Authentication, Authorization and Accounting

Authentication, Authorization and Accounting

1. Purpose of AAA

   • Components
     • Authentication
       • Prove who you are
         • Local AAA
         • Server-based
     • Authorization
       • What can you access
       • What can you do
     • Accounting
       • What did you do
         • Auditing
         • Billing
   • Advantages
     • Backup for authentication
     • Central server

2. Local AAA

   • Small networks
     • 1 or 2 routers
   • Local database
     • Username
     • Passwords
   • Backup methods
   • Can lock users
   • Show users/sessions

3. Server-based AAA

   • Protocols
     • TACACS+
       • Full packet encrypted
       • Separated AAA
       • TCP 49
     • RADIUS
       • Password encrypted
       • Authentication n' authorization as one
       • UDP 1645|1812 authentication
       • UDP 1646|1813 authorization
   • Cisco ACS
     • Uses TACACS+ n' RADIUS
     • Full accounting tasks

4. Server-based AAA authentication

   • Configure servers
     • TACACS+ Server
     • RADIUS Server
   • Include servers
     • Method list
       • group tacacs+
       • group radius
   • Debbuging commands

5. Server-based AAA authorization n' accounting

   • Authorization
     • Control access
   • Accounting
     • List of loggins
       • Users
       • Date
       • Changes
     • Store information
       • Management
       • Security audits
       • Capacity planing
     • Method lists
       • Way is performed
       • Sequence
   • 802.1X authentication
     • Only RADIUS server
     • 3 roles
       • Client
       • Authenticator
       • Authentication server