Skip to content
Log in Sign up My account

5.1.b AAA: Authentication, Authorization and Accounting

Blueprint 5.1: Configure and verify device access control

Local user accounts do not scale. With 400 routers, adding or removing one engineer means 400 configuration changes, and there is no central record of who typed what. AAA moves those decisions to a central server:

  • Authentication: who are you? (username and password, certificate, token)
  • Authorization: what may you do? (privilege level, which commands, which VLAN)
  • Accounting: what did you do? (session start and stop, every command typed, bytes used)

The device asking the questions is the network access server (NAS). The server answering them is usually Cisco ISE, which speaks both TACACS+ and RADIUS.

TACACS+ versus RADIUS

TACACS+ RADIUS
Origin Cisco, documented in RFC 8907 IETF standard, RFC 2865 and RFC 2866
Transport TCP 49 UDP 1812 authentication, 1813 accounting (older 1645 and 1646)
Encryption Whole packet body (the header stays clear) Password attribute only
AAA separation Authentication, authorization and accounting are separate exchanges Authentication and authorization are combined in one Access-Accept; accounting is separate
Per-command authorization Yes No practical equivalent
Typical use Device administration (who can log in to routers and what they can type) Network access (802.1X, MAB, VPN, wireless)
Multiprotocol IP only in practice Extensible with vendor-specific attributes (VSAs) 
graph LR
  subgraph "Device administration"
    ENG["Engineer"] -- "SSH" --> R1["Router NAS"]
    R1 -- "TACACS+ TCP 49" --> ISE1["ISE / TACACS+"]
  end
  subgraph "Network access"
    PC["Laptop"] -- "EAPoL" --> SW["Switch NAS"]
    SW -- "RADIUS UDP 1812/1813" --> ISE2["ISE / RADIUS"]
  end

Exam trap

"Which protocol encrypts the entire payload and allows per-command authorization?" is TACACS+. "Which protocol combines authentication and authorization?" is RADIUS. Swapping these is the most common AAA mistake on the exam.

The AAA model in IOS

Everything follows the same pattern:

  1. Turn AAA on with aaa new-model.
  2. Define servers and group them.
  3. Build method lists: an ordered list of places to ask (server groups, local, enable, none).
  4. Apply named lists to lines or interfaces, or rely on the list called default.
graph TB
  A["aaa new-model"] --> B["tacacs server / radius server<br/>address, key"]
  B --> C["aaa group server<br/>TAC-SERVERS"]
  C --> D["Method list<br/>aaa authentication login VTY group TAC-SERVERS local"]
  D --> E["Applied: line vty 0 15<br/>login authentication VTY"]
  D --> F["Or named default<br/>applies to every line without a list"]

How a method list is evaluated

IOS tries the first method. It moves to the next method only if the current method returns an ERROR, meaning no answer at all (every server in the group timed out or could not be reached). A FAIL (the server answered "no") is final.

graph LR
  S["Login attempt"] --> M1{"group TAC-SERVERS"}
  M1 -- "PASS" --> OK["Access granted"]
  M1 -- "FAIL: user rejected" --> NO["Access denied"]
  M1 -- "ERROR: no server answered" --> M2{"local"}
  M2 -- "PASS" --> OK
  M2 -- "FAIL" --> NO
Method keyword Meaning
group tacacs+ Every configured TACACS+ server
group radius Every configured RADIUS server
group <NAME> A named server group
local Local username database (case-insensitive username)
local-case Local database, case-sensitive username
enable The enable secret
line The line password
none Always succeeds. Use only as a deliberate last resort, never on VTY

Exam trap

aaa authentication login default group tacacs+ local does not let a user in through the local database when TACACS+ rejects them. Local is consulted only when TACACS+ cannot be reached. If an exhibit shows a reachable server and a user who exists only locally, the login fails.

Avoid locking yourself out

As soon as you type aaa new-model, lines without a named list use the default login list, and if no default list exists IOS uses the local database for them. Always create a local level 15 user before enabling AAA, keep a console session open, and test from a second session before you close the first.

Server and group configuration

aaa new-model
!
tacacs server ISE-1
 address ipv4 192.168.100.20
 key ENCOR-TAC
 timeout 5
tacacs server ISE-2
 address ipv4 192.168.100.21
 key ENCOR-TAC
!
aaa group server tacacs+ TAC-SERVERS
 server name ISE-1
 server name ISE-2
 ip tacacs source-interface Loopback0

aaa new-model
!
radius server ISE-1
 address ipv4 192.168.100.20 auth-port 1812 acct-port 1813
 key ENCOR-RAD
!
aaa group server radius RAD-SERVERS
 server name ISE-1
 ip radius source-interface Loopback0

The source interface matters because the server identifies the NAS by the IP address in the packet. If the server knows the router as 10.255.255.1 (Loopback0) but the router sources the request from whatever interface faces the server, the server drops it or returns an error that looks like a bad key. Set the source interface explicitly. On RADIUS, state the ports explicitly too; older releases and some server defaults still use 1645 and 1646.

