ntication login default group Login-Servers This example includes the default method, which, when implemented, is automatically applied to all interfaces. Chapter 26: Authentication in Cisco Devices If you're relying on external servers and you encounter problems, you can sometimes lock everyone out of the router. The none method allows anyone to access the router without authenticating. When the none method is included as the last method in a list, anyone will be able to access the router in the event that all other authentication meth- ods fail: aaa authentication login default group tacacs+ local none Again, failure is defined here as failed communication with the server listed, not an incorrect password entry. Of course, including none can be dangerous, as it means that a malicious party can launch a denial-of-service attack on the authentication servers and thereby gain access to your devices (which is counterindicated by most network administrators). Instead, I prefer to use local-case as the last method in my method lists: aaa authentication login default group tacacs+ local-case I like to configure on all routers a standard username and password that will only be needed in the event of a server or network failure. I feel slightly better about using local-case than local, as it means I can include both uppercase and lowercase char- acters in the usernames and passwords. Be careful, though, as this practice is frowned upon in environments where credit card transactions occur. Payment Card Industry (PCI) compliance dictates many details about how user data is stored and accessed. You can use the same method list name for both PPP and login authen- tication, but be aware that creating a login method list doesn't auto- matically result in the creation of a ppp method list with the same name. If you want to have login and PPP method lists with the same names, you'll need to create them both: aaa authentication login GAD-Login group GAD-Servers none aaa authentication ppp GAD-Login group GAD-Servers none NX-OS l