AAA: Authentication, Authorization and Accounting

Understand the three-part model every access control system is built on.

beginnernetwork-securityfundamentalsaaa

What is it?

AAA is the framework behind almost every access control system. Authentication verifies identity (who are you?). Authorization decides what an authenticated identity is allowed to do (what can you access?). Accounting logs what was actually done (what did you do, and when?). Network devices commonly use protocols like TACACS+ and RADIUS to centralise AAA instead of relying on local passwords on every device.

Why should I learn it?

Every login to a router, switch, firewall, or VPN goes through some form of AAA. Understanding the three separate steps is essential before you can troubleshoot “why can this user log in but not run this command.”

How it works

User attempts login → Authentication (username/password, certificate, MFA) confirms identity → Authorization checks what the identity is permitted to do → Accounting logs the session and actions for audit. Centralised AAA servers (RADIUS/TACACS+) let an admin manage access for hundreds of devices from one place instead of local accounts everywhere.

Real-world example

A junior engineer authenticates successfully to a core switch via TACACS+, but authorization restricts them to show commands only — they cannot run configure terminal. Accounting logs record every command they typed, for audit purposes.

Troubleshooting mindset

If a user “can’t do something” on a device, first separate whether it’s an authentication failure (can’t log in at all) or an authorization failure (logged in, but blocked from that action).

Common mistake

Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?

Quick recap

  • Understand the job of the protocol or feature.
  • Know where it sits in the traffic path.
  • Verify behaviour instead of guessing.
  • Connect the topic to the next networking layer.

Interview connection

Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.

References & Further Reading

  • AddySec original content — written for the Network Security track to build practical, interview-ready understanding.
CONTINUE LEARNING