IntroductionThis document describes how to configure Authentication, Authorization, and Accounting (AAA) on a Cisco router with Radius or TACACS+ protocols. Show
PrerequisitesRequirementsThere are no specific requirements for this document. ConventionsFor more information on document conventions, see the Cisco Technical Tips Conventions. Components UsedThe information in this document is based on Cisco IOSĀ® software release 12 main line. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command. Background InformationThis document explains how to configure Authentication, Authorization, and Accounting (AAA) on a Cisco router with Radius or TACACS+ protocols. The goal of this document is not to cover all AAA features, but to explain the main commands and provide some examples and guidelines. Note: Read the section on General AAA Configuration before you proceed with the Cisco IOS configuration. Failure to do so can result in misconfiguration and subsequent lockout. For more information, see Authentication, Authorization and Accounting Configuration Guide. Network Diagram
General AAA ConfigurationEnable AAATo enable AAA, you need to configure the aaa new-model command in global configuration. Note: Until this command is enabled, all other AAA commands are hidden. Warning: The aaa new-model command immediately applies local authentication to all lines and interfaces (except console line line con 0). If a telnet session is opened to the router after this command is enabled (or if a connection times out and has to reconnect), then the user has to be authenticated with the local database of the router. It is recommended to define a username and password on the access server before you start the AAA configuration, so you are not locked out of the router. See the next code example. Router(config)#username xxx password yyy Tip: Before you configure your AAA commands, save your configuration. You can save the configuration again only after you have completed your AAA configuration (and are satisfied that it works correctly). This allows you to recover from unexpected lockouts as you can roll back any change with a reload of the router. Specify the External AAA ServerIn global configuration, define the security protocol used with AAA (Radius, TACACS+). If you do not want to use either of these two protocols, you can use the local database on the router. If you use TACACS+, use the tacacs-server host <IP address of the AAA server> <key> command. If you use Radius, use the radius-server host <IP address of the AAA server> <key> command. AAA Server ConfigurationOn the AAA server, configure the next parameters:
Refer to your AAA server documentation for the exact procedure used to configure the previous parameters. If the AAA server is not correctly configured, then AAA requests from the NAS can be ignored by the AAA server and the connection can fail. The AAA server has to be IP reachable from the access server (conduct a ping test to verify connectivity). Authentication ConfigurationAuthentication verifies users before they are allowed access to the network and network services (which are verified with authorization). To configure AAA authentication:
The only exception is the default method list (which is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list. These authentication examples use Radius, login and Point-to-Point Protocol (PPP) authentication to explain concepts such as methods and named lists. In all the examples, TACACS+ can be substituted for Radius or local authentication. The Cisco IOS software uses the first method listed to authenticate users. If that method fails to respond (indicated by an ERROR), the Cisco IOS software selects the next authentication method listed in the method list. This process continues until there is successful communication with a listed authentication method, or all methods defined in the method list are exhausted. It is important to note that the Cisco IOS software attempts authentication with the next listed authentication method only when there is no response from the previous method. If authentication fails at any point in this cycle, that is, if the AAA server or local username database responses are to deny the user access (indicated by a FAIL), the authentication process stops, and no other authentication methods are attempted. To allow a user authentication, you must configure the username and the password on the AAA server. Login AuthenticationYou can use the aaa authentication login command to authenticate users who want exec access into the access server (tty, vty, console and aux). Example 1: Exec Access with Radius then LocalRouter(config)#aaa authentication login default group radius local In the previous command:
