Note By default, guest logins through ARAP are disabled when you initialize AAA. To allow guest logins, you must use the aaa authentication arap { authentication-list | default command with either the guest or the auth-guest keyword. ARAP Authentication Allowing Guest Logins Use the aaa authentication arap { default | authentication-list } command with the guest keyword to allow guest logins. This method must be the first listed in the ARAP authentication method list but it can be followed by other methods if it does not succeed. For example, to allow all guest logins as the default method of authentication, using RADIUS only if that method fails, enter the following command:
Device(config)# aaa authentication arap default guest group radius ARAP Authentication Using Line Password Use the aaa authentication arap { default | authentication-list }command with the line keyword to specify the line password as the authentication method. For example, to specify the line password as the method of ARAP user authentication when no other method list has been defined, enter the following command: Device(config)# aaa authentication arap default line Before you can use a line password as the ARAP authentication method, you need to define a line password.
ARAP Authentication Using Local Password Use the aaa authentication arap { default | authentication-list }command with the local keyword to specify that the Cisco device will use the local username database for authentication. For example, to specify the local username database as the method of ARAP user authentication when no other method list has been defined, enter the following command: Device(config)# aaa authentication arap default local ARAP Authentication Using Group RADIUS Use the aaa authentication arap { default | authentication-list }command with the group radius method to specify RADIUS as the ARAP authentication method.
For example, to specify RADIUS as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication arap default group radius Before you can use RADIUS as the ARAP authentication method, you need to enable communication with the RADIUS security server. For more information about establishing communication with a RADIUS server, refer to the chapter “Configuring RADIUS.” ARAP Authentication Using Group TACACS Use the aaa authentication arap { default | authentication-list } command with the group tacacs+ method to specify TACACS+ as the ARAP authentication method.
For example, to specify TACACS+ as the method of user authentication at login when no other method list has been defined, enter the following command: Device(config)# aaa authentication arap default group tacacs+ Configuring Authentication ARAP Authentication Allowing Guest Logins Configuring Authentication 7