Configuring AAA on a Cisco PIX

Below shows the required configuration commands for configuring AAA.


Interactive user

#(config) aaa-server <server name> protocol <tacacs/radius>
#(config) aaa-server <server name> <interface> host <AAA server IP>
#(config) aaa authentication include <https/https/ftp/telnet>  inbound 0 0 0 0
#(config) access-list 111 permit tcp any any eq ftp
#(config) aaa authentication match 111 <interface> <AAA server name>

Console Access

#(config) aaa authentication  http/enable/serial/telnet/ssh console <aaa server>

#(config) Timeout uauth 3:00 absolute
#(config) Timeout  uauth 0:30 inactivity


#(config) access-list 113 permit tcp any any eq ftp
#(config) aaa authorisation match 113 <interface> <aaa server>

This will authorise only tcp ports 1-444 inbound from anywhere to anywhere

#(config)#aaa authorisation include tcp/1-444 inbound 0 0 0 0 <server name>


#(config)aaa accounting match <acl> <interface> <aaa server>

About the Author


R Donato

Rick Donato is the Founder and Chief Editor of He currently works as an SDN/NFV Solutions Architect and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001