AAA (Authentication, Authorization, and Accounting) is a comprehensive security framework that provides centralized access control for network devices and resources. Authentication verifies user identity through credentials, certificates, or other methods; Authorization determines what resources authenticated users can access; and Accounting tracks user activities and resource usage for auditing and billing purposes. This framework integrates with external servers like RADIUS and TACACS+ to provide scalable, centralized security management across enterprise networks.
Name Type Constraint Mandatory Default Value aaa Class [aaa]No
Name Type Constraint Mandatory Default Value new_model Boolean true, falseNo session_id Choice common, uniqueNo local_authentication_type Choice enable, localNo local_authorization Boolean true, falseNo local_authentication_max_fail_attempts Integer min: 1, max: 65535 No radius_dynamic_author Boolean true, falseNo radius_dynamic_author_clients List [radius_dynamic_author_clients]No radius_groups List [radius_groups]No tacacs_groups List [tacacs_groups]No accounting Class [accounting]No authentication Class [authentication]No authorization Class [authorization]No radius Class [radius]No tacacs_servers List [tacacs_servers]No usernames List [usernames]No
Name Type Constraint Mandatory Default Value ip IP Yes key_type Choice 0, 6, 7No key String No
Name Type Constraint Mandatory Default Value name String Yes server_names List String No source_interface_type Choice Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernetNo source_interface_id String No
Name Type Constraint Mandatory Default Value name String Yes vrf String No server_names List String No source_interface_type Choice Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernetNo source_interface_id String No
Name Type Constraint Mandatory Default Value update_newinfo_periodic Integer No system_guarantee_first Boolean true, falseNo identities List [identities]No identity_default_start_stop_groups List String No commands List [commands]No connections List [connections]No execs List [execs]No networks List [networks]No
Name Type Constraint Mandatory Default Value logins List [logins]No dot1xs List [dot1xs]No dot1x_defaults List Any[String or Choice[local]] No enable_defaults List [enable_defaults]No
Name Type Constraint Mandatory Default Value commands List [commands]No config_commands Boolean true, falseNo config_lists List [config_lists]No execs List [execs]No networks List [networks]No
Name Type Constraint Mandatory Default Value attributes List [attributes]No dead_criteria_time Integer min: 1, max: 120 No dead_criteria_tries Integer min: 1, max: 100 No deadtime Integer min: 1, max: 1440 No servers List [servers]No
Name Type Constraint Mandatory Default Value name String Yes ip IP Yes timeout Integer min: 1, max: 1000 No key String No encryption Any 0, 6, 7No
Name Type Constraint Mandatory Default Value name String Yes privilege Integer min: 0, max: 15 No description String No password_encryption Choice 0, 6, 7No password String No secret_encryption Choice 0, 5, 8, 9No secret String No
Name Type Constraint Mandatory Default Value name String Yes start_stop_broadcast Boolean true, falseNo start_stop_group_broadcast Boolean true, falseNo start_stop_group_logger Boolean true, falseNo start_stop_groups List String No identity_default_start_stop_groups List String No
Name Type Constraint Mandatory Default Value level Integer min: 0, max: 15 Yes list_name String Yes action_type Choice start-stop, stop-onlyNo broadcast Boolean true, falseNo group_broadcast Boolean true, falseNo group_logger Boolean true, falseNo groups List String No
Name Type Constraint Mandatory Default Value name String Yes default Boolean true, falseNo none Boolean true, falseNo start_stop_broadcast Boolean true, falseNo start_stop_group_logger Boolean true, falseNo start_stop_groups List String No stop_only_broadcast Boolean true, falseNo stop_only_group_logger Boolean true, falseNo stop_only_groups List String No wait_start_broadcast Boolean true, falseNo wait_start_group_logger Boolean true, falseNo wait_start_groups List String No
Name Type Constraint Mandatory Default Value name String Yes none Boolean true, falseNo start_stop_broadcast Boolean true, falseNo start_stop_group_logger Boolean true, falseNo start_stop_groups List String No stop_only_broadcast Boolean true, falseNo stop_only_group_logger Boolean true, falseNo stop_only_groups List String No wait_start_broadcast Boolean true, falseNo wait_start_group_logger Boolean true, falseNo wait_start_groups List String No
Name Type Constraint Mandatory Default Value name String Yes start_stop_groups List String No
Name Type Constraint Mandatory Default Value name String Yes methods List Any[String or Choice[none, line, enable, local]] No
Name Type Constraint Mandatory Default Value name String Yes methods List Any[String or Choice[local, cache, radius]] No
Name Type Constraint Mandatory Default Value method Any String or Choice[enable, line, none] or String[Regex: ^.*[\$\%]\{.*$] No cache Boolean true, falseNo
Name Type Constraint Mandatory Default Value level Integer min: 0, max: 15 Yes list_name String Yes methods List Any[String or Choice[local, radius, tacacs, if_authenticated, none]] No
Name Type Constraint Mandatory Default Value name String Yes groups List [groups]No
Name Type Constraint Mandatory Default Value name String Yes methods List Any[String or Choice[local, radius, tacacs, if_authenticated, none]] No
Name Type Constraint Mandatory Default Value name String Yes methods List Any[String or Choice[local]] No
Name Type Constraint Mandatory Default Value number Integer Yes access_request_include Boolean true, falseNo attribute_31_parameters List [attribute_31_parameters]No send_attributes List String No
Name Type Constraint Mandatory Default Value name String Yes ip IP Yes authentication_port Integer min: 0, max: 65534 No accounting_port Integer min: 0, max: 65534 No timeout Integer min: 1, max: 1000 No retransmit Integer min: 0, max: 100 No key String No automate_tester_username String No automate_tester_ignore_acct_port Boolean true, falseNo automate_tester_probe_on_config Boolean true, falseNo pac_key String No pac_key_encryption Any 0, 6, 7No
Name Type Constraint Mandatory Default Value cache Boolean true, falseNo method Any String or Choice[radius, tacacs] or String[Regex: ^.*[\$\%]\{.*$] No
Name Type Constraint Mandatory Default Value calling_station_id Choice mac, sendNo id_mac_format Choice ietfNo id_mac_lu_case Choice lower-case, upper-caseNo id_send_nas_port_detail Boolean true, falseNo id_send_mac_only Boolean true, falseNo
By integrating TACACS+ and RADIUS servers, AAA centralizes and secures user authentication and policy enforcement across the network.
This enhances security, simplifies management, and enables detailed auditing of user actions.
Authentication methods Authorization methods Accounting methods Server group TACACS+ server RADIUS server Shared key Timeout Retransmit Auth port Acct port Dead criteria Deadtime Attribute settings Username PAC key By default, AAA processes authentication, authorization, and accounting sequentially according to the configured method lists, starting with the first specified method and moving to the next if the previous one fails or is unavailable.
You can use these AAA parameters to define how your device authenticates users, authorizes their actions, and tracks their activity. Customize the methods, server settings, and timeouts to fit your network’s security and operational needs. Adjusting these parameters lets you tailor access control and monitoring for your environment.
Defines a TACACS+ server for centralized authentication with specified address, key, and timeout radius-server attribute 25 access-request include
Includes RADIUS attribute 25 in access-request messages radius-server attribute 31 mac format ietf
Sets MAC address format in RADIUS attribute 31 to IETF standard radius-server dead-criteria time <time> tries <count>
Sets criteria for marking a RADIUS server as dead based on response time and retry attempts radius-server deadtime <minutes>
Specifies how long to avoid retrying a dead RADIUS server. Configures a RADIUS server with authentication and accounting ports, timeout, retransmit, automated testing, and PAC key options The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.
tacacs server tacacs_10.10.15.13
radius-server attribute 25 access-request include
radius-server attribute 31 mac format ietf
radius-server dead-criteria time 1 tries 3
radius-server deadtime 10
address ipv4 192.168.1.1 auth-port 220 acct-port 221
automate-tester username test_user ignore-acct-port probe-on
The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.
automate_tester_probe_on_config : true
automate_tester_ignore_acct_port : true
automate_tester_username : test_user
access_request_include : true
source_interface_type : GigabitEthernet
