CCNA Security v2.0: AAA

Chapter 3: Authentication, Authorization, and Accounting

• AAA is covered in CCNA Security v2.0

Chapter Outline

• Introduction to AAA
• Purpose of the AAA
• Local AAA Authentication
• Server-Based AAA
• Server-Based AAA Authentication
• Server-Based Authorization and Accounting
• Summary

Purpose of the AAA

• Learning objectives include explaining why AAA is critical to network security and describing its characteristics

AAA Overview

• AAA involves Identification, Authentication, Authorization, Auditing, and Accounting

AAA Elements:

• Identification: claiming an identity when attempting to access a secured area or system.
• Authentication: proving you are that identity.
• Authorization: defining resource and object access allowances/denials for a specific identity.
• Auditing: recording a log of system events and activities related to the system and subjects.
• Accounting: reviewing log files to check compliance and hold subjects accountable for actions

AAA Components

• Authentication: Verifying the identity (Who are you?)
• Authorization: Determining allowed actions (How much can you spend?)
• Accounting: Tracking resource usage. (What did you spend it on?)

Authentication Without AAA

• Telnet is vulnerable to brute-force attacks due to its lack of security features
• Authentication is possible using SSH and a local database method

AAA Characteristics

• AAA has different authentication modes, including a local AAA and server-based AAA

Local AAA Authentication

• Client establishes connection with the router, which then prompts the user for credentials.
• Router authenticates credentials using a local database.
• User accesses the network based on information in the local database.

Server-Based AAA Authentication

• Authentication flows to a server
• Client connects to the router and is prompted to enter login information
• Router authenticates credentials using a remote AAA server.
• User is authorized to access the network based on information on the remote AAA server.

Authorization

• Session occurs with the AAA server once user is authenticated
• Router requests authorization for service from the authentication service
• Result is pass or fail for authentication

Accounting

• Accounting information types include Network, Connection, EXEC, System, Command, and Resource

AAA process

• Start message generated once a user authenticates for the accounting process
• Stop message recorded at the end of the process.

Local AAA Authentication

• Objectives include configuring using the CLI to validate users against a local database, and troubleshooting

Configuring Local AAA Authentication with CLI

• Administrative access is authenticated by adding usernames and passwords to the local router database
• AAA can be enabled on the router
• AAA parameters can be configured
• AAA configuration can be confirmed and troubleshooted

Authenticating Administrative Access Steps

• Add usernames and passwords to the local router database for users needing administrative access
• Enable AAA globally
• Configure AAA parameters
• Confirm and troubleshoot the AAA config

Authentication Methods

• Enable: Uses the enable password for authentication
• Local: Uses the local username database for authentication.
• Local-case: Uses case-sensitive local username authentication.
• None: Uses no authentication

Group radius and Tacacs

• Group radius uses the list of all RADIUS servers for authentication
• Group tacacs uses the list of all TACACS+ servers for authentication

Group name

• Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command.

AAA authentication login

• Configured using the CLI: aaa authentication login (default | list-name} method1... [method4]

Command Description

• Default: Uses the listed authentication methods as the default when a user logs in.
• List-name: Names the list of authentication methods activated when a user logs in.
• Method: Specifies authentication methods that the AAA authentication lists will query in sequence up to four methods

Default and Named Methods

• Local AAA Authentication can be configured via CLI using aaa new-model, username <name> algorithm-type scrypt secret <password>
• aaa authentication login default local-case enable in the global configuration switches default authentication to local

Fine-Tuning the Authentication Configuration

• Configuring the maximum login failure attempts
• aaa local authentication attempts max-fail [number-of-unsuccessful-attempts]

CLI Command for Authentication

• Displays locked out users: show aaa local user lockout
• Displays unique if of session: show aaa sessions

Server-Based AAA

• Objectives include benefits of server-based AAA, and comparing TACACS+ and RADIUS authentication protocols

Server-Based AAA Characteristics

• Comparing local and server-based AAA implementations

Local Authentication

• User establishes a connection with the router.
• Router prompts for username and password, authenticating using local database.

