Cisco AAA Configuration

Date: Jan 20, 2011

Return to the article

The understanding of security is becoming a knowledge requirement for everyone working on networks, from the entry level network associate to the senior level network engineer. This article reviews the function of Authentication, Authorization and Accounting (AAA) security functionality and shows some basic configurations which can be used.

The first thing that must be understood is what each of the different A’s in AAA stands for and how they can improve the security of the network.

AAA Overview

Cisco defines Authentication, the first A in AAA, as providing ”the method of identifying users, including login and password dialog, challenge and response, messaging support, and, depending on the security protocol you select, encryption.” Simply stated, authentication is used to ensure that the person attempting to use the device or service is authorized to use it according to the credentials configured.

Authorization, as defined by Cisco, “provides the method for remote access control, including one-time authorization or authorization for each service, per-user account list and profile, user group support, and support of IP, Internetwork Packet Exchange (IPX), AppleTalk Remote Access (ARA), and Telnet.”

Authorization is typically used as the next layer of security on a device. For example, while a specific user may have the permissions to use a device, they may not be allowed to perform service affecting commands like reload, or configure the device at all. Authentication is used to configure the specific actions a user (or group of users) is allowed to perform on a device.

Accounting is the third A, and as Cisco explains, “Accounting provides the method for collecting and sending security server information used for billing, auditing, and reporting, such as user identities, start and stop times, executed commands (such as PPP), number of packets, and number of bytes.”

The accounting functionality can be used for a number of different purposes; from a security perspective, it is often used to monitor the specific commands which are performed on the devices. This way, should anyone attempt commands that are not allowed, a record will be created. This functionality can also be used to provide a traceable record of what happened before a specific event. For example, if multiple people were working on a device and then the device became unreachable, the record could be used to track what command was issued at the time the device specifically had problems. As seen in Cisco’s definition, it can also be used for billing purposes to log the amount of packets or traffic forwarded through a device.

AAA Configuration

All of the AAA services are generally configured in similar ways: AAA is enabled, a method list is defined, and this list is then applied to a specific interface, line or service. A method list is simply a list of the methods used to perform the given action (any of the A’s); there are several which can be used (local, TACACS, RADIUS, etc.) and the ones which can be used with each will be detailed in the following sections. Once a method list has been defined, the specific action can be applied to a specific interface, line or service.

Authentication

There are several different ways that authentication can be implemented on a Cisco device; these include login, PPP, ARAP, and NASI, among others. The most common of these is login authentication; as such, this is the one that we will focus on in this section. The ability to authenticate the login of a specific user allows network operations the ability to screen which users are able to log in and utilize the specific network device. The following steps are used to configure login authentication:

1. Enable AAA
2. Configure an authentication method list
3. Enter line configuration mode
4. Apply the authentication method list to the specific line or set of lines

Enabling AAA on a device requires a single command:

router(config)#aaa new-model

In order to configure an authentication method list, the available methods must be known. There are a number of methods that can be used for login authentication; these are shown in Table 1.

Table 1: Login Authentication Methods

The command to configure an authentication method list is:

router(config)#aaa authentication login {default | list-name} method1..methodn

When configuring AAA authentication, the ability exists to either configure the default authentication list or a named method list; these are configured with the default or list-name parameters. Multiple methods can be configured; however, the first method configured will be used unless there is an authentication error (there was a problem with the configured method, i.e. an unreachable server), it will not move on to other configured methods if there is an authentication failure (i.e. authentication was denied).

