6.8. AAA Concepts

💡 First Principle: Without centralized AAA, every network device stores its own usernames and passwords. Add a new admin? Configure 200 switches. Someone leaves the company? Visit 200 switches again—and hope you don't miss one. AAA centralizes identity management: one server, one set of credentials, consistent policies everywhere.

Consider this real-world nightmare: A network engineer is fired for cause. Without centralized AAA, security must disable their account on every switch, router, firewall, and wireless controller—hundreds of devices. They miss a remote site's switch. The former employee, angry, uses that access to wreak havoc. With AAA, disabling one account in the central server instantly locks them out of everything.

What happens without AAA: Each device has local accounts. Password changes require touching every device. There's no audit trail of who did what. When an incident occurs, you can't prove which admin made the change that caused the outage. Compliance auditors fail you immediately.