AAA

AAA (Authentication, Authorization, and Accounting) is a comprehensive security framework that provides centralized access control for network devices and resources. Authentication verifies user identity through credentials, certificates, or other methods; Authorization determines what resources authenticated users can access; and Accounting tracks user activities and resource usage for auditing and billing purposes. This framework integrates with external servers like RADIUS and TACACS+ to provide scalable, centralized security management across enterprise networks.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
aaa	Class	[aaa]	No

aaa (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
new_model	Boolean	true, false	No
session_id	Choice	common, unique	No
local_authentication_type	String		No
local_authorization	String		No
local_authentication_max_fail_attempts	Integer	min: 1, max: 65535	No
radius_dynamic_author	Boolean	true, false	No
radius_dynamic_author_clients	List	[radius_dynamic_author_clients]	No
radius_groups	List	[radius_groups]	No
tacacs_groups	List	[tacacs_groups]	No
accounting	Class	[accounting]	No
authentication	Class	[authentication]	No
authorization	Class	[authorization]	No
radius	Class	[radius]	No
tacacs	Class	[tacacs]	No
usernames	List	[usernames]	No

radius_dynamic_author_clients (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
ip	IP		Yes
key_type	Choice	0, 6, 7	No
key	String		No

radius_groups (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
deadtime	Integer	min: 0, max: 1440	No
server_names	List	String	No
source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, FiftyGigabitEthernet, HundredGigabitEthernet	No
source_interface_id	Any	String or Integer[min: 0]	No

tacacs_groups (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vrf	String		No
server_names	List	String	No
source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, FiftyGigabitEthernet, HundredGigabitEthernet	No
source_interface_id	Any	String or Integer[min: 0]	No

accounting (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
update_newinfo_periodic	Integer		No
system_guarantee_first	Boolean	true, false	No
identities	List	[identities]	No
identity_default_start_stop_groups	List	String	No
commands	List	[commands]	No
connections	List	[connections]	No
execs	List	[execs]	No
networks	List	[networks]	No
dot1x	List	[dot1x]	No
dot1x_defaults	List	Any[String]	No
dot1x_default_start_stop_broadcast	Boolean	true, false	No
dot1x_default_start_stop_group_broadcast	Boolean	true, false	No
dot1x_default_start_stop_group_logger	Boolean	true, false	No

authentication (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
logins	List	[logins]	No
dot1xs	List	[dot1xs]	No
dot1x_defaults	List	Any[String or Choice[local]]	No
enable_defaults_legacy	Any	String or Choice[enable, line, none] or String[Regex: ^.*[\$\%]\{.*$]	No
enable_defaults	List	[enable_defaults]	No

authorization (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
commands	List	[commands]	No
config_commands	Boolean	true, false	No
config_lists	List	[config_lists]	No
console	Boolean	true, false	No
execs	List	[execs]	No
networks	List	[networks]	No

radius (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
attributes	List	[attributes]	No
dead_criteria_time	Integer	min: 1, max: 120	No
dead_criteria_tries	Integer	min: 1, max: 100	No
deadtime	Integer	min: 1, max: 1440	No
servers	List	[servers]	No

tacacs (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
timeout	Integer	min: 1, max: 1000	No
directed_request	Boolean	true, false	No
directed_request_restricted	Boolean	true, false	No
directed_request_no_truncate	Boolean	true, false	No
key	String		No
encryption	Any	0, 6, 7	No
attribute_allow_unknown	Boolean	true, false	No
servers	List	[servers]	No

usernames (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
privilege	Integer	min: 0, max: 15	No
description	String		No
password_encryption	Choice	0, 6, 7	No
password	String		No
secret_encryption	Choice	0, 5, 8, 9	No
secret	String		No

identities (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_broadcast	Boolean	true, false	No
start_stop_group_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
identity_default_start_stop_groups	List	String	No

commands (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
level	Integer	min: 0, max: 15	Yes
list_name	String		Yes
action_type	Choice	start-stop, stop-only	No
group_broadcast	Boolean	true, false	No
group_logger	Boolean	true, false	No
groups	List	String	No

connections (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
none	Boolean	true, false	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
stop_only_broadcast	Boolean	true, false	No
stop_only_group_logger	Boolean	true, false	No
stop_only_groups	List	String	No

execs (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
none	Boolean	true, false	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
stop_only_broadcast	Boolean	true, false	No
stop_only_group_logger	Boolean	true, false	No
stop_only_groups	List	String	No

networks (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_groups	List	String	No

dot1x (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_groups	List	String	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No

