Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.1 |  | Introduction to AAA and security protocols |

AAA is an architectural framework for configuring three different security features:

- Authentication – supplying user credentials to gain access to a system. Authentication asks the user who they are.
- Authorization – limiting a user’s access to certain ‘authorized’ commands and options. Authorization asks the user what privileges they have.
- Accounting – recording user activity for security, billing, or other purposes. Accounting makes a record of what the user did and when they did it.

Configuring a local database of usernames and passwords on the switch has already been covered in this module. AAA can also be used for login authentication. Using AAA for device logins offers three main advantages:

- AAA provides scalability – many Cisco IOS devices can use AAA to refer to a common set of usernames and passwords on a central security server
- AAA supports standardized protocols – Cisco IOS devices running AAA can communicate securely with security servers using the protocols covered later.
- AAA allows for multiple backup systems – Cisco IOS devices can consult a second or third source of information if the primary source of security information is offline.

Overall, these benefits mean that AAA provides scalability, as well as increased flexibility and control of access configuration.

Network hosts are often configured to use a security protocol. Hosts use a security protocol to communicate with a specialized security server. The security server maintains a password and username database, as well as authorization configurations, and stores accounting information. The Cisco IOS supports three key security protocols:

- Terminal Access Controller Access Control System Plus (TACACS+)
- Remote Authentication Dial-In User Service (RADIUS)
- Kerberos

TACACS+ is a security application used with AAA that provides centralized validation of users attempting to gain access to a router or network access server. TACACS+ services are maintained in a database on a TACACS+ daemon running, typically, on a UNIX or Windows NT workstation. TACACS+ provides for separate and modular authentication, authorization, and accounting facilities.

RADIUS is a distributed client/server system used with AAA that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a central RADIUS server that contains all user authentication and network service access information.

Kerberos is a secret-key network authentication protocol used with AAA that uses the Data Encryption Standard (DES) cryptographic algorithm for encryption and authentication. Kerberos was designed to authenticate requests for network resources. Kerberos is based on the concept of a trusted third party that performs secure verification of users and services. The primary use of Kerberos is to verify that users and the network services they use are really who and what they claim to be. To accomplish this, a trusted Kerberos server issues tickets to users. These tickets, which have a limited lifespan, are stored in a user's credential cache and can be used in place of the standard username and password authentication mechanism.

Of the three protocols, TACACS+ and RADIUS offer the most comprehensive AAA support. Kerberos provides a highly secure method of authentication, in which passwords are never sent over the wire. Kerberos does not support the authorization and accounting components of AAA, and is therefore not covered in any detail in this module.

The following sections examine TACACS+ and RADIUS in detail. Figure compares the features of each.