4 AAA Fundamentals

The three AAA functions

AAA addresses three distinct questions about access to a network device or service. Authentication asks who the user is, authorization determines what that authenticated user may do, and accounting records what activity occurred.

For example, a network administrator may authenticate by logging in to a switch over SSH. Authorization could allow one administrator to view configuration while allowing another to change it. Accounting could record session start and stop times or commands used. A successful login does not itself grant every permission, and recording activity does not itself grant access.

Centralized AAA

With centralized AAA, a network device acting as the AAA client sends requests to a shared server, commonly using TACACS+ or RADIUS. Administrators can manage accounts and policies centrally across many devices, making consistent access control and centralized auditing easier to manage.

Centralized access control depends on the server being available and reachable over the network, and on device-server communication being correctly configured. TACACS+ is commonly used for network-device administration and separates its authentication, authorization, and accounting functions. RADIUS is also widely used for network access and can return service and configuration information.

Local access control

With local access control, each device checks its own configured user database. It can work without an AAA server and is straightforward for a small number of devices, but accounts and policies must be managed separately on each device. Its records and policies are therefore less centralized, and account management is duplicated.

A local account can also provide carefully controlled fallback access if the central service becomes unreachable. Centralized AAA is useful for shared identity and policy management across devices, while local access can work independently of external AAA and provide emergency access.

Method lists and fallback

On Cisco IOS-style devices, method lists specify the order of authentication, authorization, or accounting methods. A list named default applies by default to the relevant service; a named list can be applied to a specific line or service.

The following illustrative configuration tries TACACS+ first for login authentication and uses the local database as a fallback. It also requests EXEC authorization, records session start and stop activity, and applies the default login method list to remote terminal lines using SSH.

Illustrative Cisco IOS-style configuration

Behavior and safe deployment

The local method is not necessarily tried after every kind of failure. On Cisco IOS method lists, the next method is generally tried when the earlier method does not respond. If the server responds and denies access, that denial is not bypassed by trying the local account; this preserves the central policy decision. Verify behavior for the specific platform before deployment.

Exact commands and server syntax vary by platform and software release. Before enabling AAA on a production device, confirm the syntax for the device and release, configure a tested recovery path, and keep an active management session while testing a second login. Otherwise, a configuration mistake could prevent remote administration.