Basic AAA Concepts

AAA (Authentication, Authorization, and Accounting) is a security management framework that provides mechanisms to verify user identities, control they access privileges, and monitor their network usage. It offers three essential security functions:

• Authentication (Verify user identity)
• Authorization (Determine user access rights)
• Accounting (Track user network activity)

Common AAA Architectures

AAA systems typically consist of:

• Users attempting network access
• Network Access Servers (NAS) handling access requests
• Centralized AAA Servers managing security policies

Domains are used on NAS devices to group users and associate them with specific AAA policies. Each domain can have its own authentication, authorization, and accounting schemes.

Authentication

AAA supports three authentication methods:

• No Authentication
• Local Authentication
• Remote Authentication

Authorization

Authorization determines user permissions including:

• User group membership
• VLAN assignments
• ACL (Access Control List) rules

It can be implemented through:

• No Authorization
• Local Authorization
• Remote Authorization

Accounting

Accounting tracks user activity and resource usage. It supports:

• No Accounting
• Remote Accounting

AAA Implementation Protocols

RADIUS Protocol

RADIUS (Remote Authentication Dial-In User Service) is the most widely used protocol for implementing AAA services. It provides:

• Centralized user authentication
• Network resource authorization
• Usage tracking and billing

AAA Use Cases

RADIUS-Based User Management

Configure NAS devices to interact with RADIUS servers:

1. Users authenticate via client devices
2. RADIUS server validates credentials
3. Granted access to network resources
4. Usage records maintained throughout session

Local Management User Authentication

For device management:

1. Configure local authentication schemes on routers
2. Administrators authenticate using local credentials
3. Assigned specific management privileges

AAA Configuration Steps

1. Enter AAA configuration mode

Router(config)# aaa authentication login default group radius local

3. Create authentication schemes

Router(config)# aaa authentication login MyAuthScheme radius local

5. Define authorization rules

Router(config)# aaa authorization network MyAuthScheme radius local

7. Set up acccounting records

Router(config)# aaa accounting network MyAccountScheme radius

9. Configure user domains

Router(config)# domain MyDomain
Router(config-domain)# authentication login MyAuthScheme

11. Create local users

Router(config)# username admin privilege 15 secret AdminPassword123!

Configuration Example

Configure remote login access on a network device:

Router(config)# aaa
Router(config-aaa)# authentication login MyScheme radius local
Router(config-aaa)# domain MyNetworkDomain
Router(config-aaa-domain)# authentication login MyScheme
Router(config-aaa)# username networkuser privilege 1 password NetworkPass123
Router(config-aaa)# line vty 0 4
Router(config-line)# login authentication MyScheme
Router(config-line)# exit
Router(config)# end

After configuration, user access records can be viewed with:

Router# show aaa accounting network
Username: networkuser
Domain: MyNetworkDomain
Access type: SSH
Start time: 10:00:00 UTC Wed Dec 28 2022
End time: 10:15:00 UTC Wed Dec 28 2022
Session duration: 15 minutes
Bytes transferred: 120000