Authentication

aaa authentication login VTY-AUTH group TAC-SERVERS local
aaa authentication login CON-AUTH local
aaa authentication enable default group TAC-SERVERS enable
!
line con 0
 login authentication CON-AUTH
line vty 0 15
 login authentication VTY-AUTH
 transport input ssh
  • aaa authentication login controls the username and password prompt.
  • aaa authentication enable controls what happens when a user types enable. Here the server is asked first and the local enable secret is the fallback.
  • A common design keeps the console on local only, so a network outage between the router and ISE never stops someone standing at the rack.

Authorization

Authentication says who you are. Authorization decides what you get.

Type Command What it authorizes
EXEC aaa authorization exec <list> <methods> Whether the user gets a shell, and at which privilege level (the server returns priv-lvl=15 for example)
Commands aaa authorization commands <level> <list> <methods> Every command at that privilege level, one by one (TACACS+)
Network aaa authorization network <list> <methods> Network services such as 802.1X and VPN (VLAN, downloadable ACL, SGT)
Console aaa authorization console Turns on authorization for the console line, which is off by default 
aaa authorization exec VTY-EXEC group TAC-SERVERS local
aaa authorization commands 15 VTY-CMD group TAC-SERVERS local
aaa authorization commands 1 VTY-CMD group TAC-SERVERS local
!
line vty 0 15
 authorization exec VTY-EXEC
 authorization commands 15 VTY-CMD
 authorization commands 1 VTY-CMD

The flow for one command with per-command authorization:

sequenceDiagram
  participant U as Engineer
  participant R as Router
  participant T as TACACS+ server
  U->>R: show running-config
  R->>T: AUTHOR REQUEST cmd=show cmd-arg=running-config priv-lvl=15
  T->>R: AUTHOR PASS_ADD
  R->>U: command output
  U->>R: reload
  R->>T: AUTHOR REQUEST cmd=reload
  T->>R: AUTHOR FAIL
  R->>U: Command authorization failed.

Exam trap

Without aaa authorization exec, a user authenticated by TACACS+ or RADIUS lands at privilege level 1, even if the server's profile says level 15. The privilege level is an authorization attribute, so the router must ask for it. The same applies on the console only if aaa authorization console is configured.

Exam trap

Command authorization is per privilege level. aaa authorization commands 15 checks level 15 commands only. Commands that live at level 1 (for example show version) are not sent to the server unless you also configure aaa authorization commands 1.

Where the privilege level comes from

Server Attribute that sets the level
TACACS+ priv-lvl=15 in the shell (exec) service of the user's profile
RADIUS Cisco AV pair shell:priv-lvl=15
Local privilege 15 on the username command

Accounting

Accounting sends records to the server. It never blocks the user.

aaa accounting exec default start-stop group TAC-SERVERS
aaa accounting commands 15 default start-stop group TAC-SERVERS
aaa accounting connection default start-stop group TAC-SERVERS
aaa accounting system default start-stop group TAC-SERVERS
Record type Logs
exec Shell session start and stop: who, from where, how long
commands <level> Every command at that level
connection Outbound Telnet or SSH from the router to elsewhere
network Network sessions (802.1X, PPP, VPN)
system System events such as reloads and accounting being turned on or off
Keyword Sends
start-stop A start record when the event begins and a stop record when it ends
stop-only Only a stop record
none Nothing, disables accounting for that list

Accounting lists are applied the same way, with accounting exec <list> and accounting commands <level> <list> under the line, or by naming the list default.

Verification and troubleshooting

R1# show aaa servers
TACACS+: id 1, priority 1, host 192.168.100.20, auth-port 49, hostname ISE-1
     State: current UP, duration 3812s, previous duration 0s
     Dead: total time 0s, count 0
     ...
     Authen: request 14, timeouts 0, failover 0, retransmission 0
             Response: accept 12, reject 2, challenge 0
     Author: request 31, timeouts 0, failover 0, retransmission 0
             Response: pass 30, fail 1
     Account: request 22, timeouts 0, failover 0, retransmission 0
     ...
R1# show tacacs
Tacacs+ Server -  public  :
               Server name: ISE-1
            Server address: 192.168.100.20
               Server port: 49
              Socket opens:         14
             Socket closes:         14
             Socket aborts:          0
             Socket errors:          0
           Socket Timeouts:          0
   Failed Connect Attempts:          0
        Total Packets Sent:         67
        Total Packets Recv:         67
R1# show aaa method-lists authentication
authen queue=AAA_ML_AUTHEN_LOGIN
  name=default valid=TRUE id=0 :state=ALIVE : LOCAL
  name=VTY-AUTH valid=TRUE id=5 :state=ALIVE : SERVER_GROUP TAC-SERVERS LOCAL
  name=CON-AUTH valid=TRUE id=6 :state=ALIVE : LOCAL
...
R1# test aaa group TAC-SERVERS netadmin Lab-Pass1 legacy
Attempting authentication test to server-group TAC-SERVERS using tacacs+
User was successfully authenticated.

