Authentication, Authorization, and Accounting

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

Create and configure a AAA feature in a System profile.

1. Configure users.

   Table 1. Local

   Field	Description
   Enable AAA Authentication	Enable authentication parameters.
   Accounting Group	Enable accounting parameters.
   Add AAA User
   Name	Enter a name for the user. It can be 1 to 128 characters long, and it must start with a letter. The name can contain only lowercase letters, the digits 0 through 9, hyphens (-), underscores (_), and periods (.). The name cannot contain any uppercase letters. The following usernames are reserved, so you cannot configure them: backup, basic, bin, daemon, games, gnats, irc, list, lp, mail, man, news, nobody, proxy, quagga, root, sshd, sync, sys, uucp, and www-data. Also, names that start with viptela-reserved are reserved.
   Password	Enter a password for the user. The password is an MD5 digest string, and it can contain any characters, including tabs, carriage returns, and linefeeds. For more information, see Section 9.4 in RFC 7950, The YANG 1.1 Data Modeling Language. Each username must have a password. Users are allowed to change their own passwords. The default password for the admin user is admin. We strongly recommended that you change this password.
   Confirm Password	Re-enter the password for the user.
   Privilege	Select between privilege level 1 or 15. Level 1: User EXEC mode. Read-only, and access to limited commands, such as the ping command. Level 15: Privileged EXEC mode. Full access to all commands, such as the reload command, and the ability to make configuration changes. By default, the EXEC commands at privilege level 15 are a superset of those available at privilege level 1.
   Add Public Key Chain
   Key String*	Enter the authentication string for a key.
   Key Type	Choose ssh-rsa.

2. Configure RADIUS servers.

   Table 2. RADIUS

   Field	Description
   Address*	Enter the IP address of the RADIUS server host.
   Acct Port	Enter the UDP port to use to send 802.1X and 802.11i accounting information to the RADIUS server. Range: 1 - 65534. Default: 1813
   Auth Port	Enter the UDP destination port to use for authentication requests to the RADIUS server. Default: 1812 Range: 1 - 65534
   Retransmit	Enter the number of times the device transmits each RADIUS request to the server before giving up. Default: 3 Range: 0 - 100
   Timeout	Enter the number of seconds a device waits for a reply to a RADIUS request before retransmitting the request. Default: 5 seconds Range: 1 through 1000
   Key*	Enter the key the Cisco IOS XE Catalyst SD-WAN device passes to the RADIUS server for authentication and encryption.
   Key Type	Choose Protected Access Credential (PAC) key.

3. Configure TACACS servers.

   Table 3. TACACS Server

   Field	Description
   Address*	Enter the IP address of the TACACS+ server host.
   Port	Enter the UDP destination port to use for authentication requests to the TACACS+ server. If the server is not used for authentication, configure the port number to be 0. Default: 49
   Timeout	Enter the number of seconds a device waits for a reply to a TACACS+ request before retransmitting the request. Default: 5 seconds Range: 1 through 1000
   Key*	Enter the key the Cisco IOS XE Catalyst SD-WAN device passes to the TACACS+ server for authentication and encryption. You can type the key as a text string from 1 to 31 characters long, and it is immediately encrypted, or you can type an AES 128-bit encrypted key. The key must match the AES encryption key used on the TACACS+ server.

4. Configure accounting rules.

   Table 4. Accounting

   Field	Description
   Rule Id*	Enter the accounting rule ID.
   Method*	Specifies the accounting method list. Choose one of the following: commands: Provides accounting information about specific, individual EXEC commands associated with a specific privilege level. exec: Provides accounting records about user EXEC terminal sessions on the network access server, including username, date, and start and stop times. network: Runs accounting for all network-related service requests. system: Performs accounting for all system-level events not associated with users, such as reloads. Note When system accounting is used and the accounting server is unreachable at system startup time, the system will not be accessible for approximately two minutes.
   Level	Choose the privilege level (1 or 15). Accounting records are generated only for commands entered by users with this privilege level.
   Start Stop	Enable this option to if you want the system to send a start accounting notice at the beginning of an event and a stop record notice at the end of the event.
   Use Server-group*	Choose a previously configured TACACS group. The parameters that this accounting rule defines are used by the TACACS servers that are associated with this group.

