What is the difference between local AAA authentication and server-based AAA authentication?

Question

Accepted Answer

Local AAA (Authentication, Authorization, and Accounting) stores usernames and passwords on each network device individually — simple but doesn't scale. Server-based AAA uses a central RADIUS (Remote Authentication Dial-In User Service) or TACACS+ (Terminal Access Controller Access-Control System Plus) server — scales to thousands of devices and users.

Feature
Local AAA
Server-Based AAA

Where credentials stored
On each router/switch locally
Central AAA server (RADIUS or TACACS+)

Scalability
Poor — must configure each device separately
Excellent — one server manages all devices

Best for
Small networks (few devices)
Enterprise networks (many devices and users)

Fallback
No centralized fallback
Can fall back to local if server unreachable

User management
Must update every device when passwords change
Update once on the server

Server-based protocols:

RADIUS (Remote Authentication Dial-In User Service) — open standard, combines authentication and authorization, uses UDP (User Datagram Protocol)
TACACS+ (Terminal Access Controller Access-Control System Plus) — Cisco-proprietary, separates authentication/authorization/accounting, uses TCP (Transmission Control Protocol), encrypts entire payload

Configuration for local authentication:
Router(config)# username Admin secret Str0ng3rPa55w0rd
Router(config)# line vty 0 4
Router(config-line)# login local

Configuration for SSH (Secure Shell) (more secure than Telnet):
Router(config)# ip domain-name example.com
Router(config)# crypto key generate rsa general-keys modulus 2048
Router(config)# ssh version 2
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local

Go deeper:

RADIUS (Wikipedia) — the open-standard, UDP-based, combined-auth server for centralized AAA.
 TACACS+ (Wikipedia) — the Cisco TCP-based alternative that separates A/A/A and encrypts the whole payload.

Feature	Local AAA	Server-Based AAA
Where credentials stored	On each router/switch locally	Central AAA server (RADIUS or TACACS+)
Scalability	Poor — must configure each device separately	Excellent — one server manages all devices
Best for	Small networks (few devices)	Enterprise networks (many devices and users)
Fallback	No centralized fallback	Can fall back to local if server unreachable
User management	Must update every device when passwords change	Update once on the server