- [Narrator] The AAA security architecture
is a framework that allows administrators
to control user access to network devices
by using three independent security functions.
These functions are authentication,
authorization, and accounting.
Authentication is the process
where a user must prove their identity.
This is typically achieved with a username
and a password combination, so, for example,
if a user is attempting to connect
to a router's console board, they might be prompted
for their authentication credentials.
Authorization is the process
that determines which resources or operations
a user is able to access, and it does that
through certain access privileges or restrictions.
Just because a user is authenticated correctly doesn't mean
that they're authorized to do anything they want.
So if you log in with working credentials
and you're successfully authenticated
as a valid network user, you might still be restricted
in the actions you're allowed to take
based on the authorization guidelines.
And accounting is used to record all of the actions
a user takes while they are accessing network resources.
It does that by recording and storing log files.
So this can track items such as the times the user
was connected, which commands they executed, and much more.
AAA can be achieved using either
an external server or locally on our device.
When using an external server,
the two most popular protocols are RADIUS and TACACS+.
RADIUS is an IETF open standard that uses UDP communication
on ports 1812 and 1813 by default.
RADIUS does only encrypt the password field.
Also notable is that RADIUS combines
the authentication and authorization processes.
RADIUS is primarily used where
we want to restrict network access.
TACACS+, on the other hand,
is a Cisco proprietary protocol that uses
reliable TCP communication over port 49 by default.
Where RADIUS only encrypts the password field,
TACACS+ can encrypt the entire payload.
Also as opposed to RADIUS,
TACACS+ does not combine any of the AAA processes.
So authentication, authorization,
and accounting are all separate.
This protocol is preferred for usage
with secure device administration.
Now, the recommended solution for mid to large environments
that is able to handle both RADIUS secure network access
and TACACS+ device administration,
that's Cisco's ISE, their identity services engine.
So configuring external AAA with something
like Cisco ISE, that requires two steps.
First it requires the configuration of our router
and it requires the configuration of the AAA server itself,
which might be something like the Cisco ISE.
Now configuring Cisco ISE in this manner,
that's actually outside of the scope of this exam,
so we're going to focus on the local configuration here.
We're going to configure AAA to operate without TACACS+.
We're going to configure AAA to operate
as if there is a TACACS+ server in our environment
but we're also going to implement local mode
as a fallback method, meaning that the router will handle
authentication and authorization by using
the local user database found on the router.
So let's connect to a router now
and a take a look at how we can configure this.
So here we're connected to our router, and you can see
that right now if I hit return, I'm allowed to connect
with no prompt for credentials at all.
So when we do enable AAA, that's going to add
some authentication here to our log in process.
And the first thing we want to do,
let's go into enable mode, we'll go under
global configuration mode as well.
And the first thing we want to do is enable
the AAA service globally on the router,
we can do that under global configuration mode
with the command "aaa new-model."
If I hit enter, that's all it takes
to enable AAA globally on there.
And now I want to show you how to point
to an external TACACS+ server, such as a Cisco ISE
while we still use local AAA as our fallback method.
Now, since we don't have an external AAA server configured,
in our case our router's going to try to reach out
to that server, it's going to see that it's unreachable,
and then it's going to try a backup method that we configure.
So it's important that we configure this
locally so that it works correctly.
So the next thing we want to do
if we're going to do that is want to create a local user.
We can do that with a command "username,"
I'll say, "Charles" and I'm also going to
give this user the highest privilege of 15,
and then I'll say, "secret Cisco" and I'll hit enter.
So now we have a loca user in our user database
that we can use for a fallback method.
So with that in place, we now want to add
a TACACS+ server to our configuration.
Now, depending on your iOS version,
the commands are going to vary slightly.
If you're running a version prior to iOS 15.x,
the command will be "TACACS-server host"
followed by the host name
or IP address of the TACACS+ server.
Now if I hit enter there, you can see
it doesn't really like that command,
that's because I am in a newer version of that,
I'm running iOS 15.7, so in the newer iOS version,
the relevant command is "TACACS" plus "server"
followed by the name of the server, so this is going to
allow you to give that server an easily identifiable name
that's going to help you when you're looking through
your running configuration later.
I'm going to name this instance, just something really simple,
I'm just going to call it "TACACS" and I'm going to hit enter.
And now you can see we're under TACACS configuration mode.
So now we can point to the actual server by either
its host name or by the IP address.