Output is trimmed and wording varies by release. Read it like this: the server is UP, there are accepts and rejects (so the key and reachability are fine), the authorization pass and fail counters move when users run commands, and the method list for VTY is TAC-SERVERS then LOCAL.

Symptom Likely cause Check
Every login waits several seconds, then works with the local password Server unreachable, so the method list falls back after the timeout show aaa servers shows DEAD, ping the server sourced from the right interface
Server log shows "invalid shared secret" or the router logs a bad key Key mismatch Re-enter key under the server
Server never sees the request, but the router sends it Wrong source address; the NAS is not defined on the server under that IP ip tacacs source-interface, debug tacacs
User logs in at > instead of # No aaa authorization exec, or server profile has no priv-lvl show privilege, debug aaa authorization
Every command returns "Command authorization failed" Command authorization on, server unreachable and no fallback, or profile missing permits debug tacacs, check the fallback methods
Local user can not log in although the server is down local not in the list, or the list is not applied to that line show aaa method-lists all, show run \| section line

Useful debugs: debug aaa authentication, debug aaa authorization, debug aaa accounting, debug tacacs and debug radius. Turn them off with undebug all when done.

A dead-server timer stops every login from waiting on a server that is known to be down. Under the server group, deadtime 5 marks a non-responding server dead for five minutes so IOS goes straight to the next method.

Lab: TACACS+ with local fallback

Topology: R1 (Catalyst 8000v) Gi1 192.168.100.1/24 on the management LAN. Host1 (Ubuntu) at 192.168.100.10 is the admin workstation. A second Ubuntu node at 192.168.100.20 runs a TACACS+ daemon (an open-source tac_plus build, or Cisco ISE evaluation if you have the resources). If you skip the server, steps 6 and 7 still work and show the fallback.

  1. Save a baseline. Keep the console open for the whole lab.
  2. Create the break-glass user first: username netadmin privilege 15 algorithm-type scrypt secret Lab-Pass1.
  3. Enable aaa new-model. Define tacacs server ISE-1 and the group TAC-SERVERS with source interface Gi1.

  4. On the TACACS+ daemon, define the NAS key and a user. For example, in a classic tac_plus configuration file:

    key = ENCOR-TAC
user = jdoe {
    login = cleartext "Tac-Pass1"
    service = exec {
        priv-lvl = 15
    }
    cmd = show { permit .* }
    cmd = configure { permit .* }
    cmd = reload { deny .* }
}

    The exact file format depends on the daemon you use. Check its documentation.

  5. Configure on R1:

    aaa authentication login VTY-AUTH group TAC-SERVERS local
aaa authentication login CON-AUTH local
aaa authorization exec VTY-EXEC group TAC-SERVERS local
aaa authorization commands 15 VTY-CMD group TAC-SERVERS local
aaa accounting exec default start-stop group TAC-SERVERS
aaa accounting commands 15 default start-stop group TAC-SERVERS
!
line con 0
 login authentication CON-AUTH
line vty 0 15
 login authentication VTY-AUTH
 authorization exec VTY-EXEC
 authorization commands 15 VTY-CMD
 transport input ssh

  6. From Host1, ssh [email protected]. Expected: lands at R1#. Run show ip interface brief (permitted) and reload (expected: Command authorization failed.).

  7. Log in as netadmin. Expected with the server up: rejected, because the server is reachable and does not know netadmin.
  8. Stop the TACACS+ daemon (or shut its switch port). Log in as netadmin again. Expected: a pause of about the server timeout, then success through the local fallback. show aaa servers now shows the server as DEAD.
  9. Add deadtime 2 under the server group and repeat. After the first failure, the next login falls back without the pause.
  10. Remove aaa authorization exec VTY-EXEC from the VTY lines and log in as jdoe with the server up. Expected: R1>. Put it back.

Quick check

A router has aaa authentication login default group radius local and no aaa authorization exec. The RADIUS server returns shell:priv-lvl=15. At what level does the user land?

Level 1. Without EXEC authorization, the router never processes the privilege attribute. Add aaa authorization exec default group radius local.

Why is TACACS+ preferred over RADIUS for router and switch administration?

It runs over TCP, encrypts the whole body, and separates authorization from authentication, which allows the server to approve or deny each command and log each command separately.

Accounting for commands is configured with stop-only. When is the record sent?

When the command completes. No start record is sent.

References