Implementing Network Security ( Version 2.0) – CCNAS Chapter 3 Exam Online

One of the components in AAA is authorization. After a user is authenticated through AAA, authorization services determine which resources the user can access and which operations the user is allowed to perform.

The local database method of authentication does not provide a fallback authentication method if an administrator forgets the username or password. Password recovery will be the only option. When authentication with AAA is used, a fallback method can be configured to allow an administrator to use one of many possible backup authentication methods.

In a small network with a few network devices, AAA authentication can be implemented with the local database and with usernames and passwords stored on the network devices. Authentication using the TACACS+ or RADIUS protocol will require dedicated ACS servers although this authentication solution scales well in a large network.

One of the components in AAA is accounting. After a user is authenticated through AAA, AAA servers keep a detailed log of exactly what actions the authenticated user takes on the device.

Cisco Secure Access Control System (ACS) supports both TACACS+ and RADIUS servers. Local databases do not use these servers.​

The Cisco IOS configuration is the same whether communicating with a Windows AAA server or any other RADIUS server. ​

The TACACS+ protocol provides flexibility in AAA services. For example, using TACACS+, administrators can select authorization policies to be applied on a per-user or per-group basis.

Both TACACS+ and RADIUS support password encryption (TACACS+ encrypts all communication) and use Layer 4 protocol (TACACS+ uses TCP and RADIUS uses UDP). TACACS+ supports separation of authentication and authorization processes, while RADIUS combines authentication and authorization as one process. RADIUS supports remote access technology, such as 802.1x and SIP; TACACS+ does not.

TACACS+ is considered to be more secure than RADIUS because all TACACS+ traffic is encrypted instead of just the user password when using RADIUS.

Cisco routers, by default, use port 1645 for the authentication and port 1646 for the accounting. In the configuration output, the configuration of the RADIUS authentication and authorization ports must match on both router Rtr1 and Server1.

Authorization is the ability to control user access to specific services. Authentication is used to verify the identity of the user. The accounting feature logs user actions once the user is authenticated and authorized.

The three parameters that can be used with aaa accounting are:

• network– runs accounting for all network-related service requests, including PPP
• exec– runs accounting for all the EXEC shell session
• connection – runs accounting on all outbound connections such as SSH and Telnet​ ​

The devices involved in the 802.1X authentication process are as follows:

• The supplicant, which is the client that is requesting network access
• The authenticator, which is the switch that the client is connecting and that is actually controlling physical network access
• The authentication server, which performs the actual authentication

The devices involved in the 802.1X authentication process are as follows:

• The supplicant, which is the client that is requesting network access
• The authenticator, which is the switch that the client is connecting to and that is actually controlling physical network access
• The authentication server, which performs the actual authentication

Encapsulation of EAP data between the authenticator and the authentication server is performed using RADIUS.