CCNA 2 - Capitulo 10.1

CCNA 2 - Capitulo 10.1

1. LAN SECURITY CONCEPTS

   • ACCESS CONTROL
     • AAA COMPONENTS
       • AUTHENTICATION
         • LOCAL DATABASE METHOD
           • SSH
             • USERNAME AND PASSOWRD
             • AUTHENTICATED LOCAL DATA BASE
             • MORE ACCOUNTABILITY ; RECORDED USER LOGS IN
           • LIMITATIONS
             • USER ACCOUNTS CONFIGURED EACH DEVICE
               • EX : LARGE ENTERPRISE WITH MULTIPLE ROUTERS , SWITCHES , IS PROBLEM
             • NO FALLBACK AUTHENTICATION METHOD
             • EASIEST TO IMPLEMENT
           • SIMPLE METHOD
           • TELNET
             • INSECURE
           • CONSOLE
           • STORES NETWORK AND PASSWORDS LOCALLY
             • IN NETWORK DEVICE
           • SMALL NETWORKS
         • SERVER BASED METHOD
           • ROUTER ACCESS CENTRAL AAA SERVER CENTRAL
             • AAA SERVER CONTAINS USERNAME AND PASSOWORD ALL USERS
               • PROTOCOLS TO COMMMUNICATE WITH THE AAA SERVER ?
                 • REMOTE AUTHENTICATION DIAL-IN USER SERVICE (RADIUS )
                 • TERMINAL ACCESS CONTROLLER ACCESS CONTROL SYSTEM (TACACS+)
           • ADVANTEGE
             • CENTRALIZED DATABASE
           • BESP PRACTICES
         • WHO IS PERMITTED TO ACCESS A NETWORK PASS / FAIL
       • ACCOUTING
         • AUDITING OR BILLING
         • WHAT ACTIONS THEY PERFORMED WHILE ACCESS THE NETWORK
         • COLLECTED DATA MIGHT INCLUDE START AND STOP CONNECTION TIMES
           • EXECUTED COMMANDS
           • NUMBER OF PACKETS
           • NUMBER OF BYTES
           • DATA AND TIME
         • KEEPS A DETAILED LOG OF EXACLTY WHAT USER DOES ON THE DEVICE
       • AUTHORIZATION
         • WHAT USERS CAN AND CANNOT DO ON THE NETWORK AFTER THEY ARE AUTHENTICATED.
         • USER + PASSWORD = WHO IS IT
         • CAN DO WHILE THEY ARE THERE
         • USERS CAN AND CANNOT DO ON THE NETWORK AFTER THEY ARE AUTHENTICATED
         • PRIVILEGES AND RESTRICTIONS
       • PRIMARY FRAMEWORKS TO SET UP ACCESS ON A NETWORK DEVICE
     • IEEE 802.1X PORT-BASED CONTROL AND AUTHENTICATION PROTOCOL
       • PORT BASED ACCESS
       • 1) SUPPLICANT (CLIENT )
         • DEVICE RUNNING
           • 802.1X COMPLIANT CLIENT SOFTWARE
         • WIRED OR WIRELESS
         • WHAT HAPPENS TO THOSE WHO ARE NOT COMPATIBLE WITH 802.1X?
           • THEY MUST USE MAC AUTHENTICATION BYPASS
           • WHAT HAPPENS TO SOMEONE WHO IS 802.1X COMPATIBLE BUT NOT AUTHORIZED TO AUTHENTICATE? GUEST VLAN
       • 2) AUTHENTICATOR
         • INTERMEDIARY BETWEEN CLIENT AND AUTHENTICATION SERVER
           • COULD IT BE SWITCH , ACCESS POINT , WLC , FIREWALL , ROUTER
           • HOW DOES IT WORK ?
             • 3. RELAYS A RESPONSE TO THE CLIENT
             • 1.REQUEST IDENTIFYING CLIENT
             • 2. VERIFIES INFORMATION WITH THE AUTHENTICATION SERVER
       • 3) AUTHENTICATION SERVER
         • NOTIFIES THE INTERMEDIARY IS OR IS NOT AUTHORIZED
         • VALIDATES THE IDENTITY OF THE CLIENT
       • WHATS YOUR PURPOSE ?
         • THROUGH PUBLICLY ACCESSIBLE SWITCH PORTS
         • RESTRICTS UNAUTHORIZED WORKSTATIONS FROM TO A LAN