Cisco Catalyst SD-WAN User Management Guide, Releases 26.x and Later
Introduces authentication concepts, describes authentication order and fallback mechanisms, and guides users through configuring authentication order for robust and resilient network login procedures.
Authentication in Cisco SD-WAN Manager is a security mechanism that
ensures only authorized devices and users can access the network, and
integrates with AAA, RADIUS, and TACACS+ to authenticate users and control device access and operations.
The authentication order is a configuration setting that
dictates the order in which authentication methods are tried when verifying user access to a Cisco IOS XE Catalyst SD-WAN device through an SSH session or a console port, and
provides a way to proceed with authentication if the current authentication method is unavailable.
The default authentication order is local, followed by radius, and then tacacs. The default authentication order works as follows:
local: The authentication process checks for a username and passwords in the running configuration of the device.
radius: The authentication process uses a RADIUS server to validate credentials.
tacacs: The authentication process uses a TACACS+ server to validate credentials. For this method to work, you must configure one or more TACACS+ servers with the system tacacs server command. If a TACACS+ server is reachable, you are authenticated or denied access based on that server's TACACS+ database. If you have configured multiple TACACS+ servers, then the authentication process contacts one server, and if that server is not available, the process continues in sequence to the other servers. You are then authenticated or denied access based on one of the reachable TACACS+ servers.
If none of the authentication processes succeed, access to the device is denied.
You can use the auth-order command to modify the default authentication order. Specify one, two, or three authentication methods in the preferred order, starting with the one to be tried first. If you configure only one authentication method, it must be local.
To modify the authentication order for admin users, include the keyword admin in the preceding command, for e.g., admin-auth-order and then specify the authentication method(s).
If you do not include this command, the admin user is always authenticated locally.
You can configure authentication to fall back to a secondary or tertiary authentication mechanism when the higher-priority authentication method fails to authenticate a user, either because the user has entered invalid credentials or because the authentication server is unreachable (or all the servers are unreachable).
If the authentication order is configured as
radius local: With radius as the default authentication, local authentication is used only when all RADIUS servers are unreachable. If an authentication attempt via a RADIUS server fails, the user is not allowed to log in even if they have provided the correct credentials for local authentication.
local radius: With local as the default authentication, RADIUS authentication is tried when a username and matching password are not present in the running configuration on the local device.
radius tacacs local: With radius as the default authentication, TACACS+ is tried only when all RADIUS servers are unreachable, and local authentication is tried only when all TACACS+ servers are unreachable. If an authentication attempt via a RADIUS server fails, the user is not allowed to log in even if they have provided the correct credentials for the TACACS+ server. Similarly, if a TACACS+ server denies access, the user cannot log via local authentication.
After the remote server authenticates a user, it assigns the user to a user group:
If a remote server validates the authentication but does not specify a user group, it places the user in the basic user group.
If a remote server validates the authentication and specifies a user group (say, X), it assigns the user to that group only. However, if that user is also configured locally and belongs to a user group (for example, group Y), the user is assigned to both groups (X and Y).
If a remote server validates the authentication and the user is not configured locally, the system logs the user into the vshell as the basic user, with a home directory of /home/basic.
If a remote server validates the authentication and the user is configured locally, the system logs the user into the vshell under their local username (for example, "eve") with a home directory of /home/username (for example, /home/eve).
The authentication order determines the order in which the system authenticates users, and helps users proceed with authentication if the current authentication method is unavailable.
Configure the authentication order for devices using these steps.