Configure And Verify
5.1 Configure and verify device access control
3 min read
ENCOR 350-401 v1.2
Updated
Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.
On this page
What this section tests
Section 5.1 tests management plane protection. If an attacker can log in to a switch or router, the rest of the security design does not matter. ENCOR expects you to configure and verify two things:
- Lines and local user authentication.
- Authentication, Authorization, and Accounting (AAA) with central servers and local fallback.
A network device answers three questions before it gives someone a shell:
- Who are you? Authentication.
- What are you allowed to do? Authorization.
- What did you do? Accounting.
Local users answer these on one device. AAA answers them from a central server for every device.
Articles
Topic map
| Topic | Control point | Proof command | |
|---|---|---|---|
| Lines and local users | The line itself (line vty, line con) | show users, `show running-config \ | section line` |
| SSH-only access | transport input ssh under the line | show ip ssh | |
| AAA servers | The TACACS+ or RADIUS server group | show aaa servers | |
| Method lists | aaa authentication login and aaa authorization exec | test aaa group | |
| Fallback | Local user database after server ERROR | Login test with the server unreachable |
Local versus central authentication
| Choice | Use it for |
|---|---|
| Line password only | Never in production. No per-user identity. |
Local users (login local) | Labs, small sites, and break-glass fallback. |
| AAA with TACACS+ | Centralized device administration with command authorization. |
| AAA with RADIUS | Network access such as 802.1X and VPN. |
Note: Keep one local privilege 15 user even when AAA is in place. That user is the fallback when the AAA servers are unreachable.
Study plan
- Read 5.1.a Lines and local user authentication. Build the lab.
- Read 5.1.b AAA authentication and authorization. Build the lab with a console session open.
- For every configuration, run the proof command. Do not trust the configuration text alone.
Exam traps
aaa new-modelchanges login behavior on every line. Plan a fallback before you enable it.- Fallback to local happens on server ERROR, not on a FAIL from a rejected password.
- The AAA source interface matters. Servers often accept requests only from a known device IP.
- Privilege level 0 is user mode. Privilege level 15 is privileged mode. A user with privilege 15 lands in enable mode directly.
Pass check
You are ready for Section 5.1 when you can do these things:
- Configure SSH-only VTY access with a local user and a source ACL.
- Explain each part of
aaa authentication login default group TACACS-SERVERS local. - Verify a login with
test aaa groupbefore you log out. - Explain when local fallback applies and when it does not.