AAA separates network user access control into authentication, authorization, and accounting. It provides a structured way to control access while recording activity in an interconnected network. section 11.4 section 11.0
AAA answers three operational questions:
- Authentication verifies a user’s or system’s identity: “Who are you?” section 11.4.1
- Authorization grants appropriate access after authentication, such as permitted files, services, or Cisco IOS commands. section 11.4.1
- Accounting records user activity, including file operations and device configuration changes, supporting audits and troubleshooting. section 11.4.1
Centralized AAA commonly uses Cisco Identity Services Engine (ISE) with RADIUS or TACACS+. RADIUS combines authentication and authorization in one Access Request, while TACACS+ keeps all three AAA operations separate for more granular control. section 11.4.2 section 11.4.2
Table 11.1 RADIUS and TACACS+ (view table figure)
| RADIUS |
TACACS+ |
|---|---|
| Open standard |
Created by Cisco but now open standard |
| Combines authentication and authorization into a single operation |
Keeps all three AAA components separate |
| UDP ports 1812 and 1813 |
TCP port 49 |
| Encrypts passwords only |
Encrypts all communications |
| Typically used for network access |
Typically used for device administration |
Compare RADIUS and TACACS+ by operation model, transport, ports, encryption coverage, and typical deployment. section 11.4.2
Router administration
When a user connects to a router CLI, the router can use RADIUS or TACACS+ to control access. RADIUS handles authentication and authorization together; TACACS+ processes authentication, authorization, and accounting separately. section 11.4.2
