CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.1

Information About AAA

---

This chapter describes authentication, authorization, and accounting (AAA, pronounced “triple A”). AAA is a a set of services for controlling access to computer resources, enforcing policies, assessing usage, and providing the information necessary to bill for services. These processes are considered important for effective network management and security.

This chapter includes the following sections:

• Authentication
• Authorization
• Accounting
• Interaction Between Authentication, Authorization, and Accounting
• AAA Servers
• AAA Server Groups
• Local Database Support
• Summary of AAA Service Support

Authentication

Authentication provides a way to identify a user, typically by having the user enter a valid username and valid password before access is granted. The AAA server compares a user's authentication credentials with other user credentials stored in a database. If the credentials match, the user is permitted access to the network. If the credentials do not match, authentication fails and network access is denied.

You can configure the ASA to authenticate the following items:

• All administrative connections to the ASA, including the following sessions:

– Telnet

– SSH. For more information, see Chapter41, “Configuring Management Access”

– Serial console

– ASDM using HTTPS

– VPN management access

• The enable command. For more information, see Chapter41, “Configuring Management Access”
• Network access. For more information, see “Configuring the Identity Firewall,” “Configuring the ASA to Integrate with Cisco TrustSec,” and Chapter 7, “Configuring AAA Rules for Network Access” of the firewall configuration guide.
• VPN access. For more information, see Chapter 6, “Configuring Remote Access IPsec VPNs,” Chapter 8, “Configuring Easy VPN Services on the ASA 5505,” Chapter 10, “Configuring LAN-to-LAN IPsec VPNs,” and Chapter 82, “Introduction to Clientless SSL VPN” of the VPN configuration guide.

Authorization

Authorization is the process of enforcing policies: determining what types of activities, resources, or services a user is permitted to access. After a user is authenticated, that user may be authorized for different types of access or activity.

You can configure the ASA to authorize the following items:

• Management commands. For more information, see Chapter41, “Configuring Management Access”
• Network access. For more information, see Chapter 7, “Configuring AAA Rules for Network Access” of the firewall configuration guide.
• VPN access. For more information, see Chapter 6, “Configuring Remote Access IPsec VPNs,” Chapter 8, “Configuring Easy VPN Services on the ASA 5505,” Chapter 10, “Configuring LAN-to-LAN IPsec VPNs,” and Chapter 82, “Introduction to Clientless SSL VPN” of the VPN configuration guide.

Accounting

Accounting measures the resources a user consumes during access, which may include the amount of system time or the amount of data that a user has sent or received during a session. Accounting is carried out through the logging of session statistics and usage information, which is used for authorization control, billing, trend analysis, resource utilization, and capacity planning activities.

Interaction Between Authentication, Authorization, and Accounting

You can use authentication alone or with authorization and accounting. Authorization always requires a user to be authenticated first. You can use accounting alone, or with authentication and authorization.

AAA Servers

The AAA server is a network server that is used for access control. Authentication identifies the user. Authorization implements policies that determine which resources and services an authenticated user may access. Accounting keeps track of time and data resources that are used for billing and analysis.

AAA Server Groups

If you want to use an external AAA server for authentication, authorization, or accounting, you must first create at least one AAA server group per AAA protocol and add one or more servers to each group. You identify AAA server groups by name. Each server group is specific to one type of server or service.

Local Database Support

The ASA maintains a local database that you can populate with user profiles. You can use a local database instead of AAA servers to provide user authentication, authorization, and accounting. For more information, see Chapter33, “Configuring the Local Database for AAA”

Summary of AAA Service Support

Table 32-1 provides cross-references to the configuration guide chapters that describe support for specific AAA service types.