aaa authentication question

[cxu21]

On our C9800 WLC, there are several lines about aaa authentication which confuse me.

The commands are like below

aaa authentication login dnac-group1 group dnac-group1 local

aaa authentication login dnac-group2 group dnac-group2 local

My understanding is the first dnac-group1 is the radius group for authentication as default, and the dnac-group1 after group keyword is telling try to use this radius server group to authenticate, if failed use local.

Is my understanding correct?

If my understanding is correct, why we need to configure the first radius server group

Also, any reason we have 2 aaa authetication lines?

[M02@rt37 · Accepted solution]

Hello @cxu21 

aaa authentication login dnac-group1 group dnac-group1 local

aaa authentication login dnac-group2 group dnac-group2 local

- dnac-group1 and dnac-group2 are the method-list names. A method list specifies the authentication methods and the sequence in which they are applied.

- group dnac-group1 and group dnac-group2 indicate the RADIUS server group(s) to be used for authentication. If the first group fails, the second one is attempted.

- local is the keyword that specifies the local authentication (using the local username and password database) as a fallback if both RADIUS groups fail.

The reason for having two lines could be redundancy or load distribution. If you have multiple RADIUS servers or server groups, spreading the authentication attempts across them helps distribute the load or provides redundancy in case one group becomes unreachable.

[MHM Cisco World]

the AAA can config per WLAN, 
here each AAA group is used for specific WLAN 
show run , check each WLAN auth, each group must appear under that WLAN
MHM