AAA TACACS+ and RADIUS Tutorial

As a company’s network grows, so does the need to control who can access it and what they are allowed to do once they are in. Without any dedicated security mechanism in place, an unauthorized user can often get onto the network with little effort, and once there, can potentially cause real damage.

Access Without AAA

A very basic approach is to configure a login username and password directly on each device’s access lines. This works, but it comes with a long list of weaknesses: it is not a particularly secure login method and is vulnerable to brute-force attacks; there is no accountability, since there is no record of who did what; credentials have to be configured manually on every single device; usernames and passwords are stored locally on each device rather than centrally; and there is no way to restrict which specific commands a given user is allowed to run.

Access With AAA

With AAA in place, a user’s login attempt and subsequent actions are instead submitted to a centralized server, which makes the actual authorization decisions. This brings several advantages: a more secure login process backed by a protected server; centralized management of credentials and policy; the option to build on a stronger security infrastructure; control over which commands a user is permitted to run; and a complete audit log of what every user did. The main trade-off is that this approach requires a sufficiently robust server infrastructure to handle the authentication traffic from all the network’s devices.

What AAA Stands For

AAA stands for Authentication, Authorization, and Accounting:

• Authentication — verifying a user’s identity, typically through a username and password.
• Authorization — determining which resources that authenticated user may access and which actions they are permitted to take.
• Accounting — tracking what the user actually did and what resources they consumed, for logging and auditing purposes.

As an illustration, suppose a user named “tom” connects to a server called “LearnCCNA” over HTTP and FTP. Authentication confirms that this really is tom; authorization might limit him to read-only commands for a period of 2 hours; and accounting records that tom accessed the server, for how long, and what he did while connected.