System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

AAA service capabilities

Updated: September 18, 2026

Want to summarize with AI?

Log in

Introduces the primary functions of AAA services, outlining essential preparation steps and requirements for AAA configuration, including server compatibility and interoperability considerations to ensure successful deployment.

AAA service capabilities are Cisco IOS XR software features that

  • control administrative access to the router

  • use task-based authorization as the administrative model to manage user access, and

  • verify user identity and permissions through authentication and authorization.

AAA services availability

AAA is included in the Cisco IOS XR software base package by default. Major tasks for implementing task-based authorization include configuring task groups and user groups.

Before configuring user groups, task groups, or external authentication servers (such as RADIUS or TACACS+), review the conceptual information to understand the purpose and significance of AAA.

To configure AAA services, follow the appropriate configuration tasks for this topic.

Requirement: Prepare for AAA service configuration

To prepare for AAA service configuration, ensure that you meet the following requirements:

  • You must belong to a user group associated with a task group that includes the necessary task IDs for AAA command access. Refer to the command reference guides for task ID requirements for each command. If you cannot use a command, contact your AAA administrator to confirm your user group assignment.

  • Establish a root system user during initial setup. Administrators may configure local users without any specific AAA configuration, but use an external AAA security server and database if user accounts are shared across multiple routers in an administrative domain. Configure the local database as a fallback to ensure access if the external server is unreachable.

Requirement: Verify AAA server compatibility and interoperability

To ensure proper compatibility and interoperability when connecting Cisco IOS XR routers to external AAA servers, follow these requirements:

  • Verify compatibility only with the Cisco freeware TACACS+ server and FreeRADIUS. Cisco supports these servers for AAA integration.

  • When choosing external TACACS+ or RADIUS server software for AAA services, ensure it follows Cisco's compatibility guidelines.

  • Use the same AAA server software and database (such as CiscoSecure ACS) for your router and other Cisco equipment not running Cisco software to simplify interoperability.

  • If the external TACACS+ server does not support task IDs, follow Cisco's task-ID interoperability guidance provided in the AAA password security and authorization policies chapter.

  • The router will preserve task-ID behavior only where the external AAA server supports it.