logins (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[none, line, enable, local]]	No

dot1xs (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local, cache, radius]]	No

enable_defaults (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
method	Any	String or Choice[enable, line, none] or String[Regex: ^.*[\$\%]\{.*$]	No
cache	Boolean	true, false	No

commands (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
level	Integer	min: 0, max: 15	Yes
list_name	String		Yes
methods	List	Any[String or Choice[local, radius, tacacs, if_authenticated, none]]	No

config_lists (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
groups	List	[groups]	No

execs (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local, radius, tacacs, if_authenticated, none]]	No

networks (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local]]	No

attributes (iosxe.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
number	Integer		Yes
attribute_31_parameters	List	[attribute_31_parameters]	No
send_attributes	List	String	No

servers (iosxe.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip	IP		Yes
authentication_port	Integer	min: 0, max: 65534	No
accounting_port	Integer	min: 0, max: 65534	No
timeout	Integer	min: 1, max: 1000	No
retransmit	Integer	min: 0, max: 100	No
key	String		No
encryption	Any	0, 6, 7	No
automate_tester_username	String		No
automate_tester_ignore_acct_port	Boolean	true, false	No
automate_tester_probe_on_config	Boolean	true, false	No
automate_tester_ignore_auth_port	Boolean	true, false	No
automate_tester_idle_time	Integer	min: 1, max: 35791	No
pac_key	String		No
pac_key_encryption	Any	0, 6, 7	No

servers (iosxe.devices.configuration.aaa.tacacs)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip	IP		Yes
timeout	Integer	min: 1, max: 1000	No
port	Integer	min: 1, max: 65535	No
key	String		No
encryption	Any	0, 6, 7	No

groups (iosxe.devices.configuration.aaa.authorization.config_lists)

Name	Type	Constraint	Mandatory	Default Value
cache	Boolean	true, false	No
method	Any	String or Choice[radius, tacacs] or String[Regex: ^.*[\$\%]\{.*$]	No

attribute_31_parameters (iosxe.devices.configuration.aaa.radius.attributes)

Name	Type	Constraint	Mandatory	Default Value
calling_station_id	Choice	mac, send	No
id_mac_format	Choice	ietf	No
id_mac_lu_case	Choice	lower-case, upper-case	No
id_send_nas_port_detail	Boolean	true, false	No
id_send_mac_only	Boolean	true, false	No

By integrating TACACS+ and RADIUS servers, AAA centralizes and secures user authentication and policy enforcement across the network.

This enhances security, simplifies management, and enables detailed auditing of user actions.

Guidelines and Limitations

• The enable_defaults attribute (as well as any attributes under the enable_defaults attribute) is/are supported starting with Cisco IOS-XE 17.15.1 and later. These attributes are not supported on older versions of Cisco IOS-XE, as the underlying YANG models do not support the definition of multiple enable group targets until IOS-XE 17.15.1.
• For IOS-XE versions prior to 17.15.1, use enable_defaults_legacy instead of enable_defaults. This legacy attribute accepts a single method (enable, line, none) or a group name string.
• Command accounting (accounting.commands[]) requires TACACS+ server groups. RADIUS server groups cannot be used for command accounting.

Sample Configuration:

The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.

AAA Accounting Connections

aaa accounting connection default none
aaa accounting connection my-connection-list start-stop broadcast group tacacs-group1

Full AAA Configuration Example

aaa session-id unique
aaa authentication enable default group testgroup1 enable
aaa authentication enable default cache AUTHCACHE1 enable
aaa local authentication local authorization true
aaa local authentication attempts max-fail 5
aaa accounting system guarantee-first
aaa accounting update newinfo periodic 2880
aaa accounting identity test_identity start-stop broadcast logger group testgroup1
aaa accounting identity default start-stop group testgroup1
aaa accounting exec default start-stop broadcast logger group testgroup1
aaa accounting exec stop_only_exec stop-only broadcast logger group testgroup1
aaa accounting exec none_exec none
aaa accounting commands 15 default start-stop broadcast logger group test_tacacs_group
aaa accounting connection test_connection start-stop broadcast logger group testgroup1
aaa accounting connection default stop-only group testgroup1
aaa accounting network test_network start-stop group testgroup1 group testgroup2
aaa authorization console
aaa authorization network test_network_authz group test_radius_group local
aaa authorization config-commands
aaa authorization configuration test_config_list group test_tacacs_group
aaa authorization commands 15 default group test_tacacs_group
aaa authentication dot1x DOT1X_LOCAL_ONLY local
aaa authentication dot1x DOT1X_RADIUS_LOCAL group radius local
aaa server radius dynamic-author
 client 10.10.10.1 server-key testkey123
!
tacacs server test1
 address ipv4 192.168.0.1
 key testkey
 timeout 5
tacacs server tacacs_10.10.15.13
 address ipv4 10.10.15.13
 key 123
 timeout 4
!
!
radius-server attribute 25 send-attribute include-in-access-req
radius-server attribute 31 mac format ietf
radius-server dead-criteria time 1 tries 3
radius-server deadtime 10
!
radius server test1
 address ipv4 192.168.1.1 auth-port 220 acct-port 221
 timeout 5
 retransmit 3
 automate-tester username test_user ignore-acct-port probe-on
 pac key test_pac
!
aaa group server radius testgroup1
 server name test1
!
aaa group server tacacs+ test_tacacs_group
 server name test1
 ip tacacs source-interface Loopback0
 ip vrf forwarding management
!
username testuser1 privilege 15 password 0 testpassword
username admin privilege 15 secret 0 adminsecret

