What is AAA, and how do you turn it on for device administration on a Cisco router?
Show the answer
Say this first
Authentication answers who you are, authorization decides what you may do, and accounting records
what you did and when. On IOS I enable it with aaa new-model, define the servers and a server group,
then write method lists that say which group to ask first and what to fall back to, usually a local
break-glass user. Central AAA gives every admin a personal login, instant revocation when someone
leaves, and an audit trail of commands instead of a shared enable password.
Go deeper
Configuration with TACACS+
username breakglass privilege 15 algorithm-type scrypt secret Br3akGlass2026
!
aaa new-model
!
tacacs server ISE1
address ipv4 10.10.50.11
key Tac4csKey2026
tacacs server ISE2
address ipv4 10.10.50.12
key Tac4csKey2026
!
aaa group server tacacs+ TAC-SERVERS
server name ISE1
server name ISE2
!
ip tacacs source-interface Loopback0
!
aaa authentication login default group TAC-SERVERS local
aaa authorization exec default group TAC-SERVERS local if-authenticated
aaa authorization commands 15 default group TAC-SERVERS local if-authenticated
aaa accounting exec default start-stop group TAC-SERVERS
aaa accounting commands 15 default start-stop group TAC-SERVERSThe local user is created first, so the device is never left with AAA on and no way in.
How method lists work
defaultapplies to every line unless a line names its own list withlogin authentication NAME.- Methods are tried left to right. The next method is used only when the current one gives no answer (server down or unreachable). A reject is final.
execauthorization decides whether you get a shell and at what privilege level.commands 15sends every level 15 command to the server for a yes or no.- Accounting
start-stopsends a record when a session or command starts and when it ends.
Why a source interface
The server identifies network devices by IP. Pinning the source to a loopback means the request always comes from the address the server knows, whichever interface the packet leaves on.
They will ask next
What is the difference between exec and command authorization?
Exec authorization runs once at login: may this user start a shell, and at which privilege level. Command authorization runs for every command at the configured level, so the server can allow
showcommands but denyreloadfor a junior operator. That needs TACACS+.Why keep a local account if you have AAA servers?
For the day the servers or the path to them are down. Keep it to one break-glass account with a long secret stored in a vault, rotate it, and alert when it is used.
Traps
- Typing
aaa new-modelon a remote device before creating a local user and method lists. New sessions may have no working login method. - Saying the router falls back to local when the server rejects the password. It only falls back when the server does not answer.