Connect your Cisco routers and switches to the AAA RADIUS server.
- AAA stands for Authentication, Authorization, and Accounting.
- RADIUS is a distributed client/server authentication system.
- TACACS+ is a protocol developed by Cisco for Terminal Access Control.
AAA uses RADIUS or TACACS+ to verify credentials on a server when a user tries to log in.
On all network devices (routers, switches, access points, etc.) issue the following commands:
enable configure terminal enable secret LOCAL_PASSWORD username admin privilege 15 secret ADMIN_PASSWORD
Note: These local credentials serve as a fallback in case the RADIUS or TACACS+ server is unreachable.
For RADIUS
aaa new-model aaa authentication enable default group radius local aaa authentication login default group radius local aaa authorization exec default group radius local radius-server host 192.168.1.100 key PASSWORD
For TACACS+
aaa new-model aaa authentication enable default group tacacs+ local aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local tacacs-server host 192.168.1.100 key PASSWORD
Replace 192.168.1.100 and PASSWORD with the IP address and key of your RADIUS or TACACS+ server.
To test whether AAA is authenticating successfully through the server, run:
do test aaa group radius REMOTE_USER REMOTE_PASSWORD new-code OR do test aaa group tacacs+ REMOTE_USER REMOTE_PASSWORD legacy
Note: REMOTE_USER and REMOTE_PASSWORD must already exist on the server.
Other useful commands:
show users do debug aaa authentication do debug radius do debug tacacs