Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software

aaa authentication

Command History

Release

Modification

 

Release 2.0

This command was introduced on the Cisco CRS-1.

 

 

 

 

Release 3.0

No modification.

 

 

 

 

Release 3.2

This command was supported on the Cisco XR 12000 Series Router.

 

 

 

 

Release 3.3.0

The method-listargument was added to specify either group tacacs+, group

 

 

radius, group named-group,local, or line options.

 

 

 

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper

 

 

 

task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on

 

 

 

Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

 

 

 

Use the aaa authentication command to create a series of authentication methods, or method list. You

 

 

 

can specify up to four methods in the method list. A method list is a named list describing the

 

 

 

authentication methods to be used (such as TACACS+ or RADIUS) in sequence. The subsequent

 

 

 

methods of authentication are used only if the initial method is not available, not if it fails.

 

 

 

The default method list is applied for all interfaces for authentication, except when a different named

 

 

 

method list is explicitly specified—in which case the explicitly specified method list overrides the

 

 

 

default list.

 

 

 

For console and vty access, if no authentication is configured, a default of local method is applied.

 

 

 

 

Note

The group tacacs+, group radius, and group group-nameforms of this command refer to a set of

 

 

 

previously defined TACACS+ or RADIUS servers.

 

 

 

Use the tacacs-server host or radius-server host command to configure the host servers.

 

 

 

Use the aaa group server tacacs+ or aaa group server radius command to create a named subset

 

 

 

of servers.

 

 

 

The login keyword, remote keyword, local option, and group option are available only in

 

 

 

administration configuration mode.

 

 

 

 

Task ID

Examples

Task ID

Operations

aaa

read, write

 

 

The following example shows how to specify the default method list to be used for authentication, and also enable authentication for console:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa authentication login default group tacacs+

Related Commands

Command

Description

 

aaa accounting

Creates a method list for accounting.

 

 

 

 

aaa authorization

Creates a method list for authorization.

 

 

 

Cisco IOS XR System Security Command Reference

SR-7

Page 7
Image 7
Cisco Systems XR manual Radius, group named-group,local, or line options, Creates a method list for accounting, SR-7