AAA services

By ayushparashar on Friday, December 27, 2019

AAA stands for authentication Authorization and Accounting. We all know the importance of AAA services in any network. There are numbers of ways to implement AAA services. The most commonly used are

Tacacs+
Radius

TACACS+	RADIUS
Terminal Access Control Access Control Server	Remote Authentication Dial-In User services.
Cisco proprietary protocol	open standard protocol
It uses TCP as transmission protocol	It uses UDP as transmission protocol
It uses TCP port number 49.	It uses UDP port number 1812 for authentication and authorization and 1813 for accounting.
Authentication, Authorization and Accounting is separated in TACACS+.	Authentication and Authorization is combined in RADIUS.
All the AAA packets are encrypted.	Only the password are encrypted while the other information such as username, accounting information etc are not encrypted.
preferably used for ACS.	used when ISE is used
It provides more granular control i.e can specify the particular command for authorization.	No external authorization of commands supported.
TACACS+ offers multiprotocol support	No multiprotocol support.
Used for device administration.	used for network access

The lab below will show the implementation of Tacacs+ server and Radius Server as well.

R1#sh run
 Building configuration…
 Current configuration : 3799 bytes
 !
 ! Last configuration change at 03:18:41 UTC Fri Dec 27 2019
 !
 version 15.6
 service timestamps debug datetime msec
 service timestamps log datetime msec
 no service password-encryption
 !
 hostname R1
 !
 boot-start-marker
 boot-end-marker
 !
 !
 enable secret 5 cisco123
 !
 aaa new-model
 !
 !
 aaa group server tacacs+ tacacs-servers
  server name tacacs-server1
 !
 aaa group server radius radius-servers
  server name radius-server1
 !
 aaa authentication login default group radius-servers local
or
  aaa authentication login default group tacacs-servers local 
 !
 !
 !
 !
 !
 aaa session-id common
 ethernet lmi ce
 !
 !
 !
 mmi polling-interval 60
 no mmi auto-configure
 no mmi pvc
 mmi snmp-timeout 180
 !
 !
 !
 !
 !
 no ip icmp rate-limit unreachable
 !
 !
 !
 !
 !
 !
 no ip domain lookup
 ip domain name example.com
 ip cef
 no ipv6 cef
 !
 multilink bundle-name authenticated
 !
 !
 !
 !
 username cisco privilege 15 password 0 cisco123
 !
 interface GigabitEthernet0/0
  description tacacs-servers
  ip address 192.168.10.1 255.255.255.0
  duplex auto
  speed auto
  media-type rj45
 !
 interface GigabitEthernet0/1
  description radius-servers
  ip address 172.16.0.1 255.255.255.0
  duplex auto
  speed auto
  media-type rj45
 !
 interface GigabitEthernet0/2
  description host
  ip address 10.10.10.1 255.255.255.0
  duplex auto
  speed auto
  media-type rj45
 !
 ip forward-protocol nd
 !
 !
 no ip http server
 no ip http secure-server
 !
 tacacs server tacacs-server1
  address ipv4 192.168.10.2
  key gns3
 !
 !
 radius server radius-server1
  address ipv4 172.16.0.2 auth-port 1812 acct-port 1813
  key gns3
!
 line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 line vty 0 4
 transport input ssh
 line vty 5 15
 transport input ssh
 !
 no scheduler allocate
 !
 end