Example YAML Code:

The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.

iosxe:
  devices:
    - name: Device1
      configuration:
        aaa:
          new_model: true
          session_id: unique
          local_authentication_type: local
          local_authorization: true
          local_authentication_max_fail_attempts: 5
          radius_dynamic_author: true
          radius_dynamic_author_clients:
            - ip: 10.10.10.1
              key_type: "0"
              key: testkey123
          authentication:
            enable_defaults:
              - method: testgroup1
              - method: AUTHCACHE1
                cache: true
              - method: enable
            enable_defaults_legacy: enable
            logins:
              - name: default
                methods:
                  - local
            dot1xs:
              - name: DOT1X_LOCAL_ONLY
                methods:
                  - local
              - name: DOT1X_RADIUS_LOCAL
                methods:
                  - radius
                  - local
          authorization:
            console: true
            config_commands: true
            config_lists:
              - name: test_config_list
                groups:
                  - method: test_tacacs_group
            commands:
              - level: 15
                list_name: default
                methods:
                  - test_tacacs_group
            execs:
              - name: default
                methods:
                  - local
            networks:
              - name: test_network_authz
                methods:
                  - test_radius_group
                  - local
          accounting:
            system_guarantee_first: true
            update_newinfo_periodic: 2880
            execs:
              - name: default
                start_stop_groups:
                  - testgroup1
                start_stop_broadcast: true
                start_stop_group_logger: true
              - name: stop_only_exec
                stop_only_groups:
                  - testgroup1
                stop_only_broadcast: true
                stop_only_group_logger: true
              - name: none_exec
                none: true
            identities:
              - name: test_identity
                start_stop_groups:
                  - testgroup1
                start_stop_group_broadcast: true
                start_stop_group_logger: true
            identity_default_start_stop_groups:
              - testgroup1
            commands:
              - level: 15
                list_name: default
                action_type: start-stop
                group_broadcast: true
                group_logger: true
                groups:
                  - test_tacacs_group
            connections:
              # To configure the default connection accounting method, use name: "default"
              - name: default
                stop_only_groups:
                  - testgroup1
              # Named connection accounting lists can also be configured
              - name: test_connection
                start_stop_groups:
                  - testgroup1
                start_stop_broadcast: true
                start_stop_group_logger: true
            networks:
              - name: test_network
                start_stop_groups:
                  - testgroup1
                  - testgroup2
            dot1x:
              -  name: dot1x_tester
                 start_stop_groups:
                  - group1
                  - group2
                  - group3
                 start_stop_broadcast: true
                 start_stop_group_broadcast: true
                 start_stop_group_logger: true
            dot1x_defaults: [default_group1,default_group2,default_group3]
            dot1x_default_start_stop_broadcast: true
            dot1x_default_start_stop_group_broadcast: true
            dot1x_default_start_stop_group_logger: true
          radius:
            dead_criteria_time: 1
            dead_criteria_tries: 3
            deadtime: 10
            servers:
              - name: test1
                ip: 192.168.1.1
                timeout: 5
                key: testkey
                encryption: 0
                authentication_port: 220
                accounting_port: 221
                retransmit: 3
                automate_tester_probe_on_config: true
                automate_tester_ignore_acct_port: true
                automate_tester_username: test_user
                automate_tester_idle_time: 8
                automate_tester_ignore_auth_port: true
                pac_key: test_pac
                pac_key_encryption: 0
            attributes:
              - number: 25
                send_attributes:
                  - include-in-access-req
              - number: 6
                send_attributes:
                  - on-for-login-auth
              - number: 31
                attribute_31_parameters:
                  - calling_station_id: mac
                    id_mac_format: ietf
          radius_groups:
            - name: testgroup1
              deadtime: 10
              server_names:
                - test1
              source_interface_type: GigabitEthernet
              source_interface_id: 1
          tacacs:
            timeout: 8
            directed_request: true
            directed_request_restricted: true
            directed_request_no_truncate: true
            key: test_key
            encryption: 0
            attribute_allow_unknown: true
            servers:
              - name: test1
                ip: 192.168.0.1
                timeout: 5
                port: 555
                encryption: 0
                key: testkey
          tacacs_groups:
            - name: test_tacacs_group
              server_names:
                - test1
              source_interface_type: Loopback
              source_interface_id: 0
              vrf: management
          usernames:
            - name: testuser1
              privilege: 15
              password_encryption: "0"
              password: testpassword
            - name: admin
              privilege: 15
              secret_encryption: "0"
              secret: adminsecret

