AAA-Netconf

AAA

Resources Summary

YANG Path	get/get-config	edit-config	rpc
/aaa	Y	merge, replace, create, delete	—
/aaa/accounting	Y	merge, replace, create, delete	—
/aaa/authentication	Y	merge, replace, create, delete	—
/aaa/authorization	Y	merge, replace, create, delete	—
show-aaa	—	—	Y

Examples

Authentication, Authorization, and Accounting (AAA) is a framework for controlling access to network resources. It provides a way to manage user access and permissions, ensuring that only authorized users can access specific resources.

AsterNOS support Authentication, Authorization, and Accounting (AAA) for user management with following capabilities.

For Authentication, AsterNOS supports the following methods:

• Local Authentication
• RADIUS Authentication
• TACACS+ Authentication

For Authorization, AsterNOS supports the following methods:

• Local Authorization
• TACACS+ Authorization
• RADIUS Authorization

For Accounting, AsterNOS supports the following methods:

• Local Accounting
• TACACS+ Accounting
• RADIUS Accounting

Modify AAA Configuration

The following example give a typical AAA configuration:

• Use TACACS+ as primary authentication protocol, and local as secondary protocol.
• Enable failthrough and fallback for authentication, which will allow local user database to be used if TACACS+ server is unreachable.
• Enable debug for authentication, which will log detailed information about authentication attempts.
• Use TACACS+ as authorization protocol, and enable auth-cmd, which strictly checks user permissions for executing commands via TACACS+ protocol.
• Enable debug for authorization, which will log detailed information about authorization attempts.
• use TACACS+ as accounting protocol, which will sending user activity logs to TACACS+ server.

Request example

<config><top>
  <aaa>
    <accounting>
        <protocol>tacacs+</protocol>
    </accounting>
    <authorization>
        <protocol>tacacs+</protocol>
        <auth-service>false</auth-service>
        <auth-cmd>true</auth-cmd>
        <debug>true</debug>
    </authorization>
    <authentication>
        <protocol>tacacs+</protocol>
        <protocol>local</protocol>
        <failthrough>true</failthrough>
        <fallback>true</fallback>
        <debug>true</debug>
    </authentication>
  </aaa>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:c0494172-98ab-4056-b83c-8c0df58e3e92">
  <ok/>
</rpc-reply>

Get Current AAA Configurations

Request example to get current AAA configurations via get-config

<filter type="subtree">
    <top>
        <aaa/>
    </top>
</filter>

Response example

<data xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <top>
    <aaa xmlns="http://asterfusion.com/ns/yang/asternos-aaa">
      <accounting>
        <protocol>tacacs+</protocol>
      </accounting>
      <authentication>
        <protocol>tacacs+</protocol>
        <protocol>local</protocol>
        <failthrough>true</failthrough>
        <fallback>true</fallback>
        <debug>true</debug>
      </authentication>
      <authorization>
        <protocol>tacacs+</protocol>
        <auth-service>false</auth-service>
        <auth-cmd>true</auth-cmd>
        <debug>true</debug>
      </authorization>
    </aaa>
  </top>
</data>

Reset AAA Configurations

Request example to reset AAA configurations to factory default.

<config><top>
  <aaa operation="delete"/>
</top></config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:fcc97206-be43-444a-8a9c-1d69cc14992f">
  <ok/>
</rpc-reply>

Show AAA Status via rpc

Use show-aaa rpc to show current AAA status.

Request example to show current AAA configurations in CLI format via rpc show-aaa

<show-aaa/>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:55a84d56-e32a-4713-87ae-674b4070812f">
  <data xmlns="http://asterfusion.com/ns/yang/asternos-aaa">
AAA authentication login ['tacacs+', 'local']
AAA authentication failthrough True
AAA authentication fallback True
AAA authentication debug True
AAA authorization command ['tacacs+']
AAA authorization auth_cmd True
AAA authorization debug True
AAA accounting command ['tacacs+']
  </data>
</rpc-reply>

Properties Descriptions

Aaa

Tree Diagram

module: asternos-aaa
  +--rw aaa
     +--rw accounting
     |  +--rw protocol*   enumeration
     +--rw authentication
     |  +--rw protocol*      enumeration
     |  +--rw failthrough?   boolean
     |  +--rw fallback?      boolean
     |  +--rw debug?         boolean
     +--rw authorization
        +--rw protocol*       enumeration
        +--rw auth-service?   boolean
        +--rw auth-cmd?       boolean
        +--rw debug?          boolean

Table of Properties

Name	Required	Type/Range	Description
aaa	M		Path-only node, has no configurable value.
accounting	M		Path-only node, has no configurable value. AAA accounting
protocol	O	”tacacs+" "local" "radius”	AAA accounting protocol. Default value: [‘local’]
authentication	M		Path-only node, has no configurable value. AAA authentication
protocol	O	”local" "tacacs+" "radius”	AAA authentication login mode. Currently, when you set primary protocol to non-local, the sencond protocol can only be set to local. Otherwise,an error is raised out. Default value: [‘local’]
failthrough	O	”true" "false”	Allow AAA fail-through Default value: False
fallback	O	”true" "false”	Allow AAA fallback Default value: False
debug	O	”true" "false”	Authentication debug Default value: False
authorization	M		Path-only node, has no configurable value. AAA authentication
protocol	O	”tacacs+" "local" "radius”	AAA authorization protocol. Default value: [‘local’]
auth-service	O	”true" "false”	AAA Authentication for service Default value: False
auth-cmd	O	”true" "false”	AAA Authentication for cmd Default value: False
debug	O	”true" "false”	Authentication debug Default value: False

AAA accounting

Tree Diagram

module: asternos-aaa
  +--rw aaa
     +--rw accounting
        +--rw protocol*   enumeration

Table of Properties

Name	Required	Type/Range	Description
accounting	M		Path-only node, has no configurable value. AAA accounting
protocol	O	”tacacs+" "local" "radius”	AAA accounting protocol. Default value: [‘local’]

AAA authentication

Tree Diagram

module: asternos-aaa
  +--rw aaa
     +--rw authentication
        +--rw protocol*      enumeration
        +--rw failthrough?   boolean
        +--rw fallback?      boolean
        +--rw debug?         boolean

Table of Properties

Name	Required	Type/Range	Description
authentication	M		Path-only node, has no configurable value. AAA authentication
protocol	O	”local" "tacacs+" "radius”	AAA authentication login mode. Currently, when you set primary protocol to non-local, the sencond protocol can only be set to local. Otherwise,an error is raised out. Default value: [‘local’]
failthrough	O	”true" "false”	Allow AAA fail-through Default value: False
fallback	O	”true" "false”	Allow AAA fallback Default value: False
debug	O	”true" "false”	Authentication debug Default value: False

AAA authentication

Tree Diagram

module: asternos-aaa
  +--rw aaa
     +--rw authorization
        +--rw protocol*       enumeration
        +--rw auth-service?   boolean
        +--rw auth-cmd?       boolean
        +--rw debug?          boolean

Table of Properties

Name	Required	Type/Range	Description
authorization	M		Path-only node, has no configurable value. AAA authentication
protocol	O	”tacacs+" "local" "radius”	AAA authorization protocol. Default value: [‘local’]
auth-service	O	”true" "false”	AAA Authentication for service Default value: False
auth-cmd	O	”true" "false”	AAA Authentication for cmd Default value: False
debug	O	”true" "false”	Authentication debug Default value: False

Show Aaa

Tree Diagram

module: asternos-aaa

  rpcs:
    +---x show-aaa
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-aaa	O
data	O		Dispaly configuration of AAA accounting, authentication and authorization.