What Is AAA?

AAA is a framework for controlling and monitoring access to network resources.

    AAA
     |
     +-------------------+
     |                   |
     v                   v
```

Authentication      Authorization
"Who are you?"      "What can you do?"
|
+-------------------+
|
v
Accounting
"What happened?" 

The three components are:

• Authentication – verifies identity.
• Authorization – determines permissions.
• Accounting – records activity or usage.

1. Authentication — Who Are You?

Authentication is the process of verifying the identity of a user or device.

For example, when an administrator logs into a Cisco router:

    Username: admin01
    Password: ********

             |
             v

      Authentication
             |
      Is the identity
         valid?
             |
       +-----+-----+
       |           |
      Yes          No
       |           |
       v           v
    Continue     Deny
    

Authentication methods can include:

• Username and password
• Certificates
• Multi-factor authentication
• 802.1X
• Centralized AAA servers

2. Authorization — What Are You Allowed to Do?

Authentication alone does not determine what the user can do.

Authorization determines the permissions available to an authenticated user.

    User successfully authenticated
                |
                v
          Authorization
                |
      +---------+---------+
      |                   |
      v                   v
 Show commands       Configuration
   allowed              allowed?
      |                   |
      v                   v
    Yes/No              Yes/No
    

For example:

This principle helps organizations follow least privilege: users should receive only the access they need for their responsibilities.

3. Accounting — What Happened?

Accounting records information about user activity, sessions, or resource usage.

Depending on the system, accounting information may include:

• Username
• Login time
• Logout time
• Session duration
• Device accessed
• Network usage
• Commands or events, where supported

    User
      |
      v
    Login
      |
      v
  Authentication
      |
      v
  Authorization
      |
      v
   Session
      |
      v
  Accounting
      |
      v
 Activity Record
    

AAA Real-World Example

Imagine a company with 50 network administrators.

An administrator wants to access a Cisco switch.

1. The administrator enters their credentials.
2. The system verifies their identity.
3. The system determines their permissions.
4. The administrator accesses the switch.
5. Relevant activity is recorded.

    Administrator
          |
          v
   +-------------+
   |   Switch    |
   +-------------+
          |
          | AAA
          v
   +-------------+
   | AAA Server  |
   +-------------+
          |
          v
   Identity / Policy
          |
          v
   Access Decision
    

AAA and RADIUS

RADIUS is commonly used to provide centralized AAA services, especially for network access.

Common examples include:

• Enterprise Wi-Fi
• VPN authentication
• 802.1X
• Network Access Control

    Laptop
       |
       v
    Wi-Fi AP
       |
       | RADIUS
       v
   AAA / RADIUS
     Server
       |
       v
  User Database
    

AAA and TACACS+

TACACS+ is another AAA protocol commonly used for centralized administration of network devices.

For example:

    Network Engineer
           |
           v
       Cisco Switch
           |
           | TACACS+
           v
      AAA Server
           |
           v
    Authentication
           |
           v
     Authorization
           |
           v
    Administrative Access
    

TACACS+ is particularly useful when an organization needs detailed authorization policies for network administrators.

AAA Server vs Local Authentication

A small network might use local accounts directly on each device.

    Router
    |
    +-- username admin
    +-- local password
    

In a larger organization, centralized authentication is easier to manage.

                +----------------+
                |   AAA Server   |
                +----------------+
                  /      |      \
                 /       |       \
                v        v        v
             Router    Switch   Firewall
    

If an employee leaves the organization, administrators can disable the account centrally rather than manually changing credentials on every network device.

AAA and Least Privilege

AAA can help organizations implement the principle of least privilege.

Instead of giving every administrator full access:

    Junior Admin
    ↓
    Read-only access


    Network Engineer
    ↓
    Configuration access


    Senior Engineer
    ↓
    Full administrative access
    

This reduces the risk of accidental or unauthorized changes.

AAA in Network Security

AAA is an important part of enterprise network security because it provides identity-based access control and accountability.

AAA can work together with technologies such as:

• 802.1X
• RADIUS
• TACACS+
• NAC
• VPN authentication
• Multi-factor authentication
• Role-based access control

AAA vs Authentication — Are They the Same?

No.

Authentication is only one part of AAA.

Simple AAA Memory Trick

    A — Authentication
        "Who are you?"

    A — Authorization
        "What can you do?"

    A — Accounting
        "What did you do?"
    

Remembering these three questions makes AAA very easy to understand during CCNA, networking, and interview preparation.

Cisco AAA Basic Example

A basic Cisco AAA configuration may look like:

```

aaa new-model

aaa authentication login default local

username admin privilege 15 secret StrongPassword123 

This example enables AAA and uses the local user database for login authentication.

In larger environments, the authentication method list can instead reference centralized RADIUS or TACACS+ servers.

Centralized AAA Architecture

                Users / Admins
                     |
                     v
          +-------------------+
          | Network Devices   |
          |                   |
          | Routers           |
          | Switches          |
          | Firewalls         |
          | VPN               |
          +-------------------+
                     |
                     | AAA
                     v
          +-------------------+
          | Central AAA Server |
          +-------------------+
                /          \
               /            \
              v              v
        RADIUS            TACACS+
         Access          Administration
    

AAA Interview Questions

Practical Lab Idea

Build a small AAA lab in Cisco Packet Tracer or a suitable network lab environment.

1. Create a router or switch.
2. Create a local administrative user.
3. Enable AAA.
4. Configure local authentication.
5. Study how RADIUS or TACACS+ would replace the local database.
6. Test successful and failed authentication.
7. Explore authorization and accounting concepts.

Key Takeaways

• AAA stands for Authentication, Authorization, and Accounting.
• Authentication verifies identity.
• Authorization controls permissions.
• Accounting records activity or usage.
• RADIUS and TACACS+ are commonly used for centralized AAA.
• RADIUS is widely used for Wi-Fi, VPN and 802.1X.
• TACACS+ is commonly used for network device administration.
• AAA supports centralized and consistent access control.
• Least privilege can be implemented through authorization policies.