AAA Framework: Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting (AAA)

• AAA stands for Authentication, Authorization, and Accounting, a framework for managing access to network devices
• Verifies a user's identity through authentication, determines access and operations through authorization, and records user activity through accounting

Authentication

• Verifies if a user can access network resources through their given credentials
• Types of authentication:
  • Something you know (e.g., passwords, PIN)
  • Something you have (e.g., USB key)
  • Something you are (e.g., biometrics, fingerprints)

Authorization

• Determines which resources a user is allowed to access and what operations they can perform
• Stored in a database along with the user's identity
• Can be changed by an administrator
• Different from authentication, as it dictates what the user is allowed to do

Accounting

• Records/logging the actions a user took while accessing network resources
• Tracks user identities, login time, data sent/received, services accessed, and IP address

Purpose of AAA

• Limits access to a system
• Records user activity
• Acts as a three-step verification process to control access to network resources and devices

Uses of AAA

• Network access: verifies the identity of a device or user
• Device administration: involves controlling access to sessions, network devices, and secure shell (SSH)

Local AAA

• Simplest implementation of AAA for small working environments
• Credentials are stored directly on the Cisco device
• Not ideal for network security, but useful for small networks
• Downsides: no accounting methods, users cannot select their own passwords, and limited scalability

Server-Based AAA

• Also known as Centralized AAA, uses separate servers to store and centrally manage AAA policies
• Benefits: centralized management, enhanced security, scalability, and granular control
• Drawbacks: complexity of setting up and maintaining a central AAA server, and impact on AAA functionality if the server goes down

AAA Protocols

• RADIUS: Remote Authentication Dial-In User Service, best used for network access
• TACACS+: Terminal Access Controller Access Control System Plus, best used for device administration
• Diameter: Derived from RADIUS, used for service administration in fixed and mobile networks

Learn about the AAA framework, its purpose, and protocols in managing access to network devices. Understand the role of authentication, authorization, and accounting in network security.