Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting

1. Purpose of the AAA

   • Authentication without AAA
     • The simplest method of remote access authentication is to configure a login and password combination on console, vty lines, and aux ports,
       • A better solution is to have all devices refer to the same database of usernames and passwords from a central server.
         • Accounting
           • AAA Accounting collects and reports usage data. This data can be used for such purposes as auditing or billing.

2. Configuring Local AAA Authentication with CLI

   • The Local AAA Authentication method is similar to using the login local command with one exception. AAA also provides a way to configure backup methods of authentication.
   • Authentication Methods
     • Use the aaa authentication login command
       • The default keyword applies authentication to all lines.
   • Default and Named Methods
     • For flexibility, different method lists can be applied to different interfaces and lines using the aaa authentication login list-name command.

3. Server-Based AAA

   • Comparing Local AAA and Server-Based AAA Implementations
     • To solve this challenge, one or more AAA servers, such as Cisco Secure ACS, can be used to manage the user and administrative access needs for an entire corporate network.
   • Introducing TACACS+ and RADIUS
     • ACACS+ and RADIUS are both authentication protocols that are used to communicate with AAA servers. As shown in the figure, each supports different capabilities and functionality. Whether TACACS+ or RADIUS is selected depends on the needs of the organization.
   • TACACS+ Authentication
     • TACACS+ provides separate AAA services. Separating the AAA services provides flexibility in implementation

4. Server-Based AAA Authentication

   • Steps for Configuring Server-Based AAA Authentication
     • Step 1. Globally enable AAA to allow the use of all AAA elements. This step is a prerequisite for all other AAA commands
     • Step 2. Specify the Cisco Secure ACS that will provide AAA services for the router. This can be a TACACS+ or RADIUS server.
     • Step 3. Configure the encryption key needed to encrypt the data transfer between the network access server and Cisco Secure ACS.
   • Step 4. Configure the AAA authentication method list to refer to the TACACS+ or RADIUS server. For redundancy, it is possible to configure more than one server.
   • Configuring RADIUS Servers
     • Because RADIUS uses UDP, there is no equivalent single-connection keyword. If required, multiple RADIUS servers can be identified by entering a radius server name command for each server.
     • In radius server configuration mode, configure the IPv4 address of the radius server using the address ipv4 ipv4-address command.
   • Configure Authentication to Use the AAA Server
     • AAA servers are identified using the group tacacs+ or group radius keywords. Refer to Figure 1 to see command syntax options available with the aaa authentication login command.

5. Authentication, Authorization, and Accounting 3.5 Server-Based AAA Authorization and Accounting

   • AAA Authorization Configuration
     • network - For network services such as PPP exec - For starting an exec (shell) commands level - For exec (shell) commands
   • Authentication, Authorization, and Accounting 3.5 Server-Based AAA Authorization and Accounting 3.5.2 Configuring Server-Based AAA Accounting
     • network - Runs accounting for all network-related service requests, including PPP. exec - Runs accounting for the EXEC shell session. connection - Runs accounting on all outbound connections such as SSH and Telnet.
   • Security Using 802.1X Port-Based Authentication
     • Supplicant (Client) - The device (workstation) that requests access to LAN and switch services and then respond
     • 802.1X Port Authorization State
       • Use the authentication port-control command to control the port authorization state. The syntax for the command and a description of the parameters is shown in the figure. By default, a port is in the force-authorized state meaning it can send and receive traffic without 802.1x authentication.