Users Guide

Authentication, Authorization, and Accounting 255
Methods that never return an error cannot be followed by any other methods
in a method list.
• The enable method uses the enable password. If there is no enable
password defined, then the enable method will return an error.
• The ias method is a special method that is only used for 802.1X. It uses an
internal database (separate from the local user database) that acts like an
802.1X authentication server. This method never returns an error. It will
always authenticate or deny a user.
• The line method uses the password for the access line on which the user is
accessing the switch. If there is no line password defined for the access
line, then the line method will return an error.
• The local method uses the local user database. If the user password does
not match, then access is denied. This method returns an error if the user
name is not present in the local user database.
• The none method does not perform any service, but instead always returns
a result as if the service had succeeded. This method never returns an error.
If none is configured as a method, the user will always be authenticated
and allowed to access the switch.
• The radius and tacacs methods communicate with servers running the
RADIUS and TACACS+ protocols, respectively. These methods can
return an error if the switch is unable to contact the server.
Method Lists
The method lists shown in Table 9-2 are defined by default. They cannot be
deleted, but they can be modified. Using the “no” command on these lists
will return them to their default configuration.
Table 9-2. Default Method Lists
AAA Service (type) List Name List Methods
Authentication (login) defaultList none
Authentication (login) networkList local
Authentication (enable) enableList enable none
Authentication (enable) enableNetList enable
Authorization (exec) dfltExecAuthList none