CCNA security chapitre 3

1. CCNA Security v2.0
Chapter 3:
Authentication, Authorization,
and Accounting

2. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 2
3.0 Introduction
3.1 Purpose of the AAA
3.2 Local AAA Authentication
3.3 Server-Based AAA
3.4 Server-Based AAA Authentication
3.5 Server-Based Authorization and Accounting
3.6 Summary

3. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
Upon completion of this section, you should be able to:
• Explain why AAA is critical to network security.
• Describe the characteristics of AAA.

4. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 4

5. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
Telnet is Vulnerable to Brute-Force Attacks

6. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
SSH and Local Database Method

7. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 8

9. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
Local AAA
Authentication
Server-Based
AAA Authentication

10. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
AAA Authorization

11. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
Types of accounting information:
• Network
• Connection
• EXEC
• System
• Command
• Resource
AAA Accounting

12. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
Upon completion of this section, you should be able to:
• Configure AAA authentication, using the CLI, to validate users against a local
database.
• Troubleshoot AAA authentication that validates users against a local database.

13. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 13

14. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
1. Add usernames and passwords to the local router database for users that
need administrative access to the router.
2. Enable AAA globally on the router.
3. Configure AAA parameters on the router.
4. Confirm and troubleshoot the AAA configuration.

15. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
Example Local AAA Authentication

17. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
Show Unique ID
of a Session
Display Locked
Out Users
Command
Syntax

18. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 18

19. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Debug Local AAA Authentication

20. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Understanding Debug Output

21. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Upon completion of this section, you should be able to:
• Describe the benefits of server-based AAA.
• Compare the TACACS+ and RADIUS authentication protocols.

22. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 22

23. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
Server-based authentication:
1. User establishes a connection
with the router.
2. Router prompts the user for a
username and password.
3. Router passes the username and
password to the Cisco Secure
ACS (server or engine)
4. The Cisco Secure ACS
authenticates the user.
Local authentication:
1. User establishes a connection
with the router.
2. Router prompts the user for a
username and password,
authentication the user using a
local database.

24. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 25

26. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
TACACS+ Authentication Process

28. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
RADIUS Authentication Process

29. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Cisco Secure ACS

30. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
Upon completion of this section, you should be able to:
• Configure server-based AAA authentication, using the CLI, on Cisco routers.
• Troubleshoot server-based AAA authentication.

32. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 32

33. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
1. Enable AAA.
2. Specify the IP address of the ACS server.
3. Configure the secret key.
4. Configure authentication to use either the RADIUS or
TACACS+ server.

34. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
Server-Based AAA
Reference Topology
Configure a AAA
TACACS+ Server

35. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 35
Configure a AAA RADIUS Server

36. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
Configure Server-Based
AAA Authentication
Command Syntax

37. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 37

38. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
Troubleshooting Server-Based AAA Authentication

39. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
Troubleshooting RADIUS
Troubleshooting TACACS+

40. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
AAA Server-Based
Authentication Failure
AAA Server-Based
Authentication Success

41. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
Upon completion of this section, you should be able to:
• Configure server-based AAA authorization.
• Configure server-based AAA accounting.
• Explain the functions of 802.1x components.

42. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 42

43. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
Authentication vs. Authorization
• Authentication ensures a device or end-user is legitimate
• Authorization allows or disallows authenticated users access to certain
areas and programs on the network.
TACACS+ vs. RADIUS
• TACACS+ separates authentication from authorization
• RADIUS does not separate authentication from authorization

44. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
Example AAA Authorization
Authorization Method Lists
Command Syntax

45. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 45

46. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 46

47. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 47
Example AAA Accounting
Accounting Method Lists
Command Syntax

48. Cisco Public© 2013 Cisco and/or its affiliates. All rights reserved. 48

49. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
802.1X Message Exchange
802.1X Roles

50. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
Command Syntax for dot1x port-control

51. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

52. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 52
Chapter Objectives:
• Explain how AAA is used to secure a network.
• Implement AAA authentication that validates users against a local database.
• Implement server-based AAA authentication using TACACS+ and RADIUS
protocols.
• Configure server-based AAA authorization and accounting.

53. Thank you.

54. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 54
• Remember, there are
helpful tutorials and user
guides available via your
NetSpace home page.
(https://www.netacad.com)
• These resources cover a
variety of topics including
navigation, assessments,
and assignments.
• A screenshot has been
provided here highlighting
the tutorials related to
activating exams, managing
assessments, and creating
quizzes.
1
2