TechKnowSurge
CompTIA Security+ 1.2 ISC2 CISSP 5.6 NIST 800-53 IA-2 NIST CSF PR.AA-01 CompTIA Security+ 4.6 CompTIA SecurityX 2.1
TechKnowSurge Catalog Videos AAA Services
VideoSecurityFree

AAA Services

AAA (Authentication, Authorization, and Accounting) is a security framework used to manage network access at scale through centralized authentication servers rather than local device databases. Common protocols implementing this model include TACACS+, RADIUS, and Diameter.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

AAA — Authentication, Authorization, and Accounting — is a foundational framework in network security and identity management. Authentication confirms who a user is, authorization defines what that user is permitted to access, and accounting records and logs their activity on the network. While these three functions can be handled independently, the AAA model brings them together into a cohesive approach to access control that scales with organizational needs. Managing credentials locally on individual network devices works for small environments but becomes unmanageable and insecure at scale. When credentials are stored on each router, switch, or firewall separately, adding or removing users requires touching every device individually — a time-consuming process that introduces serious security gaps, particularly when access needs to be revoked promptly. Centralizing authentication through a dedicated server eliminates this problem by giving all network devices a single, authoritative source for credential validation. Several protocols and services exist specifically to implement the AAA model in network infrastructure. TACACS+ is a Cisco-proprietary protocol widely used in enterprise environments, while RADIUS and Diameter are open-standard alternatives commonly deployed across a broad range of systems. Understanding the distinction between the AAA model itself and the protocols used to implement it is important — the model describes the framework for authentication and access management, while the protocols define how devices communicate with authentication servers to enforce that framework in practice.

What you'll learn

What's covered

AAA Services

Aligned to

CompTIA Security+
1.2 Summarize fundamental security concepts.
4.6 Given a scenario, implement and maintain identity and access management.
ISC2 CISSP
5.6 Implement authentication systems
NIST 800-53
IA-2 Identification and Authentication (Organizational Users)
NIST CSF
PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization.
CompTIA SecurityX
2.1 Given a scenario, analyze the security requirements and objectives to provide the appropriate authentication and authorization controls.

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Authorization
The process of determining what actions or resources an authenticated user is permitted to access.
Scalability
The ability of a system to handle increased load by adding resources without degrading performance.
Authentication, Authorization, and Accounting
AAA
Authentication, Authorization, and Accounting is a security framework that controls network access by verifying user identity, determining permitted actions, and logging activity for auditing and billing purposes.
Accounting
The tracking and logging of user activity, resource access, and system changes on a network for auditing and oversight purposes.
Terminal Access Controller Access-Control System Plus
TACACS+
A Cisco proprietary AAA protocol that encrypts the entire body of its messages and separates authentication, authorization, and accounting into independent functions, allowing granular control over each. TACACS+ uses TCP port 49 and is commonly used to authenticate administrator access to network devices.
Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Diameter
An AAA protocol designed as the successor to RADIUS, offering improved reliability, security, and support for modern network environments.

Topics

Aaa Protocols Tacacs Plus Radius Diameter Network Authentication Access Control Networking

Transcript

Why We Need AAA Services

Many times we authenticate to a local database. What I mean by that is we make a connection to maybe a server, or maybe it's a router or firewall or switch, and we are using the local database for our credentials to log into that machine. But that's not always feasible, especially at scale. We probably want some sort of authentication server. Well, that's what AAA services do for us.

AAA stands for authentication, authorization and accounting. Authentication is verifying the identity. Authorization is determining what they should have access to. And accounting tracks and logs that information.

One thing to understand about AAA is there is a AAA model, that is this idea that there's authentication, authorization and accounting, and we want to implement that. Then there are specific protocols or services or servers that we can use to implement this model to make sure it's implemented on our network. So many times I find that the model doesn't necessarily always 100% apply to network protocols, that we can use it in other scenarios as a model for authentication, for identity and access management services. But there are some specific protocols that are associated with AAA.

An Example at Scale

Let's just use an example here. I'm on a laptop right here, and let's say I'm logging into a router right here and I'm sshing into it. I need to SSH into it because I need to perform some work on it. Well, what I'm going to do is I'm going to SSH onto it, and perhaps it has some sort of local database. We call it the local database, a set of usernames and passwords that I can use to log into this router. I do my work and I log off of it.

That's great if I just have one or two routers, but let's say I have a thousand routers. Now, for me to do that on each one of those devices, that would take a long time, to have a separate username and password on those. Now think, if let's say somebody got laid off or fired or has left the company, and I've got to visit a thousand of those routers to remove that username and passwords. You can see how that would be both a management and a security nightmare, because are you going to get it off of all of those routers? So it creates some vulnerabilities there.

Versus if I set up a separate database that does the authentication. Now I can have those credentials on this separate system right here, and then the router uses that separate system in order to give permission or deny permission. Now all of those thousand routers are on the same page, because they're using the same database server.

Protocols, Services and Servers

So not only do we have this AAA model, but we also have protocols, services and servers that go along with that. So in this example right here we have the authenticator with the authentication servers back here. So these are these servers. The servers are what are running the services, which is just the program that's providing these services, and the protocols is the communication that's happening between these devices right here.

So what are examples of these protocols and services that are associated with AAA? Well, one of them is TACACS, which is a Cisco proprietary one. We have RADIUS and we have Diameter. So there's just a few examples.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →