Authentication, Authorization and Accounting

What it is

AAA stands for authentication, authorization and accounting, and it controls who can use a device, what they can do, and what they did.

Rather than storing user accounts on every router and switch, AAA lets devices ask a central server. Accounts are created, changed and removed in one place.

That is easier to manage and more secure than local passwords spread over many devices.

How it works

A device asks a central AAA server to authenticate the user, then authorize actions, then record them.

The three parts

Authentication proves identity. It may use a password, a certificate, a one-time code or a combination of them.

Authorization happens after authentication. It sets the limits: which devices the user may reach, which commands they may run, and which privilege level they get. A person can be authenticated and still be authorised to do very little.

Accounting records activity. It supports auditing, billing and investigation. For example, it can show who made a configuration change at a certain time.

A good way to hold all three together is a visit to a building.

Authentication is showing your ID at the door. Authorization is the badge that opens only certain rooms. Accounting is the log of when you entered and left.

The AAA server and protocols

Devices that ask for decisions are called network access servers or clients of AAA. The server that decides is a AAA server. Devices and the server communicate using one of two protocols.

TACACS+ lets you control which individual commands each administrator may run, so it is often chosen for device administration.

These were also compared on the management access page in the Network Access chapter.

802.1X

IEEE 802.1X applies AAA to the network port or the wireless connection itself. A device must authenticate before it is allowed to use the network. It has three roles:

• the supplicant, which is the client device
• the authenticator, which is the switch or access point
• the authentication server, which is usually a RADIUS server

Until authentication succeeds, the authenticator allows only authentication traffic. Afterwards, it opens the port, or places the user in a VLAN chosen by the server. This is the basis for WPA2 and WPA3 Enterprise on wireless networks.

A simple configuration example

On a Cisco device, AAA is switched on with aaa new-model, and then you list methods to try, in order:

aaa new-model
username admin secret STRONGPASS
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+

The server itself is defined separately:

tacacs server TAC1
 address ipv4 10.1.1.20
 key SHAREDKEY

Reading the first method line: for logins, try the group of TACACS+ servers first, and if none of them can be reached, fall back to the local username database. The fallback is important. Without it, an unreachable server would lock administrators out.

Note that a server that is reachable but rejects the login does not trigger the fallback. Only a failure to respond does.

The name default is a method list. It applies to all lines unless a named list is attached to a specific line.

Why it matters

• Central control: change a password or remove a leaver once.
• Individual accountability: every action is tied to a person.
• Least privilege: authorization limits what each user may do.
• Audit trail: accounting provides the record needed for compliance and investigation.