1. Introduction to AAA Network Security

A security framework that secures network access through Authentication, Authorization, and Accounting. It controls user access to network resources, ensuring only authorized users can access network resources.

The verification of a user or device's identity before allowing network access. This process involves comparing credentials like usernames and passwords against a database of authorized users.

This process determines what actions a user is allowed to perform once they are authenticated. Access controls, defined by policies, determine the level of access granted to specific resources.

This component tracks and logs all network activity for analysis and security purposes. It monitors user logins, file access, and resource utilization to identify suspicious activity or security breaches.

A method of authentication that requires multiple forms of identification to verify a user's identity. This enhances security by making it harder for attackers to compromise accounts even if they obtain one credential.

A process of verifying a user's identity using unique biological characteristics, such as fingerprints, facial recognition, or iris scans.

Network devices like routers, switches, and firewalls implement AAA protocols to manage access to the network and enforce security policies.

Specialized servers responsible for storing user credentials and managing the authentication process. They play a key role in AAA solutions.

Rules that define which users can access specific network resources and what actions they can perform. They are used to enforce authorization policies.

Detailed records of network activity, including user logins, file access, and resource utilization, used for security analysis and auditing purposes.

RADIUS, or Remote Authentication Dial-In User Service, is a common AAA protocol. It provides standardized communication between devices for authenticating, authorizing, and accounting user access.

TACACS+, or Terminal Access Controller Access-Control System Plus, is another widely used AAA protocol. TACACS+ provides comprehensive security features like authentication, authorization, and accounting, and is more commonly used in enterprise environments.

AAA protocols provide a standardized way for network devices to exchange authentication, authorization, and accounting information. They ensure secure and controlled access to network resources.

Implementing AAA enhances security by preventing unauthorized access and reducing the risk of security breaches. It also improves network management and control.

AAA helps in monitoring user activity and maintaining accountability for actions taken on the network. This provides valuable insights for auditing and security investigations.

AAA makes troubleshooting easier by providing detailed logs of user activity and network events. This information can be used to investigate security incidents and pinpoint the cause.

Maintaining an up-to-date user database is critical for accurate authentication and authorization. Inaccurate information can lead to security loopholes.

Authentication servers are vulnerable to attacks. It's crucial to protect these servers and implement security measures to prevent unauthorized access.

AAA implementation requires ongoing maintenance to address new vulnerabilities and threats. It's crucial to stay updated with security best practices.

The networking device authenticates the username and password using the local database on the device.

➢ Usernames and passwords are stored on the AAA server ➢ Allows for centralised authentication ➢ Reduces Admin workload ➢ Scalable

➢ Usernames and passwords are stored on the AAA server ➢ Allows for centralised authentication ➢ Reduces Admin workload ➢ Scalable

Supplicant ▪ Device requesting access ▪ Computer, Laptop, Mobile phone, Printer, Tablet, etc. AAA Client (Authenticator / Network Access Server) ▪ Device enforcing authentication ▪ Router, Switch, WLAN controller ▪ Bridges data between Supplicant and Authentication Server Authentication Server ▪ Validates the identity of the supplicant and notifies the authenticator if access is allowed. ▪ RADIUS or TACACS+ protocol ▪ Username & Password, Public Key Infrastructure (PKI)

#aaa new-model

Switch(config)#username keith secret smyth Switch(config)#enable secret smyth Switch(config)#aaa new-model Switch(config)#aaa authentication login default local-case

Switch(config)#hostname C243 C243(config)#username keith priv 15 secret smyth C243(config)#enable secret smyth C243(config)#aaa new-model Primary method Backup method C243(config)#aaa authentication login default group radius local C243(config)#radius-server host 192.168.10.254 auth-port 1812 acct-port 1813 key IndustrialNetworks

Switch(config)#hostname C243 C243(config)#username keith priv 15 secret smyth C243(config)#enable secret smyth C243(config)#aaa new-model C243(config)#aaa authentication login default group radius local C243(config)#aaa authentication login method1 group radius local C243(config)#aaa authentication login method2 group tacacs+ local C243(config)#aaa authentication login method3 group radius group tacacs+ local C243(config)#aaa authentication login method4 local-case none C243(config)#radius-server host 192.168.10.254 auth-port 1812 acct-port 1813 key IndustrialNetworks C243(config)#tacacs-server host 192.168.10.254 key IndustrialNetworks

AAA remote database example using named method lists Switch(config)#hostname C243 C243(config)#username keith priv 15 secret smyth C243(config)#enable secret smyth C243(config)#aaa new-model C243(config)#aaa authentication login default group radius local C243(config)#aaa authentication login method 1 group radius local C243(config)#aaa authentication login method 2 group tacacs+ local C243(config)#aaa authentication login method 3 group radius group tacacs+ local C243(config)#aaa authentication login method 4 local-case none C243(config)#radius-server host 192.168.10.254 auth-port 1812 acct-port 1813 key IndustrialNetworks C243(config)#tacacs-server host 192.168.10.254 key IndustrialNetworks C243(config)#line con 0 C243(config-line)#login authentication method3 C243(config-line)#logging synchronous C243(config-line)#exit C243(config)#line vty 0 15 C243(config-line)#logging synchronous C243(config-line)#login auth C243(config-line)#login authentication method4

Essential for website functionality; cannot be disabled.

Analyze site usage to improve our website.

An algorithm used to improve your learning.

A place to get common questions answered.

A way to report issues or provide input.