# AAA and Device Access Security

> Chapter 16 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/aaa-and-device-access-security

**Official objective:** 4.3 — Configure and verify AAA for device access

## Introduction

AAA is a security framework that controls who can access a network device, what they can do on it, and keeps a record of every action they take. For the 300-410 ENARSI exam, you must understand how to configure and verify AAA on Cisco routers and switches because it is the standard method for securing device access in enterprise networks. Without AAA, you would have to manage usernames and passwords on every single device individually, which is impractical and insecure at scale.

## The Five-Hotel Security Desk Analogy

On a Friday evening, 50 guests are queued at the entrance of a five-hotel resort complex. Each hotel has its own entrance, but the resort uses one central security desk for all of them. The first guest approaches. The security guard asks for a photo ID and a booking confirmation. This step is Authentication — proving you are who you say you are. The guard checks the ID against a central list of confirmed guests. If the name matches, the guard hands the guest a wristband colour-coded for their hotel. The colour determines which buildings the guest can enter: blue wristband for the main block, gold for the executive wing, red for the staff area. This step is Authorisation — what you are allowed to do once you are inside. At midnight, the guard logs every entry and exit into a book. Every time a guest swipes their wristband at a door, the system records the time and location. The next morning, the resort manager reviews the log to see who entered the pool area after hours. This step is Accounting — keeping a detailed record of what each authenticated user did.

Without the central desk, each hotel would need its own staff and its own guest list, leading to chaos and long queues. The single security desk makes the process faster, more secure, and easier to audit. This is precisely what AAA does for a network: it centralises who can get in (Authentication), what they can do once inside (Authorisation), and what they actually did (Accounting).

## Core explanation

AAA stands for Authentication, Authorisation, and Accounting. It is a framework used by Cisco IOS devices to control access to the device itself — typically for management purposes like logging into a router to change its configuration.

Before AAA existed, network administrators configured a local username and password on each router, stored in the device's local memory. This approach has serious problems. If you have 200 routers, you must update the password on each one individually. If an employee leaves the company, you must change passwords everywhere. There is no central log of who logged into which device or what they did. AAA solves all of this.

How AAA works: The network device (a router or switch) acts as a client that sends authentication requests to a central server. The most common server protocol is RADIUS (Remote Authentication Dial-In User Service) or TACACS+ (Terminal Access Controller Access Control System Plus). Cisco devices use TACACS+ as the preferred protocol because it encrypts the entire packet and separates authentication, authorisation, and accounting into separate services.

Let's break down each component.

Authentication is the process of verifying identity. When you connect to a router via SSH, the router prompts for a username and password. The router does not check the password locally; instead, it sends the credentials to the AAA server. The server checks the credentials against its database and responds with either "accept" or "reject." If accepted, the user gains access. If rejected, the connection is dropped. Common methods include local authentication (using the router's own username database), server-based authentication (using RADIUS or TACACS+), and line authentication (using the console or vty password).

Authorisation determines what commands the authenticated user is allowed to execute. After authentication succeeds, the router sends a second request to the AAA server: "This user is logged in. What is their privilege level? Which commands can they run?" The server responds with an authorisation profile. For example, a junior technician might only be allowed to run "show" commands (read-only), while a senior engineer can enter global configuration mode and change routing protocols. Authorisation can also be used to control access to specific interfaces or services.

Accounting is the logging and auditing component. The router sends real-time updates to the AAA server about what the user is doing. Every time the user enters a command, the router sends an accounting record with the command text, the timestamp, and the source IP address. This creates a complete audit trail. If a router crashes, you can check the accounting logs to see who made the last configuration change. Accounting records are typically sent using a protocol called RADIUS Accounting or TACACS+ Accounting.

The configuration process on a Cisco device involves three main steps.

First, you enable AAA globally with the command 'aaa new-model'. This one command turns on the AAA framework and disables the older, less secure authentication methods.

Second, you define the method list for authentication. A method list is a list of one or more authentication sources, tried in order. For example: 'aaa authentication login default group tacacs+ local'. This tells the router: first try TACACS+, and if the server is unreachable, fall back to the local username database.

