The three components of AAA
Authentication answers 'who are you?' — verifying identity through credentials (username/password, certificate, token). Before a user can access a network device or the network itself, they must prove their identity. Authentication can be local (usernames stored on the device itself) or centralized (credentials verified by a RADIUS or TACACS+ server).
Authorization answers 'what can you do?' — after authentication, authorization determines what resources and actions the authenticated user has access to. For network device access, this might mean a network admin can run `debug` commands while a read-only user can only run `show` commands. Authorization is applied per-session and sometimes per-command.
Accounting answers 'what did you do?' — recording user activity for audit, billing, and compliance. Accounting logs which user logged in, at what time, from where, what commands they ran, and when they logged out. These logs are invaluable during security incidents and for compliance audits.
Local vs centralized AAA
Local AAA stores usernames and passwords directly on the network device (`username admin privilege 15 secret cisco`). It's simple and works even if the network is down, but it doesn't scale — every device has its own user database, and changing a password requires updating every device individually.
Centralized AAA uses a dedicated AAA server (RADIUS or TACACS+) to validate credentials. All devices point to the same server; changing a password or disabling an account takes effect immediately across all devices. The trade-off: if the AAA server is unreachable and local fallback isn't configured, administrators may be locked out.
Best practice: configure centralized AAA with local fallback (`aaa authentication login default group tacacs+ local`). This ensures that if the TACACS+ server is unreachable, local credentials still work for emergency access.
802.1X port-based network access control
802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses AAA to control which devices can connect to the network. Three roles: Supplicant (the end device wanting network access — runs the 802.1X client), Authenticator (the switch or AP — enforces access based on authentication result), Authentication Server (RADIUS server — verifies credentials).
The flow: a device plugs into a switch port. The switch puts the port in an unauthorized state, passing only EAPOL (Extensible Authentication Protocol over LAN) traffic. The device sends EAP credentials. The switch forwards them to the RADIUS server. The RADIUS server verifies credentials and sends Access-Accept or Access-Reject. On Accept, the switch moves the port to authorized state.
802.1X is commonly deployed with EAP-TLS (certificate-based, no passwords), PEAP (password tunneled in TLS), or EAP-FAST. For wireless networks, 802.1X is used in WPA2-Enterprise mode where each user authenticates with individual credentials rather than a shared passphrase.
TACACS+ and RADIUS for AAA
TACACS+ (TCP 49, full encryption, separates A/A/A) is the choice for network device administration. It allows per-command authorization: an administrator might be allowed to run `show` commands but not `debug` or `configure`. TACACS+ accounting logs every command typed, providing a complete audit trail.
RADIUS (UDP 1812/1813, password-only encryption, combines authentication and authorization) is the choice for network access control — 802.1X wired and wireless authentication, VPN authentication. RADIUS attributes (VSAs) can return VLAN assignments and ACLs to the switch, dynamically placing authenticated users in the correct VLAN.
A single network commonly uses both: TACACS+ for device management (who can SSH to the router) and RADIUS for network access (who can connect to Wi-Fi or the wired port).