AAA TACACS+ and RADIUS Tutorial

AAA Configuration

The following steps are required to configure AAA:

1. Enable the “new model” of AAA.
2. Configure the server(s) to be used for AAA (e.g. TACACS+ or RADIUS servers).
3. Define authentication and authorization method lists.
4. Enforce AAA authentication on the relevant lines (e.g. console and VTY lines).

Example:

In this example we will do an Authentication configuration so that the users are authenticated when telnet to the device:

1. Globally enables AAA on a device:

2. We are going to configure the server to be used for AAA and the key; note that the key used is the same key that was configured on the RADIUS server.

In the above command we don’t specify the ports used for RADIUS authentication and accounting so it will use the default values of 1645 and 1646, respectively (or we can specify them via the “radius-server host 192.168.1.2 auth-port 1645 acct-port 1646 key MySecretP@ssword” command). The full syntax of above command is:

Switch(config)# radius-server host { hostname | ip-address } [ auth-port port-number ] [ acct-port port-number ] [ timeout seconds ] [ retransmit retries ] [ key string] [alias {hostname | ip address}]

3. We will activate authentication for logins to the device and specify that RADIUS is the preferred method but we should include the local user database as a fall back if RADIUS becomes unavailable. Note that users in the local database cannot be used if the user doesn’t exist in RADIUS, it will only fall back if the RADIUS server is offline.

This command is broken down as follows:

+ The ‘aaa authentication’ part is simply saying we want to configure authentication settings.
+ The ‘login’ is stating that we want to prompt for a username/password when a connection is made to the device.
+ The ‘default’ means we want to apply for all login connections (such as tty, vty, console and aux). If we use this keyword, we don’t need to configure anything else under tty, vty and aux lines. If we don’t use this keyword then we have to specify which line(s) we want to apply the authentication feature. An example of not using the ‘default’ keyword is shown in step 4 below.
+ The ‘group radius local” means all users are authenticated using RADIUS servers (the first method). If the RADIUS servers don’t respond (unreachable), then the router’s local database is used (the second method). But notice that if the RADIUS server is reachable while the user has not configured on it, it will not fallback and try to search in the local database. It will display% Authentication failed message.

Note: If we don’t have the ‘local’ keyword (only ‘aaa authentication login default group radius’ command then the authentication will fail if the AAA server does not reply to the authentication request as there is no fallback authentication method)

For local authentication to work we need to create a local user. To create a new user, with password stored in plain text:

But having passwords in plain text isn’t a good idea! The below command is better to create a new user, with password stored in encrypted text:

specify the RADIUS server and a group to be used.

4. In step 3, if we don’t use the ‘default’ login method list, for example:

Then we have to configure the same group (MY_AUTHEN_GROUP in this case) to the specific line(s) with the “login authentication list_name” command. For example we want to apply to VTY lines (for telnet):

Note:
+ We can configure different usernames/passwords on the local device and the remote AAA server but for normal users we should configure same usernames/passwords on both devices so that the transition (in case the remote AAA server fails) is transparent to them.
+ Use the aaa authentication global configuration command to define method lists for RADIUS authentication
+ Use the aaa authorization global command to authorize specific user functions
+ Use the aaa accounting command to enable accounting for RADIUS connections

So in conclusion this is all the config we need for a simple authentication using AAA:

A simple TACACS+ configuration for authentication would be:

With this configured, when logging in, the password supplied will be attempted to be verified by the TACACS+ server before access is granted. If the server is unavailable/unreachable, then the switch will fall back to using the local authentication database.

In the next part we will see some examples of configuring AAA.