AAA (Authentication, Authorization, and Accounting) is a comprehensive security framework that provides centralized access control for network devices and resources. Authentication verifies user identity through credentials, certificates, or other methods; Authorization determines what resources authenticated users can access; and Accounting tracks user activities and resource usage for auditing and billing purposes. This framework integrates with external servers like RADIUS and TACACS+ to provide scalable, centralized security management across enterprise networks.
The enable_defaults attribute (as well as any attributes under the enable_defaults attribute) is/are supported starting with Cisco IOS-XE 17.15.1 and later. These attributes are not supported on older versions of Cisco IOS-XE, as the underlying YANG models do not support the definition of multiple enable group targets until IOS-XE 17.15.1.
For IOS-XE versions prior to 17.15.1, use enable_defaults_legacy instead of enable_defaults. This legacy attribute accepts a single method (enable, line, none) or a group name string.
Command accounting (accounting.commands[]) requires TACACS+ server groups. RADIUS server groups cannot be used for command accounting.
The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.
The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.
iosxe:
devices:
- name: Device1
configuration:
aaa:
new_model: true
session_id: unique
local_authentication_type: local
local_authorization: true
local_authentication_max_fail_attempts: 5
radius_dynamic_author: true
radius_dynamic_author_clients:
- ip: 10.10.10.1
key_type: "0"
key: testkey123
authentication:
enable_defaults:
- method: testgroup1
- method: AUTHCACHE1
cache: true
- method: enable
enable_defaults_legacy: enable
logins:
- name: default
methods:
- local
dot1xs:
- name: DOT1X_LOCAL_ONLY
methods:
- local
- name: DOT1X_RADIUS_LOCAL
methods:
- radius
- local
authorization:
console: true
config_commands: true
config_lists:
- name: test_config_list
groups:
- method: test_tacacs_group
commands:
- level: 15
list_name: default
methods:
- test_tacacs_group
execs:
- name: default
methods:
- local
networks:
- name: test_network_authz
methods:
- test_radius_group
- local
accounting:
system_guarantee_first: true
update_newinfo_periodic: 2880
execs:
- name: default
start_stop_groups:
- testgroup1
start_stop_broadcast: true
start_stop_group_logger: true
- name: stop_only_exec
stop_only_groups:
- testgroup1
stop_only_broadcast: true
stop_only_group_logger: true
- name: none_exec
none: true
identities:
- name: test_identity
start_stop_groups:
- testgroup1
start_stop_group_broadcast: true
start_stop_group_logger: true
identity_default_start_stop_groups:
- testgroup1
commands:
- level: 15
list_name: default
action_type: start-stop
group_broadcast: true
group_logger: true
groups:
- test_tacacs_group
connections:
# To configure the default connection accounting method, use name: "default"
- name: default
stop_only_groups:
- testgroup1
# Named connection accounting lists can also be configured
By default, AAA processes authentication, authorization, and accounting sequentially according to the configured method lists, starting with the first specified method and moving to the next if the previous one fails or is unavailable.
You can use these AAA parameters to define how your device authenticates users, authorizes their actions, and tracks their activity. Customize the methods, server settings, and timeouts to fit your network’s security and operational needs. Adjusting these parameters lets you tailor access control and monitoring for your environment.
The enable_defaults attribute (as well as any attributes under the enable_defaults attribute) is/are supported starting with Cisco IOS-XE 17.15.1 and later. These attributes are not supported on older versions of Cisco IOS-XE, as the underlying YANG models do not support the definition of multiple enable group targets until IOS-XE 17.15.1.
The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.
The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.
