Courseiva
AAAGlobal Config

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

Definition: aaa authentication login default group radius local is a Cisco IOS global config command. Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

Overview

The `aaa authentication login default group radius local` command is a global configuration command on Cisco IOS devices that defines the authentication method list for login access. It instructs the router or switch to first attempt authentication using a RADIUS server group; if the RADIUS server is unreachable (e.g., due to network failure or server downtime), the device falls back to local authentication using the local username database. This command is critical for centralized authentication management in enterprise networks, ensuring consistent access control while providing a failover mechanism to prevent lockouts.

It is part of the broader AAA (Authentication, Authorization, and Accounting) framework, which is essential for security, compliance, and auditing. Network engineers reach for this command when deploying RADIUS-based authentication for administrative access (console, SSH, HTTP) or user access (e.g., VPN, wireless). Alternatives include using TACACS+ (via `aaa authentication login default group tacacs+ local`) or local-only authentication (`aaa authentication login default local`).

The command fits into the configuration workflow after defining a RADIUS server group with `radius server` and `aaa new-model`. Important IOS behaviors: the command takes effect immediately; it does not require a reload; it is stored in the running configuration; privilege level 15 (enable) is required to configure it. The `default` keyword applies the method list to all login interfaces unless overridden by a named list.

If no RADIUS server is reachable and no local user exists, authentication fails. The command does not affect authorization or accounting, which are configured separately.

Syntax·Global Config
aaa authentication login default group radius local

When to Use This Command

  • Centralized authentication of remote administrators via a RADIUS server with local backup
  • Enforcing TACACS+ or RADIUS authentication for console and VTY lines in a secure enterprise network
  • Providing fallback authentication when the RADIUS server is down to prevent lockout
  • Integrating with Cisco ISE or FreeRADIUS for multi-factor authentication

Parameters

ParameterSyntaxDescription
defaultdefaultSpecifies that this authentication method list is the default list applied to all login interfaces (console, vty, aux, tty) unless a named list is explicitly applied. Using 'default' simplifies configuration but may not be suitable if different authentication methods are needed for different access types.
group radiusgroup radiusSpecifies that the RADIUS server group (as defined by 'radius server' commands) should be used as the primary authentication method. The device sends authentication requests to all configured RADIUS servers in the group. If no RADIUS server responds (e.g., timeout or unreachable), the next method in the list is tried.
locallocalSpecifies that the local username database (configured with 'username' commands) should be used as the fallback authentication method. This method is attempted only if the RADIUS server group is unreachable. It does not require a server; authentication is performed locally on the device.

Command Examples

Basic RADIUS authentication with local fallback

aaa authentication login default group radius local
Router(config)# aaa authentication login default group radius local
Router(config)#

No output is displayed upon successful configuration. The command sets the default login authentication list to first try RADIUS servers defined under 'radius server' or 'aaa group server radius', then fall back to local usernames if RADIUS is unavailable.

Verifying AAA authentication configuration

show running-config | include aaa authentication login
aaa authentication login default group radius local

The output confirms the command is present in the running configuration. The 'default' keyword applies this authentication method to all lines (console, VTY, AUX) unless overridden by a named list.

Understanding the Output

This command does not produce direct output; it modifies the running configuration. To verify, use 'show running-config | section aaa' or 'show aaa sessions'. The key fields in the configuration line are: 'aaa authentication login' (command), 'default' (applies to all lines), 'group radius' (use RADIUS servers), 'local' (fallback to local database).

If RADIUS servers are not reachable, the router will prompt for local credentials. A common verification is to test login from a VTY line and observe debug output with 'debug aaa authentication'.

Configuration Scenarios

Configure RADIUS Authentication with Local Fallback for SSH Access

A network administrator wants to centralize authentication for SSH access to routers and switches using a RADIUS server, but needs a fallback to local credentials in case the RADIUS server is down. This ensures administrators can always access the devices.

