Refer to the exhibit. An administrator configured a Cisco router for TACACS authentication, but the router is using the local enable password instead. Which action resolves the issue?
Refer to the exhibit. An administrator configured a Cisco router for TACACS authentication, but the router is using the local enable password instead. Which action resolves the issue?
The issue is that the AAA authentication method list defined as 'admin' is configured to use the TACACS+ group 'tacacs+', which does not exist in the configuration. Instead, the TACACS+ server group is named 'admin'. The correct command should be 'aaa authentication login admin group admin local enable', which properly links the method list 'admin' to the correct server group 'admin', allowing the router to use TACACS+ for authentication as intended.
Well, first of all the question seems to be wrong. We can see the admin method defined and the group is tacacs+ , tacacs server is defined as well as a tacacs server-group. By applying the aaa authentication login admin group tacacs+ local enable the device should use the defined tacacs server and succesfully communicate, so based on the config there is no issue, I've tested it in LAB. From the answers D is most logical, the others do not make sense, however the point is the question is wrong.
"A" is not reflecting the solution from here: https://community.cisco.com/t5/network-access-control/problem-setting-7606-router-for-tacacs-authentication/td-p/2316903 "A" adds " if-authenticated", which is used with authorization method lists, and not for authentication. "D" defines method list "admin" and uses it for "line vty" configuration, which is correct. Some examples: https://www.netprojnetworks.com/cisco-9800-tacacs-config-cli-and-verify-notes/
Correct answer is D the configuration in the exhibit is using a TACACS+ server group called tacacs+ that does not exist. The group is called admin!
D is correct: https://community.cisco.com/t5/network-access-control/if-authenticated/td-p/1248124
please review cisco website in jarz 's comment but I vote for D the tacacs+ group name is "admin", so it must be "group admin" not "group tacacs+" so B , C is out and if-authenticated command is use for aaa authorization so I choose D
I think it is D. The vty line is using the method "admin" and the method "admin" uses the TACACS+ group admin. In the original config, it used a wrong TACACS+ group name that is undefined. Then it doesn't have a local username or password I think. Therefore, causing authentication to refer to the enable password.
a little correction. It was using the TACACS+ group "local" and it is undefined. The "local" here is not for using the local credentials
D is correct
aaa authentication login default group admin local enable https://community.cisco.com/t5/network-access-control/problem-setting-7606-router-for-tacacs-authentication/td-p/2316903
aaa authentication login default group admin local enable So You mean answer is D?
OH , I see the comment below.. in the cisco community --- Please replace the below listed command aaa authentication login admin group tacacs+ local enable with; aaa authentication login default group admin local enable