Third, you apply the method list to the lines (console, vty, aux) or to the entire device. For example: 'line vty 0 4' then 'login authentication default'.

You also need to configure the router as a client of the AAA server. This means specifying the server IP address and a shared secret key that both the router and server know. For TACACS+, the command looks like: 'tacacs-server host 10.1.1.100 key CiscoSecret123'.

Verifying AAA is done using 'show aaa sessions' to see active authentication sessions, 'show aaa servers' to check the status of configured servers, and 'debug aaa authentication' to troubleshoot authentication failures. Common verification tasks on the exam include checking that the router is communicating with the AAA server and that method lists are applied correctly.

Why does AAA exist? It replaces the insecure and unmanageable model of local device-by-device administration. In a large enterprise, you might have hundreds of network devices. AAA centralises user management, enforces consistent security policies, and provides an unchangeable log of all administrative activity. It is also required for compliance with security standards like PCI-DSS and ISO 27001.

AAA is not just for router login. It can also be used for VPN authentication, wireless network access, and even for granting access to the network itself via 802.1X port-based authentication. However, for the 300-410 exam, the focus is specifically on device access security — controlling who can log into the router or switch and what they can do.

## Real-world context

Imagine you are the new network engineer for a company called GlobalTech with 250 Cisco routers and switches spread across 12 offices. The previous admin left the devices with standard local accounts: user 'admin' with password 'admin' on every device. Your first task is to implement AAA for device access.

Here is what you actually do on the job.

First, you set up a central AAA server. In most enterprises, this is a Cisco ISE (Identity Services Engine) appliance, but it could also be a Linux server running FreeRADIUS. You install the server software, create a user database with all network staff, and assign each user a privilege level. For example, the junior NOC team gets privilege level 7 (limited commands), the senior engineers get privilege level 15 (full access).

Second, you configure the shared secret key on both the server and all routers. You write a script using Python or Ansible to push the following configuration to all 250 devices: 'aaa new-model', 'tacacs-server host 10.10.10.100 key globaltech-secret-2024', and 'aaa authentication login default group tacacs+ local'. You also configure 'aaa authorization exec default group tacacs+ local' so that after login, the router asks the server what privilege level the user should have.

Third, you configure accounting. You add 'aaa accounting exec default start-stop group tacacs+' and 'aaa accounting commands 15 default start-stop group tacacs+'. This tells the router to send a log every time a user starts or ends a session, and for every command executed at privilege level 15.

Fourth, you test the setup. You open an SSH session from your laptop to one router. You log in with a test user account. If the AAA server replies, you are authenticated. You try to run 'configure terminal'. If the server authorises it, the command succeeds. If the server denies it, the command fails with 'Authorization denied'. You then check the accounting logs on the ISE server to see that the login and commands were recorded.

Fifth, you handle failover. You configure multiple AAA servers in case the primary goes down: 'tacacs-server host 10.10.10.101 key globaltech-secret-2024'. The router automatically tries the second server if the first does not respond.

Sixth, you create more granular method lists for different access types. For example, you might allow local authentication on the console port even if the AAA servers are unreachable, because you need to be able to fix the network from a direct connection: 'aaa authentication login CONSOLE local' and then apply it to line con 0.

The final result: a consistent, auditable, and scalable access control system. When the CEO asks who changed the BGP configuration last week, you can run a report from the AAA server showing exactly which user, from which IP address, at what time, and the exact command they typed.

## Exam focus

The 300-410 exam tests configure and verify AAA for device access in several specific ways. You need to know the exact commands, the order of operations in method lists, and how to troubleshoot when AAA fails.

What they test:

- 'aaa new-model' command: They will ask what happens when you issue this command. Answer: It enables AAA globally and disables local authentication on all lines except the console. The console still uses local authentication unless overridden. This is a common trap.

- Method lists: You will be asked to configure authentication for VTY lines. They give a scenario: "Configure AAA so that users authenticate first via TACACS+, then fall back to the local database, and if neither works, no authentication." The correct command: 'aaa authentication login default group tacacs+ local none'. The order matters. The 'none' keyword means "if all methods are unavailable, allow access without authentication." They love to test 'none' vs 'local' vs 'enable'.

