Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand a config on one of our Cisco routers (teaching myself iOS) and have run into a problem with one line.

Can somebody please explain the "line enable" piece of the command below and check the rest of my information to ensure it is correct?

aaa authentication login default group tacacs+ local line enable
# Creates an authentication list that specifies the types of authentication methods allowed.

# aaa authentication login = command to authenticate users who want exec (enable) access into the access server (tty, vty, console, and aux).
## default = the named list is the the default one (in this case the default one is default)

# There are three authentication methods:
## local
## line

# All users are authenticated using the tacacs+ server (the first method). If the TACACS+ server doesn't respond, then the router's local database is used (the second method). The local authentication, define the username and password::
## username xxx password yyy

# Because we are using the list default in the aaa authentication login command, login authentication is automatically applied for all login connections (such as tty, vty, console, and aux). 
share|improve this question
up vote 5 down vote accepted

line and enable are additional methods of authentication that will be attempted after failure of the previous methods in the list.

line authentication uses a password that's defined in your line configs, so it can vary based on your connection method. enable authentication simply uses the enable password defined in the enable password command.

Here's a reference of the methods available for the authentication list:

(config)#aaa authentication login default ?
  cache        Use Cached-group
  enable       Use enable password for authentication.
  group        Use Server-group
  krb5         Use Kerberos 5 authentication.
  krb5-telnet  Allow logins only if already authenticated via Kerberos V
  line         Use line password for authentication.
  local        Use local username authentication.
  local-case   Use case-sensitive local username authentication.
  none         NO authentication.
share|improve this answer
This is perfect, thank you for this! – Windows Ninja Jul 13 '11 at 11:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.