Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
AAA Configuration
All of the AAA services are generally configured in similar ways: AAA is enabled, a method list is defined, and this list is then applied to a specific interface, line or service. A method list is simply a list of the methods used to perform the given action (any of the A’s); there are several which can be used (local, TACACS, RADIUS, etc.) and the ones which can be used with each will be detailed in the following sections. Once a method list has been defined, the specific action can be applied to a specific interface, line or service.
Authentication
There are several different ways that authentication can be implemented on a Cisco device; these include login, PPP, ARAP, and NASI, among others. The most common of these is login authentication; as such, this is the one that we will focus on in this section. The ability to authenticate the login of a specific user allows network operations the ability to screen which users are able to log in and utilize the specific network device. The following steps are used to configure login authentication:
- Enable AAA
- Configure an authentication method list
- Enter line configuration mode
- Apply the authentication method list to the specific line or set of lines
Enabling AAA on a device requires a single command:
router(config)#aaa new-model
In order to configure an authentication method list, the available methods must be known. There are a number of methods that can be used for login authentication; these are shown in Table 1.
Table 1: Login Authentication Methods
|
Keyword |
Description |
|
enable |
Uses the enable password for authentication |
|
krb5 |
Uses Kerberos 5 for authentication |
|
line |
Uses the line password for authentication |
|
local |
Uses the local username database for authentication |
|
local-case |
Uses the local username database for authentication, case-sensitive |
|
none |
Uses no authentication |
|
group radius |
Uses all configured RADIUS servers for authentication |
|
group tacacs+ |
Uses all configured TACACS servers for authentication |
|
group group-name |
Uses a configured subset (aaa group) of RADIUS or TACACS servers for authentication. |
The command to configure an authentication method list is:
router(config)#aaa authentication login {default | list-name} method1..methodn
When configuring AAA authentication, the ability exists to either configure the default authentication list or a named method list; these are configured with the default or list-name parameters. Multiple methods can be configured; however, the first method configured will be used unless there is an authentication error (there was a problem with the configured method, i.e. an unreachable server), it will not move on to other configured methods if there is an authentication failure (i.e. authentication was denied).
To enter into the specific command mode to apply the AAA authentication method, the following command is used:
router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number
The final step to configure login authentication is to apply the configured method list onto a specific line (or lines). To do this, the following command is used:
router(config-line)#login authentication {default | list-name}
Example
To wrap this together, the following shows the configuration of vty login authentication using the local authentication database.
router(config)#aaa new-model router(config)#aaa authentication login default local router(config)#line vty 0 4 router(config-line)#login authentication default
Authorization
Like authentication, there are a number of different ways to configure authorization, including for EXEC attributes, EXEC commands, on network connections (i.e. PPP) among others. One of the most common is EXEC command authorization; as such this is the one that we will focus on in this section. The ability to authorize the commands that are permitted to be run by a specific user (or group of users) allows a granular level of security. When configured, the IT security department has the ability to permit only specific users the ability to configure devices (or specific configuration commands); this also enables the ability to permit only troubleshooting access (or troubleshooting access commands) to those in lower-level operations without risking the security of the device. The following steps are used to configure EXEC command authorization:
- Enable AAA
- Configure an authorization method list
- Enter line configuration mode
- Apply the authorization method list to the specific line or set of lines
As with AAA authentication, enabling AAA on a device only requires a single command; keep in mind that this only needs to be entered once regardless of configuring multiple AAA components:
router(config)#aaa new-model
As with AAA authentication, the available methods must be known for configuration. There are a number of methods which can be used for EXEC command authentication; these are shown in Table 2.
Table 2: Command Authorization Methods
|
Keyword |
Description |
|
local |
Uses the local username database for authentication |
|
none |
Uses no authentication |
|
group radius |
Uses all configured RADIUS servers for authentication |
|
group tacacs+ |
Uses all configured TACACS servers for authentication |
|
if-authenticated |
This user is allowed access to the requested function if the user has authenticated successfully |
When configuring a command authorization list, the access level of the user must be provided. On Cisco devices there are levels from 0 through 15 that are available to be assigned to users; this provides tiered security. The command to configure a command authorization method list is
router(config)#aaa authorization commands level {default | list-name} method1..methodn
Notice that AAA authorization methods are subject to the same error requirement as with AAA authentication.
To enter into the specific command mode to apply the AAA authentication method, the following command is used:
router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number
The final step to configure command authorization is to apply the configured method list onto a specific line (or lines); to do this, the following command is used:
router(config-line)#authorization commands level {default | list-name}
Example
To wrap this together, the following shows the configuration of vty command authorization for users configured in level 7 using the local authentication database.
router(config)#aaa new-model router(config)#aaa authorization commands 7 default local router(config)#line vty 0 4 router(config-line)#authorization commands 7 default
Accounting
Again, like authentication and authorization, there are a number of different ways to configure AAA accounting; these are shown in Table 3:
Table 3:AAA Accounting Types
|
Type |
Description |
|
Network |
Provides information for all PPP, SLIP or ARAP sessions, including packet and byte counts |
|
EXEC |
Provides information about user EXEC terminal sessions. |
|
Commands |
Provides information about the EXEC mode commands that a user issues |
|
Connection |
Provides information about all outbound connections made from the network access server (i.e. Telnet) |
|
System |
Provides information about system-level events |
|
Resource |
Provides “start” and “stop” records for calls that have passed user authentication and provides “stop” records for calls that fail to authenticate |
One of the most common uses of accounting is to provide an accounting for user command usage; as such this is the one we will focus on in this section. The ability to account for the commands which are run by a user allows a granular level of security logging. The following steps are used to configure EXEC command accounting:
- Enable AAA
- Configure an accounting method list
- Enter line configuration mode
- Apply the accounting method list to the specific line or set of lines
As with AAA authentication, enabling AAA on a device only requires a single command, this command is
router(config)#aaa new-model
As with AAA authentication, the available methods must be known for configuration. There are a number of methods which can be used for command accounting; these are shown in Table 4.
Table 4: Command Accounting Methods
|
Keyword |
Description |
|
group radius |
Uses all configured RADIUS servers for authentication |
|
group tacacs+ |
Uses all configured TACACS servers for authentication |
|
group group-name |
Uses a configured subset (aaa group) of RADIUS or TACACS servers for accounting. |
As with command authorization, when configuring a command accounting list the access level of the user must be provided. The command to configure a command accounting method list is
router(config)#aaa accounting commands level {default | list-name} method1..methodn
Notice that AAA accounting methods are subject to the same error requirement as with AAA authentication. It should also be noted that if system accounting is being configured, it does not support the use of named method lists; if using system accounting only, the default method list is available.
To enter into the specific command mode to apply the AAA accounting method, the following command is used:
router(config)#line [aux | console | tty | vty] starting-line-number ending-line-number
The final step to configure command accounting is to apply the configured method list onto a specific line (or lines); to do this the following command is used:
router(config-line)#accounting commands level {default | list-name}
Example
To wrap this together, the following shows the configuration of vty command accounting for users configured in level 7 using the local authentication database.
router(config)#aaa new-model router(config)#aaa accounting commands 7 default local router(config)#line vty 0 4 router(config-line)#authorization accounting 7 default