| The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the network elements in conjunction with an authentication server, the administrators can easily add, modify, or delete accounts, as well as, add or remove command authorizations and privilege levels. The use of an authentication server provides the capability to assign network administrators and engineers to tiered groups containing their associated or required privilege levels establishing what commands and objects the authenticated administrator is authorized to access. This implementation would enforce the organization's AAA policy for separation of duties and its responsibility assignments for each administrator. This requirement is applicable to network device management and is not applicable to the routing function. |