Server-Based Authentication

• User establishes a connection with the router.
• Router prompts for username and password
• Router authenticates using the remote AAA server
• Router passes the username and password to the Cisco Secure ACS.
• The Cisco Secure ACS authenticates the user.

Introducing Cisco Secure Access Control System

• TACACS+ or RADIUS protocols are used to communicate between the clients and AAA security servers.

Server-Based AAA Communication Protocols

• Introducing TACACS+ and RADIUS

TACACS+ and RADIUS

• Protocols for implementing server-based AAA

TACACS+

• Separates AAA architecture, allowing modularity of security server implementation
• Mostly Cisco supported
• TCP transport protocol
• Bidirectional Challenge Handshake Authentication Protocol (CHAP)
• Multiprotocol support
• Entire packet encrypted
• Router command authorization per user or group
• Limited accounting

RADIUS

• Combines authentication and authorization, but separates accounting with less flexibility than TACACS+
• Open/RFC Standard
• UDP transport protocol
• Unidirectional challenge and response
• No ARA, no NetBEUI
• Password encrypted
• No option to authorize router commands on a per-user of group basis
• Extensive accounting

TACACS+ Authentication Process

• Client connects to R2
• Username is prompted to client and passed to R2
• Name is passed to the ACS
• It is checked, and the password prompt is sent back, process is again repeated if successful

RADIUS Authentication Process

• Client sends username and password to R2
• R2 bundles this request and asks ACS for the all clear
• ACS returns Access-Accept if it checks out

Integration of TACACS+ and ACS

• TACACS+ or RADIUS protocols are used to communicate between the clients and AAA security servers with Cisco Secure ACS

Integration of AAA with Active Directory

• RADIUS is used to communicate between users as clients and Windows Server NPS (IAS) AAA server
• Microsoft NPS is used to authenticate access to the router

Server-Based AAA Authentication

• Configuring and troubleshooting

Steps for Configuring Server-Based AAA Authentication with CLI

• Objectives involve configuring server-based AAA authentication, using the CLI, on Cisco routers, and troubleshooting

Steps:

• Enable AAA
• Specify the IP address of the ACS server
• Configure secret key
• Configure authentication to use either the RADIUS or TACACS+ server

Configuring the CLI with TACACS+ Servers

• Use these in global configuration aaa new-model
• Then enter TACACS server configuration with tacacs server <name>
• Specify the IPv4 address and the secret key

Configuring the CLI for RADIUS Servers

• Similar steps as TACACS, but for RADIUS

Configure Authentication to Use the AAA Server

• Commands for Authentication
• aaa authentication login default group ?
• Can specifiy word such as ldap, radius, tacacs+

AAA new-model

• Enables the AAA framework
• Use the tacacs server host command to define the TACACS+ servers
• The aaa authentication login method-list command configures a set of authentication methods

Server-Based AAA Authorization and Accounting

• Server-based AAA authorization and accounting

Introduction to Server-Based AAA Authorization

• Authentication confirms identity - making sure the end user or device is legitimate
• Authorization provides or restricts access to certain areas and or programs of a given network

TACACS+ vs. RADIUS:

• TACACS+ grants separate authentication from authorization
• RADIUS integrates authentication with authorization

AAA Authorization Configuration with CLI

• There are different types of authorization to implement with TACACS

aaa authorization (commands level)

• To apply authorization to commands used in the EXEC mode

level

• To apply authorization to commands with the specified privilege level

AAA Accounting Configuration with CLI

• Syntax aaa accounting {network | exec | connection} {default | list-name}, and then can specify start-stop, stop-only, or none, and then the broadcast message and finally the method.

Summary

• Explain how AAA is used to secure a network
• Implement AAA authentication that validates users against a local database
• Implement server-based AAA authentication using TACACS+ and RADIUS protocols
• Configure server-based AAA authorization and accounting