AAA with RADIUS and TACACS+

What it is

AAA stands for authentication, authorisation and accounting, and it controls who may use a device, what they may do and what they did.

A central AAA server holds the users, so you change a password or remove an administrator in one place. Devices ask the server each time someone logs in. The two protocols used for this are RADIUS and TACACS+.

How it works

Method lists tell the device which source to ask, and in which order.

The three A's

RADIUS and TACACS+ compared

TACACS+ separates authorisation from authentication, so you can control exactly which commands each administrator may type. This is why it is the usual choice for device administration. RADIUS is widely used for user network access.

The ports 1812 for authentication and 1813 for accounting are the current ones, and older systems used 1645 and 1646.

Enabling AAA

The first step is to turn the new model on.

R1(config)# aaa new-model
R1(config)# username ADMIN privilege 15 secret STRONGPASSWORD

Create a local user before you apply AAA to the lines, so the device has a fallback. Once aaa new-model is on, the lines use AAA methods and the old line passwords no longer apply the same way.

Defining servers

R1(config)# tacacs server TAC1
R1(config-server-tacacs)# address ipv4 10.1.1.10
R1(config-server-tacacs)# key SHAREDKEY
R1(config)# radius server RAD1
R1(config-radius-server)# address ipv4 10.1.1.11 auth-port 1812 acct-port 1813
R1(config-radius-server)# key SHAREDKEY
R1(config)# aaa group server tacacs+ TACGROUP
R1(config-sg-tacacs+)# server name TAC1

The shared key must match on the device and on the server. A server group collects servers under one name, so a method list can refer to them.

Method lists

A method list is an ordered list of sources. The device tries the first, and moves to the next only if the first does not answer.

R1(config)# aaa authentication login default group TACGROUP local
R1(config)# aaa authorization exec default group TACGROUP local
R1(config)# aaa accounting exec default start-stop group TACGROUP
R1(config)# aaa authentication login CONSOLE-LIST local
R1(config)# line console 0
R1(config-line)# login authentication CONSOLE-LIST

The list named default applies to every line unless a line names another. Here, login first asks the TACACS+ group, and uses the local database only if the servers cannot be reached.

The key point is that the device falls back to local only when the server does not answer. If the server answers with a rejection, the login fails and local is not tried.

Accounting with start-stop records the start and the end of a session.

Command authorisation

R1(config)# aaa authorization commands 15 default group TACGROUP local

This sends each privilege 15 command to the server for approval. It gives fine control, but if the server is down and no fallback exists, it can lock you out, so keep a local method in the list.

Testing and verifying

R1# test aaa group TACGROUP ADMIN1 PASSWORD new-code
R1# show aaa servers
R1# show running-config | section aaa
R1# debug aaa authentication

The test aaa command checks the server and the key without logging in. show aaa servers shows the state of each server and its counters, including the requests that failed. Use the debug with care, since it adds load and can show sensitive data.

Troubleshooting order

1. Check that the device can reach the server, and that no firewall blocks the port.
2. Check that the shared keys match.
3. Check that the device address is a known client on the server.
4. Check the method lists, and that the right list is on the line.
5. Test with test aaa and read the result.