Topology

RADIUS Server (192.168.1.100) --- Management Network --- R1(Gi0/0)---(Gi0/0)R2

Steps

  1. 1.Step 1: Enable AAA new model: R1(config)# aaa new-model
  2. 2.Step 2: Configure RADIUS server: R1(config)# radius server RADIUS-SERVER, R1(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813, R1(config-radius-server)# key MySecretKey
  3. 3.Step 3: Create a local user for fallback: R1(config)# username admin privilege 15 secret LocalPass123
  4. 4.Step 4: Configure default login authentication: R1(config)# aaa authentication login default group radius local
  5. 5.Step 5: Apply authentication to VTY lines: R1(config)# line vty 0 4, R1(config-line)# login authentication default
  6. 6.Step 6: Enable SSH: R1(config)# ip domain-name example.com, R1(config)# crypto key generate rsa modulus 2048, R1(config)# line vty 0 4, R1(config-line)# transport input ssh
Configuration
! Enable AAA
R1(config)# aaa new-model
! Configure RADIUS server
R1(config)# radius server RADIUS-SERVER
R1(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
R1(config-radius-server)# key MySecretKey
! Create local user
R1(config)# username admin privilege 15 secret LocalPass123
! Default login authentication
R1(config)# aaa authentication login default group radius local
! Apply to VTY lines
R1(config)# line vty 0 4
R1(config-line)# login authentication default
R1(config-line)# transport input ssh

Verify: Use 'show running-config | section aaa' to verify the command is present. Test SSH from a client: if RADIUS server is reachable, authenticate with RADIUS credentials; if unreachable, authenticate with local username 'admin' and password 'LocalPass123'. Use 'debug aaa authentication' to see which method is used.

Watch out: If the RADIUS server is reachable but rejects the credentials (e.g., wrong password), the fallback to local does NOT occur. The fallback only happens if the server is unreachable (no response). Ensure local users have the correct privilege level to avoid being locked out.

Configure RADIUS Authentication for Console Access with Local Fallback

An organization requires console port access to be authenticated via RADIUS for auditing, but wants local fallback in case the management network is down. This ensures out-of-band access remains available.

Topology

RADIUS Server (10.0.0.5) --- Management Switch --- R1(Con0)

Steps

  1. 1.Step 1: Enable AAA new-model: R1(config)# aaa new-model
  2. 2.Step 2: Configure RADIUS server group: R1(config)# radius server MGMT-RADIUS, R1(config-radius-server)# address ipv4 10.0.0.5 auth-port 1812 acct-port 1813, R1(config-radius-server)# key SecureKey456
  3. 3.Step 3: Create local fallback user: R1(config)# username consoleop privilege 15 secret ConsoleFallback
  4. 4.Step 4: Configure default login authentication: R1(config)# aaa authentication login default group radius local
  5. 5.Step 5: Apply authentication to console line: R1(config)# line con 0, R1(config-line)# login authentication default
Configuration
! Enable AAA
R1(config)# aaa new-model
! Configure RADIUS server
R1(config)# radius server MGMT-RADIUS
R1(config-radius-server)# address ipv4 10.0.0.5 auth-port 1812 acct-port 1813
R1(config-radius-server)# key SecureKey456
! Create local user
R1(config)# username consoleop privilege 15 secret ConsoleFallback
! Default login authentication
R1(config)# aaa authentication login default group radius local
! Apply to console line
R1(config)# line con 0
R1(config-line)# login authentication default

Verify: Connect via console and attempt login. If RADIUS server is reachable, use RADIUS credentials; if not, use 'consoleop' with password 'ConsoleFallback'. Use 'show aaa sessions' to see active authenticated sessions.

Watch out: The console line typically has no timeout by default; if the RADIUS server is slow to respond, the login may appear to hang. Consider configuring 'exec-timeout' on the console line to avoid indefinite waits.

Troubleshooting with This Command

When troubleshooting AAA authentication with the `aaa authentication login default group radius local` command, the primary goal is to determine whether authentication is succeeding via RADIUS or falling back to local, and why. Healthy output from `show aaa sessions` shows active sessions with the method used (e.g., 'radius' or 'local'). Problem indicators include repeated fallback to local (suggesting RADIUS unreachability), authentication failures even with correct credentials, or complete lockout.

