AAA & Device Access Quick Reference

Authentication: who are you. Authorization: what are you allowed to do (a genuinely separate question from identity). Accounting: what did you actually do.

A method list is an ordered sequence of authentication methods. Fallback to the next method triggers only when a method is genuinely UNREACHABLE — a legitimate denial from a reachable server is final, not a trigger to try the next method.

Always include a local fallback in a server-based method list. Without one, a AAA server outage locks out every administrator from every device relying on that method list simultaneously.

'aaa new-model' must be enabled globally, or method lists are defined but have no effect.

TACACS+: encrypts the entire packet body, uses TCP, cleanly separates authentication/authorization/accounting — preferred for device administration needing granular per-command authorization.

RADIUS: encrypts only the password field, uses UDP, combines authentication and authorization into one step — preferred for network access (802.1X) given its broad multi-vendor support.