I'm going to use the IP address, so I'm going to say
"address," and if we look at contextual help you'll see
that we can use either an IP version four
or an IP version six address.
I'm going to use the IP version four address
and I'm going to say "10.1.1.5" for that address
and I'm going to hit enter to accept that.
And finally we need to enter our TACACS+ key here by using
the command "key" followed by the actual key string.
Now, this is actually the pre-shared key
that we have to configure, which would already be configured
on the AAA server itself, so that this router
could authenticate to that server.
And I'm going to use the key "security" here
and we'll hit enter to accept that.
Going to back out into global configuration mode,
and one other thing that we want to do
is we want to create a server group.
So if you have a really large environment,
it's entirely possible that you have multiple
TACACS+ servers, or you could have a TACACS+
and a RADIUS server, or maybe you have
redundant servers in place just to ensure
that you have reachability in case of a server failure.
And what we can do is we can leverage server groups
to set up those fallback methods.
Now, when we create this group, the order in which
we add the servers later, that's going to determine
which order they'll be used during fail over,
so it will go right down the list and try those in order.
And the command to do this is "AAA group server", and notice
if we use contextual help we have several options
at our disposal, we have diameter, LDAP, RADIUS and TACACS+.
In our case, we are creating a TACACS+ server group,
so we'll use that keyword, and then we need to
give this group a name for identification.
I'm going to call that "T-GROUP,"
just make a really simple name, and I'll hit enter.
So now we are under the server group configuration mode
and we can begin to add our servers to this group
in the order that we want them to be used for fail over.
Now since I've only configured a single TACACS+ server,
this is a bit redundant, to create a server group,
but I wanted to give you a look at how
you could actually do that and how that configuration works.
Now we're under server group configuration mode.
And we can say "server name" and the name of the server
that we previously configured was "TACACS," so we want to
call out that name, very, very simple.
If we had more servers we could reenter that command
for each server that we wanted to add into this group.
Now let's back out into global configuration mode
and we now want to enable AAA log in authentication.
And the command we want to use is
"aaa authentication login."
And if we look at our contextual help options,
you'll see that we have a couple of options here.
What we're doing is we're actually defining
what's called a method list, and the method list
is going to indicate the authentication methods
that can be applied to a line or to an interface.
So you see that we can create a custom list
if we want to, we can give that a name,
or we can use the default list.
Now in most cases we'll just choose the default method list
so that's what I'm going to choose here.
And if we again look at contextual help,
you can see there's an option for group under there,
and we since we have defined a server group,
we want to use the group keyword followed by the name
of the group, which was "T-GROUP."
And if we use contextual help once more,
notice that we have the exact same options presented to us.
And that's because this is allowing us to configure
additional authentication methods.
So as it stands, we have one authentication method
that we've listed here, which is our TACACS+ server group.
We can add additional TACACS+ server groups if we'd like to,
we could add a RADIUS server group, and so on,
we can see all of those options there.
The option that I want to choose is local.
'Cause that's going to fallback to our local user database
when the connection to our TACACS+ server fails.
And again, remember, I don't actually have
a TACACS+ server in this lab, so this is necessary
for the configuration to work properly.
So we have the keyword "local," and one other thing
that we can do here if we wanted to is we could actually
append the keyword "enable" as our final method.
And what that's going to do is that's going to use
the configured enable password as the last resort
for getting logged in if everything else fails.
So I'll go ahead and hit enter with that,
and that completes AAA authentication.
Now we want to configure authorization.
What I want to do here is I want to enable
the authorization requirement for starting an exec shell.
So if any user tries to do that,
they're going to be prompted for authorization credentials,
and that command is "aaa authorization exec".
If we look at our options, again, we can create a list
or we can use the default list, I'm going to use
that default method list again, as we typically do.
And again, contextual help is going to show
the option for group, so I want to use the group keyword
and again I want to enter that group name, which is "T-GROUP,"
that is our TACACS+ server group, and then we want to
also add, again, that local fallback option and hit enter.
Now we've configured AAA authentication and authorization,
we've done that to an external TACACS+ server,
which we don't actually have, but we've also
configured local login as our fallback method.
So we can actually test this very simply.
We can log out of the console,
I'll hit enter to log back in.
And you can see that this time, instead of allowing us
to go right into the console, we're prompted for a username.
So I'll input "Charles," the password
that I configured was "Cisco," and now it does
let me into the console, as you would expect.
So that's a look at how we can configure
external AAA servers and server groups
and use local AAA as a fallback method
for both authentication and authorization.