Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 7: Authentication, Authorization, and Accounting (AAA) - Coggle…

- - - - When a user has been authenticated, the AAA accounting process generates a start message to begin the accounting process.
        
        When the user finishes, a stop message is recorded and the accounting process ends.
  - - - Server-Based AAA Authentication
        
        With the server-based method, the router accesses a central AAA server, such as the Cisco Secure Access Control System (ACS) for Windows, which is shown in the figure. The central AAA server contains the usernames and password for all users. The router uses either the Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System (TACACS+) protocols to communicate with the AAA server. When there are multiple routers and switches, server-based AAA is more appropriate because accounts can be administered from a central location rather than on individual devices.
        
        The client establishes a connection with the router.
        
        The AAA router prompts the user for a username and password.
        
        The router authenticates the username and password using a AAA server.
        
        The user is provided access to the network based on information on the remote AAA server.
      - Local AAA Authentication
        
        Local AAA uses a local database for authentication. This method is sometimes known as self-contained authentication. In this course, it will be referred to as local AAA authentication.
        
        The client establishes a connection with the router.
        
        The AAA router prompts the user for a username and password.
        
        The router authenticates the username and password using the local database and the user is provided access to the network based on information in the local database.
  - - - When a user has been authenticated, a session is established between the router and the server.
        
        Authorization controls what users can and cannot do on the network after they are authenticated. This is similar to how privilege levels and role-based CLI give users specific rights and privileges to certain commands on the router.
        
        Authorization is typically implemented using a AAA server. Authorization uses a set of attributes that describes the user’s access to the network. These attributes are compared to the information contained within the AAA database, and a determination of restrictions for that user is made and delivered to the local router where the user is connected.
      - The router requests authorization from the AAA server for the client's requested service.
      - The AAA server returns a PASS/FAIL for authorization.
  - - - Authorization
        
        After the user is authenticated, authorization services determine which resources the user can access and which operations the user is allowed to perform. An example is “User ‘student’ can access host serverXYZ using SSH only.”
      - Accounting and auditing
        
        Accounting records what the user does, including what is accessed, the amount of time the resource is accessed, and any changes that were made. Accounting keeps track of how network resources are used. An example is "User 'student' accessed host serverXYZ using SSH for 15 minutes."
      - Authentication
        
        Users and administrators must prove their identity before accessing the network and network resources. Authentication can be established using username and password combinations, challenge and response questions, token cards, and other methods. For example: “I am user ‘student’ and I know the password to prove it.”
- - - - No other AAA commands are available until this command is entered.
      - To enable AAA, the aaa new-model global configuration command must first be configured. To disable AAA, use the no form of this command.
      - Default and Named Methods
        
        For flexibility, different method lists can be applied to different interfaces and lines using the aaa authentication login list-name command.
        
        An administrator could apply a special login for SSH and then have the default login method for the line console
- - - - TACACS+ is a Cisco enhancement to the original TACACS protocol. Despite its name, TACACS+ is an entirely new protocol that is incompatible with any previous version of TACACS
      - TACACS+ provides separate AAA services
- - - - Step 1. Globally enable AAA to allow the use of all AAA elements. This step is a prerequisite for all other AAA commands.
        Step 2. Specify the server that will provide AAA services for the router. This can be a TACACS+ or RADIUS server.
      - Step 3. Configure the encryption key needed to encrypt the data transfer between the network device and AAA server.
        Step 4. Configure the AAA authentication method list to refer to the TACACS+ or RADIUS server. For redundancy, it is possible to configure more than one server.
      - Configure RADIUS Servers
        
        To configure a RADIUS server, use the radius server name command. This puts you into radius server configuration mode.
        
        In RADIUS server configuration mode, configure the IPv4 address of the RADIUS server using the address ipv4 ipv4-address command. You can also specify an IPv6 address with the address ipv6 ipv6-address command.
        
        To configure the shared secret key for encrypting the password, use the key command. This key must be configured exactly the same way on the router and the RADIUS server.