Using server groups, you can specify a subset of the configured server hosts and use them for a particular service. For example, server groups allow you to define R1 and R2 as a server group, and define T1 and T2 as a separate server group. For example, you can specify R1 and T1 in the method list for authentication login, while specifying R2 and T2 in the method list for PPP authentication. Server groups also can include multiple host entries for the same server, as long as each entry has a unique identifier.
The combination of an IP address and a UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service--for example, authentication--the second host entry configured acts as failover backup to the first one.
Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries will be tried in the order in which they are configured.) For more information about configuring server groups and about configuring server groups based on Dialed Number Identification Service (DNIS) numbers, see the “Configuring RADIUS” or “Configuring TACACS+” chapters. Login Authentication Using AAA Login Authentication Using Enable Password Use the aaa authentication login command with the enable keyword to specify the enable password as the login authentication method.
For example, to specify the enable password as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default enable Before you can use the enable password as the login authentication method, you need to define the enable password. For more information about defining enable passwords, see chapter “Controlling Switch Access with Passwords and Privilege Levels.” Login Authentication Using Line Password Use the aaa authentication login default command with the line keyword to specify the line password as the login authentication method.
For example, to specify the line password as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication login default line Before you can use a line password as the login authentication method, you need to define a line password. Login Authentication Using Local Password Use the aaa authentication login default command with the local keyword to specify that the Cisco device will use the local username database for authentication. For example, to specify the local username database as the method of user authentication at login when no other method list has been defined, enter the following command:
Device(config)# aaa authentication login default local Configuring Authentication Login Authentication Using AAA Configuring Authentication 3