Managing local passwords on 50 switches does not scale. AAA (Authentication, Authorization, Accounting) centralizes access control. TACACS+ and RADIUS are the two protocols used, and they serve different purposes.

TACACS+ vs RADIUS

Rule of thumb: TACACS+ for switch/router admin access, RADIUS for end-user network access.

Configuring TACACS+ (for Switch Administration)

1. Configure the AAA Server

tacacs-server host 192.168.1.100
 key MyTacacsKey123!

Or using the newer syntax:

aaa new-model
 
tacacs server TACACS-1
 address ipv4 192.168.1.100
 key MyTacacsKey123!
 
tacacs server TACACS-2
 address ipv4 192.168.1.101
 key MyTacacsKey123!

2. Define AAA Methods

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
 
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
 
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

Breakdown:

• authentication login — who can log in
• authentication enable — who can run enable
• authorization exec — what shell access they get
• authorization commands 15 — which privilege 15 commands they can run
• accounting exec — log when sessions start/stop
• accounting commands 15 — log every command executed

3. Fallback to Local

The local keyword at the end means: if the TACACS server is unreachable, fall back to local users. This prevents lockouts.

aaa authentication login default group tacacs+ local

4. Configure Console Access

line con 0
 login authentication default

Configuring RADIUS (for Network Access / 802.1X)

radius server RADIUS-1
 address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
 key MyRadiusKey123!
 
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting network default start-stop group radius
 
dot1x system-auth-control

Creating the ACS Server (Linux with FreeRADIUS)

Install FreeRADIUS on a Linux server:

apt install freeradius freeradius-utils

Edit /etc/freeradius/3.0/clients.conf:

client 192.168.0.0/16 {
    secret = MyRadiusKey123!
    shortname = network-devices
}

Add users in /etc/freeradius/3.0/users:

admin    Cleartext-Password := "StrongPass"
         Service-Type = NAS-Prompt-User,
         Cisco-AVPair = "shell:priv-lvl=15"

netop    Cleartext-Password := "NetopPass"
         Service-Type = NAS-Prompt-User,
         Cisco-AVPair = "shell:priv-lvl=5"

Restart:

systemctl restart freeradius

Verification

test aaa group tacacs+ admin StrongPass! new-code
test aaa group radius admin StrongPass! new-code
 
show aaa servers
show tacacs
show radius statistics

AAA Debugging

debug aaa authentication
debug aaa authorization
debug tacacs
debug radius

Always disable debug when done — it floods the console:

undebug all

Common Pitfalls

Break-In Procedure (When AAA Fails)

If AAA misconfiguration locks you out:

1. Connect via console
2. Reboot the switch
3. Press Ctrl+Break during boot to enter ROMMON
4. confreg 0x2142 (skip startup config)
5. reset
6. Copy startup-config running-config
7. Fix AAA config
8. config-register 0x2102
9. wr