Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.7 |  | Configuring AAA authentication |

Authentication provides the method of identifying users including:

- Login and password dialog
- Challenge and response
- Messaging support

On a Cisco catalyst switch, there are several different types of authentication:

- When logging into the switch
- When accessing privileged EXEC mode
- When establishing a Point-to-Point Protocol (PPP) connection to a router

A username and password that successfully authenticates for one type of access may not work for another.

The basic steps to follow when configuring AAA authentication are:

1. Turn on aaa new-model in the switch
2. Configure AAA server group(s)
3. Configure AAA login method(s)
4. Attach login methods to server groups
5. Attach AAA login method(s) to line(s)

AAA authentication can be used on Cisco catalyst 6500 series, 3550 series and 2950 series switches to configure the following configuration types:

- Access to the console
- Access to virtual terminals through Telnet and SSH connections
- Access to privileged EXEC mode (enable mode)

To configure access to the console, use the command:

> Router(config)#aaa authentication login method1

Specify which type of authentication to configure (login, enable, PPP) when using this command. Figure lists some of the keywords use with the aaa authentication command.

Once an authentication type has been specified, define either a default method list or a named method list. Named method lists must be applied to a specific interface before any of the defined authentication methods will be performed. The default method list is automatically applied to all interfaces if no other method list is defined.

These lists are called "method lists" because they list the types of authentication to be performed and the sequence in which they will be performed. Authentication methods include:

Using a password already configured on the router, such as the enable password or a line password.

- Using the local username/password database
- Consulting a Kerberos server
- Consulting a RADIUS server, or group of RADIUS servers
- Consulting a TACACS+ server or group of TACACS+ servers

Note that a FAIL response is significantly different from an ERROR. A FAIL means that the user has not met the criteria contained in the applicable authentication database to be successfully authenticated. Authentication ends with a FAIL response. An ERROR means that the security server has not responded to an authentication query. Because of this, no authentication has been attempted. Only when an ERROR is detected will AAA select the next authentication method defined in the authentication method list.

One of the advantages of AAA is that more than one of these methods can be configured, which will be tried in sequence. For example, the router can be configured to authenticate PPP users by first consulting a group of RADIUS or TACACS+ servers. If the router fails to connect to a server, a backup method such as using the local username/password database can be configured.

Using AAA, configure up to four methods in a method list. If all of the defined methods return an error, the user is not authenticated.

AAA commands can be confusing because there are so many syntax possibilities. When configuring AAA authentication, it is best to follow a three-step process for each aaa authentication command:

- Specify the authentication type (login, enable, PPP, etc.).
- Specify the method list as default or give it a name.
- List the authentication methods to be tried, in order.

For example, the syntax for creating a method list to be used for PPP authentication is as follows:

> Router(config)#aaa authentication ppp {default | list-name} method1 [...[method4]]

The aaa authentication login command enables AAA authentication for logins on terminal lines (TTYs), virtual terminal lines (VTYs), and the console (con 0). Using this command can create one or more lists that are tried at login:

> Router(config)#aaa authentication login {default | list-name} method1 [...[method4]]

The default list is applied to all lines. If a named list is configured, apply the list to a specific line or group of lines using the aaa login authentication command.

The additional methods of authentication are used only if the previous method returns an ERROR, not a FAIL.

A typical ERROR is a failure to connect with a member of a server group due to link failure or a server-side problem.

To ensure that the user is granted access, even if all methods return an ERROR, specify none as the final method in the command line. If all defined methods end with an ERROR and none is not specified as the final method, the user will not be authenticated. If authentication is not specifically set for a line, the default is to deny access and no authentication is performed.

Depending on the network security policy, none may be configured as the final method. Alternately, the security policy may dictate that denying access when all other methods return an ERROR is the most secure course of action.

Because this authentication method list specifies TACACS+ as the first method, the tacacs-server host and tacacs-server key commands are used to configure RTA as a TACACS+ client. Two TACACS+ servers are specified (192.168.0.11 and 192.168.1.12). The server specified first, 192.168.0.11, is tried first.

The aaa new-model command enables the AAA feature. Finally, the aaa authentication login command defines the method list. The method list configures RTA to attempt to contact the TACACS+ servers first. If neither server is reached, this method returns an ERROR and AAA tries to use the second method, the enable password. If this attempt also returns an ERROR (because no enable password is configured on the router), the user is allowed access with no authentication.

The default list is applied to the console (con 0), all TTY lines (including the auxiliary line or AUX port), and all VTY lines. The default method list can be overridden by a named list to one or more of these lines. Figure shows how to configure a named list.

RTB is configured with the radius-server host and radius-server key commands because the named method list relies on RADIUS. The aaa authentication login default local command configures the default method as the local username/password database. This method is applied to all TTYs, VTYs, and the console by default.

The aaa authentication login PASSPORT group radius local none command creates a named method list called PASSPORT. The first method in this list is the group of RADIUS servers. In the event that RTB cannot contact either RADIUS server, the local username/password database will be tried. The none keyword assures that, if no usernames exist in the local database, the user is granted access.

Apply named method lists for login authentication by using the login authentication command, as shown:

> Router(config-line)#login authentication listname

Figure shows the commands needed to apply the PASSPORT method list to all five VTYs.