Authentication, authorization, accounting
- Authentication: who are you? (user name and password)
- Authorization: what may you do? (privilege level, commands)
- Accounting: what did you do? (a log of logins and commands)
With twenty routers, local users mean twenty copies of every account. An AAA server (Cisco ISE, FreeRADIUS, tac_plus) keeps them in one place. Routers ask it with one of two protocols:
| TACACS+ | RADIUS | |
|---|---|---|
| Transport | TCP 49 | UDP 1812 (auth) and 1813 (accounting); old ports 1645/1646 |
| Encrypts | The whole body of the packet | Only the password |
| AAA | Authentication, authorization and accounting separate | Authentication and authorization combined |
| Typical use | Administrators logging in to network devices | Network access: Wi-Fi (802.1X), VPN users |
| Origin | Cisco | Open standard |
Configuring AAA
aaa new-modelturns on AAA (and changes how every line logs in).- Define the servers:
tacacs server NAME/radius server NAMEwith an address and a shared key. - Method lists:
aaa authentication login default group tacacs+ localtries the TACACS+ servers, and only if none answers the local users. aaa authorization exec default group tacacs+ locallets the server's privilege level count.- Keep a local user as a back door for when the server is down.
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#username admin privilege 15 secret Local!Admin1 R1(config)#aaa new-model R1(config)#tacacs server AAA1 R1(config-server-tacacs)#address ipv4 10.1.1.50 R1(config-server-tacacs)#key AAA!Key19 R1(config-server-tacacs)#exit R1(config)#aaa authentication login default group tacacs+ local R1(config)#aaa authorization exec default group tacacs+ local R1(config)#end *Mar 1 00:00:11.000: %SYS-5-CONFIG_I: Configured from console by console R1#test aaa group tacacs+ netadmin Net!Admin19 legacy Attempting authentication test to server-group tacacs+ using tacacs+ User was successfully authenticated. R1#test aaa group tacacs+ netadmin wrong legacy Attempting authentication test to server-group tacacs+ using tacacs+ User authentication request was rejected by server. ▶ ADMIN NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>telnet 10.1.1.1 Connecting To 10.1.1.1... User Access Verification Username: netadmin Password: R1#show privilege Current privilege level is 15 R1#exit Connection to host lost.
The fallback only happens when the server doesn't answer (down, unreachable, wrong key). A server that says "wrong password" is final: R1 doesn't then try the local user.
RADIUS
The same idea with radius server:
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#aaa new-model R1(config)#radius server RAD1 R1(config-radius-server)#address ipv4 10.1.1.50 auth-port 1812 acct-port 1813 R1(config-radius-server)#key AAA!Key19 R1(config-radius-server)#exit R1(config)#aaa authentication login default group radius local R1(config)#end *Mar 1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console R1#test aaa group radius helpdesk Help!Desk19 legacy Attempting authentication test to server-group radius using radius User was successfully authenticated.
Common mistake: Typing
aaa new-modelwith no method list and no local users can lock you out of the vty lines: they now want a local user name. Create a local user first.
Remember: TACACS+: TCP 49, whole packet encrypted, admin logins. RADIUS: UDP 1812/1813, only the password encrypted, network access.