AAA

General Notes

  • Authentication, authorization and accounting
  • Framework for controlling access to resources, monitoring usage, ensuring correct permissions
  • if-authenticated
    • Used with the aaa authorization command as a suffix to allow access to higher privilege commands even if the AAA server is unreachable
    • without the if-authenticated suffix, the device will continually try to poll the AAA server for authorization and running any commands will be a painfully slow process

Useful Debugs

  • debug aaa authentication - Debug all AAA auth
  • debug radius authentication - Debug for radius auth
  • debug tacacs authentication - Debug for tacacs auth
  • debug aaa protocol local - Debug local authentication

Standard AAA Config

username <user> privilege 15 secret <pass> ! good idea to have local auth as backup
!
aaa new-model
aaa group server tacacs+ <group-name>
 server-private 10.20.5.35 single-connection key <key>
 ip vrf forwarding Mgmt-intf
 ip tacacs source-interface GigabitEthernet0
!
! alternatively can define the server like this
!
tacacs server <serv-name>
 address ipv4 10.20.5.35
 key <key>
aaa group server tacacs+ <group-name>
 server name <serv-name>
 ip tacacs source-interface GigabitEthernet0
!
aaa authentication login <list-name> group <group-name> local
aaa authorization exec <list-name> group <group-name> local if-authenticated
aaa authorization commands 15 <list-name> group <group-name> local if-authenticated
aaa accounting commands 1 <list-name> start-stop group <group-name>
aaa accounting commands 15 <list-name> start-stop group <group-name>
aaa session-id common
!
! using the list-name 'default' will apply the AAA methods to all lines without additional config
!
line vty 0 4
login authentication <list-name>