Cisco routers have different categories for authentication. A category for command line access (called EXEC). A category for PPP access. After all we wouldn't want a ISP's clients to be granted EXEC access just because they successfully authenticated their PPP session. The authentication to enter enable mode is simply one more category; a little unusual in that there is no user-supplied username.
Some authentication backends -- like RADIUS -- always need a username field. If we use those authentication backends to authenticate the enable mode category (using a configuration like aaa authentication enable default group EXEC-RADIUS
) then the router supplies the backend with $enab15$
in the RADIUS User-Name
field.
Note that this isn't the same as saying there is a default username for enable mode.
(The above answer assumes aaa new-model
, which is fair as it's hardly new anymore.)