Home / server / Questions / 289542
Accepted
Windows Ninja
Asked: 2011-07-13 10:16:05 +0800 CST

Can somebody please explain IOS line authentication?

  • 772

I'm trying to understand a config on one of our Cisco routers (teaching myself iOS) and have run into a problem with one line.

Can somebody please explain the "line enable" piece of the command below and check the rest of my information to ensure it is correct?

aaa authentication login default group tacacs+ local line enable
---
# Creates an authentication list that specifies the types of authentication methods allowed.

# aaa authentication login = command to authenticate users who want exec (enable) access into the access server (tty, vty, console, and aux).
## default = the named list is the the default one (in this case the default one is default)

# There are three authentication methods:
## TACACS+
## local
## line

# All users are authenticated using the tacacs+ server (the first method). If the TACACS+ server doesn't respond, then the router's local database is used (the second method). The local authentication, define the username and password::
## username xxx password yyy

# Because we are using the list default in the aaa authentication login command, login authentication is automatically applied for all login connections (such as tty, vty, console, and aux).
cisco ios

1 Answers

  1. Best Answer

    line and enable are additional methods of authentication that will be attempted after failure of the previous methods in the list.

    line authentication uses a password that's defined in your line configs, so it can vary based on your connection method. enable authentication simply uses the enable password defined in the enable password command.

    Here's a reference of the methods available for the authentication list:

    (config)#aaa authentication login default ?
  cache        Use Cached-group
  enable       Use enable password for authentication.
  group        Use Server-group
  krb5         Use Kerberos 5 authentication.
  krb5-telnet  Allow logins only if already authenticated via Kerberos V
               Telnet.
  line         Use line password for authentication.
  local        Use local username authentication.
  local-case   Use case-sensitive local username authentication.
  none         NO authentication.
    • 5