AAA Explained: Authentication, Authorization and Accounting for Network+

AAA is the framework behind almost every access decision on a network: Authentication, Authorization and Accounting. Three separate questions, asked in order, and the exam expects you to keep them apart.

The three As

Authentication — who are you? Proving identity, usually with a password, a certificate, a token or a biometric. Authentication only establishes identity. It grants nothing.

Authorization — what are you allowed to do? Once identity is established, what resources and actions does this identity get? A valid login with no permissions is authenticated but not authorized, and that distinction is a favourite exam question.

Accounting — what did you do? Recording the session: when it started and ended, how much data moved, which commands ran. This is what produces the audit trail, and it is the A that candidates forget.

A useful way to hold it: authentication is the ID check at the door, authorization is which rooms your badge opens, accounting is the log of every door you went through.

Why centralise it

Without AAA, every switch, router, firewall and access point keeps its own accounts. An administrator leaves and you are editing local accounts on fifty devices, hoping you did not miss one.

A central AAA server fixes that: one identity store, one place to change a password or revoke access, consistent policy, and accounting collected in one log. The trade-off is a dependency — if the AAA server is unreachable, devices fall back to local credentials, which is exactly why those local accounts still need to exist and be protected.

RADIUS versus TACACS+

This comparison appears on both Network+ and Security+, and the differences are specific enough to memorise.

Aspect	RADIUS	TACACS+
Transport	UDP 1812/1813 (older: 1645/1646)	TCP 49
Encryption	Password only	Entire payload
AAA separation	Combines authentication and authorization	Separates all three
Origin	Open standard	Cisco proprietary
Typical use	Network access — Wi-Fi, VPN, 802.1X	Device administration

Three points carry most of the questions. TACACS+ encrypts the whole packet while RADIUS encrypts only the password, so TACACS+ is the more confidential of the two. TACACS+ separates authorization from authentication, which lets you control individual commands on a router — the classic reason to choose it for administrator access. And the transport differs: TCP 49 against UDP 1812.

In practice organisations often run both: RADIUS for users getting onto the network, TACACS+ for engineers logging into the network gear.

802.1X and port-based access control

802.1X is how AAA reaches the physical edge. Before a device is allowed to pass traffic on a switch port or wireless SSID, it must authenticate.

Three roles, and the exam asks for them by name.

Supplicant — the client device requesting access.

Authenticator — the switch or access point controlling the port. It relays credentials but does not decide.

Authentication server — usually RADIUS. It makes the decision.

The authenticator is a gatekeeper, not a judge. Credentials are carried using EAP, and the RADIUS server can return not just permit or deny but also a VLAN assignment, putting an unrecognised device onto a guest or quarantine VLAN instead of rejecting it outright.

Accounting in practice

Accounting records feed billing, capacity planning, compliance evidence and incident investigation. After a breach, accounting data is what tells you which account was used, from where, for how long and to do what.

Records typically go to a syslog server or a SIEM for correlation. For that to be worth anything, clocks must agree — which is why accurate time synchronisation underpins the whole audit trail.

Related terms worth separating

Identification is claiming an identity; authentication is proving it. Authentication factors are the categories of proof — something you know, have, or are. Non-repudiation is the property that someone cannot credibly deny an action, and it depends on accounting plus strong authentication.

What to remember for the exam

Authentication proves who, authorization decides what, accounting records what happened. RADIUS is UDP 1812/1813, encrypts only the password, combines authentication with authorization, and is used for network access. TACACS+ is TCP 49, encrypts the whole payload, separates all three As, and is used for device administration. In 802.1X the supplicant requests, the authenticator gates the port, and the authentication server decides.

Related reading: Authentication factors · Kerberos · Syslog severity levels