show aaa servers
Verify AAA server connectivity and diagnose authentication failures by checking request statistics and server reachability.
Definition: show aaa servers is a Cisco IOS privileged exec command. Displays statistics for all AAA servers (RADIUS and TACACS+) configured on the device including server status, request/response counts, authentication success and failure rates, and round-trip times.
Overview
The 'show aaa servers' command is a critical diagnostic tool for any network engineer managing authentication, authorization, and accounting (AAA) services on Cisco IOS devices. AAA is the framework that controls who can access the network (authentication), what they can do (authorization), and what they did (accounting). This command displays the operational status, statistics, and configuration details of all AAA servers configured on the device, including RADIUS and TACACS+ servers.
It is used to verify server reachability, monitor authentication activity, and troubleshoot AAA-related issues such as failed logins or service disruptions. When a user reports being unable to authenticate, or when you suspect a server is down, this command is your first stop. Unlike 'debug aaa authentication' or 'debug radius', which are intrusive and resource-intensive, 'show aaa servers' provides a non-disruptive snapshot of server health and transaction counts.
It fits into the broader workflow of AAA configuration and troubleshooting: after configuring AAA servers with 'radius-server host' or 'tacacs-server host', you use this command to confirm the servers are alive and responding. During troubleshooting, you correlate its output with logs from 'show logging' or 'debug aaa' to pinpoint failures. Important IOS behaviors: the command requires privileged EXEC mode (enable) and does not affect the running configuration.
Output is buffered and may show stale data if the device has been running for a long time without AAA activity; clearing counters with 'clear aaa counters' can refresh the statistics. The command also shows the number of pending requests, which can indicate network congestion or server overload. Understanding the output fields—such as 'RADIUS: id', 'server address', 'status', 'round trip time', 'number of pending requests', and 'authentication success/failure counts'—is essential for effective troubleshooting.
This command is available in most IOS versions, including 12.x, 15.x, and 16.x, with minor output format variations. It is a cornerstone for CCNA and CCNP candidates to master, as AAA is a core topic in the security and infrastructure services domains.
show aaa servers [detailed] [server-id <id>]When to Use This Command
- Confirm the RADIUS or TACACS+ server is responding to authentication requests
- Diagnose why users cannot log in — check if the server is marked dead or unreachable
- Monitor authentication request rates and failure counts over time
- Verify the correct server IP and port are being used
Command Examples
Show AAA server statistics
Router# show aaa servers
RADIUS: id 1, priority 1, host 10.0.0.100, auth-port 1812, acct-port 1813
State: current UP, duration 3600s, previous duration 0s
Dead: total time 0s, count 0
Authen: request 452, timeouts 2, failover 0, retransmissions 2
Response: accept 448, reject 2, error 0, server error 0
Transaction: success 448, failure 4Understanding the Output
State: UP = server responding. Dead: count > 0 means the server was marked unreachable. Authen request = total authentication attempts sent. timeouts = requests with no response (indicates network issue or wrong port). accept = successful authentications. reject = valid response but credentials rejected.
Transaction failure = authentication denied for any reason.
Configuration Scenarios
Verify RADIUS Server Reachability After Configuration
After configuring a RADIUS server for network access authentication, you need to confirm the server is reachable and responding to authentication requests.
Topology
R1(Gi0/0)---192.168.1.0/24---(eth0)RADIUS-Server(10.0.0.1)Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: View AAA server status: Router# show aaa servers
- 3.Step 3: Locate the RADIUS server entry with address 10.0.0.1
- 4.Step 4: Check the 'status' field; it should show 'alive' or 'up'
- 5.Step 5: Verify 'round trip time' is low (e.g., < 10 ms) and 'number of pending requests' is zero
! RADIUS server configuration Router(config)# radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 key Cisco123 Router(config)# aaa new-model Router(config)# aaa authentication login default group radius local
Verify: Router# show aaa servers RADIUS: id 1, priority 1, host 10.0.0.1, auth-port 1812, acct-port 1813 State: current UP, duration 3600s, previous duration 0s Dead: total 0, retries 0, time 0s Authen: request 10, timeouts 0, success 10, failure 0 Author: request 0, timeouts 0, success 0, failure 0 Account: request 0, timeouts 0, success 0, failure 0 Round trip time: 5 ms
Watch out: If the server shows 'DEAD' or 'unknown', check that the shared secret key matches on both the router and the RADIUS server, and that UDP ports 1812/1813 are not blocked by a firewall.
Troubleshoot TACACS+ Authentication Failures
Users are unable to authenticate via TACACS+ for device administration; you suspect the TACACS+ server is unreachable or misconfigured.
Topology
R2(Gi0/0)---172.16.0.0/16---(eth0)TACACS-Server(192.168.100.10)Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Display AAA server information: Router# show aaa servers
- 3.Step 3: Find the TACACS+ server entry with address 192.168.100.10
- 4.Step 4: Check 'status' field; if 'DEAD', note the 'dead time' and 'retries'
- 5.Step 5: Verify 'authen request' count and 'failure' count; high failures indicate wrong key or server issues
- 6.Step 6: Test connectivity: Router# ping 192.168.100.10
! TACACS+ server configuration Router(config)# tacacs-server host 192.168.100.10 key SecretKey Router(config)# aaa new-model Router(config)# aaa authentication login default group tacacs+ local Router(config)# aaa authorization exec default group tacacs+ local
Verify: Router# show aaa servers TACACS+: id 1, priority 1, host 192.168.100.10, port 49 State: current DEAD, duration 0s, previous duration 300s Dead: total 3, retries 2, time 300s Authen: request 15, timeouts 5, success 8, failure 2 Author: request 10, timeouts 3, success 7, failure 0 Account: request 0, timeouts 0, success 0, failure 0 Round trip time: 0 ms
Watch out: A 'DEAD' state with high retries often means the TACACS+ server is not responding. Ensure TCP port 49 is open and the server is running. Also, check that the 'tacacs-server host' command uses the correct IP and key.
