Courseiva
DebugPrivileged EXEC

debug aaa authentication

Use this command to enable real-time debugging of AAA authentication events to troubleshoot login failures or misconfigurations.

Definition: debug aaa authentication is a Cisco IOS privileged exec command. Use this command to enable real-time debugging of AAA authentication events to troubleshoot login failures or misconfigurations.

Overview

The `debug aaa authentication` command is a powerful diagnostic tool used in Cisco IOS to monitor and troubleshoot AAA (Authentication, Authorization, and Accounting) authentication events in real time. AAA is a framework for controlling access to network devices, managing user authentication, authorizing specific actions, and logging user activities. Authentication is the first pillar of AAA, verifying the identity of users or devices before granting network access.

This command is essential when users are unable to log in, authentication fails unexpectedly, or when configuring new authentication methods like local, RADIUS, or TACACS+. It provides granular visibility into the authentication process, showing which method list is used, the exact steps taken, and where failures occur. Unlike `show` commands that provide static snapshots, `debug aaa authentication` offers dynamic, real-time output that can pinpoint transient issues.

However, it must be used with caution in production environments because debug output can overwhelm the console or syslog server, especially during high traffic. The command requires privileged EXEC mode (enable mode) and does not affect the running configuration; it only enables logging. To stop debugging, use the `undebug aaa authentication` or `no debug aaa authentication` command.

This command is typically used in conjunction with other debug commands like `debug radius authentication` or `debug tacacs authentication` to isolate protocol-specific issues. Understanding its output is crucial for CCNA and CCNP candidates, as AAA is a core security concept in enterprise networks. The command outputs lines prefixed with `AAA/AUTHEN/` followed by details such as the user, port, method list, and status.

For example, a successful authentication might show `AAA/AUTHEN/LOGIN: Login passed` while a failure might show `AAA/AUTHEN/LOGIN: Login failed (Invalid password)`. The debug output is buffered by default, meaning it may not appear immediately on the console; use `terminal monitor` to see it in real time if connected via Telnet or SSH. The command is available in all IOS versions, but the output format may vary slightly between 12.x, 15.x, and 16.x.

It is a critical tool for network engineers to quickly diagnose authentication problems, whether due to misconfigured servers, incorrect shared secrets, or wrong method lists. By mastering this debug command, engineers can reduce downtime and ensure secure access control.

Syntax·Privileged EXEC
debug aaa authentication

When to Use This Command

  • Diagnosing why a remote user cannot authenticate via RADIUS or TACACS+
  • Verifying the sequence of authentication methods (local, group, etc.) during login
  • Troubleshooting AAA server reachability or shared key mismatches
  • Monitoring authentication attempts during a security audit or change window

Command Examples

Basic AAA Authentication Debug Output

debug aaa authentication
AAA Authentication debugging is on
*Mar  1 00:05:23.123: AAA/BLINK(0): BLINK LOGIN: User=admin
*Mar  1 00:05:23.123: AAA/BLINK(0): BLINK LOGIN: authen_type=1 (ASCII)
*Mar  1 00:05:23.123: AAA/BLINK(0): BLINK LOGIN: source=10.0.0.1
*Mar  1 00:05:23.123: AAA/BLINK(0): BLINK LOGIN: service=1 (LOGIN)
*Mar  1 00:05:23.123: AAA/BLINK(0): BLINK LOGIN: priv=1
*Mar  1 00:05:23.123: AAA: parse name=tty0 idb type=-1 tty=-1
*Mar  1 00:05:23.123: AAA: name=tty0 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=0 channel=0
*Mar  1 00:05:23.123: AAA/MEMORY: create_user (0x123456) user='admin' rcmd='0' acct=0x0
*Mar  1 00:05:23.123: AAA: user authentication methods: local
*Mar  1 00:05:23.123: AAA: authen(1): status = GETPASS
*Mar  1 00:05:23.123: AAA: authen(1): status = PASS
*Mar  1 00:05:23.123: AAA: authen(1): status = PASS

Line 1: Debug enabled. Lines 2-6: BLINK LOGIN shows user 'admin' authenticating from source IP 10.0.0.1 with ASCII password. Lines 7-8: AAA parses the tty line. Line 9: AAA creates a user context. Line 10: Authentication method is 'local'. Lines 11-13: Status transitions from GETPASS (waiting for password) to PASS (success).

