Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.5 |  | Configuring AAA |

Configuring AAA can be a complex process. It is imperative that security policies are well planned before beginning to configure AAA.

To enable AAA, issue the following command in global configuration mode:

> Router(config)#aaa new-model

The aaa new-model command (see Figure ) enables the AAA feature so that other AAA commands can be entered. To disable AAA, use the no aaa new-model command.

Do not issue the aaa new-model command unless prepared to configure AAA authentication. In some cases, just issuing this command will force Telnet users to authenticate with a username, even if no username database or authentication method is configured. If access to the router console is not available, access to the router will be blocked.

The following sections describe how to configure the three elements of AAA using TACACS+, RADIUS, and local databases.