- TACACS+ vs RADIUS: They will compare the two. TACACS+ uses TCP port 49 and encrypts the entire packet body. RADIUS uses UDP ports 1812/1813 and only encrypts the password. TACACS+ separates authentication, authorisation, and accounting into three distinct functions. RADIUS combines authentication and authorisation. Cisco devices prefer TACACS+ for device administration. You must know these differences.

- Authorisation commands: 'aaa authorization exec default group tacacs+ local' controls whether a user can start an EXEC shell. 'aaa authorization commands 15 default group tacacs+' controls whether a specific command at privilege level 15 is allowed. The exam will test which command applies to which scenario.

- Accounting: They test the difference between 'start-stop' and 'stop-only'. 'start-stop' sends a record when the session starts and when it ends. 'stop-only' sends only the stop record. For billing or auditing purposes, you need start-stop.

- Debug and show commands: 'debug aaa authentication', 'debug tacacs', 'show aaa servers', 'show aaa sessions'. They might ask which command shows failed authentication attempts. The answer: 'debug aaa authentication' shows real-time failures.

Common traps:

- Forgetting that 'aaa new-model' overrides existing local authentication. If you then apply a method list that fails, you lock yourself out. The exam loves scenarios where an engineer configures AAA incorrectly and ends up unable to access the router. The fix is to have a local fallback or console access.

- Mistaking the order of keywords in method lists. The correct syntax is: 'aaa authentication login {list-name} {method1} {method2} ...'. They might present a configuration with 'group tacacs+' and 'local' reversed.

- Confusing authorisation and authentication. Authentication is 'who you are'. Authorisation is 'what you can do'. The exam may give a situation where the user can log in but cannot run any commands — that is an authorisation problem, not an authentication problem.

- Not knowing that TACACS+ uses TCP. RADIUS uses UDP. This is a frequent multiple-choice point.

Concepts to memorise:

- 'aaa new-model'
- 'aaa authentication login default group tacacs+ local'
- 'aaa authorization exec default group tacacs+ local'
- 'aaa accounting exec default start-stop group tacacs+'
- 'tacacs-server host {ip} key {key}'
- 'show aaa servers'
- 'debug aaa authentication'
- The seven-layer method list (enable, line, local, none, group radius, group tacacs+, if-authenticated)

The exam may present a configuration with a typo, like 'tacacs-server host 10.1.1.1 key cisco' missing a keyword. They ask why authentication fails. The answer: the shared key does not match between the router and the server.

## Step by step

1. **Enable AAA Globally** — Enter global configuration mode and type 'aaa new-model'. This activates the AAA framework and changes how the router handles authentication. It automatically disables local authentication on VTY lines, forcing you to define a method list or risk being locked out.
2. **Configure the AAA Server Details** — Specify the IP address and shared secret of your TACACS+ or RADIUS server. For TACACS+, use 'tacacs-server host 10.1.1.100 key MySecretKey'. This tells the router where to send authentication requests and the key to encrypt communication.
3. **Create Authentication Method Lists** — Define a login authentication list using 'aaa authentication login default group tacacs+ local'. This list tells the router: first try TACACS+, and if that fails, check the local usernames on the router. The 'default' keyword applies this method list to all lines automatically.
4. **Configure Authorisation** — Set up authorisation for EXEC sessions and commands. Use 'aaa authorization exec default group tacacs+ local' to control if a user can start a shell. Use 'aaa authorization commands 15 default group tacacs+ local' to control which privilege level 15 commands are allowed.
5. **Configure Accounting** — Enable accounting to log user activity. Use 'aaa accounting exec default start-stop group tacacs+' to log when sessions start and end. Use 'aaa accounting commands 15 default start-stop group tacacs+' to log every privileged command executed.
6. **Verify the Configuration** — Use 'show aaa servers' to confirm the router is communicating with the AAA server. Use 'show aaa sessions' to see active authenticated sessions. Test by SSHing into the router with a test user account and checking the AAA server logs for the authentication and accounting records.