AAA (Authentication, Authorization, and Accounting) is a comprehensive security framework that provides centralized access control for network devices and resources. Authentication verifies user identity through credentials, certificates, or other methods; Authorization determines what resources authenticated users can access; and Accounting tracks user activities and resource usage for auditing and billing purposes. This framework integrates with external servers like RADIUS and TACACS+ to provide scalable, centralized security management across enterprise networks.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
aaa	Class	[aaa]	No

aaa (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
new_model	Boolean	true, false	No
session_id	Choice	common, unique	No
local_authentication_type	Choice	enable, local	No
local_authorization	Boolean	true, false	No
local_authentication_max_fail_attempts	Integer	min: 1, max: 65535	No
radius_dynamic_author	Boolean	true, false	No
radius_dynamic_author_clients	List	[radius_dynamic_author_clients]	No
radius_groups	List	[radius_groups]	No
tacacs_groups	List	[tacacs_groups]	No
accounting	Class	[accounting]	No
authentication	Class	[authentication]	No
authorization	Class	[authorization]	No
radius	Class	[radius]	No
tacacs	Class	[tacacs]	No
usernames	List	[usernames]	No

radius_dynamic_author_clients (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
ip	IP		Yes
key_type	Choice	0, 6, 7	No
key	String		No

radius_groups (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
deadtime	Integer	min: 0, max: 1440	No
server_names	List	String	No
source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernet	No
source_interface_id	Any	String or Integer[min: 0]	No

tacacs_groups (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vrf	String		No
server_names	List	String	No
source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernet	No
source_interface_id	Any	String or Integer[min: 0]	No

accounting (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
update_newinfo_periodic	Integer		No
system_guarantee_first	Boolean	true, false	No
identities	List	[identities]	No
identity_default_start_stop_groups	List	String	No
commands	List	[commands]	No
connections	List	[connections]	No
execs	List	[execs]	No
networks	List	[networks]	No
dot1x	List	[dot1x]	No
dot1x_defaults	List	Any[String]	No
dot1x_default_start_stop_broadcast	Boolean	true, false	No
dot1x_default_start_stop_group_broadcast	Boolean	true, false	No
dot1x_default_start_stop_group_logger	Boolean	true, false	No

authentication (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
logins	List	[logins]	No
dot1xs	List	[dot1xs]	No
dot1x_defaults	List	Any[String or Choice[local]]	No
enable_defaults_legacy	Any	String or Choice[enable, line, none] or String[Regex: ^.*[\$\%]\{.*$]	No
enable_defaults	List	[enable_defaults]	No

authorization (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
commands	List	[commands]	No
config_commands	Boolean	true, false	No
config_lists	List	[config_lists]	No
execs	List	[execs]	No
networks	List	[networks]	No

radius (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
attributes	List	[attributes]	No
dead_criteria_time	Integer	min: 1, max: 120	No
dead_criteria_tries	Integer	min: 1, max: 100	No
deadtime	Integer	min: 1, max: 1440	No
servers	List	[servers]	No

tacacs (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
timeout	Integer	min: 1, max: 1000	No
directed_request	Boolean	true, false	No
directed_request_restricted	Boolean	true, false	No
directed_request_no_truncate	Boolean	true, false	No
key	String		No
encryption	Any	0, 6, 7	No
attribute_allow_unknown	Boolean	true, false	No
servers	List	[servers]	No