5. Configure authorization parameters.

   Table 5. Authorization

   Field	Description
   Server Auth Order*	Choose the authentication order. It dictates the order in which authentication methods are tried when verifying user access to a Cisco IOS XE Catalyst SD-WAN device through an SSH session or a console port.
   Authorization Console	Enable this option to perform authorization for console access commands.
   Authorization Config Commands	Enable this option to perform authorization for configuration commands.
   Add Authorization Rule
   Rule Id*	Enter the authorization rule ID.
   Method*	Choose Commands, which causes commands that a user enters to be authorized.
   Level	Choose the privilege level (1 or 15) for commands to be authorized. Authorization is provided for commands entered by users with this privilege level.
   If Authenticated	Enable this option to apply the authorization rule parameters only to the authenticated users. If you do not enable this option, the rule is applied to all users.
   Use Server-group*	Choose a previously configured TACACS group. The parameters that this authorization rule defines are used by the TACACS servers that are associated with this group.

6. Configure 802.1x parameters.

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

Click Device Templates, and click Create Template.

From the Create Template drop-down list, select From Feature Template.

From the Device Model drop-down list, select the type of device for which you are creating the template.

Select Basic Information.

To create a custom template for AAA, select Factory_Default_AAA_CISCO_Template and click Create Template.

In the Template Name field, enter a name for the template.

In the Template Description field, enter a description of the template.

When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the Scope drop-down list to the left of the parameter field and select one of these:

To configure local access for individual users, select Local.

To add a new user, click + New User, and configure the following parameters:

Click Add to add the new user. Click + New User again to add additional users.

From Local, select User Group.

Click + New User Group, and configure the following parameters:

Click Add to add the new user group.

To add another user group, click + New User Group again.

To delete a user group, click the trash icon. You cannot delete the three standard user groups, basic, netadmin, and operator.

To configure a connection to a RADIUS server, from RADIUS, click + New Radius Server, and configure the following parameters:

Click Add to add a new RADIUS server.

To add another RADIUS server, click + New RADIUS Server again.

To remove a server, click the trash icon.

Device(config)# radius server 10.99.144.201
Device1(config-radius-server)# retransmit 5
Device(config-radius-server)# timeout 10

To configure a connection to a TACACS+ server, from TACACS, click + New TACACS Server.

Configure these parameters:

To configure AAA authentication order on a Cisco IOS XE Catalyst SD-WAN device, select the Authentication tab and configure the Server Group Order parameter.

Change the default order of authentication methods that the software uses to verify user's access to a Cisco IOS XE Catalyst SD-WAN device:

1. Click the ServerGroups priority order field to display the drop-down list of server groups.

   The list displays groups from local, RADIUS, and TACACS authentication methods.

2. Select the groups in the order the software should use to verify users accessing the device.

   Note

   Select at least one group from the list.

To configure authorization, choose the Authorization tab, click + New Authorization Rule.

Configure the following parameters:

Click Add to add the new authorization rule.

To add another authorization rule, click + New Accounting Rule again.

To remove an authorization rule, click the trash icon on the right side of the line.

system
   aaa  
     aaa authorization console
     aaa authorization config-commands
     aaa authorization exec default list-name method 
     aaa authorization commands level default list-name method

To configure accounting, choose the Accounting tab and click + New Accounting Rule.

Configure these parameters:

Click Add to add the new accounting rule.

To add another accounting rule, click + New Accounting Rule again.

To remove an accounting rule, click the trash icon on the right side of the line.

 system
   ​aaa  
     aaa accounting exec default start-stop group group-name
     aaa accounting commands level default start-stop group group-name
     aaa accounting network default start-stop group group-name
     aaa accounting system default start-stop group group-name