CCNA 200-301 v1.1 reference — Security Fundamentals
Authentication, authorization and accounting
The three AAA functions and how RADIUS and TACACS+ differ in transport, encryption scope and use cases.
Objective 5.8v1.1 exam target
Loading
The three AAA functions
| Function | Question answered | Example |
|---|---|---|
| Authentication | Who are you? | Username/password, MFA, certificate |
| Authorization | What may you do? | Privilege level, per-command permission |
| Accounting | What did you do? | Command logs, session records, connection logs |
RADIUS versus TACACS+
| Property | RADIUS | TACACS+ |
|---|---|---|
| Transport | UDP 1812/1813 | TCP 49 |
| Encryption scope | Password field only | Entire payload |
| AAA separation | Auth+Authz combined in one exchange | Separates authentication, authorization, accounting |
| Per-command authorization | Limited (vendor-specific) | Native — the standard for device admin |
| Best fit | Network access (802.1X, VPN users) | Device administration |
Beyond exam scope
AAA method list for device login (beyond exam scope)
Authenticate vty logins against TACACS+ with local fallback — Privileged EXEC → Global + line configuration
Cisco IOS / IOS XE
- A reachable TACACS+/RADIUS server; local user as fallback.
configure terminal aaa new-model tacacs server TAC1 address ipv4 192.168.99.20 key <placeholder-aaa-key> exit aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local username fallback secret <placeholder-fallback> end
Verify
show aaa servers test aaa group tacacs+ <user> <pass> legacy
- Server shows as up/alive in the group.
- Test authentication succeeds (or falls back to local when the server is down).
- Always keep a local fallback — a dead AAA server plus no fallback locks everyone out.
test aaaexercises the server group only; validating the local fallback needs a controlled real login with console access.
Changes device configuration.
Verifying AAA
show aaa servers— server state (alive/dead), attempted/failed requests.- Server-side logs — the authoritative record of who authenticated when.
test aaa— verifies credentials against the server without a live session.
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 2865 — Remote Authentication Dial In User Service (RADIUS) — reviewed 2026-11-02
- RFC 8907 — The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol — reviewed 2026-11-02
- Cisco — AAA Configuration Guide — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.