er host 10.100.100.100 tacacs-server host 10.100.100.101 The router will query the second server in the list only if the first server returns an error, or is unavailable. A login failure is not considered an error. Many installations require a secure key to be sent with the query. This key, which functions like a password for the server itself (as opposed to the user being authenti- cated), is configured through the tacacs-server command using the key keyword: tacacs-server key Secret The password will be stored in the configuration as plain text unless you have the password-encryption service enabled. With the password encrypted, the password line ends up looking like this: tacacs-server key 7 01200307490E12 RADIUS servers are configured similarly. Most of the useful features are supplied in a single command. To accomplish the same sort of simple server configuration with a key, you could enter the following command: radius-server host 10.100.200.200 key Secret This will result in a configuration line that looks similar to this: radius-server host 10.100.200.200 auth-port 1645 acct-port 1646 key Secret Port 1645 is the default port for RADIUS, and was added automatically by the router. As with TACACS+, you can add multiple servers: radius-server host 10.100.200.200 auth-port 1645 acct-port 1646 key Secret radius-server host 10.100.200.201 auth-port 1645 acct-port 1646 key Secret2 AAA Authentication Again, the second server will be accessed only if the first returns an error. Notice, however, that with RADIUS you can have a different key for each server. TACACS+ only allows you to specify a global key for all servers. Custom groups Say you have two different sets of TACACS+ servers that you need to reference sepa- rately: two servers that you use for login authentication, and two servers that you use for PPP authentication. IOS lets you specify custom groups for either RADIUS or TACACS+ servers. The aaa group server command is used to create these groups. Add the keyword tacacs+ or radius, followed by the name of