AAA Best Practices

Authentication, Authorization, and Accounting... Otherwise Known as AAA (triple A).  Most people who have had to implement AAA on a router or switch probably know very little about the commands they copy to the router config.  Most simply grab the AAA configs from another working router or switch and be done with. But have you ever wondered what these commands do? Have you asked yourself - "Do I even need this? What's the best way to implement AAA?"  Today we're gonna get our [ROUTER]FREAK on and check out some best practices with AAA.

If your working in an environment that uses AAA then you no doubt have a TACACS+ or ACS server running somewhere that is used for management of logins to your devices.  AAA works in conjuction with TACACS+ to provide management of your login security.  Who can login (Authentication), What can that user do (Athorization), and track the commands that are used (Accounting).

I've recently worked directly with Cisco to bang out what exactly is the best practices for configuring AAA on a router.  what we came up with is the following:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+


Some router configurations look more intimidating than others and AAA is always one them.  Don't worry, we'll break this down and you will see its not so bad after all.

So lets take a look at it one line at a time...

aaa new-model
This basically turns on aaa on the router.

aaa authentication login default group tacacs+ local
Here we are saying that to authenticate to this router for logins use the default group which is tacacs+.  If tacacs+ fails then use the local user account configured on the router. (This is why you always want to make sure you have a local user configured on your router)

aaa authentication enable default group tacacs+ enable
Here we are saying that for enable mode we want to use the default group tacacs+ (notice the local keyword is not used.  This is because that a locally defined user will have specified the authorization level they require. . for example leve 15 will get enable mode)

aaa authorization config-commands
This says we want to check with TACACS+ to authorize going into config mode.

aaa authorization exec default group tacacs+ local if-authenticated
Notice the "if-authenticated" keyword at the end of this line.  This is saying that if we are authenticated we will immediately be dropped into exec (enable) mode.

aaa authorization commands 1 default group tacacs+ if-authenticated
For best practices Cisco recommends that authorization be configured to each level of user access to network devices. In this command we are authorizing level 1 user. This would also be the same as non-enable mode. A fallback method should be configured such as a local user.  This also requires the use of tacacs+.

aaa authorization commands 15 default group tacacs+ local if-authenticated
Here we are providing authorization for level 15 users against tacacs+. If tacacs+ is not available then the local user account is used.  If authenticated the user will immediately be dropped into exec/enable mode.

aaa accounting exec default start-stop group tacacs+
AAA Accounting for each level of commands ensures there is accountability for use of privileged commands on the router.  Privilege levels range from 1 to 15, with 15 being the highest level.  Some organizations may want to implement additional levels of commands where 1 might be a help desk and 15 are network administrators.

aaa accounting commands 1 default start-stop group tacacs+
This is an optional command as far as best practices go... but this provides accountability or tracking of user activity even they thay have only logged in (not exec/enable)

aaa accounting commands 15 default start-stop group tacacs+
This command will provide for accounting of adminsitrators or priveledge level 15

... And that's it!  See? Oonce you go over each line its not quite so bad.  The biggest hurdle is understanding the freaky Cisco command structure.

I hope this break down has helped clear things up a bit.

Until next time -- FREAK!