Couple of AAA questions

[ColForbin]

Just trying to verify the difference in these two commands

aaa authentication login default group radius local

aaa authentication login default radius local 

Is the use of the group keyword necessary?

thanks 

[ColForbin]

AAAA group server radius is not used in my config. Just have a single radius server defined. My guess is 

aaa authentication login default group radius local

needs to be used if you have a group, but also works with a standalone server.  But

aaa authentication login default radius local

can only be used with a single server. 

Logical. But wouldn’t be the first time logic didn’t pan out in the Cisco world lol

[Rob Ingram · Accepted solution]

@ColForbin on my switch version I have to hand, they do the same thing. If you configure the command "aaa authentication login default radius local" the actual switch configuration (via show run) is "aaa authentication login default group radius local"

If you specify the "group" command you can explictly configure a RADIUS group of servers (e.g. "aaa authentication login default group RAD-GRP loca"l), as opposed to all RADIUS servers.

[M02@rt37 · Accepted solution]

Hello @ColForbin 

Yes, the group keyword is necessary if you want to specify a radius server group instead of just the raidus method. Without it, the command still works but doesn't explicitly reference a group—just the general radius method. Functionally, they behave similarly in most cases, but using group radius is the proper way to reference a defined RADIUS server group.

[ColForbin]

Ah yes confirmed. My sh run shows the group keyword as well. Thanks!