## Comparisons

### AAA Authentication vs AAA Authorisation

**AAA Authentication:**
- Determines who the user is by verifying credentials (username and password).
- Runs first in the AAA process; without successful authentication, authorisation never occurs.
- Configured with the 'aaa authentication login' command.

**AAA Authorisation:**
- Determines what the user is allowed to do (which commands or interfaces they can access).
- Runs after authentication; the router asks the server for a permission profile for the authenticated user.
- Configured with the 'aaa authorization' command (e.g., 'aaa authorization exec').

### TACACS+ vs RADIUS

**TACACS+:**
- Encrypts the entire packet body, including username and commands.
- Uses TCP port 49, which provides reliable delivery.
- Separates authentication, authorisation, and accounting into three separate functions.

**RADIUS:**
- Only encrypts the password in the packet; the rest is in plain text.
- Uses UDP ports 1812 (authentication/authorisation) and 1813 (accounting), which is connectionless.
- Combines authentication and authorisation into one request/response; accounting is separate.

### Local Authentication vs AAA Server Authentication

**Local Authentication:**
- Usernames and passwords are stored in the router's local memory.
- Requires manual updates on every device when users change.
- No centralised audit trail; logs are limited to the router's own buffer.

**AAA Server Authentication:**
- Credentials are stored on a central server (TACACS+ or RADIUS).
- User changes are made once on the server and propagate to all devices automatically.
- Provides centralised accounting logs for compliance and troubleshooting.

### 'start-stop' Accounting vs 'stop-only' Accounting

**'start-stop' Accounting:**
- Sends an accounting record when the session starts and another when it ends.
- Provides complete session duration data, which is useful for billing or audit trails.
- Configured with 'aaa accounting exec default start-stop group tacacs+'.

**'stop-only' Accounting:**
- Only sends an accounting record when the session ends.
- Does not record session start time, so you cannot calculate session duration from the AAA server data.
- Configured with 'aaa accounting exec default stop-only group tacacs+'.

## Diagram

_This flowchart shows the complete AAA authentication, authorisation, and accounting process from a user's SSH connection to a Cisco router._

```mermaid
flowchart TD
    A[User SSH to Router] --> B{Router: AAA Enabled?}
    B -- Yes --> C[Send Credentials to AAA Server]
    C --> D{Server Responds?}
    D -- Accept --> E[Authentication Successful]
    D -- Reject --> F[Authentication Failed - Access Denied]
    E --> G[Server Sends Authorisation Profile]
    G --> H{User Authorised?}
    H -- Yes --> I[User Enters EXEC Shell]
    H -- No --> J[Access Restricted]
    I --> K[Router Sends Accounting Records]
    K --> L[Server Logs Commands, Time, IP]
    B -- No --> M[Use Local Database or Line Password]
    M --> N[Local Check]
    N --> O[Grant or Deny Access]
```

## Common misconceptions

- **Misconception:** AAA only applies to remote access (VPN) and not to local router login. **Reality:** AAA is commonly used for router and switch management access (SSH, console) and is the primary method for device access security in enterprise networks. (People hear 'AAA' in the context of network access control (802.1X) and assume it is only for end-user network connectivity, forgetting the 'device access' part of the exam objective.)
- **Misconception:** If you configure 'aaa new-model', you can still use the old 'enable password' command exactly as before. **Reality:** After 'aaa new-model', the 'enable password' and 'enable secret' are still used, but the authentication process defers to the AAA method lists. The enable password becomes the fallback if no AAA server is available, not the primary method. (The 'enable' command still works, so people think nothing has changed, but the priority of authentication sources is now controlled by AAA method lists.)
- **Misconception:** RADIUS and TACACS+ are interchangeable and can be used for the same purpose without changes. **Reality:** TACACS+ encrypts the entire packet (including username and command), while RADIUS only encrypts the password. TACACS+ separates authentication, authorisation, and accounting; RADIUS combines auth and authz. Cisco recommends TACACS+ for device administration, RADIUS for network access (like wireless). (Both are AAA protocols, so beginners think they do the same thing, but they are optimised for different use cases and have different security properties.)
- **Misconception:** If the AAA server is unreachable, the user is automatically denied access with no login possible. **Reality:** The method list determines fallback. If you configure 'group tacacs+ local', the router will fall back to the local database if the server is unreachable. If you add 'none' at the end, it will allow access with no authentication if all methods fail. (Beginners assume AAA is an all-or-nothing system, but the method list gives administrators fine-grained control over fallback behaviour, which is essential for maintaining access during outages.)
- **Misconception:** Accounting is optional and not needed for the exam. **Reality:** Accounting is a core part of AAA and is tested. You must know how to configure 'aaa accounting exec' and 'aaa accounting commands' and the difference between 'start-stop' and 'stop-only'. (Many study guides focus heavily on authentication, so students neglect the accounting and authorisation sections, but the exam objective explicitly includes all three.)
- **Misconception:** You must configure AAA on every interface of the router to secure device access. **Reality:** AAA for device access is applied to the lines (console, vty, aux) that control how you connect to the device, not to the data interfaces (GigabitEthernet, Serial). (Newcomers confuse 'network access control' (applied to interfaces via 802.1X) with 'device access control' (applied to management lines).)

## Key takeaways

- AAA stands for Authentication (who you are), Authorisation (what you can do), and Accounting (what you did).
- The 'aaa new-model' command enables AAA globally on a Cisco device and disables the older, insecure authentication methods.
- TACACS+ encrypts the entire packet and separates authentication, authorisation, and accounting; RADIUS only encrypts the password and combines authentication with authorisation.
- A method list defines the order of authentication sources to try, such as 'group tacacs+' then 'local' then 'none'.
- The 'aaa authentication login default' command applies the method list to all VTY lines, while a named list can be applied to specific lines like the console.
- Accounting with 'start-stop' sends logs both when a session begins and ends, providing a complete audit trail for compliance.

## FAQ

**What is the difference between AAA and a simple local username/password on a router?**

A local username/password is stored on the router itself, so you must manage it on every device individually. AAA centralises user management on a server, supports role-based access, and logs all activity.

**Can I use RADIUS instead of TACACS+ for device access?**

Yes, you can, but Cisco recommends TACACS+ for device administration because it encrypts the entire packet and separates authentication, authorisation, and accounting. RADIUS is better suited for network access (like wireless).

**What happens if the AAA server goes down?**

The router tries the next method in the method list. If you configured 'group tacacs+ local', it falls back to the local user database. If you also added 'none', it allows access without any authentication if all methods fail.

**What is the 'aaa new-model' command and why is it important?**

'aaa new-model' is the command that enables the AAA security framework on a Cisco device. Without it, AAA commands are not available, and the device uses older, less secure authentication methods.

**How do I see which users are currently logged into a router via AAA?**

Use the command 'show users' to see active sessions, or 'show aaa sessions' to see detailed AAA session information including the authentication method used.

**What is the 'none' keyword in a method list for?**

The 'none' keyword tells the router to allow access without any authentication if all other methods in the list fail. It is a last-resort option to prevent being locked out of the device during a server outage.

## Check your understanding

1. **Which command enables the AAA security framework on a Cisco router?**

   Answer: The command is 'aaa new-model'. It must be entered in global configuration mode to enable all AAA features.

2. **What is the difference between the 'local' and 'none' keywords in an authentication method list?**

   Answer: 'local' means fall back to the router's own username database. 'none' means allow access without any authentication if all other methods fail.

3. **Which protocol should you use for device access AAA on Cisco routers: TACACS+ or RADIUS?**

   Answer: Cisco recommends TACACS+ because it encrypts the entire packet and separates authentication, authorisation, and accounting into separate services.

4. **A user can log into a router but cannot enter global configuration mode. Is this an authentication or authorisation problem?**

   Answer: This is an authorisation problem. Authentication succeeded (the user was able to log in), but the AAA server did not authorise the user for privilege level 15 commands.

5. **What does the 'show aaa servers' command display?**

   Answer: It displays the status of all configured AAA servers, including whether they are up or down, the number of requests sent, and the time since the last reply.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/aaa-and-device-access-security