usernames (iosxe.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
privilege	Integer	min: 0, max: 15	No
description	String		No
password_encryption	Choice	0, 6, 7	No
password	String		No
secret_encryption	Choice	0, 5, 8, 9	No
secret	String		No

identities (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_broadcast	Boolean	true, false	No
start_stop_group_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
identity_default_start_stop_groups	List	String	No

commands (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
level	Integer	min: 0, max: 15	Yes
list_name	String		Yes
action_type	Choice	start-stop, stop-only	No
broadcast	Boolean	true, false	No
group_broadcast	Boolean	true, false	No
group_logger	Boolean	true, false	No
groups	List	String	No

connections (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
default	Boolean	true, false	No
none	Boolean	true, false	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
stop_only_broadcast	Boolean	true, false	No
stop_only_group_logger	Boolean	true, false	No
stop_only_groups	List	String	No
wait_start_broadcast	Boolean	true, false	No
wait_start_group_logger	Boolean	true, false	No
wait_start_groups	List	String	No

execs (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
none	Boolean	true, false	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No
start_stop_groups	List	String	No
stop_only_broadcast	Boolean	true, false	No
stop_only_group_logger	Boolean	true, false	No
stop_only_groups	List	String	No
wait_start_broadcast	Boolean	true, false	No
wait_start_group_logger	Boolean	true, false	No
wait_start_groups	List	String	No

networks (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_groups	List	String	No

dot1x (iosxe.devices.configuration.aaa.accounting)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
start_stop_groups	List	String	No
start_stop_broadcast	Boolean	true, false	No
start_stop_group_broadcast	Boolean	true, false	No
start_stop_group_logger	Boolean	true, false	No

logins (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[none, line, enable, local]]	No

dot1xs (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local, cache, radius]]	No

enable_defaults (iosxe.devices.configuration.aaa.authentication)

Name	Type	Constraint	Mandatory	Default Value
method	Any	String or Choice[enable, line, none] or String[Regex: ^.*[\$\%]\{.*$]	No
cache	Boolean	true, false	No

commands (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
level	Integer	min: 0, max: 15	Yes
list_name	String		Yes
methods	List	Any[String or Choice[local, radius, tacacs, if_authenticated, none]]	No

config_lists (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
groups	List	[groups]	No

execs (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local, radius, tacacs, if_authenticated, none]]	No

networks (iosxe.devices.configuration.aaa.authorization)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
methods	List	Any[String or Choice[local]]	No

attributes (iosxe.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
number	Integer		Yes
attribute_31_parameters	List	[attribute_31_parameters]	No
send_attributes	List	String	No

servers (iosxe.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip	IP		Yes
authentication_port	Integer	min: 0, max: 65534	No
accounting_port	Integer	min: 0, max: 65534	No
timeout	Integer	min: 1, max: 1000	No
retransmit	Integer	min: 0, max: 100	No
key	String		No
encryption	Any	0, 6, 7	No
automate_tester_username	String		No
automate_tester_ignore_acct_port	Boolean	true, false	No
automate_tester_probe_on_config	Boolean	true, false	No
automate_tester_ignore_auth_port	Boolean	true, false	No
automate_tester_idle_time	Integer	min: 1, max: 35791	No
pac_key	String		No
pac_key_encryption	Any	0, 6, 7	No

servers (iosxe.devices.configuration.aaa.tacacs)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip	IP		Yes
timeout	Integer	min: 1, max: 1000	No
port	Integer	min: 1, max: 65535	No
key	String		No
encryption	Any	0, 6, 7	No

groups (iosxe.devices.configuration.aaa.authorization.config_lists)

Name	Type	Constraint	Mandatory	Default Value
cache	Boolean	true, false	No
method	Any	String or Choice[radius, tacacs] or String[Regex: ^.*[\$\%]\{.*$]	No

attribute_31_parameters (iosxe.devices.configuration.aaa.radius.attributes)

Name	Type	Constraint	Mandatory	Default Value
calling_station_id	Choice	mac, send	No
id_mac_format	Choice	ietf	No
id_mac_lu_case	Choice	lower-case, upper-case	No
id_send_nas_port_detail	Boolean	true, false	No
id_send_mac_only	Boolean	true, false	No

By integrating TACACS+ and RADIUS servers, AAA centralizes and secures user authentication and policy enforcement across the network.

This enhances security, simplifies management, and enables detailed auditing of user actions.

