We have our first Catalyst 9200L switches. I am setting them up with SSH access using AAA I am able to log in using console cable with the local username and password that I set up. I can also log in via SSH using AAA as well. I can't log in via SSH using the local username and password. I am getting "access denied".   We have used 2960x switches for years. We use telnet and are able to use both AAA and local username (if needed).   With the 9000L series we are trying to start off right by using only SSH. I also wanted to use a different algorithm for the password. After reading this scrypt for cisco password storage I set up the username and password like this: username <user> privilege 15 algorithm-type scrypt secret <password> Like I said, AAA works fine, as does console log in. Can someone please check the code and let me know what I missed?  Thank you!   ! ! version 16.9 no service pad ! hostname Kxxxxx ! ! aaa new-model ! ! aaa authentication login default group radius local aaa authorization exec default group radius if-authenticated ! ! ! aaa session-id common switch 1 provision c9200l ! ! ! ! ip domain name xxxx.org ! username xxxxxxxx privilege 15 secret 9 xxxxxxxBb0euNxxxxxxxx ! redundancy mode sso ! interface GigabitEthernet1/1/4 switchport mode trunk ! ip default-gateway 10.xxxxxx ip forward-protocol nd no ip http server ip http authentication local no ip http secure-server ! ip access-list extended AutoQos-4.0-Acl-Default ip radius source-interface Vlan2 logging host 192.xxxxxx ! snmp-server community fuz RO radius-server key 7 011C0xxxxx1E ! radius server xxxxx address ipv4 192.xxxxx auth-port 364 acct-port 456 ! control-plane service-policy input system-cpp-policy ! ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 transport input ssh line vty 5 15 transport input ssh ! ! mac address-table notification mac-move ! ! end   ... View more