topic Couple of AAA questions in Network Access Control

Couple of AAA questions

ColForbin — Tue, 04 Mar 2025 17:45:18 GMT

Just trying to verify the difference in these two commands

aaa authentication login default group radius local

aaa authentication login default radius local

Is the use of the group keyword necessary?

thanks

Re: Couple of AAA questions

ColForbin — Tue, 04 Mar 2025 18:07:37 GMT

AAAA group server radius is not used in my config. Just have a single radius server defined. My guess is

aaa authentication login default group radius local

needs to be used if you have a group, but also works with a standalone server. But

aaa authentication login default radius local

can only be used with a single server.

Logical. But wouldn’t be the first time logic didn’t pan out in the Cisco world lol

Re: Couple of AAA questions

Rob Ingram — Tue, 04 Mar 2025 18:09:26 GMT

@ColForbin on my switch version I have to hand, they do the same thing. If you configure the command "aaa authentication login default radius local" the actual switch configuration (via show run) is "aaa authentication login default group radius local"

If you specify the "group" command you can explictly configure a RADIUS group of servers (e.g. "aaa authentication login default group RAD-GRP loca"l), as opposed to all RADIUS servers.

Re: Couple of AAA questions

M02@rt37 — Tue, 04 Mar 2025 18:11:02 GMT

Hello @ColForbin

Yes, the group keyword is necessary if you want to specify a radius server group instead of just the raidus method. Without it, the command still works but doesn't explicitly reference a group—just the general radius method. Functionally, they behave similarly in most cases, but using group radius is the proper way to reference a defined RADIUS server group.

Re: Couple of AAA questions

ColForbin — Tue, 04 Mar 2025 18:11:06 GMT

Ah yes confirmed. My sh run shows the group keyword as well. Thanks!