AAA Parameters:

• Authentication methods
• Authorization methods
• Accounting methods
• Server group
• TACACS+ server
• RADIUS server
• Shared key
• Timeout
• Retransmit
• Auth port
• Acct port
• Dead criteria
• Deadtime
• Attribute settings
• Username
• PAC key

By default, AAA processes authentication, authorization, and accounting sequentially according to the configured method lists, starting with the first specified method and moving to the next if the previous one fails or is unavailable.

You can use these AAA parameters to define how your device authenticates users, authorizes their actions, and tracks their activity. Customize the methods, server settings, and timeouts to fit your network’s security and operational needs. Adjusting these parameters lets you tailor access control and monitoring for your environment.

Guidelines and Limitations

• The enable_defaults attribute (as well as any attributes under the enable_defaults attribute) is/are supported starting with Cisco IOS-XE 17.15.1 and later. These attributes are not supported on older versions of Cisco IOS-XE, as the underlying YANG models do not support the definition of multiple enable group targets until IOS-XE 17.15.1.

Examples:

tacacs server test1

• Defines a TACACS+ server for centralized authentication with specified address, key, and timeout

radius-server attribute 25 send-attribute include-in-access-req

• Includes RADIUS attribute 25 in access-request messages

radius-server attribute 31 mac format ietf

• Sets MAC address format in RADIUS attribute 31 to IETF standard

 radius-server dead-criteria time <time> tries <count>

• Sets criteria for marking a RADIUS server as dead based on response time and retry attempts

radius-server deadtime <minutes>

• Specifies how long to avoid retrying a dead RADIUS server.

radius server test1

• Configures a RADIUS server with authentication and accounting ports, timeout, retransmit, automated testing, and PAC key options

Sample Configuration:

The following configuration describes how to set up AAA on an IOS-XE device. It lists how to authenticate and authorize users, includes configuration of RADIUS and TACACS+ servers, server groups, timeouts, and custom attributes for robust and secure access control.

tacacs server test1
 address ipv4 192.168.0.1
 key testkey
 timeout 5
tacacs server tacacs_10.10.15.13
 address ipv4 10.10.15.13
 key 123
 timeout 4
!
!
radius-server attribute 25 send-attribute include-in-access-req
radius-server attribute 31 mac format ietf
radius-server dead-criteria time 1 tries 3
radius-server deadtime 10
!
radius server test1
 address ipv4 192.168.1.1 auth-port 220 acct-port 221
 timeout 5
 retransmit 3
 automate-tester username test_user ignore-acct-port probe-on
 pac key test_pac

Example YAML Code:

The following code sets up AAA on an IOS-XE device, specifying how users are authenticated and authorized, how RADIUS and TACACS+ servers are used, and how to handle server groups, timeouts, and custom attributes for robust and secure access control.

iosxe:
  devices:
    - name: Device1
      configuration:
        aaa:
          new_model: true
          authentication:
            logins:
              - name: default
                methods:
                  - local
          authorization:
            execs:
              - name: default
                methods:
                  - local
          accounting:
            dot1x:
              -  name: dot1x_tester
                 start_stop_groups:
                  - group1
                  - group2
                  - group3
                 start_stop_broadcast: true
                 start_stop_group_broadcast: true
                 start_stop_group_logger: true
            dot1x_defaults: [default_group1,default_group2,default_group3]
            dot1x_default_start_stop_broadcast: true
            dot1x_default_start_stop_group_broadcast: true
            dot1x_default_start_stop_group_logger: true
          radius:
            dead_criteria_time: 1
            dead_criteria_tries: 3
            deadtime: 10
            servers:
              - name: test1
                ip: 192.168.1.1
                timeout: 5
                key: testkey
                encryption: 0
                authentication_port: 220
                accounting_port: 221
                retransmit: 3
                automate_tester_probe_on_config: true
                automate_tester_ignore_acct_port: true
                automate_tester_username: test_user
                automate_tester_idle_time: 8
                automate_tester_ignore_auth_port: true
                pac_key: test_pac
                pac_key_encryption: 0
            attributes:
              - number: 25
                send_attributes:
                  - include-in-access-req
              - number: 6
                send_attributes:
                  - on-for-login-auth
          radius_groups:
            - name: testgroup1
              deadtime: 10
              source_interface_type: GigabitEthernet
              source_interface_id: 1
          tacacs:
            timeout: 8
            directed_request: true
            directed_request_restricted: true
            directed_request_no_truncate: true
            key: test_key
            encryption: 0
            attribute_allow_unknown: true
            servers:
              - name: test1
                ip: 192.168.0.1
                timeout: 5
                port: 555
                encryption: 0
                key: testkey