User's Manual

114
Users Manual of CS-6306R
(3) Login Authentication Using Local Password
Use the aaa authentication login command with the local method keyword to specify that the Cisco router or
access server will use the local username database for authentication. For example, to specify the local
username database as the method of user authentication at login when no other method list has been defined,
enter the following command:
aaa authentication login default local
For information about adding users into the local username database, refer to the section "Establishing
Username Authentication" in this chapter.
(4) Login Authentication Using Group RADIUS
Use the aaa authentication login command with the group radius method to specify RADIUS as the login
authentication method. For example, to specify RADIUS as the method of user authentication at login when
no other method list has been defined, enter the following command:
aaa authentication login default group radius
Before you can use RADIUS as the login authentication method, you need to enable communication with the
RADIUS security server. For more information about establishing communication with a RADIUS server, refer
to the chapter "Configuring RADIUS."
6.1.4.2 Enabling Password Protection at the Privileged Level
Use the aaa authentication enable default command to create a series of authentication methods that are
used to determine whether a user can access the privileged EXEC command level. You can specify up to four
authentication methods. The additional methods of authentication are used only if the previous method
returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an
error, specify none as the final method in the command line.
Use the following command in global configuration mode:
Command Purpose
aaa authentication enable
defaultmethod1 [method2...]
Enables user ID and password checking for users
requesting privileged EXEC level.
The method argument refers to the actual list of methods the authentication algorithm tries, in the sequence
entered.
The following table lists the supported enable authentication methods.
Keyword Description
enable Uses the enable password for authentication.
group
group-name
Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the
aaa group server radius or aaa group server tacacs+ command.
group radius Uses the list of all RADIUS hosts for authentication.
line Uses the line password for authentication.
none Uses no authentication.