Outlines how authentication order determines the sequence of authentication methods for SSH or console access, describes the default method order (local, radius, tacacs), and provides instructions for customizing the order using the auth-order command for admin users.
The authentication order is a configuration setting that
-
dictates the order in which authentication methods are tried when verifying user access to a Cisco IOS XE Catalyst SD-WAN device through an SSH session or a console port, and
-
provides a way to proceed with authentication if the current authentication method is unavailable.
Default authentication order
The default authentication order is local, followed by radius, and then tacacs. The default authentication order works as follows:
-
local: The authentication process checks for a username and passwords in the running configuration of the device.
-
radius: The authentication process uses a RADIUS server to validate credentials.
-
tacacs: The authentication process uses a TACACS+ server to validate credentials. For this method to work, you must configure one or more TACACS+ servers with the system tacacs server command. If a TACACS+ server is reachable, you are authenticated or denied access based on that server's TACACS+ database. If you have configured multiple TACACS+ servers, then the authentication process contacts one server, and if that server is not available, the process continues in sequence to the other servers. You are then authenticated or denied access based on one of the reachable TACACS+ servers.
If none of the authentication processes succeed, access to the device is denied.
You can use the auth-order command to modify the default authentication order. Specify one, two, or three authentication methods in the preferred order, starting with the one to be tried first. If you configure only one authentication method, it must be local.
To modify the authentication order for admin users, include the keyword admin in the preceding command, for e.g., admin-auth-order and then specify the authentication method(s).
If you do not include this command, the admin user is always authenticated locally.