PlantUML DiagramAAA Architecture
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Local authentication on network devices is fine for a lab. In production with 50 routers and 200 engineers, it collapses. You can't rotate passwords consistently across 50 devices, you can't revoke access for a departing employee without touching every device, and you have no audit trail of who logged in where. That's why every serious enterprise runs AAA — authentication, authorization, and accounting — backed by a central server.
| Component | Question it answers | Examples |
|---|---|---|
| Authentication | Who are you? | Username/password, certificate, MFA token |
| Authorization | What can you do? | Which commands, which networks, which resources |
| Accounting | What did you do? | Login time, commands executed, data accessed |
Think of it as the sequence when you log into a network device. Authentication proves identity. Authorization checks permissions. Accounting logs the session. All three matter, and all three should be centralized for anything beyond a small lab.
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Standard | Open (IETF) | Cisco-proprietary |
| Transport | UDP 1812/1813 (or 1645/1646) | TCP 49 |
| Encryption | Password only | Full packet |
| Combined AAA | Yes (single transaction) | No (separate for each) |
| Command authorization | Limited | Full support |
| Typical use | VPN, 802.1X, general authentication | Network device administration |
RADIUS is the standard for network access authentication — VPN users, 802.1X wireless, and general authentication. TACACS+ is preferred for network device administration because it encrypts the entire packet (not just the password) and supports per-command authorization. Many enterprises run both — RADIUS for user access, TACACS+ for admin access.
RADIUS only encrypts the password field — the rest of the packet (username, attributes) travels in cleartext. TACACS+ encrypts the entire payload. If an attacker captures RADIUS traffic, they learn usernames and group memberships even without the password. In high-security environments, TACACS+ wins for this reason.
! Enable new AAA model (required)R1(config)# aaa new-model! Define the AAA serverR1(config)# radius server CORP_RADIUSR1(config-radius-server)# address ipv4 10.10.20.100 auth-port 1812 acct-port 1813R1(config-radius-server)# key MyRadiusKeyR1(config-radius-server)# exit! Create server groupR1(config)# aaa group server radius RAD_GROUPR1(config-sg-radius)# server name CORP_RADIUSR1(config-sg-radius)# exit! Configure authentication method listR1(config)# aaa authentication login default group RAD_GROUP localR1(config)# aaa authorization exec default group RAD_GROUP localR1(config)# aaa accounting exec default start-stop group RAD_GROUP! Apply to VTY linesR1(config)# line vty 0 4R1(config-line)# login authentication defaultR1(config-line)# transport input sshR1(config-line)# exit
The `aaa authentication login default group RAD_GROUP local` line defines the method list: try RADIUS first, fall back to local if RADIUS is unreachable. The `local` fallback is critical — without it, a RADIUS outage locks everyone out of the device. Always include a local fallback account with a strong password.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.