Authentication and Authorization with AAA

  • You just secured a device with its own local accounts.
    The username, the password, the privilege level: all of it lives on the network equipment.

    Local accounts do not scale

    That holds up for one router.

    Cisco account stored locally on router R1 before AAA

    Figure 1 – The account lives on the device

    Now imagine your network has dozens of devices.
    Recreating every account on each one, and cleaning them up by hand when someone leaves, does not scale.

    One central server

    It would be much better to have one central server that holds every account and every permission.
    Each device just refers to it.

    That is exactly what AAA does.

    AAA centralizes accounts on a TACACS+ server for R1 and R2

    Figure 2 – With AAA, the accounts move to one central server

    With AAA, R1 and R2 both ask the same server: here, a TACACS+ server.
    It holds the accounts and the credentials for the whole network.

    Answer the question below

    In our example, which type of server holds all the accounts?

    How a login works

    You log in to R1 with your own account.
    Watch where your credentials go.

    Admin SSH login to R1 forwarded to the TACACS+ server

    Figure 3 – Login forwarded to the server

    R1 no longer checks locally.
    It forwards your request to the TACACS+ server.

    TACACS+ server checks authentication (who you are) then authorization (which commands)

    Figure 4 – Authentication vs authorization

    The TACACS+ server then runs two checks:

    • Authentication is who you are.

    • Authorization is which commands you may run.

    The TACACS+ server is now responsible for authentication and authorization.
    That is two of the three A's. The third, accounting, just logs what a user did.

    Answer the question below

    Which AAA function records what a user did?