Debug with RADIUS Authentication Failure

debug aaa authentication
AAA Authentication debugging is on
*Mar  1 00:10:45.456: AAA/BLINK(0): BLINK LOGIN: User=jdoe
*Mar  1 00:10:45.456: AAA/BLINK(0): BLINK LOGIN: authen_type=1 (ASCII)
*Mar  1 00:10:45.456: AAA/BLINK(0): BLINK LOGIN: source=192.168.1.100
*Mar  1 00:10:45.456: AAA/BLINK(0): BLINK LOGIN: service=1 (LOGIN)
*Mar  1 00:10:45.456: AAA/BLINK(0): BLINK LOGIN: priv=1
*Mar  1 00:10:45.456: AAA: parse name=tty1 idb type=-1 tty=-1
*Mar  1 00:10:45.456: AAA: name=tty1 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=0 channel=0
*Mar  1 00:10:45.456: AAA/MEMORY: create_user (0x789012) user='jdoe' rcmd='0' acct=0x0
*Mar  1 00:10:45.456: AAA: user authentication methods: group radius local
*Mar  1 00:10:45.456: AAA: authen(1): status = GETPASS
*Mar  1 00:10:45.456: AAA: authen(1): status = GETPASS
*Mar  1 00:10:45.456: AAA: authen(1): status = FAIL
*Mar  1 00:10:45.456: AAA: authen(1): status = GETPASS
*Mar  1 00:10:45.456: AAA: authen(1): status = PASS

Line 10: Methods are 'group radius local' (RADIUS first, then local). Lines 11-13: After GETPASS, status becomes FAIL (RADIUS rejected or unreachable). Lines 14-15: AAA falls back to local method, GETPASS then PASS (local authentication succeeded).

Understanding the Output

The debug output shows each step of AAA authentication. 'BLINK LOGIN' lines indicate a login attempt with user, authentication type (1=ASCII, 2=CHAP, etc.), source IP, service (1=LOGIN, 2=PPP, etc.), and privilege level. 'AAA: parse name' identifies the line.

'AAA/MEMORY: create_user' creates a user context. 'AAA: user authentication methods' lists the configured methods in order (e.g., 'group radius local'). Status values: GETPASS (waiting for password), PASS (success), FAIL (failure).

Multiple GETPASS/FAIL sequences indicate fallback to next method. A successful authentication ends with PASS. Watch for FAIL statuses to identify authentication failures; if all methods fail, the user is denied access.

Configuration Scenarios

Troubleshooting RADIUS Authentication Failure for Remote Access

A remote user is unable to authenticate via SSH to a router configured with RADIUS authentication. The goal is to identify whether the failure is due to a wrong username/password, RADIUS server unreachability, or a shared secret mismatch.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)RADIUS_Server(192.168.1.100)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: Enable AAA authentication debugging: Router# debug aaa authentication
  3. 3.Step 3: Enable terminal monitor to see debug output on your session: Router# terminal monitor
  4. 4.Step 4: Reproduce the authentication failure by attempting to SSH to the router from a remote host.
  5. 5.Step 5: Observe the debug output. Look for lines like 'AAA/AUTHEN/LOGIN: Login failed' or 'AAA/AUTHEN/LOGIN: User not found'.
  6. 6.Step 6: If the RADIUS server is not responding, you may see 'AAA/AUTHEN/LOGIN: Could not contact RADIUS server'.
  7. 7.Step 7: Disable debugging after capturing the output: Router# undebug aaa authentication
Configuration
! AAA configuration on R1
Router(config)# aaa new-model
Router(config)# aaa authentication login default group radius local
Router(config)# radius server RADIUS
Router(config-radius-server)# address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
Router(config-radius-server)# key cisco123
Router(config)# line vty 0 4
Router(config-line)# login authentication default

Verify: Use 'show aaa servers' to verify RADIUS server status. Expected output shows the server as 'UP' and counters incrementing. Also use 'test aaa group radius user1 password1 new-code' to simulate authentication.

Watch out: A common mistake is forgetting to enable 'terminal monitor' when connected via SSH or Telnet; without it, debug output is not displayed on the remote session.

Verifying Local Authentication Fallback When TACACS+ Server Is Unreachable

A router is configured to authenticate users via TACACS+ first, then fall back to local authentication if the server is unreachable. An engineer needs to confirm that the fallback works correctly during a server outage.

Topology

R2(Gi0/0)---10.10.10.0/30---(Gi0/0)TACACS_Server(10.10.10.2)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: Enable AAA authentication debugging: Router# debug aaa authentication
  3. 3.Step 3: Enable terminal monitor: Router# terminal monitor
  4. 4.Step 4: Simulate a TACACS+ server failure by disconnecting the server or blocking its IP.
  5. 5.Step 5: Attempt to log in via console or SSH using a local username.
  6. 6.Step 6: Observe debug output. You should see 'AAA/AUTHEN/LOGIN: Method list default: TACACS+ failed' followed by 'AAA/AUTHEN/LOGIN: Method list default: local' and then 'Login passed'.
  7. 7.Step 7: Disable debugging: Router# undebug aaa authentication
Configuration
! AAA configuration on R2
Router(config)# aaa new-model
Router(config)# aaa authentication login default group tacacs+ local
Router(config)# tacacs server TACACS
Router(config-server-tacacs)# address ipv4 10.10.10.2
Router(config-server-tacacs)# key cisco123
Router(config)# username admin secret cisco
Router(config)# line console 0
Router(config-line)# login authentication default

Verify: Use 'show aaa method-list authentication' to see the order of methods. Expected output: 'Method list: default, group tacacs+, local'. Also use 'show tacacs' to verify server status.