Troubleshooting with This Command
When troubleshooting AAA issues, 'show aaa servers' is indispensable. A healthy output shows all configured servers in an 'UP' or 'alive' state, with low round-trip times (typically under 10 ms for local networks) and zero pending requests. The 'authen request' counter should increment with each authentication attempt, and 'success' should match or exceed 'failure' under normal conditions.
Key fields to focus on: 'State' indicates whether the server is currently reachable; 'Dead' shows the number of times the server has been marked dead and the dead time duration; 'Authen request' and 'failure' counts help identify authentication problems; 'Round trip time' reveals network latency. Common symptoms: if the server shows 'DEAD', it means the router has determined the server is unreachable after a series of retries. This could be due to network connectivity issues, incorrect server IP, or firewall blocking.
High 'timeout' counts suggest network congestion or server overload. A high 'failure' count with low 'success' indicates authentication credential mismatches (wrong key, username, or password). If 'pending requests' is non-zero, the router is waiting for responses, which may indicate server performance issues.
Step-by-step diagnostic flow: 1) Run 'show aaa servers' to check server status. 2) If a server is dead, verify IP reachability with 'ping' and 'telnet' to the AAA port (1812 for RADIUS, 49 for TACACS+). 3) Check the AAA configuration with 'show running-config | section aaa' to ensure correct server addresses and keys. 4) Use 'debug radius' or 'debug tacacs' (with caution in production) to see real-time exchanges. 5) Correlate with 'show logging' to see AAA error messages. 6) If counters are stale, clear them with 'clear aaa counters' to get fresh data. This command is often used alongside 'show aaa sessions' to see active authenticated sessions, and 'show aaa method-list' to verify the authentication method order. Remember that the output is cumulative since the last boot or counter clear, so for accurate troubleshooting, clear counters before testing.
CCNA Exam Tips
CCNA exam: RADIUS uses UDP 1812 (authentication) and 1813 (accounting)
TACACS+ uses TCP 49 and encrypts the entire payload (RADIUS only encrypts the password)
TACACS+ is Cisco proprietary and preferred for device administration (separates authentication, authorisation, accounting)
RADIUS is better for network access control (802.1X, VPN)
Common Mistakes
Confusing RADIUS and TACACS+ ports
RADIUS UDP 1812/1813 vs old 1645/1646
TACACS+ TCP 49
A server showing timeouts indicates a network or firewall issue, not a credential problem
Dead state means IOS stopped sending requests — check dead-time configuration
show aaa servers vs username privilege
Both 'show aaa servers' and 'username privilege' relate to AAA security, but one displays operational statistics for external authentication servers while the other creates local user accounts. They are often considered together when troubleshooting authentication issues or configuring local fallback.
| Aspect | show aaa servers | username privilege |
|---|---|---|
| Scope | All configured RADIUS/TACACS+ servers | Single local user account |
| Configuration mode | Privileged EXEC (#) | Global config (config)# |
| Persistence | Volatile; shows live counters | Written to running-config and saved |
| Precedence | N/A (informational only) | Enforced at login; local auth overrides when server unreachable |
| Typical use | Monitor server reachability and response times | Define local backup or admin accounts with privilege levels |
Use show aaa servers when verifying that external AAA servers are responding or analyzing authentication success/failure rates after configuration changes.
Use username privilege when creating a local administrative account with specific privilege level, especially as fallback if AAA servers become unreachable.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the 'show aaa servers' command syntax and output are very similar to classic IOS, but the output may include additional fields like 'Server Group' and 'Vrf' if VRF-aware AAA is configured. The command is fully supported in IOS-XE 16.x and later. For NX-OS (e.g., Nexus switches), the equivalent command is 'show aaa-server' (note the hyphen).
The NX-OS output is more concise and groups servers by type (radius, tacacs+, ldap). For example: 'show aaa-server radius' displays all RADIUS servers. The 'show aaa-server' command without a type shows all servers.
On ASA firewalls, the equivalent is 'show aaa-server' (similar to NX-OS), which lists server groups and their status. The ASA also supports 'show aaa-server protocol radius' for protocol-specific details. In IOS-XR (e.g., ASR 9000, CRS), AAA server information is obtained via 'show aaa server-groups' or 'show running-config aaa'.
The 'show aaa servers' command is not available in IOS-XR; instead, use 'show aaa server-group all' to see server status. Behavior differences across IOS versions: In older IOS 12.x, the output might not show 'Round trip time' or 'pending requests' fields; these were added in later 15.x trains. In IOS 15.x and 16.x, the output is more detailed and includes per-server statistics.
Always check the specific version documentation, but the core fields remain consistent.
Related Commands
login on-failure
Enables syslog logging of failed login attempts, recording the username attempted, source IP address, and timestamp. Used for security monitoring and brute-force detection.
service password-encryption
Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.
username privilege
Creates a local user account with a specific privilege level (0-15) and a hashed password stored in the configuration. Privilege 15 grants full access equivalent to enable mode.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions