AAA

AAA (Authentication, Authorization, and Accounting) is a comprehensive security framework that provides centralized access control for network devices and resources. Authentication verifies user identity through credentials, certificates, or other methods; Authorization determines what resources authenticated users can access; and Accounting tracks user activities and resource usage for auditing and billing purposes. This framework integrates with external servers like RADIUS and TACACS+ to provide scalable, centralized security management across enterprise networks.

Diagram

Classes

configuration (iosxe.devices)

aaa (iosxe.devices.configuration)

radius_dynamic_author_clients (iosxe.devices.configuration.aaa)

radius_groups (iosxe.devices.configuration.aaa)

tacacs_groups (iosxe.devices.configuration.aaa)

accounting (iosxe.devices.configuration.aaa)

authentication (iosxe.devices.configuration.aaa)

authorization (iosxe.devices.configuration.aaa)

radius (iosxe.devices.configuration.aaa)

tacacs_servers (iosxe.devices.configuration.aaa)

usernames (iosxe.devices.configuration.aaa)

identities (iosxe.devices.configuration.aaa.accounting)

execs (iosxe.devices.configuration.aaa.accounting)

networks (iosxe.devices.configuration.aaa.accounting)

logins (iosxe.devices.configuration.aaa.authentication)

dot1xs (iosxe.devices.configuration.aaa.authentication)

execs (iosxe.devices.configuration.aaa.authorization)

networks (iosxe.devices.configuration.aaa.authorization)

attributes (iosxe.devices.configuration.aaa.radius)

servers (iosxe.devices.configuration.aaa.radius)

attribute_31_parameters (iosxe.devices.configuration.aaa.radius.attributes)

By integrating TACACS+ and RADIUS servers, AAA centralizes and secures user authentication and policy enforcement across the network.

This enhances security, simplifies management, and enables detailed auditing of user actions.

AAA Parameters:

• Authentication methods
• Authorization methods
• Accounting methods
• Server group
• TACACS+ server
• RADIUS server
• Shared key
• Timeout
• Retransmit
• Auth port
• Acct port
• Dead criteria
• Deadtime
• Attribute settings
• Username
• PAC key

By default, AAA processes authentication, authorization, and accounting sequentially according to the configured method lists, starting with the first specified method and moving to the next if the previous one fails or is unavailable.

You can use these AAA parameters to define how your device authenticates users, authorizes their actions, and tracks their activity. Customize the methods, server settings, and timeouts to fit your network’s security and operational needs. Adjusting these parameters lets you tailor access control and monitoring for your environment.

Examples:

tacacs server test1

• Defines a TACACS+ server for centralized authentication with specified address, key, and timeout

radius-server attribute 25 access-request include

• Includes RADIUS attribute 25 in access-request messages

radius-server attribute 31 mac format ietf

• Sets MAC address format in RADIUS attribute 31 to IETF standard

 radius-server dead-criteria time <time> tries <count>

• Sets criteria for marking a RADIUS server as dead based on response time and retry attempts

radius-server deadtime <minutes>

• Specifies how long to avoid retrying a dead RADIUS server.

radius server test1

• Configures a RADIUS server with authentication and accounting ports, timeout, retransmit, automated testing, and PAC key options

Sample Configuration:

The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.

tacacs server test1
 address ipv4 192.168.0.1
 key testkey
 timeout 5
tacacs server tacacs_10.10.15.13
 address ipv4 10.10.15.13
 key 123
 timeout 4
!
!
radius-server attribute 25 access-request include
radius-server attribute 31 mac format ietf
radius-server dead-criteria time 1 tries 3
radius-server deadtime 10
!
radius server test1
 address ipv4 192.168.1.1 auth-port 220 acct-port 221
 timeout 5
 retransmit 3
 automate-tester username test_user ignore-acct-port probe-on
 pac key test_pac

Example YAML Code:

The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.

iosxe:
  devices:
    - name: Device1
      configuration:
        aaa:
          new_model: true
          authentication:
            logins:
              - name: default
                methods:
                  - local
          authorization:
            execs:
              - name: default
                methods:
                  - local
          radius:
            dead_criteria_time: 1
            dead_criteria_tries: 3
            deadtime: 10
            servers:
              - name: test1
                ip: 192.168.1.1
                timeout: 5
                key: testkey
                authentication_port: 220
                accounting_port: 221
                retransmit: 3
                automate_tester_probe_on_config: true
                automate_tester_ignore_acct_port: true
                automate_tester_username: test_user
                pac_key: test_pac
                pac_key_encryption: 0
            attributes:
              - number: 25
                access_request_include: true
          radius_groups:
            - name: testgroup1
              source_interface_type: GigabitEthernet
              source_interface_id: 1
          tacacs_servers:
            - name: test1
              ip: 192.168.0.1
              timeout: 5
              encryption: 0
              key: testkey