AAA on network devices

Authentication, authorization, accounting — local fallback and RADIUS/TACACS+.

AAA splits three jobs: who are you, what may you do, and what did you do. Local users are fine for a lab. Production boxes should authenticate against a central server and keep a local admin for when that server is unreachable.

aaa new-model
aaa authentication login default group tacacs+ local
username breakglass privilege 15 secret 0 change-me

TACACS+ is common for device admin because it can authorize commands one by one. RADIUS is common for 802.1X and VPN users. Do not mix the two without a reason.