ed in a variety of ways. The default method is to be challenged to provide a password that's been entered in the configuration of the interface or line itself. For example, the following commands would secure the console with a simple password: line con 0 password Secret1 This behavior is called line authentication when using AAA, and is one of many meth- ods available for authentication. The possible methods for login authentication are: enable Use the configured enable password as the authentication password. Query a Kerberos 5 authentication server for authentication information. krb5-telnet Use the Kerberos 5 telnet authentication protocol when using telnet to connect to the network device. This method must be listed first if used. Use the configured line password as the authentication password. local Use locally configured usernames and passwords (entered in the configuration of the device itself). local-case Same as local, but the usernames are case-sensitive. This method essentially removes authentication. If none is the only method, access is granted without challenge. group radius Query the list of RADIUS servers for authentication information. AAA Authentication group tacacs+ Query the list of TACACS+ servers for authentication information. Custom (group group-name) Query a custom group as defined in the local configuration. A method list can contain multiple methods, or just one. Method lists must be named. Here, I've specified a login method list called GAD-Method. The method being used is local users: aaa authentication login GAD-Method local If multiple methods are listed, they will be referenced in the order in which they appear. The second method will be referenced only if the first method fails; failure is not authentication failure, but rather, a failure to establish connectivity with that method. Here, I've configured the GAD-Method method list to use TACACS+ first, followed by local users: aaa authentication login GAD-Method group tacacs+ local When using the server groups tacacs+ and radius, 