Purpose
Command or Action
Configures the default authentication methods.
aaa authentication login default
{
group group-list
[
none
]
|
local
|
none
}
Step 2
The
group-list
argument consists of a space-delimited list
of group names. The group names are the following:
Example:
switch(config)#
aaa authentication login default
group radius
•
radius
—Uses the global pool of RADIUS servers for
authentication.
•
named-group
—Uses a named subset of RADIUS,
, or LDAP servers for authentication.
The
local
method uses the local database for authentication,
and the
none
method specifies that no AAA authentication
be used. The default login method is
local
, which is used
when no methods are configured or when all the configured
methods fail to respond, unless fallback to local is disabled
for the console login.
You can configure one of the following:
• AAA authentication groups
• AAA authentication groups with no authentication
• Local authentication
• No authentication
The
local
keyword is not supported (and is not
required) when configuring AAA authentication
groups because local authentication is the default
if remote servers are unreachable. For example,
if you configure
aaa authentication login
default group g1
, local authentication is tried if
you are unable to authenticate using AAA group
g1. In contrast, if you configure
aaa
authentication login default group g1 none
,
no authentication is performed if you are unable
to authenticate using AAA group g1.
Note
Exits configuration mode.
exit
Example:
Step 3
switch(config)#
exit
switch#
Displays the configuration of the default login authentication
methods.
(Optional)
show aaa authentication
Example:
Step 4
switch#
show aaa authentication
Copies the running configuration to the startup
configuration.
(Optional)
copy running-config startup-config
Example:
Step 5
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
18
Configuring AAA
Configuring Default Login Authentication Methods
