AAA Explained: Authentication, Authorization, and Accounting on Cisco Devices
Learn how AAA controls administrative access on Cisco devices, including authentication, authorization, accounting, local databases, RADIUS, TACACS+, and Cisco Secure ACS.
What AAA Means
AAA is an access-control framework made up of authentication, authorization, and accounting. It helps control and track users who connect to network infrastructure such as routers, switches, and security appliances.
For administrative access, AAA can answer three related questions:
- Authentication: Who is the user?
- Authorization: What is that authenticated user allowed to do?
- Accounting: What did the user do, and how much of the service or resource did the user consume?
These functions commonly operate as one workflow. A user first proves an identity, receives a set of permitted actions, and then generates activity records during the session.
Authentication: Verifying Identity
Authentication is the process of validating a user's claimed identity before access is granted. The most familiar example is entering a username and password.
Consider an administrator connecting to a router through its console port. The router checks the supplied credentials against an identity source. That source can be:
- A local database stored directly on the router.
- A centralized external AAA service that the router contacts over the network.
With local authentication, the device maintains user records itself. With centralized authentication, several devices can use the same identity service instead of maintaining separate user lists.
RADIUS and TACACS+
RADIUS is a remote-access AAA protocol commonly used to centralize authentication and related access decisions. A router forwards an authentication request to a RADIUS server, which checks the credentials and returns a result.
TACACS+ is another protocol commonly used for centralized administrative AAA. It is particularly useful when an organization needs detailed control over device administration and commands.
Neither RADIUS nor TACACS+ changes the meaning of authentication: both provide a way for a device to consult an external service when validating a user's identity.
Authorization: Controlling Permitted Actions
Authorization occurs after successful authentication. It assigns and enforces the resources, services, commands, and administrative functions available to the authenticated user.
Authentication and authorization are separate decisions. Authentication proves that a person is associated with a particular account; authorization determines what that account may do.
For example, two administrators can both successfully log in to the same router but receive different permissions:
- One administrator may view status information and make configuration changes.
- Another administrator may have limited access and be unable to modify or remove protected settings.
Authorization can therefore limit what a user can view, alter, remove, or otherwise manage. The exact controls depend on the device, software image, AAA service, and configured policy.
Accounting: Recording Activity
Accounting collects records about user sessions and actions involving network resources. The records are commonly stored as session statistics and usage data.
Useful accounting information can include:
- Session start time and duration.
- Data sent or received.
- Network usage.
- Services accessed.
- Administrative activity performed during a device-management session.
Accounting does not decide whether an action is permitted. Authorization defines allowed activity, while accounting records activity.
Organizations use accounting data for auditing, usage analysis, capacity planning, billing, and cost allocation. For example, an audit can use session records to establish who accessed a device and when the access occurred.
Comparing the Three AAA Functions
| AAA function | Core question answered | When it occurs | Example outcome |
|---|---|---|---|
| Authentication | Who are you? | Before access is granted | The router accepts valid credentials for an administrator. |
| Authorization | What are you allowed to do? | After authentication succeeds | The administrator receives permission to view or change selected resources. |
| Accounting | What happened during the session? | During and after access | The system records connection time, services used, and activity statistics. |
Local AAA and Centralized AAA
Local AAA
In a local AAA design, user information and authorization details are stored on the Cisco device itself. A router can check its local user database when an administrator connects through the console or another management method.
Local AAA is straightforward for a small environment or for initial access to a device. However, each device may require its own account updates. As the number of devices grows, keeping usernames, passwords, and permissions consistent becomes more difficult.
Centralized AAA
In centralized AAA, a separate server stores identities, credentials, and access-policy information. Multiple routers and other devices consult that service when administrators connect.
