentication login default group tacacs+ local
tacacs-server host 192.168.1.10 key tacacskey
What is the most likely cause of the issue?
- A
The TACACS+ server IP address is incorrectly configured.
- B
The local database does not contain valid user credentials.
- C
The 'aaa authentication login default' command is incorrectly configured.
- D
The shared key between the router and the TACACS+ server is invalid.
Show answer and explanation
Correct answer: D
Explanation
The issue lies with the shared key ('tacacskey') between the router and the TACACS+ server. If this key is incorrect or mismatched, the router cannot establish a secure connection to the TACACS+ server, causing authentication to fail. Additionally, fallback to the local database will not occur if the router is unable to determine that the TACACS+ server is unreachable. Ensuring the shared key matches on both the router and the TACACS+ server resolves this issue.
- A. Incorrect.
The TACACS+ server IP address appears to be correctly configured as 192.168.1.10, and there is no evidence in the scenario indicating it's incorrect.
- B. Incorrect.
If the TACACS+ server fails, the fallback to the local database is expected to work as long as valid credentials are present. However, the issue described is related to TACACS+ communication, not missing local database credentials.
- C. Incorrect.
The 'aaa authentication login default' command is correctly configured to use TACACS+ first and fallback to the local database. There is no issue with this command syntax.
- D. Correct.
If the shared key is invalid, the router cannot communicate with the TACACS+ server. As a result, authentication via TACACS+ fails, and the system does not properly fallback to the local database.