I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access with public-key authn, using local user accounts for authz.

Given Cisco support seems absolutely useless until you give them your first born I ended up using "Express Setup" until I could telnet in, from which point I tried to work out what that did using IOS CLI.

Right now I'm trying to nail the authentication. I have the following setup for aaa, ...

Switch#show running-config aaa
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local
username admin privilege 15 password 0 xxxxxxxxxxxxxxxxxxxxxxxxx
aaa new-model
aaa session-id common

... and I have run ...

Switch(config)#crypto key generate rsa
Switch(config)#ip ssh time-out 60
Switch(config)#ip ssh authentication-retries 2

... so I can SSH fine.

Now I'm looking at show aaa method-lists authentication to make sure I understand what I have configured and I can't make sense of AAA_ML_AUTHEN_DOT1X.

Switch#show aaa method-lists authentication
authen queue=AAA_ML_AUTHEN_LOGIN
  name=default valid=TRUE id=0 :state=ALIVE : LOCAL
authen queue=AAA_ML_AUTHEN_PPP
authen queue=AAA_ML_AUTHEN_SGBP
authen queue=AAA_ML_AUTHEN_ARAP
authen queue=AAA_ML_AUTHEN_DOT1X
  name= pvt_authen_0 valid=TRUE id=56000002 :state=DEAD : SERVER_GROUP  private_sg-0
authen queue=AAA_ML_AUTHEN_8021X
permanent lists
  name= Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE  NONE
  name= Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLE
  name= Permanent None valid=TRUE id=0 :state=ALIVE : NONE
  name= Permanent Local valid=TRUE id=0 :state=ALIVE : LOCAL
  name= Permanent rcmd valid=TRUE id=0 :state=ALIVE : RCMD

Where might private_sg-0 have come from? Why might it have been created? I have a record of what I've done and I certainly haven't typed that in or (knowingly) chosen to configure any RADIUS servers (I don't have the need for them AFAICT).

Switch#show radius server-group all
Server group radius
    Sharecount = 1  sg_unconfigured = FALSE
    Type = standard  Memlocks = 1

Have I gone wrong somewhere?

And if you fancy a more comprehensive answer: how far am I of having "a single database of local users for SSH with public-key auth configured"? Any tips to achieve this config on IOS?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 20:18

1 Answer 1


You have't gone wrong. That's the expected output for an IOS device configured for local authentication. The "private_sg-0" just means it's a server group local to the device.

I'm not 100% clear on the remainder of your question, though - is your desire setting up a list of local users on this device with associated public keys to allow key-based logins, or a central repository of keys for multiple devices?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.