5.1.b Authentication and authorization using AAA

What this objective tests

The exam wants you to configure and verify Authentication, Authorization, and Accounting (AAA) on an IOS XE device. You must define server groups, apply method lists, and verify behavior with show aaa servers and test aaa group. This matters because AAA moves identity and policy to a central server. One policy serves every device.

The three functions

• Authentication: proves the user identity.
• Authorization: decides what the user may do.
• Accounting: records what the user did.

Admin opens SSH to R1
   |
   v
Authentication: TACACS+ first, local fallback on ERROR
   |
   v
Authorization: which privilege level and shell?
   |
   v
Accounting: session start and stop sent to the server

TACACS+ versus RADIUS

Use TACACS+ for administrator access to network devices. Use RADIUS for endpoint and user access.

Method lists and fallback

A method list names the sources to try, in order:

aaa authentication login default group TACACS-SERVERS local

Read it this way: for login, try the TACACS-SERVERS group first. If every server returns ERROR, try the local username database.

The exam trap: fallback applies on ERROR, not on FAIL. A bad password does not get a second chance against the local database.

Example: TACACS+ on R1

Scenario: R1 uses two Cisco Identity Services Engine (ISE) servers at 10.10.20.10 and 10.10.20.11. AAA traffic comes from Loopback0 (10.255.255.1). One local break-glass user exists for fallback.

aaa new-model

username breakglass privilege 15 algorithm-type scrypt secret <unique-local-secret>

tacacs server ISE-TACACS-1
 address ipv4 10.10.20.10
 key 0 <shared-key>

tacacs server ISE-TACACS-2
 address ipv4 10.10.20.11
 key 0 <shared-key>

aaa group server tacacs+ TACACS-SERVERS
 server name ISE-TACACS-1
 server name ISE-TACACS-2
 ip tacacs source-interface Loopback0

aaa authentication login default group TACACS-SERVERS local
aaa authorization exec default group TACACS-SERVERS local if-authenticated
aaa accounting exec default start-stop group TACACS-SERVERS

line vty 0 15
 transport input ssh

What each AAA line does:

The default list applies to all lines with no named list. The VTY lines use it automatically after aaa new-model.

Example: RADIUS server group

The same pattern with RADIUS at 10.10.30.10:

radius server ISE-RADIUS-1
 address ipv4 10.10.30.10 auth-port 1812 acct-port 1813
 key 0 <shared-key>

aaa group server radius RADIUS-SERVERS
 server name ISE-RADIUS-1
 ip radius source-interface Loopback0

aaa authentication login default group RADIUS-SERVERS local
aaa authorization exec default group RADIUS-SERVERS local if-authenticated

Verification

R1# show aaa servers

TACACS+: id 1, priority 1, host 10.10.20.10, auth-port 49, hostname ISE-TACACS-1
     State: current UP, duration 3421s, previous duration 0s
     Dead: total time 0s, count 0
     Authen: request 12, timeouts 1, failover 0, retransmission 0
             Response: accept 9, reject 2, error 0
     Author: request 9, timeouts 0
             Response: accept 9, reject 0, error 0
     Acct: request 18, timeouts 0
             Response: start 9, stop 9, interim 0, error 0

Look for State: current UP. The accept and reject counters show real decisions. Timeouts show reachability problems.

Test a user without logging out:

R1# test aaa group TACACS-SERVERS alice <password> new-code
User successfully authenticated

new-code uses the newer AAA test path. On older releases use legacy. A reject means the credential or server policy is wrong. A timeout means a reachability or key problem.

Lab: AAA with local fallback

Topology:

[Admin PC 10.10.10.50] ---- [R1 10.10.10.2] ---- [ISE 10.10.20.10]
                                   |
                              Loopback0 10.255.255.1

Warning: aaa new-model changes login behavior on every line. You can lock yourself out. Keep a console session open and logged in while you work. Do not log out of the console until a test login succeeds.

Do these steps:

1. Open a console session to R1. Stay logged in.
2. Create the local user breakglass with privilege 15 and an scrypt secret.
3. Configure Loopback0 with 10.255.255.1 255.255.255.255.
4. Configure the TACACS+ server ISE-TACACS-1 with address 10.10.20.10 and a shared key.
5. Create the group TACACS-SERVERS with the server and source interface Loopback0.
6. Enable aaa new-model.
7. Configure the default login list: group TACACS-SERVERS local.
8. Configure default exec authorization: group TACACS-SERVERS local if-authenticated.
9. Set transport input ssh on line vty 0 15.
10. Run test aaa group TACACS-SERVERS alice <password> new-code. Confirm User successfully authenticated.
11. Open a second session. Connect with SSH as the central user alice.
12. Stop the TACACS+ service on the server. Connect with SSH as breakglass. Confirm local fallback works.
13. Try a wrong password for alice. Confirm the login fails and does not fall back to local.
14. Run show aaa servers. Confirm accept, reject, and timeout counters match your tests.

Expected results:

• Central users authenticate against the server.
• The break-glass user works only when the server is unreachable.
• show aaa servers shows the server UP with counters that match the tests.

Exam traps

• aaa new-model without a local user can lock you out. Create the local user first.
• FAIL stops the method list. Only ERROR moves to the next method.
• The server key must match on both sides. A key mismatch looks like a timeout or reject.
• The source interface matters. ISE often accepts requests only from a known device IP.
• Authorization is separate from authentication. A user can log in and still get no exec shell.

Pass check

You are ready for this objective when you can do these things:

• Write a TACACS+ server group and a default login method list from memory.
• Explain when local fallback applies and when it does not.
• Verify a credential with test aaa group before you log out.
• Read show aaa servers and name the server state and the accept and reject counters.
• Explain why you keep a console session open during AAA changes.