To enter into the specific command mode to apply the AAA authentication method, the following command is used:

router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number

The final step to configure login authentication is to apply the configured method list onto a specific line (or lines). To do this, the following command is used:

router(config-line)#login authentication {default | list-name}

Example

To wrap this together, the following shows the configuration of vty login authentication using the local authentication database.

router(config)#aaa new-model
router(config)#aaa authentication login default local
router(config)#line vty 0 4
router(config-line)#login authentication default

Authorization

Like authentication, there are a number of different ways to configure authorization, including for EXEC attributes, EXEC commands, on network connections (i.e. PPP) among others. One of the most common is EXEC command authorization; as such this is the one that we will focus on in this section. The ability to authorize the commands that are permitted to be run by a specific user (or group of users) allows a granular level of security. When configured, the IT security department has the ability to permit only specific users the ability to configure devices (or specific configuration commands); this also enables the ability to permit only troubleshooting access (or troubleshooting access commands) to those in lower-level operations without risking the security of the device. The following steps are used to configure EXEC command authorization:

1. Enable AAA
2. Configure an authorization method list
3. Enter line configuration mode
4. Apply the authorization method list to the specific line or set of lines

As with AAA authentication, enabling AAA on a device only requires a single command; keep in mind that this only needs to be entered once regardless of configuring multiple AAA components:

router(config)#aaa new-model

As with AAA authentication, the available methods must be known for configuration. There are a number of methods which can be used for EXEC command authentication; these are shown in Table 2.

Table 2: Command Authorization Methods

When configuring a command authorization list, the access level of the user must be provided. On Cisco devices there are levels from 0 through 15 that are available to be assigned to users; this provides tiered security. The command to configure a command authorization method list is

router(config)#aaa authorization commands level {default | list-name} method1..methodn

Notice that AAA authorization methods are subject to the same error requirement as with AAA authentication.

To enter into the specific command mode to apply the AAA authentication method, the following command is used:

router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number

The final step to configure command authorization is to apply the configured method list onto a specific line (or lines); to do this, the following command is used:

router(config-line)#authorization commands level {default | list-name}

Example

To wrap this together, the following shows the configuration of vty command authorization for users configured in level 7 using the local authentication database.

router(config)#aaa new-model
router(config)#aaa authorization commands 7 default local
router(config)#line vty 0 4
router(config-line)#authorization commands 7 default

Accounting

Again, like authentication and authorization, there are a number of different ways to configure AAA accounting; these are shown in Table 3:

Table 3:AAA Accounting Types

One of the most common uses of accounting is to provide an accounting for user command usage; as such this is the one we will focus on in this section. The ability to account for the commands which are run by a user allows a granular level of security logging. The following steps are used to configure EXEC command accounting:

1. Enable AAA
2. Configure an accounting method list
3. Enter line configuration mode
4. Apply the accounting method list to the specific line or set of lines

As with AAA authentication, enabling AAA on a device only requires a single command, this command is

router(config)#aaa new-model

As with AAA authentication, the available methods must be known for configuration. There are a number of methods which can be used for command accounting; these are shown in Table 4.

Table 4: Command Accounting Methods

As with command authorization, when configuring a command accounting list the access level of the user must be provided. The command to configure a command accounting method list is

router(config)#aaa accounting commands level {default | list-name} method1..methodn

Notice that AAA accounting methods are subject to the same error requirement as with AAA authentication. It should also be noted that if system accounting is being configured, it does not support the use of named method lists; if using system accounting only, the default method list is available.

To enter into the specific command mode to apply the AAA accounting method, the following command is used:

router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number

The final step to configure command accounting is to apply the configured method list onto a specific line (or lines); to do this the following command is used:

router(config-line)#accounting commands level {default | list-name}

Example

To wrap this together, the following shows the configuration of vty command accounting for users configured in level 7 using the local authentication database.

router(config)#aaa new-model
router(config)#aaa accounting commands 7 default local
router(config)#line vty 0 4
router(config-line)#authorization accounting 7 default

Conclusion

While the subject of AAA can be quite overwhelming to those new to Cisco security, it is also a concept which is easy to pickup once the basics have been established. This article has hopefully provided this basic understanding of AAA configuration and hopefully offers a good starting point in moving forward with more detailed AAA configurations.

© 2024 Pearson Education, Pearson IT Certification. All rights reserved.

800 East 96th Street, Indianapolis, Indiana 46240