All users are authenticated with the Radius server (the first method). If the Radius server does not respond, then the router local database is used (the second method). For local authentication, define the username name and password: Router(config)#username xxx password yyy Because the list default in the aaa authentication login command is used, login authentication is automatically applied for all login connections (such as tty, vty, console and aux). Note: The server (Radius or TACACS+) cannot reply to an aaa authentication request sent by the access server if there is no IP connectivity, if the access server is not correctly defined on the AAA server or the AAA server is not correctly defined on the access server. Note: If you use the previous example, without local keyword, the result is: Router(config)#aaa authentication login default group radius Note: If the AAA server does not reply to the authentication request, the authentication fails (since the router does not have an alternate method to try). Note: The group keyword provides a way to group current server hosts. The feature allows the user to select a subset of the configured server hosts and use them for a particular service. Example 2: Console Access used with Line PasswordExpand the configuration from Example 1 so that console login is only authenticated by the password set on line con 0. The list CONSOLE is defined and then applied to line con 0. Configuration: Router(config)#aaa authentication login CONSOLE line In the previous command:
When a named list (in this example, CONSOLE) is created, it must be applied to a line or interface before it executes. This is done with the login authentication <list_name> command: Router(config)#line con 0 Router(config-line)#exec-timeout 0 0 Router(config-line)#password cisco Router(config-line)#login authentication CONSOLE The CONSOLE list overrides the default method list default on line con 0. After this configuration on line con 0, you need to enter the password cisco to get console access. The default list is still used on tty, vty, and aux. Note: To have console access authenticated by a local username and password, use the next code example: Router(config)#aaa authentication login CONSOLE local In this case, a username and password have to be configured in the local database of the router. The list must also be applied to the line or interface. Note: To have no authentication, use the next code example:
In this case, there is no authentication to get to the console access. The list must also be applied to the line or interface. Example 3: Enable Mode Access used with External AAA ServerYou can issue authentication to get to enable mode (privilege 15). Configuration: Router(config)#aaa authentication enable default group radius enable Only the password can be requested, the username is $enab15$. Hence the username $enab15$ must be defined on the AAA server. If the Radius server does not reply, the enable password configured locally on the router can have to be entered. PPP AuthenticationThe aaa authentication ppp command is used to authenticate a PPP connection. It is typically used to authenticate ISDN or analog remote users who want to access the Internet or a central office through an access server. Example 1: Single PPP Authentication Method for All UsersThe access server has an ISDN interface which is configured to accept PPP dial-in clients. We use a dialer rotary-group 0, but the configuration can be done on the main interface or dialer profile interface. Configuration: Router(config)#aaa authentication ppp default group radius local This command authenticates all PPP users with Radius. If the Radius server does not reply, the local database is used. Example 2: PPP Authentication used with a Specific ListTo use a named list rather than the default list, configure these commands: Router(config)#aaa authentication ppp ISDN_USER group radius Router(config)#interface dialer 0 Router(config-if)#ppp authentication chap ISDN_USER In this example, the list is ISDN_USER and the method is Radius. Example 3: PPP Launched from within Character Mode SessionThe access-server has an internal modem card (Mica, Microcom or Next Port). Assume that both aaa authentication login and aaa authentication ppp commands are configured. If a modem user first accesses the router with a character mode exec session (for example, with Terminal Window after Dial), the user is authenticated on a tty line. To launch into a packet mode session, users must type ppp default or ppp. Since PPP authentication is explicitly configured (with aaa authentication ppp ), the user is authenticated at the PPP level again. To avoid this second authentication, use the if-needed keyword: Router(config)#aaa authentication login default group radius local Router(config)#aaa authentication ppp default group radius local if-needed Note: If the client starts a PPP session directly, PPP authentication is directly performed since there is no log in access to the access server. Configure AuthorizationAuthorization is the process by which you can control what a user can do. AAA authorization has the same rules as authentication:
Method lists are specific to the authorization type requested. This document focuses on the Exec and Network authorization types. For more information on the other types of authorization, please refer to the Cisco IOS Security Configuration Guide . Exec AuthorizationThe aaa authorization exec command determines if the user is allowed to run an EXEC shell. This facility can return user profile information such as auto command information, idle timeout, session timeout, access-list and privilege and other per-user factors. Exec authorization is only carried out over vty and tty lines. The next example uses Radius. Example 1: Same Exec Authentication Methods for All UsersWhen it is authenticated with: Router(config)#aaa authentication login default group radius local All users who want to log in to the access server have to be authorized with Radius (first method) or local database (second method). Configuration: Router(config)#aaa authorization exec default group radius local Note: On the AAA server, Service-Type=1 (login) must be selected. Note: With this example, if the local keyword is not included and the AAA server does not respond, therefore, the authorization is not possible, and the connection can fail. Note: In next Examples 2 and 3, you do not have to add any command on the router. You only need to configure the profile on the access server. Example 2: Assign Exec Privilege Levels from the AAA ServerBased on Example 1, configure the next Cisco AV-pair on the AAA server so that a user can log into the access server and enter the enable mode directly: shell:priv-lvl=15 The user can now go directly to the enable mode. Note: If the first method fails to respond, then the local database is used. However, the user cannot go directly to the enable mode, but have to enter the enable command and supply the enable password. Example 3: Assign Idle-Timeout from the AAA ServerTo configure an idle timeout (so that the session is disconnected in case of no traffic after the idle timeout) use the IETF Radius attribute 28: Idle-Timeout under the user profile. Network AuthorizationThe aaa authorization network command runs authorization for all network-related service requests such as PPP, SLIP and ARAP. This section focuses on PPP, which is most commonly used. The AAA server checks if a PPP session by the client is allowed. Moreover, PPP options can be requested by the client: callback, compression, IP address, and so on. These options have to be configured on the user profile on the AAA server. Moreover, for a specific client, the AAA profile can contain idle-timeout, access-list and other per-user attributes which can be downloaded by the Cisco IOS software and applied for this client. The next examples show authorization with Radius. Example 1: Same Network Authorization Methods for All UsersThe access server is used to accept PPP dial-in connections. Users are authenticated (as was previously configured) with: Router(config)#aaa authentication ppp default group radius local Use the next command to authorize the users: Router(config)#aaa authorization network default group radius local Note: On the AAA server, configure: Service-Type=7 (framed) and Framed-Protocol=PPP. Example 2: Apply User-Specific AttributesYou can use the AAA server to assign per-user attributes such as IP address, callback number, dialer idle timeout value or access-list, and so on. In such an implementation, the NAS downloads the appropriate attributes from the AAA server user profile. Example 3: PPP Authorization with a Specific ListSimilar to authentication, configure a list name rather than a the default one : Router(config)#aaa authorization network ISDN_USER group radius local Then, apply this list to the interface: Router(config)#interface dialer 0 Router(config-if)#ppp authorization ISDN_USER Accounting ConfigurationThe AAA accounting feature enables you to track the services that users access and the amount of network resources that they consume. AAA accounting has the same rules as authentication and authorization:
The next examples focuses on how information can be sent to the AAA server. Accounting Configuration ExamplesExample 1: Generate Start and Stop Accounting RecordsFor every dial-in PPP session, accounting information is sent to the AAA server once the client is authenticated and after the disconnect with the keyword start-stop. Router(config)#aaa accounting network default start-stop group radius local Example 2: Generate Only Stop Accounting RecordsIf accounting information has to be sent only after a client has disconnected, use the keyword stop and configure the next line: Router(config)#aaa accounting network default stop group radius local Example 3: Generate Resource Records for Authentication and Negotiation FailuresUntil this point, AAA accounting provides start and stop record support for calls that have passed user authentication. If authentication or PPP negotiation fails, there is no record of authentication. The solution is to use AAA resource failure stop accounting: Router(config)#aaa accounting send stop-record authentication failure A stop record is sent to the AAA server. Example 4: Enable Full Resource AccountingTo enable full resource accounting, which generates both a start record at call setup and a stop record at call termination, configure: Router(config)#aaa accounting resource start-stop This command was introduced in Cisco IOS Software Release 12.1(3)T. With this command, a call setup and call disconnect start-stop accounting record tracks the progress of the resource connection to the device. A separate user authentication start-stop accounting record tracks the user management progress. These two sets of accounting records are interlinked with a unique session ID for the call. Related Information
|