login on-failure

Overview

The `login on-failure log` command is a security feature in Cisco IOS that enables logging of failed login attempts to the syslog server. When configured globally, this command instructs the router or switch to generate a syslog message each time a login attempt fails, regardless of the method (console, VTY, AUX, or HTTP/HTTPS). This is critical for security monitoring and auditing because it provides visibility into potential brute-force attacks, unauthorized access attempts, or misconfigured credentials.

The underlying concept is that authentication failures are a key indicator of security threats; by logging them, network administrators can detect patterns, trigger alerts, and investigate incidents. This command is typically used in conjunction with AAA (Authentication, Authorization, and Accounting) services, but it also works with local authentication. It is often paired with `login on-success log` to log successful logins as well, providing a complete audit trail.

Compared to alternatives like `debug aaa authentication` or `debug login`, the `login on-failure log` command is less intrusive and more suitable for production environments because it generates syslog messages rather than verbose debug output that can impact router performance. It fits into the broader security configuration workflow after setting up authentication methods (e.g., local username/password or AAA server) and before enabling logging to a syslog server. Important IOS behavior: The command is available in global configuration mode and requires privilege level 15 to configure.

It does not affect the running configuration in terms of performance; the logging overhead is minimal. The syslog messages are sent to the configured logging hosts (e.g., via `logging host`). The default severity level for these messages is 5 (notification), but this can be adjusted with `logging console` or `logging monitor` commands.

The command is supported in IOS 12.0 and later, including IOS-XE, but not in NX-OS or IOS-XR (which have equivalent but different commands). It is important to note that this command only logs failures; it does not lock accounts or trigger any other action. For account lockout, additional commands like `login block-for` or AAA rate-limiting are needed.

The command is persistent across reloads once saved to startup configuration. A common mistake is forgetting to configure a syslog server; without it, the logs are only visible in the router's buffer (via `show logging`), which may not be sufficient for long-term auditing. Another mistake is assuming the command logs all failures, including those from HTTP/HTTPS; it does, but only if HTTP/HTTPS authentication is configured.

The command is part of the 'security' category and is often required for compliance with standards like PCI-DSS or HIPAA that mandate logging of authentication failures.