Please enable JavaScript.

Coggle requires JavaScript to display documents.

7. Authentication, Authorization, and Accounting (AAA), RADIUS server name…

- - - - This method is the easiest to implement, but it is also the weakest and least secure. This method provides no accountability. Anyone with the password can gain entry to the device and alter the configuration.
  - - - When a user has been authenticated, a session is established between the router and the server.
      - The router requests authorization from the AAA server for the client's requested service.
      - The AAA server returns a PASS/FAIL for authorization.
  - - - When a user has been authenticated, the AAA accounting process generates a start message to begin the accounting process.
        
        Types of information that are collected by AAA accounting
        
        Network Accounting collects usage records for network access over various remote access connections.
        
        Connection accounting captures information about all outbound connections made from the AAA client, such as Telnet or SSH.
        
        EXEC accounting captures information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, and the access server IP address.
        
        System accounting captures information about all system-level events (for example, when the system reboots or when accounting is turned on or off).
        
        Command accounting captures information about the EXEC shell commands for a specified privilege level that are being executed on a network access server. Each command accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the user who executed it.
      - When the user finishes, a stop message is recorded and the accounting process ends.
- - - - Step 1. Add usernames and passwords to the local router database for users that need administrative access to the router.
      - Step 2. Enable AAA globally on the router.
      - Step 3. Configure AAA parameters on the router.
      - Step 4. Confirm and troubleshoot the AAA configuration.
  - - - Router(config)# aaa authentication login {default | list-name} method1...[ method4 ]
        
        default
        
        Uses the listed authentication methods that follow this keyword as the default list of methods when a user logs in
        
        list-name
        
        Instead of using default list name, the administrator may wish to specify a name for documentation purposes. The name can be up to 31 characters
        
        method1...[method4]
        
        Identifies the list of methods that the AAA authentication process will query in the given sequence. At least one method must be specified. A maximum of four methods may be specified
      - Common methods
        
        enable
        
        local
        
        local-case
        
        none
        
        group radius
        
        group tacacs+
        
        group group-name
  - - - When a custom authentication method list is applied to an interface, it is possible to return to the default method list by using the no authentication login command.
  - - - number-of-unsuccessful-attempts
        
        Number of unsuccessful authentication attempts before a connection is dropped and the user account is locked
- - - - The user establishes a connection with the router.
      - The router prompts the user for a username and password.
      - The router passes the username and password to the Cisco Secure ACS (server or engine).
      - The Cisco Secure ACS authenticates the user. The user is provided access to the router (administrative access) or the network, based on information found in the Cisco Secure ACS database.
  - - - Several features of ISE
        
        Asset Visibility - Provides visibility and control over who and what is on the network consistently, across wireless, wired, and VPN connections.
        
        Posture assessment - Determines if the device complies with device security policies before it connects to the network.
        
        Segmentation - Cisco ISE uses contextual data about network devices and endpoints to facilitate network segmentation.
        
        Guest management and secure wireless - Enables providing secure network access to visitors, contractors, consultants, and customers.
        
        Threat Containment - If Cisco ISE detects threat or vulnerability attributes from an endpoint, adaptive network control policies are sent to dynamically change the access levels of the endpoint.
      - ISE provides context-aware identity management
        
        To determine whether users are accessing the network on an authorized, policy-compliant device
        
        To establish user identity, location, and access history, which can be used for compliance and reporting
        
        To assign services based on the assigned user role, group, and associated policy (job role, location, device type, etc.)
        
        To grant authenticated users access to specific segments of the network, or specific applications and services, or both, based on authentication results
  - - - Functionality
        Separates AAA according to the AAA architecture, allowing modularity of the security server implementation
      - Standard
        Mostly Cisco supported
      - Transport Protocol
        TCP
      - CHAP
        Bidirectionall challenge and response ass used in Chhallenge Handshake Auuuuthenttication Protocol (CHAP)
      - Confidentiality
        Entire packet encrypted
      - Customization
        Provides authorization of router commands pn a per-user or per-group basis
      - Accounting
        Limited
    - - Functionality
        combines authentication and authorization but separates accounting, allowing less flexibility in implementation than TACACS+
      - Standard
        Open/RFC standard
      - Transport Protocol
        UDP
      - CHAP
        Unidirectional challenge and response from the RADIUS security server to the RADIUS client
      - Confidentiality
        Password encrypted
      - Customization
        Has no option to authorize router commands on a per-user or per-group basis
      - Accounting
        Extensive
- - - - Step 1. Globally enable AAA to allow the use of all AAA elements. This step is a prerequisite for all other AAA commands.
      - Step 2. Specify the server that will provide AAA services for the router. This can be a TACACS+ or RADIUS server.
      - Step 3. Configure the encryption key needed to encrypt the data transfer between the network device and AAA server.
      - Step 4. Configure the AAA authentication method list to refer to the TACACS+ or RADIUS server. For redundancy, it is possible to configure more than one server.
  - - - Server-Based AAA Reference Topology
- - - - network - for network services such as PPP and SLIP
      - exec - for User EXEC terminal sessions
      - commands level - command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level
  - - - network - Runs accounting for all network-related service requests, including PPP.
      - exec - Runs accounting for the EXEC shell session.
      - connection - Runs accounting on all outbound connections such as SSH and Telnet.
    - - start-stop - Sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process.
      - stop-only - Sends a "stop" accounting record for all cases including authentication failures.
      - none - Disables accounting services on a line or interface.