Authentication, Authorization, and Accounting - created from Mind Map

Page 1

Purpose of the AAA

Configuring Local AAA Authentication with CLI

Server-Based AAA

Server-Based AAA Authentication

Authentication without AAA

The simplest method of remote access authentication is to configure a login and password combination on console, vty lines, and aux ports,

A better solution is to have all devices refer to the same database of usernames and passwords from a central server.

Accounting

AAA Accounting collects and reports usage data. This data can be used for such purposes as auditing or billing.

The Local AAA Authentication method is similar to using the login local command with one exception. AAA also provides a way to configure backup methods of authentication.

Authentication Methods

Default and Named Methods

Use the aaa authentication login command

The default keyword applies authentication to all lines.

For flexibility, different method lists can be applied to different interfaces and lines using the aaa authentication login list-name command.

Comparing Local AAA and Server-Based AAA Implementations

Introducing TACACS+ and RADIUS

TACACS+ Authentication

To solve this challenge, one or more AAA servers, such as Cisco Secure ACS, can be used to manage the user and administrative access needs for an entire corporate network.

ACACS+ and RADIUS are both authentication protocols that are used to communicate with AAA servers. As shown in the figure, each supports different capabilities and functionality. Whether TACACS+ or RADIUS is selected depends on the needs of the organization.

TACACS+ provides separate AAA services. Separating the AAA services provides flexibility in implementation

Steps for Configuring Server-Based AAA Authentication

Step 1. Globally enable AAA to allow the use of all AAA elements. This step is a prerequisite for all other AAA commands

Step 2. Specify the Cisco Secure ACS that will provide AAA services for the router. This can be a TACACS+ or RADIUS server.

Step 3. Configure the encryption key needed to encrypt the data transfer between the network access server and Cisco Secure ACS.