AAA Authentication
AAA in networking terminology is an abbreviation for Authentication, Authorization and Accounting.
AAA is what keeps the network secure by making sure only the right and legitimate users are authenticated, that those users have access only to the right network resources and that those users are logged as they go about their business.
Accounting: You can use accounting to see what users do once they are authenticated and authorized. For example, with accounting, you could get a log of when users logged in and when they logged out. In this post we will be configuring AAA on Cisco IOS router with two pre-requisites that should be kept in mind: – Step 1: Create a backup user account Step 2: Enable AAA
CONFIGURING AAA IN STEPS:
Step4: Define the AAA method list
We need to define a method list which instructs the router to use AAA authentication for terminal logins.
aaa authentication login : It specifies that the following parameters are to be used for user login authentication. The word default is used instead of a custom name for the list (you can only define one default list for each AAA function).
group tacacs+: means “use all configured TACACS+ servers.
local: defines a secondary authentication mechanism; it instructs the router to failover to locally defined user accounts if none of the authentication servers in the first method are reachable.
The above method list handles only the authentication aspect of AAA. By itself, this list only allows us to authenticate as a user with privilege level 1 (user exec mode).
To communicate a heightened privilege level (e.g. privilege level 15, or “enable mode”) from the TACACS+ server, we also need to define an authorization method list
Step 5: Enforcing AAA authentication on terminal lines
R1(config-line)#line vty 0 15
R1(config-line)#login authentication default
Note: These commands won’t be visible under the running-configuration.
ABOUT THE AUTHOR
I am here to share my knowledge and experience in the field of networking with the goal being – “The more you share, the more you learn.”
I am a biotechnologist by qualification and a Network Enthusiast by interest. I developed interest in networking being in the company of a passionate Network Professional, my husband.
I am a strong believer of the fact that “learning is a constant process of discovering yourself.”
– Rashmi Bhardwaj (Author/Editor)
