Textbook Notes Flashcards
Device Administration AAA
Device administration is a method of AAA for controlling access to a network device console, Telnet session, Secure Shell session, or device operating system for purpose of configuration
AAA
AAA (Authentication, Authorization, and Accounting)
- Authentication: Who the entity actually is. Involves validating an identity or credential
- Authorization: Is the entity authorized to perform that action
- Accounting: Logs of what action the entity performed
TACACS+
TACACS+
- Terminal Access Controller Access Control Systems
- TACACS+ was created by Cisco and is not backward compatible with the original TACACS
- Was not supported by Cisco ISE until version 2.0
- Was designed for device administration AAA, to authenticate and authorize users into mainframe and UNIX terminals and other terminals or consoles
- TACACS+ is mainly used for device administration AAA
- Uses port 49 and TCP
- Encrypts the entire packet
- Able to separate authentication, authorization, and accounting as separate and independent functions. This is why TACACS+ is so commonly used for device administration, even though RADIUS is still certainly capable of providing device administration AAA
- TACACS+ uses TCP port 49 to communicate between the TACACS+ client and the TACACS+ server
RADIUS
RADIUS
- Client/server-based model, where the client initiates requests to the server. RADIUS is the protocol of choice for network access AAA. If you connect to a secure wireless network regularly, RADIUS is most likely being used between the wireless device and the AAA server because RADIUS is the transport protocol for Extensible Authentication Protocol (EAP), as well as for many other authentications protocols.
- Authentication and authorization are not separated in a RADIUS transaction
- UDP 1812 (authentication) and 1813 (accounting)
- IETF standard for AAA
- Carries authentication traffic from the network device to the authentication server
- With IEEE 802.1X, RADIUS is used to extend the Layer 2 EAP from the end user to the authentication server
Extensible Authentication Protocol (EAP)
- IEEE standardized on a method to use Extensible Authentication Protocol (EAP) over local-area networks (IEEE 802.1X) using RADIUS to carry the authentication traffic. In fact, IEEE 802.1X cannot use TACACS; it must use RADIUS
TACACS+ Authentication Messages
Attribute/Value Pair (AV Pair)
When communicating with an AAA protocol, many attributes can be referenced to clearly indicate answers or results. A RADIUS server may assign an attribute to the authentication session, such as for a VLAN. In this case, the VLAN placeholder is the attribute, and the assigned VLAN number is the value for that placeholder. The attribute in the AAA communication and its assigned value are paired together and referred to as an attribute/value pair (AV pair). Figure 1-9 illustrates the concept of AV pairs by using a table with attribute and value columns to represent the pairings.
Change of Authorization (CoA)
- RFC 5176 Dynamic Authorization Extensions to RADIUS (a/k/a CoA)
- CoA allows a RADIUS server to initiate a conversation with a network device and disconnect a user’s session, bounce the port, or even tell the device re-authentic ate the user
What AAA protocol is best suited for device administration?
TACACS+
Which AAA protocol supported by ISE combines authentication and authorization in a single transaction?
RADIUS
Which AAA protocol supported by ISE uses TCP for transport?
TACACS+
In AAA communication, what is the name of the combination of an attribute and its assigned value?
Attribute/value (AV) pair
What is the common name for the technology extension to RADIUS that allows communication to be initiated from the authentication server to the authenticator (the NAD)?
Change of Authorization (CoA)
Describe an Identity Store
An identity store is basically a database that houses the credentials of users or endpoints. Because it contains those values, it can be used to authenticate the identity of a user or an endpoint. The identity store could be an internal database that resides on the AAA server or an external database that houses the identities.
Identity stores can also be used for the retrieval of the user or machine attributes used in authorization policies. Each individual identity store is referred to as an identity source.
ISE referees to Active Directory (and similar) as External Identity Stores
What is EAP
- Extensible Authentication Protocol (EAP) is an authentication framework that defines the transport and usage of identity credentials.
- EAP encapsulates the usernames, passwords, certificates, tokens, one-time passwords, and so on that a client is sending for purposes of authentication.
