Hello Giovanni
It all has to do with the behavior of the device with and without the aaa new-model
command.
Without aaa new-model
, the VTY will behave as follows:
The login
command is used to instruct the VTY to ask for credentials when an attempt to login is made. If the command is simply login
then it uses the password configured with the password
command under the VTY configuration. If the command is login local
then it asks for a username and password based on the local user database regardless of whether or not the password
was used. Note if login
is used and no password is set, it will still prompt for a password, but access will never be granted.
The following configuration will ask for a password whenever connectivity via Telnet is attempted using the password cisco
.
line vty 0 4
password cisco
login
transport input all
The following configuration will give Telnet access immediately without asking for any credentials, even though a password is configured.
line vty 0 4
password cisco
transport input all
The following configuration will ask for a username and password whenever connectivity via Telnet is attempted. The password cisco
is completely ignored, and the local database is used for authentication, using username and password.
line vty 0 4
password cisco
login local
transport input all
With aaa new-model
enabled, the VTY will behave as follows:
The VTY will always use the local database as the authentication source by default. The password configured within the VTY configuration is ignored. The login
and login local
commands are disabled and replaced with a login authentication
command which specifies an authentication list (a list of acceptable sources for credentials).
So to answer your question, when you enable aaa new-model
, the VTY will always use the local database as the source of credentials, thus it will use the username and password created using the username
command in global configuration mode.
Note that Telnet can be configured to not require a password, but the aaa new-model
mode of configuration does not allow this.
I hope this has been helpful!
Laz