What is AAA?

Authentication, Authorization, and Accounting (AAA) is a security framework that verifies who a user or device is, determines what they are permitted to do, and records what they did. Network operating systems and management platforms implement AAA through protocols such as RADIUS and TACACS+, or through a local user database.

Key takeaways

• Authentication verifies identity; authorization sets permissions; accounting logs use.
• RADIUS and TACACS+ are the two dominant protocols used to centralize AAA.
• AAA can run locally on a device or centrally through a directory server.
• Centralized AAA scales administrative access control across large device fleets.
• Versa Director and VOS devices both support RADIUS, TACACS+, and local AAA.

On this page: Why it matters · How it works · Types · AAA & Versa · FAQ

Why is AAA important?

Every network needs to answer three questions for every login and action: who is this, what are they allowed to do, and what did they actually do. AAA answers all three under one framework, which is why it underpins nearly every piece of infrastructure that requires controlled access – routers, firewalls, VPN concentrators, and management consoles alike.

Centralizing AAA also removes a real source of risk: local-only credentials scattered across hundreds of devices, each needing its own password rotated, disabled, or investigated after a breach. A centralized RADIUS or TACACS+ server lets an administrator revoke one account and lose access everywhere at once, and gives auditors a single accounting trail – often a compliance requirement in regulated industries.

What is AAA?

AAA breaks access control into three independent steps. Authentication verifies identity – a username and password, a certificate, or a token checked against a local database or an external server such as Active Directory, LDAP, RADIUS, or TACACS+. Authorization happens after authentication succeeds: the system looks up what the user is permitted to do, comparing role or group attributes against a policy database. Accounting runs continuously afterward, recording session data – login and logout times, commands executed, bytes transferred – for billing, auditing, or forensic review.

The steps are independent by design: a system can authenticate locally but authorize and account remotely, or authenticate against one server while accounting to another. RADIUS and TACACS+ are the common protocols that carry AAA requests between a device and a centralized server, but the three-step model applies regardless.

Types of AAA

AAA deployments generally fall into a few patterns. Local AAA keeps the user database on the device itself – simplest to set up, but it does not scale past a handful of devices and leaves no centralized audit trail. RADIUS-based AAA centralizes the three functions on a RADIUS server, encrypting only the password, and is common for network-access control such as VPN and Wi-Fi login. TACACS+-based AAA encrypts the entire session and separates the three functions more granularly, making it the usual choice for administrative access to network infrastructure. Directory-based AAA authenticates against Active Directory or LDAP, often paired with single sign-on and two-factor authentication, handing authorization off to group membership.

AAA & Versa

Versa implements AAA at two layers. On Versa Director, administrator and tenant logins authenticate against a local user database or an external Active Directory, LDAP, RADIUS, or TACACS+ server, with optional two-factor authentication and single sign-on through a provider such as Okta or Azure AD. Multi-Director deployments can designate one node as a central authentication node, validating every login across the topology in one place.

On VOS devices – branches, controllers, and hubs – AAA controls CLI and shell access. Local authentication uses predefined roles such as admin, operator, tenant-admin, and security-admin; external authentication delegates to RADIUS or TACACS+, using attribute-value pairs such as versa-user-group to map a remote account onto a role. Versa’s manual hardening guidance recommends centralized RADIUS or TACACS+ authentication on every branch, controller, and hub, since it removes the risk of managing local passwords at scale.

Frequently asked questions

What is the difference between authentication and authorization?

Authentication verifies who a user is, typically through a password, certificate, or token. Authorization happens after authentication succeeds and determines what that user is allowed to do, based on their assigned role or group. A user can be authenticated but still authorized to do very little.

What is the difference between RADIUS and TACACS+?

RADIUS encrypts only the password in an authentication request and combines authentication and authorization into one exchange; it dominates network-access cases like VPN and Wi-Fi. TACACS+ encrypts the full session and separates the three functions, which is why it is more common for administrative access to network devices.

Why is centralized AAA better than local device accounts?

Centralized AAA, through RADIUS, TACACS+, or a directory server, lets an administrator manage credentials and permissions in one place instead of on every device individually. Revoking access takes one change instead of hundreds, and accounting logs land in a single system instead of scattering across every device.

Does AAA require RADIUS or TACACS+?

No. AAA is a framework, not a protocol – a device can authenticate, authorize, and account entirely against a local user database with no external server involved. RADIUS and TACACS+ are simply the most common protocols used to centralize AAA across many devices.

What does the accounting part of AAA actually record?

Accounting logs session-level data: who logged in, when the session started and ended, what commands were executed, and how much traffic – packets or bytes – the session generated. That data supports billing, security auditing, and forensic investigation after an incident.

More on AAA

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about AAA, these are worth looking at next.