Centralization simplifies administrative management because changes can be made in one policy and credential system. It also scales better across many devices and supports more consistent access control. The design does introduce dependencies: devices need network reachability to the AAA service, and the service must be available when centralized authentication is required.
| Option | Where user and policy data resides | Typical use | Key consideration |
|---|---|---|---|
| Local device database | On the router or other Cisco device | Small deployments, device-specific access, or fallback access | Simple to start, but difficult to manage consistently across many devices. |
| RADIUS server | On a centralized RADIUS service | Centralized authentication and related access decisions | Requires server reachability and compatible device support. |
| TACACS+ server | On a centralized TACACS+ service | Centralized administrative access and detailed device-management control | Useful for controlling administrative operations and commands. |
| Cisco Secure ACS deployment models | On a dedicated appliance or server, Windows software installation, or virtual machine, depending on the deployment | Centralized storage and enforcement of administrator identity and access information | Requires suitable software, platform, and Cisco device feature support. |
Cisco Secure ACS Context
Cisco Secure ACS, or Cisco Secure Access Control Server, was a Cisco centralized AAA product family. It provided a location for maintaining administrator identities, credentials, and access policies, then helped enforce those policies for devices that consulted it.
ACS was not the definition of AAA. AAA is the broader access-control framework; ACS represented one centralized product approach for implementing that framework. ACS deployments were referenced in several forms, including a dedicated appliance or server, Windows software, and a virtual-machine deployment.
ACS is best understood as a legacy Cisco product context. The general lesson remains important: a centralized AAA service can provide shared identity management, policy enforcement, and accounting for many infrastructure devices.
When planning any Cisco AAA implementation, verify that the device has a software image and feature support appropriate for the required secure AAA capabilities. Device model, software release, protocol support, and available licenses or features can affect what is possible.
Centralized Device Administration Example
Suppose an organization administers several routers. With local AAA, each router has an independent user list. Adding an administrator or changing a password requires updates on multiple devices.
With centralized AAA, the routers consult one RADIUS or TACACS+ service. A centralized platform such as Cisco Secure ACS can store the identity and access policy information. Administrators can then be managed from one location, while devices apply the returned authentication and authorization decisions.
The workflow is:
- An administrator connects to a router, for example through the console.
- The router sends the credentials to its selected local or remote authentication source.
- The source validates the identity.
- After successful authentication, authorization determines the administrator's permitted access.
- During the session, accounting records connection details and other available activity or usage data.
Examples of Accounting Data and Uses
| Recorded item | Example | Operational use |
|---|---|---|
| Session duration | Login at 09:00 and logout at 10:15 | Auditing access windows and analyzing administrator activity. |
| Data transferred | Bytes sent or received during a service session | Usage analysis, capacity planning, billing, or cost allocation. |
| Services accessed | Console, remote management, or another network service | Reviewing which services are being used and whether usage matches policy. |
| Administrative activity | Recorded management actions or commands, where supported | Investigating changes and establishing what occurred during an audit. |
Troubleshooting AAA Access
Administrator Cannot Log In to a Router Console
- Check whether the supplied username and password match the selected authentication source.
- If local authentication is used, verify that the intended local user entry exists on the device.
- If centralized authentication is used, check whether the configured AAA server is reachable and available.
- Confirm that the device software and configured AAA method support the intended access type.
User Can Log In but Cannot Perform an Administrative Action
- Confirm that authentication succeeded; the problem may be an authorization decision rather than a credential failure.
- Check whether the user's assigned privileges include the requested resource or operation.
- Review restrictions on viewing, changing, removing, or managing the affected setting.
No Record of an Administrative Session Exists
- Check whether accounting is enabled for the relevant access session.
- Verify that session statistics and usage records are being sent to or retained by the selected logging destination.
- Check connectivity and availability between the device and the centralized accounting service, when one is used.
Exam-Relevant Distinctions
- Authentication verifies identity.
- Authorization assigns permitted resources and actions after authentication.
- Accounting records sessions, activity, and usage.
- A local database keeps user and access information on the device.
- RADIUS and TACACS+ support remote, centralized AAA services.
- Cisco Secure ACS was a centralized Cisco AAA product family, not the AAA concept itself.
- Centralized AAA generally scales and manages more easily than independent local accounts, but it depends on the availability and reachability of the central service.
For related device-management security concepts, see passwords on IOS devices, protecting the management plane, and what Cisco ACS is. For deployment-focused material, review configuring routers to use ACS.