• Chapter 1: Describing Network Requirements
• Chapter 2: Topologies for Teleworker Connectivity
• Chapter 3: Using Cable to Connect to a Central Site
• Chapter 4: Using DSL to Connect to a Central Site
• Chapter 5: Configuring DSL Access with PPPoE
• Chapter 6: Configuring DSL Access with PPPoA
• Chapter 7: DSL Connection Troubleshooting
• Chapter 8: The MPLS Conceptual Model
• Chapter 9: MPLS Architecture
• Chapter 10: Configuring Frame Mode MPLS
• Chapter 11: MPLS VPN Technologies
• Chapter 12: IPsec Overview
• Chapter 13: Site-to-Site VPN Operations
• Chapter 14: GRE Tunneling over IPsec
• Chapter 15: IPsec High Availability Options
• Chapter 16: Configuring Cisco Easy VPN
• Chapter 18: Cisco Device Hardening
• Chapter 19: Securing Administrative Access
• Chapter 20: Using AAA to Scale Access Control
• Chapter 21: Cisco IOS Threat Defense Features
• Chapter 22: Implementing Cisco IOS Firewalls
• Chapter 23: Implementing Cisco IDS and IPS

Chapter 20: Using AAA to Scale Access Control

AAA

Authentication, Authorization, and Accounting (AAA) has two access modes:

• Character Mode - Used on VTY, auxiliary, and console lines to access the CLI
• Packet Mode - Used on physical interfaces and dialer profiles for inter-device authentication (PPP, Arap, or NASI)

TACACS+

Developed by Cisco, defined in RFC 1492.

TACACS+ uses TCP.

TACACS+ allows for encryption of the entire packet body.

TACACS+ separates authentication and authorization, allowing a different backend to be used for each.

TACACS+ has better multiprotocol support than RADIUS.

Only TACACS+ provides command-specific authorization.

Configuration example:

aaa new-model
tacacs-server host 10.18.0.27
tacacs-server key SharedSecret
username Steve secret <hash>
aaa authentication ppp dial-list tacacs+ local
aaa authorization commands 15 tacacs+ if-authenticated none
aaa accounting network start-stop tacacs+

RADIUS

Defined in RFC 2865

RADIUS uses UDP.

RADIUS only encrypts passwords within an access-request packet.

RADIUS combines authentication and authorization.

Configuration example:

aaa new-model
radius-server host 10.18.0.27
radius-server key SharedSecret
username Steve secret <hash>
aaa authentication ppp dial-list radius local
aaa authorization network radius local
aaa accounting network mynetwork start-stop group radius

Debugging

• debug aaa authentication
• debug aaa authorization
• debug aaa accounting
• debug radius
• debug tacacs