MapaMental:Cap2

MapaMental:Cap2

1. 3.1: Purpose of the AAA

   • AAA Components: •Authentication •Authorization •Accounting and auditing
     • Authentication: can be established using username and password combinations, challenge and response questions
     • Authorization: uthorization services determine which resources the user can access and which operations the user is allowed to perform.
     • AAA Accounting collects and reports usage data. This data can be used for such purposes as auditing or billing.
   • Authentication Modes: •Local AAA •Authentication •Server-Based AAA Authentication

2. 3.2: Local AAA Authentication

   • aaa authentication login: command in the figure allows the ADMIN and JR-ADMIN users to log into the router via the console or vty terminal lines.
   • When a user logs into a Cisco router that uses AAA, a unique ID is assigned to that user's session.
   • To display a list of all locked-out users, use the show aaa local user lockout command in privileged EXEC mode
   • Additional security can be implemented on the line using the aaa local authentication attempts max-fail global configuration mode command

3. 3.3: Server-Based AAA

   • Server-Based AAA Characteristics
     • The Cisco Secure Access Control System (ACS) is a centralized solution that ties together an enterprise’s network access policy and identity strategy.
       • Protocolo RADIUS
         • RADIUS combines authentication and authorization as one process. When a user is authenticated, that user is also authorized.
       • Protocolo TACACS+
         • three critical factors for TACACS+: Separates authentication and authorization Encrypts all communication Utilizes TCP port 49
         • four critical factors for RADIUS: Combines RADIUS authentication and authorization as one process Encrypts only the password Utilizes UDP Supports remote-access technologies, 802.1X, and Session Initiation Protocol (SIP)
         • TACACS+ offers multiprotocol support, such as IP and legacy AppleTalk
   • Cisco Identity Services Engine (ISE)
     • is an identity and access control policy platform that enables enterprises to enforce compliance, enhance infrastructure security, and streamline their service operations

4. 2.5: Server-Based AAA Authorization and Accounting

   • •Supplicant (Client) Authenticator (Switch) Authentication server