Authentication, Authorization, and Accounting

Chapter 3: Authentication, Authorization, and Accounting

• AAA refers to Authentication, Authorization, and Accounting.
• AAA is critical to network security.

AAA Elements

• Identification is claiming an identity when attempting to access a secured area or system.
• Authentication is about proving that you are that identity.
• Authorization defines the allows and denials of resource and object access for a specific identity.
• Auditing involves recording a log of the events and activities related to the system and subjects.
• Accounting is about reviewing log files to check for compliance and violations to hold subjects accountable for their actions.

Authentication without AAA

• Telnet is vulnerable to brute-force attacks without AAA.
• Using SSH and a local database improves authentication over Telnet.

Authentication Modes

• Local AAA Authentication involves the router authenticating username and password using a local database allowing network access based on the local database content.
• Server-Based AAA Authentication involves a remote AAA server for authenticating username and password, authorizing network assess base on the remote AAA server information.

Authorization Defined

• After user Authentication a session is established with the AAA server.
• The router requests authorization for the requested service from the AAA server.
• AAA server returns a PASS/FAIL for authorization.

Accounting information categories

• Network
• Connection
• EXEC
• System
• Command
• Resource

Local AAA Authentication Configuration

• Add username and passwords for administrative access to the local router database for users.
• Activate AAA globally on the router.
• Parameters for AAA must be configured on the router.
• The AAA configuration can then be reviewed and fixed.

Authentication Methods

• enable uses the enable password.
• local accesses the local username database.
• local-case uses case-sensitive local username authentication.
• none indicates no authentication.
• group radius accesses all RADIUS servers.
• group tacacs+ accesses all TACACS+ servers.
• group group-name accesses RADIUS or TACACS+ servers defined by the aaa group server radius/tacacs+ command.

Server-Based AAA Characteristics

• Server-based AAA provide centralized administration.

Local AAA vs Server-Based AAA

• Local authentication uses the router's database for username and passwords which are authenticated by the local database.
• Server-based AAA uses Cisco secures ACS, the router authenticates the username and password using a remote AAA serve.

AAA Communication Protocols

• TACACS+ and RADIUS protocols communicate between clients and AAA security servers.
• Cisco secure Access Control System is used for this communication.

TACACS+ and RADIUS protocol Differences

• TACACS+ separates AAA, providing modularity, and is mostly Cisco supported.
• RADIUS combines authentication and authorization but separates accounting, and conforms to open/RFC standards.
• TACACS+ uses TCP, RADIUS uses UDP.
• TACACS+ encrypts the entire packet, RADIUS only encrypts the password.

TACACS+ Process

• The client connection is initiated.
• The router prompts for a username and the client sends the username to the router.
• The username is sent to the ACS.
• The ACS prompts the router for the password and the sends itACS to the client.
• ACS approves or rejects the authentication.

RADIUS process

• The client prompts the user for credentials.
• The credentials are packaged into an Access-Request message and sent to the RADIUS server.
• The RADIUS server authenticates the credentials.
• If successful, the RADIUS server transmits an Access-Accept message back to the client, potentially including configuration information for the user's session.

Server-Based AAA with CLI

• Enable AAA.
• Specify the IP address of the ACS server.
• Configure the secret key.
• Configure authentication to use either the RADIUS or TACACS+ server.

CLI Configuration with TACACS+ servers

• Begin by enabling AAA new model.
• Define a TACACS+ server, including its IPv4 address.
• Set up a single connection and configure a key, then exit config mode.

CLI configuring RADIUS server

• Begin by enabling the AAA new model.
• Set up a RADIUS server, specifying its IPv4 address and the authentication and accounting ports.
• Configure a key for encryption, then exit config mode.

Authentication and Authorization

• Authentication confirms the legitimacy of a user or device seeking network access.
• Authorization dictates what authenticated users can access within the network.
• TACACS+ and RADIUS handle authentication and authorization differently: TACACS+ separates these functions, while RADIUS combines them.

AAA Authorization CLI configurations

• AAA authorization is configured via the command: aaa authorization (network | exec | commands level} {default | list-name) method1... [method4]

AAA ACC Configuration with CLI

• AAA accounting is configured via the command: aaa accounting (network | exec | connection) (default | list-name} {start-stop | stop-only | none } (broadcast) method1... [method4]