Compare authentication, authorization, and accounting concepts

The three As

AAA is a framework for controlling access to network devices and network resources. Its three functions are easy to confuse, so tie each to a question:

• Authentication answers “Who are you?” It verifies identity, using a password, certificate, token, or biometric. Logging into a switch with a username and password is authentication.
• Authorization answers “What are you allowed to do?” After you are authenticated, authorization decides which commands you may run, which VLAN you are placed in, or which resources you can reach. A help-desk user allowed to run show commands but not configure terminal is being limited by authorization.
• Accounting answers “What did you do?” It records sessions and actions: when you logged in, from where, which commands you ran, how many bytes you transferred. Accounting supports auditing and billing.

The three are independent. You can authenticate against a server but do no accounting; you can authorize with a local privilege level. Together they replace the flat “one shared enable password for everyone” model with individual, controlled, logged access.

Local versus server-based AAA

Local AAA stores usernames, passwords, and privilege levels on each device (the username ... secret commands from 5.3). It is fine for a handful of devices but does not scale: with 200 switches, every password change or new hire means 200 configuration changes, and there is no central log of who did what.

Server-based AAA moves the decisions to a central AAA server. The switch or router becomes an AAA client (sometimes called a NAS, network access server). When a user tries to log in, the device forwards the credentials to the server, the server replies “accept” or “reject” along with authorization details, and the device enforces the answer. Cisco’s AAA server product is Cisco Identity Services Engine (ISE); the older product was ACS. The device and the server talk using one of two protocols: TACACS+ or RADIUS.

TACACS+ versus RADIUS

The reasoning behind the “primary use” row: because TACACS+ separates authorization from authentication, it can authorize each individual command an administrator types, which is exactly what you want for controlling engineers on network devices. RADIUS bundles authorization attributes (such as VLAN assignment) into the authentication accept message, which is efficient for deciding once whether a laptop may join the Wi-Fi, and RADIUS is the protocol 802.1X and EAP are built to work with. In practice, ISE speaks both, and an organization uses TACACS+ for its administrators and RADIUS for its users.

Basic AAA configuration

The command aaa new-model switches the device from the legacy login model to AAA. The moment you enter it, all lines require authentication against the AAA method lists, so define the servers and a fallback first (or at least have a local username) to avoid locking yourself out.

R1(config)# username backup-admin privilege 15 secret B4ckupP@ss
R1(config)# aaa new-model
! Define a TACACS+ server
R1(config)# tacacs server ISE1
R1(config-server-tacacs)# address ipv4 10.1.1.50
R1(config-server-tacacs)# key T@cacsKey1
R1(config-server-tacacs)# exit
! Define a RADIUS server
R1(config)# radius server ISE1-RAD
R1(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
R1(config-radius-server)# key R@diusKey1
R1(config-radius-server)# exit
! Default login method list: try TACACS+ first, fall back to local users
R1(config)# aaa authentication login default group tacacs+ local
! Authorize EXEC shell and log commands
R1(config)# aaa authorization exec default group tacacs+ local
R1(config)# aaa accounting exec default start-stop group tacacs+

The method list group tacacs+ local means “ask the TACACS+ servers; if none respond, use the local database.” Note that fallback happens only when the server is unreachable, not when the server says the password is wrong. Verify with show tacacs, show aaa servers, and test aaa group tacacs+ USERNAME PASSWORD legacy.