Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting

1. AAA

   • is a
     • framework to set up access control
   • Components
     • Authentication
       • username and password combinations,
       • Authentication Modes
         • Local
           • uses a local database in the Cisco router
           • ideal for small networks
         • Server-Based
           • the router accesses a central AAA server
           • contains the usernames and password
     • Authorization
       • which resources and operations the user can access
     • Accounting and auditing
       • Accounting records what the user does

2. Authenticating Administrative Access

   • Authenticating Administrative Access
     • local or local-case
       • enable local authentication using a preconfigured local database
     • enable keyword
       • To specify that a user can authenticate using the enable password
     • aaa local authentication attempts max-fail
       • locks the user account if the authentication fails
   • Debug Options

3. TACACS+ and RADIUS

   • TACACS
     • Separates authentication and authorization
     • Encrypts all communication
     • Utilizes TCP port 49
   • RADIUS
     • Combines RADIUS authentication and authorization as one process
     • Encrypts only the password (MD5)
     • Utilizes UDP
     • Supports remote-access technologies, 802.1X, and Session Initiation Protocol (SIP)
     • is an open IETF standard AAA protocol
   • Cisco Secure ACS
     • distributed architecture
     • lightweight web-based GUI
     • Administrator authentication through Microsoft
     • Scheduled (automated) reports
     • Integrated advanced monitoring, reporting, and troubleshooting
     • Encrypted (secure) syslogs
     • Flexible and detailed device administration

4. enables usage tracking

   • use
     • information
       • management, security audits, capacity planning, and network usage billing
   • create a list of changes occurring on the network
   • helps the troubleshooting process
   • uses
     • Cisco Secure ACS serves as a central repository for accounting information
     • information
       • management
       • security audits
       • capacity planning
       • network usage billing
   • roles
     • Supplicant (Client)
     • Authenticator (Switch
     • Authentication server
   • create a list of changes occurring on the network,
   • track of which resources individuals or groups use

Images and files in the map