Watch out: If the TACACS+ server is reachable but rejects the authentication (e.g., wrong password), the fallback to local may not occur unless the method list includes 'local' after 'group tacacs+'. Ensure the order is correct.

Troubleshooting with This Command

When troubleshooting AAA authentication issues, the `debug aaa authentication` command is your first line of defense. Healthy output typically shows a sequence of events: the router attempts the first method in the list, receives a response, and either passes or fails authentication. For example, a successful local authentication might show: `AAA/AUTHEN/LOGIN: Login passed for user admin on line vty0`.

Problem indicators include repeated 'Login failed' messages, 'User not found', 'Could not contact server', or 'Method list not found'. Focus on the method list name and the order of methods attempted. If you see 'Method list default: group radius' but no further output, the router may be waiting for a RADIUS response that never arrives—check connectivity and shared secrets.

Common symptoms: (1) All users fail authentication: likely a misconfigured method list or server unreachable. (2) Only some users fail: check user credentials or server-side configuration. (3) Intermittent failures: network congestion or server overload. A step-by-step diagnostic flow: 1. Enable `debug aaa authentication` and `terminal monitor`. 2.

Reproduce the failure. 3. Identify which method is being used. 4. If using a server, enable `debug radius authentication` or `debug tacacs authentication` to see protocol-level details. 5.

Check the server logs. 6. Verify the shared secret and server IP. 7. Use `test aaa` command to simulate authentication.

Correlate with `show aaa servers` to see server status and counters. For example, if the RADIUS server shows 'Auth fails' incrementing, the shared secret may be wrong. If 'Timeouts' increment, check network path.

Remember that debug output is CPU-intensive; always disable debugging after troubleshooting. In production, consider using `logging buffered` to capture debug output to a buffer instead of the console, then review it later with `show log`.

CCNA Exam Tips

1.

Remember that 'debug aaa authentication' can generate a lot of output; always use 'undebug all' or 'no debug aaa authentication' to disable it.

2.

The exam may ask you to interpret debug output to determine which authentication method succeeded or failed.

3.

Know that 'debug aaa authentication' does not show authorization or accounting details; use 'debug aaa authorization' and 'debug aaa accounting' for those.

4.

Be aware that AAA debug commands are CPU-intensive and should only be used in a lab or during specific troubleshooting windows.

Common Mistakes

Leaving debug enabled after troubleshooting, which can cause high CPU usage and log flooding.

Confusing 'debug aaa authentication' with 'debug aaa authorization' — they show different phases.

Not using 'terminal monitor' when debugging over a remote session (SSH/Telnet), so output is not seen.

debug aaa authentication vs show aaa servers

Both debug aaa authentication and show aaa servers are used for AAA troubleshooting, but they serve different purposes: the former provides real-time event tracing for authentication failures, while the latter offers historical statistics on AAA server performance. They are often used together when diagnosing complex AAA issues.

Aspectdebug aaa authenticationshow aaa servers
ScopeAll AAA authentication events on the deviceStatistics for configured AAA servers only
Data SourceReal-time events from the AAA processCached counters and statistics
Impact on DeviceHigh CPU usage; may cause instabilityLow impact; safe for production
Output TypeContinuous stream of log messagesStatic table snapshot
Typical UseLive troubleshooting of authentication failuresPeriodic health checks of server performance

Use debug aaa authentication when you need to see the exact authentication steps and error messages in real-time for a specific failed login attempt.

Use show aaa servers when you need to check the overall health and statistics of AAA servers without impacting device performance.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the `debug aaa authentication` command syntax and output are largely identical to classic IOS. However, IOS-XE may introduce additional parameters like `debug aaa authentication verbose` for more detailed output. On NX-OS (e.g., Nexus switches), the equivalent command is `debug aaa authentication` as well, but the output format differs; it uses a more structured format with timestamps and severity levels.

For ASA firewalls, the command is `debug aaa authentication` but it is used in the context of VPN and management access; the output includes additional fields like tunnel-group. In IOS-XR (e.g., ASR 9000), AAA debugging is done via `debug aaa authentication` but the command is part of the 'debug' mode and may require 'debug aaa all' for comprehensive output. Between IOS versions, the output format has remained consistent, but newer versions (15.x and 16.x) may include additional details like the authentication method (e.g., 'local', 'radius', 'tacacs+') and the specific server IP.

Always check the specific platform documentation, as some features like 'method list' names may be truncated in older versions. For CCNA/CCNP studies, focus on the classic IOS syntax, as it is the most common in exam scenarios.

Related Commands

show aaa servers

Displays statistics for all AAA servers (RADIUS and TACACS+) configured on the device including server status, request/response counts, authentication success and failure rates, and round-trip times.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions