So we've created another user on the server and we verified that to the user can log in.
We need to verify now that the local backup user cannot log in when the server is reachable.
So when router 1 pings to the switch as an example, we can't log in using the backup user, but we
can log in using AAA user accounts.
So that works but
then we need to verify what happens when we disable the port on the switch.
So at the moment we have IP connectivity from the devices to the AAA server so router 2 can ping the AAA
server, which means that when router 1 telnet to router 2, we have to log in using a user name
on the AAA server.
We can't log in
with a local user account, so the backup user doesn't work here.
So try that again.
I can log in as David
but notice I cannot log in as the backup user, but I can log in as Peter Pan.
So what happens if we disable the connection on the switch?
So interface gigabit 102, I'll shut that port down, so this port is now disabled.
How does that affect connections to the router?
So I'll Log-in is David, password is Cisco.
Notice it's taking a long time.
We have to wait for this to time out, but at the moment, I can't log in as David, notice invalid log
in.
I'll try and log in as the backup user.
You again may need to wait quite a while for the connections to fail and then revert back to using a
local username and password.
But notice, after a long time, I was able to log in as the backup user, when I type enable there's
a long delay because the router is trying to connect to the AAA server.
Remember, we enabled AAA for both login
and enable.
Use my backup user account, password of Cisco may take a while, but again, I should be able to log in
using
my local username and password. I'm going to speed up the video, but this is taking a long time
but notice eventually I can log into router 2
but if we go back to the switch
and re-enable that port, we need to wait for spanning tree to converge, but once that's done, the
backup local user account will no longer work, but the AAA accounts should start working, so I should be
able to log back in as David or Peter Pan.
So there you go.
So Log-in is David, password is Cisco, I can log straight into the router login as Peter, I can
log in.
So that proves that
the backup account is only used when AAA is not available.
We can do that test again, notice if I log in as backup it fails, I've got a login as a AAA user
to succeed when the connection is up.
But when the connection is down between the devices and the AAA server, the local user account is used.
So we've now completed the verification.
Let's run a simulation.