Key fields to focus on in `debug aaa authentication` are the method list name, server responses (Access-Accept vs Access-Reject), and timeout messages. Common symptoms: if RADIUS is unreachable, you'll see 'RADIUS: no response from server' in debugs; if RADIUS rejects credentials, you'll see 'Access-Reject' and no fallback occurs. A step-by-step diagnostic flow: 1) Verify AAA is enabled with `show running-config | include aaa new-model`. 2) Check the method list with `show running-config | section aaa authentication`. 3) Test RADIUS connectivity using `test aaa group radius username password` or `radius-server host 192.168.1.100 test username test password test`. 4) If RADIUS fails, check server IP, shared secret, and network reachability (ping). 5) Verify local user database with `show running-config | include username`. 6) Use `debug radius authentication` and `debug aaa authentication` to see real-time exchanges.

Correlate with `show ip interface brief` to ensure management interface is up. If fallback is not working as expected, ensure the 'local' keyword is present and that the local user has the correct privilege level (e.g., privilege 15 for enable access). Also check that the method list is applied to the correct lines (console, vty) with `show line` and `show running-config | section line`.

For SSH issues, verify SSH configuration and that the VTY lines permit SSH. Remember that fallback only occurs if the RADIUS server is unreachable (no response), not if it rejects credentials. If you need fallback on rejection, consider using `aaa authentication login default local group radius` (local first) or a different method list.

CCNA Exam Tips

1.

CCNA exam tip: The order of methods matters — 'group radius local' tries RADIUS first, then local. Reversing them would check local first.

2.

CCNA exam tip: 'default' applies to all lines unless a named list is applied to a specific line with 'login authentication <name>'.

3.

CCNA exam tip: If RADIUS servers are not configured, the command will still accept but authentication will fail and fall back to local.

4.

CCNA exam tip: For CCNA, remember that 'local' uses usernames configured with 'username' command, while 'enable' uses the enable password.

Common Mistakes

Mistake 1: Forgetting to configure RADIUS server details (e.g., 'radius server' or 'aaa group server radius') — the command will fall back to local but not use RADIUS.

Mistake 2: Using 'local' before 'group radius' — this causes local authentication to be attempted first, defeating the purpose of centralized authentication.

Mistake 3: Not applying the authentication list to VTY lines — if a named list is used instead of 'default', it must be explicitly applied with 'login authentication <name>' under line configuration.

aaa authentication login default group radius local vs aaa new-model

These two commands are commonly confused because they both belong to the AAA configuration set, but serve fundamentally different roles. 'aaa new-model' is a prerequisite that enables the entire AAA framework, while 'aaa authentication login default group radius local' is a specific authentication method rule that relies on AAA being active.

Aspectaaa authentication login default group radius localaaa new-model
ScopeGlobal AAA authentication method for loginGlobal enablement of AAA subsystem
Configuration modeGlobal configurationGlobal configuration
PersistenceSaved in running-config, requires aaa new-modelSaved in running-config, enables all AAA
PrecedenceMust follow aaa new-modelMust be configured first before any AAA commands
Typical useDefine RADIUS with local fallback for console/VTY loginInitial step to start using AAA features
DependenciesDepends on aaa new-model and RADIUS server configNo dependencies; enables others

Use aaa authentication login default group radius local when you want to authenticate user logins primarily via a RADIUS server group, with a local database fallback if the server is unreachable.

Use aaa new-model when you need to enable AAA security services on the device, which is required before any other AAA configuration (e.g., authentication, authorization, accounting).

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 routers), the command syntax is identical to classic IOS. However, IOS-XE uses a modular configuration model; the `radius server` command may require a FQDN or IP address, and the shared key is configured under the server configuration mode. The output of `show aaa sessions` may include additional fields like 'Method' and 'Server group'.

For NX-OS (e.g., Nexus switches), the equivalent command is `aaa authentication login default group radius local` but note that NX-OS uses `radius-server host` instead of `radius server` and the key is configured under the host. NX-OS also requires `feature aaa` to enable AAA. On ASA firewalls, the command is `aaa authentication ssh console RADIUS LOCAL` (or for other services), where the method list is defined differently.

There is no direct equivalent in IOS-XR; XR uses a different AAA configuration model with `aaa authentication login` but the syntax varies (e.g., `aaa authentication login default group radius local` may not be supported; instead, use `aaa authentication login default local` and configure RADIUS via server groups). In older IOS versions (12.x), the `radius-server` command was used instead of `radius server`; the new syntax was introduced in 15.x. The behavior of fallback is consistent across versions, but debugging output may differ slightly.

Always check the specific platform documentation for exact syntax and capabilities.

Related Commands

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions