Authentication, authorization and accounting
The three AAA functions and how RADIUS and TACACS+ differ in transport, encryption scope and use cases.
The three functions
The three AAA functions
| Function | Question answered | Example |
|---|---|---|
| Authentication | Who are you? | Username/password, MFA, certificate |
| Authorization | What may you do? | Privilege level, per-command permission |
| Accounting | What did you do? | Command logs, session records, connection logs |
AAA centralizes identity: devices defer to a AAA server (e.g., Cisco ISE) for login decisions instead of holding every credential locally. The model: define aaa new-model, list authentication/authorization methods, apply to lines. Method lists try servers in order and can fall back to local.
- Setup
- default method = group tacacs+ then local
- Admin connects; device asks TACACS+ to authenticate.
- Server returns pass + authorization profile (privilege level, allowed commands).
- If the server is unreachable → method falls to
local→ the fallback user works. - Accounting records sessions/commands only when accounting methods are configured — it is a separate
aaa accountingdefinition, not automatic with login.
One login, three separate functions — auth, authz and accounting each play their part.
RADIUS versus TACACS+
RADIUS versus TACACS+
| Property | RADIUS | TACACS+ |
|---|---|---|
| Transport | UDP 1812/1813 | TCP 49 |
| Encryption scope | Password field only | Entire payload |
| AAA separation | Auth+Authz combined in one exchange | Separates authentication, authorization, accounting |
| Per-command authorization | Limited (vendor-specific) | Native — the standard for device admin |
| Best fit | Network access (802.1X, VPN users) | Device administration |
Configuration and verification
Authenticate vty logins against TACACS+ with local fallback — Privileged EXEC → Global + line configuration
Cisco IOS / IOS XE
- A reachable TACACS+/RADIUS server; local user as fallback.
configure terminal aaa new-model tacacs server TAC1 address ipv4 192.168.99.20 key <placeholder-aaa-key> exit aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local username fallback secret <placeholder-fallback> end
show aaa servers test aaa group tacacs+ <user> <pass> legacy
- Server shows as up/alive in the group.
- Test authentication succeeds (or falls back to local when the server is down).
- Always keep a local fallback — a dead AAA server plus no fallback locks everyone out.
test aaaexercises the server group only; validating the local fallback needs a controlled real login with console access.
Changes device configuration.
Verifying AAA
show aaa servers— server state (alive/dead), attempted/failed requests.- Server-side logs — the authoritative record of who authenticated when.
test aaa— verifies credentials against the server without a live session.
Common mistakes
- Forgetting
aaa new-model— without it, aaa commands don't activate. - No local fallback in the method list — a dead server bricks remote access.
- Confusing RADIUS's password-only encryption with TACACS+'s full-payload encryption.
- Treating authentication and authorization as one step — a valid user can still be denied privilege.
Observation: Neither TACACS+ accounts nor the local fallback work.
- Method list references a server group that isn't defined/reachable
- Key mismatch between device and server
- Fallback user misconfigured or method order wrong
| Check | Indicates |
|---|---|
show aaa servers | Dead server = fallback should fire — if it doesn't, the method list is wrong. |
show running-config | section aaa | Verify default list exists and includes local. |
test aaa against each method | Isolates server-side vs device-side failure. |
Correction: Fix the server reachability/key or repair the method list.
AAA logins succeed; fallback works when the server is down (test it).
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 2865 — Remote Authentication Dial In User Service (RADIUS) — reviewed 2026-11-02
- RFC 8907 — The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol — reviewed 2026-11-02
- Cisco — AAA Configuration Guide — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.