AAA authentcation login

[asdrewaqf]

Hello Team, im working on a task to enable the aaa new-mode on our cisco switchs my question is 

what is the difference between the below commands?

#aaa authentication login default group rad-groups local

#aaa authentication login default local group rad-groups

Whenever I try to log in with a local user it lets me access and if i try to login with an AD user it also lets me access 

 i would need to set the sequence like that to check from the radius server and if it fails it shouldn't check the local users

i need it always to check from the radius as long as it can reach the server once the server is failed and can't be reached, now it can check the local users how could i do that? 

[MHM Cisco World]

"" i would need to set the sequence like that to check from the radius server and if it fails it shouldn't check the local users""

Your requirements above need

#aaa authentication login default group rad-groups local

The fallback need radius dont have user in it db but if user found in radius db and failed then there is no fallback to local user.

Also the sw use local user db if the radius is dead' i.e. fallbacl to local when SW detect dead of radius.

To make SW faster detect dead of server you can use automate tester 

MHM

[asdrewaqf]

Thank you, bro, I've resolved the issue just for reference should set 

#line vty 0 15

#login authentication default

[MHM Cisco World]

You are so welcome bro

Have a nice day 

please close this post. 

thanks

MHM

[balaji.bandi]

below config standard i use for working :

username balaji privilege 15 secre xxxxxxxxxxxxxx

enable secret  xxxxxxxxxxxxxxxxxxxxxx

aaa new-model
!
tacacs server SERVER1
address ipv4 10.10.10.100
key 0 xxxxxxxxxxxxxxxxx
tacacs server SERVER2
address ipv4 20.20.20.200
key 0 XXXXXXXXXXX

aaa group server tacacs+ SERVER_GROUP
server name SERVER1
server name SERVER2
aaa authentication login default group SERVER_GROUP local
aaa authentication enable default group SERVER_GROUP enable
aaa authorization config-commands
aaa authorization exec default group SERVER_GROUP local if-authenticated
aaa authorization commands 1 default group SERVER_GROUP if-authenticated
aaa authorization commands 15 default group SERVER_GROUP local if-authenticated
aaa accounting exec default start-stop group SERVER_GROUP
aaa accounting commands 1 default start-stop group SERVER_GROUP
aaa accounting commands 15 default start-stop group SERVER_GROUP

line vty 0 4
transport input ssh
line vty 5 15
transport input ssh

Then add the device to TACACS and test it

Note : make sure you add TACACS later after apply config if not you will lock yourself.