aaa authentication enable

Configures the AAA authentication method for securing access to the Privileged EXEC level and global configuration levels of the CLI.
Syntax
aaa authentication enable default method-list [ method-list … ]
no aaa authentication enable default method-list [ method-list … ]
Command Default

The AAA authentication method list is not configured.

By default, the device prompts for a username and password.

Parameters
default
Configures the default authentication method list.
method-list
Configures the following authentication methods.
local
Authenticate using a local username and password you configured on the device. Local usernames and passwords are configured using the username command.
radius
Authenticate using the database on a RADIUS server. You also must identify the server to the device using the radius-server command.
tacacs+
Authenticate using the database on a TACACS+ server. You also must identify the server to the device using the tacacs-server command.
Modes

Global configuration mode

Usage Guidelines

You can specify a primary authentication method and up to two backup authentication methods. If the configured primary authentication fails due to an error, the device tries the backup authentication methods in the order they appear in the list.

The aaa authorization exec default tacacs+ command must be configured before the aaa authentication login default tacacs+ command or the aaa authentication enable default tacacs+ command can be configured. If you attempt to configure either of these commands first, the following message is displayed: Warning- Please configure exec authorization using TACACS+ to get user privilege.

Likewise, the aaa authorization exec default radius command must be configured before the aaa authentication login default radius command or the aaa authentication enable default radius command can be configured. If you attempt to configure either of these commands first, the following message is displayed: Warning- Please configure exec authorization using RADIUS to get user privilege.

If authentication is enabled on the device, when a user attempts to gain Super User access to the Privileged EXEC and global configuration levels of the CLI, by default the device prompts for a username and password.

From FastIron 09.0.00, the authentication method local can be added only if at least one configured local user is present on the ICX device. Likewise, the last available local user cannot be deleted if either login authentication or web-server authentication is using local as an authentication method.

The no form of the command removes the authentication method.

Examples

The following example shows how to configure TACACS+ as the primary authentication method for securing access to the Privileged EXEC and global configuration levels of the CLI. In this example, TACACS+ is configured to be the primary authentication method for securing access. If TACACS+ authentication fails due to an error with the server, local authentication is used instead. 

device# configure terminal
device(config)# aaa authentication enable default tacacs+ local

The following example shows how to configure RADIUS as the primary authentication method and other backup authentication methods. 

device(config)# aaa authentication enable default radius tacacs+ local
History
Release version Command history
08.0.90 The command was modified as described in the usage guidelines.
09.0.00 The command was modified to remove the implicit-user keyword as well as the following method-list keywords: line, enable, tacacs, and none.
10.0.10a This command was modified to align with the following command behavior in the 08.0.95 release: The aaa authorization exec command must be configured for TACACS+ or RADIUS as the default before the respective server type can be enabled and before login privileges can be set.
Parent topic: Commands A and B