aaa new-model...

we know that one must globally enable aaa in order to support tacacs or radius authentication...

but before implementing tacacs, you setup ssh on the device for use with the local database...

username x password x
and
transport input ssh
login local

once aaa is enabled, login local goes away, and will force authentication to the tacacs box...  fair enough... if you look at the vty config you'll notice login local disappears...

but arteq, you protest, what will we do if the tacacs server goes down; how will we get to the device...

when aaa is not available, login local will magically reappear, and allow authentication with the user database that you know you set up prior to implementing aaa...

be a backdoor man...

aaa...

triple A

not the towing service

authentication- identification method, includes login, password, challenge and response, message support, and perhaps encryption

authorization- remote access control methodology, authorization per instance and/or authorization per service, per account, per profile and user group and protocol support (ip, telnet, etc)

accounting- the method of charging and collecting (funny money)

configuration

dls1(config)#aaa new-model

for tacacs and radius support

terminal access controller access control system (why, why, why)
remote authentication dial-in user service




    uh-huh


then... set up login parameters, point to the server, set up a server key and...

watch your mind melt as you read this:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080093c81.shtml