AAA: authentication, authorization, and accounting
AAA separates three questions: who are you, what are you allowed to do, and what activity should be recorded. Authentication verifies identity, authorization decides privileges or services, and accounting records session or command activity according to the implementation.
Centralized AAA makes network administration easier to revoke, audit, and standardize than independent local accounts on every switch, router, firewall, and wireless system.
AAA also creates a consistent control point for policy. Instead of embedding privilege decisions independently on every device, administrators can centralize identity, group membership, and accounting while retaining carefully controlled local fallback for emergencies.
RADIUS for network access
RADIUS is widely used for network access authentication and authorization, including enterprise Wi-Fi, wired 802.1X, VPN access, and other centralized services. Network devices act as clients that send access requests to RADIUS servers and receive accept, reject, or challenge responses plus authorization attributes.
RADIUS commonly uses UDP and shared secrets to protect selected protocol fields, so the surrounding management and transport network should also be secured.
RADIUS attributes can carry authorization information such as VLAN assignment, role, session timeout, or address-related policy depending on the access system. That makes the server part of the network access decision, not merely a password checker.
TACACS+ for device administration
TACACS+ is widely associated with administrative access to network devices. It can separate authentication from authorization and accounting in ways that fit command-level administration and centralized privilege control.
Use it to reduce shared local administrator credentials and to build an audit trail of who accessed infrastructure and what actions were authorized.
802.1X and AAA on LAN/WLAN access
In 802.1X, the endpoint is the supplicant, the switch or AP is the authenticator, and the backend authentication server commonly uses RADIUS. The result can authorize normal access, assign a VLAN or role, or apply other policy attributes.
Plan certificate trust, identity stores, endpoint onboarding, guest or remediation behavior, and fallback for devices that cannot perform 802.1X.
For certificate-based 802.1X, the trust chain, certificate lifetime, revocation behavior, and endpoint identity all matter. A network outage caused by an expired certificate can resemble an ordinary access-layer failure unless AAA logs are included in the troubleshooting workflow.
Accounting and traceability
Accounting records events such as login, logout, session duration, resource use, and—in some systems—executed commands. These records support incident response, change review, and compliance.
Centralize logs and synchronize clocks so an AAA event can be correlated with device configuration changes and network incidents.
Redundancy, timeouts, and fallback
AAA is critical infrastructure, so configure multiple servers and understand timeout and retry behavior. A network device should not wait so long for an unreachable server that administration becomes unusable, nor should it fall back insecurely without a deliberate policy.
Maintain a controlled emergency local account where appropriate and test the procedure before an outage.
Protect the AAA plane
Restrict which devices can query AAA servers, protect shared secrets and certificates, use dedicated management networks when possible, patch identity infrastructure, and monitor repeated failures. Administrative AAA should not be broadly reachable from user networks.
Prefer current secure protocol options and vendor-supported hardening rather than relying on default settings.
Monitor server availability and authentication latency in addition to simple reachability. A server that responds slowly can create user-facing timeouts even when every request eventually succeeds, especially when devices try multiple AAA servers in sequence.
Troubleshoot RADIUS and TACACS+
Start with IP reachability and routing between the network device and AAA server. Verify ports, shared secrets, source interface, time, certificates where applicable, username format, identity-store status, and authorization policy. Compare server logs with device debug or accounting records.
Distinguish timeout from explicit reject. A timeout suggests transport, server availability, or secret mismatch behavior; a reject means the request reached a decision point but policy or credentials denied it.
AAA example for switches and Wi-Fi
A company may use RADIUS with 802.1X for employee Wi-Fi and wired access, assigning users to appropriate roles, while TACACS+ handles administrator login to switches and routers. Both systems draw identity from a central directory but enforce different network purposes.
Emergency local access is documented, tightly controlled, and reviewed after use. Accounting records are forwarded to a central logging platform.
Validate both success and failure paths: an authorized administrator should receive the expected privilege, an unauthorized account should be rejected, accounting should record the session, and the documented emergency fallback should work only under the intended conditions.
Human identities, service accounts, and management networks
Automation systems and monitoring platforms also need credentials. Treat service identities separately from human accounts, grant only required permissions, rotate secrets, and avoid embedding privileged credentials in scripts or repositories.
Place management systems and AAA services on protected networks with explicit firewall policy. This completes the English guide localization: from networking fundamentals through operations and security, the full guide corpus is now available as a coherent localized master.