Please enable JavaScript.

Coggle requires JavaScript to display documents.

:star: Authentication, Authorization and Accounting :star:, image, image,…

- - - - Local AAA Authentication -Local AAA uses a local database for authentication. This method is sometimes known as self-contained authentication. In this course, it will be referred to as local AAA authentication. This method stores usernames and passwords locally in the Cisco router, and users authenticate against the local database, as shown in the figure. This database is the same one that is required for establishing role-based CLI. Local AAA is ideal for small networks.
      - Server-Based AAA Authentication - With the server-based method, the router accesses a central AAA server, such as the Cisco Secure Access Control System (ACS) for Windows, which is shown in the figure. The central AAA server contains the usernames and password for all users. The router uses either the Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System (TACACS+) protocols to communicate with the AAA server. When there are multiple routers and switches, server-based AAA is more appropriate because accounts can be administered from a central location rather than on individual devices.
  - - - Authentication - Users and administrators must prove their identity before accessing the network and network resources. Authentication can be established using username and password combinations, challenge and response questions, token cards, and other methods. For example: “I am user ‘student’ and I know the password to prove it.”
      - Authorization - After the user is authenticated, authorization services determine which resources the user can access and which operations the user is allowed to perform. An example is “User ‘student’ can access host serverXYZ using SSH only.”
      - Accounting and auditing - Accounting records what the user does, including what is accessed, the amount of time the resource is accessed, and any changes that were made. Accounting keeps track of how network resources are used. An example is "User 'student' accessed host serverXYZ using SSH for 15 minutes."
  - - - One widely deployed use of accounting is to combine it with AAA authentication. This helps with managing access to internetworking devices by network administrative staff. Accounting provides more security than just authentication. The AAA servers keep a detailed log of exactly what the authenticated user does on the device, as shown in the figure. This includes all EXEC and configuration commands issued by the user. The log contains numerous data fields, including the username, the date and time, and the actual command that was entered by the user. This information is useful when troubleshooting devices. It also provides leverage against individuals who perform malicious actions.
        
        EXEC Accounting
        
        System Accounting
        
        Connection Accounting
        
        Network Accounting
        
        Command Accounting
  - - - This method is the easiest to implement, but it is also the weakest and least secure. This method provides no accountability. Anyone with the password can gain entry to the device and alter the configuration.
        SSH is a more secure form of remote access. It requires both a username and a password, both of which are encrypted during transmissions.
        The local database method provides additional security because an attacker is required to know a username and a password. It also provides more accountability because the username is recorded when a user logs in. Although Telnet can be configured using a username and password, both are sent in plaintext, which makes it vulnerable to being captured and exploited
- - - - TACACS+ is a Cisco enhancement to the original TACACS protocol. Despite its name, TACACS+ is an entirely new protocol that is incompatible with any previous version of TACACS. TACACS+ is supported by the Cisco family of routers and access servers.
      - TACACS+ provides separate AAA services. Separating the AAA services provides flexibility in implementation because it is possible to use TACACS+ for authorization and accounting while using another method of authentication.
      - The extensions to the TACACS+ protocol provide more types of authentication requests and response codes than were in the original TACACS specification. TACACS+ offers multiprotocol support, such as IP and legacy AppleTalk. Normal TACACS+ operation encrypts the entire body of the packet for more secure communications and utilizes TCP port 49.
- - - - Asset Visibility - Provides visibility and control over who and what is on the network consistently, across wireless, wired, and VPN connections. Cisco ISE uses probes and device sensors to listen to the way devices connect to the network. The Cisco ISE profile database, which is extensive, then classifies the device. This gives the visibility and context that is required to grant the right level of network access..
      - Posture assessment - Determines if the device complies with device security policies before it connects to the network. It can determine if a device is clean of viruses and suspicious applications and can even make sure that a device’s antivirus software is up to date.
      - Segmentation - Cisco ISE uses contextual data about network devices and endpoints to facilitate network segmentation. Security group tags, access control lists, network access protocols, and policy sets that define authorization, access, and authentication, are some ways in which Cisco ISE enables secure network segmentation.
      - Guest management and secure wireless - Enables providing secure network access to visitors, contractors, consultants, and customers.
      - Threat Containment - If Cisco ISE detects threat or vulnerability attributes from an endpoint, adaptive network control policies are sent to dynamically change the access levels of the endpoint. After the threat or vulnerability is evaluated and addressed, the endpoint can be given back its original access policy.