config-sg-radius)# server 10.100.200.200 1(config-sg-radius)# server 10.100.200.201 In IOS, if you have a TACACS+ server that requires key authentication, you can add the key to an individual server within a group by using the server-private command instead of the server command: aaa group server tacacs+ Login-Servers server-private 10.100.1.72 key Secret Chapter 26: Authentication in Cisco Devices Creating Method Lists A method list is a list of authentication methods to be used in order of preference. For example, you may want to first try TACACS+ and then, if that fails, use local user authentication. Once you've created a method list, you can configure an interface to call the method list for authentication. A router can authenticate a user in a few different ways. They are: Login Login authentication is the means whereby a user is challenged to access the router's CLI. PPP authentication provides authentication for Point-to-Point Protocol connec- tivity either on serial links or through something like modem connectivity. Apple Talk Remote Access Protocol (ARAP) is a remote access protocol for Apple- Talk users. NetWare Asynchronous Services Interface (NASI) is a remote access protocol for Novell Netware users. In practice, you're likely to encounter only login and PPP authentication. With the advent of broadband Internet access in most homes and the adoption of VPN at most companies, modem connectivity is becoming a thing of the past in most metropolitan areas. I haven't seen ARAP or NASI in the field in years, SO I'll only cover login and PPP authentication here. IOS login authentication When logging into an IOS-based network device, you can be challenged in a variety of ways. The default method is to be challenged to provide a password that's been entered in the configuration of the interface or line itself. For example, the following commands secure the console with a simple password: line con 0 password Secret1 This behavior is called line authentication when you are using AAA, and it is one of many meth