Post on 26-May-2015
description
transcript
AAA Implementation
Presenter: Deniz Kaya
Outline
– Overview– Identification and Authentication– Introduction to AAA for Cisco Routers– Authenticating Remote Access– TACACS+ and RADIUS AAA Protocols– Authentication Methods– Point-to-Point Authentication Protocols– Authenticating Router Access– Configuring AAA for Cisco Routers– Troubleshooting AAA on Cisco Routers– Configuring AAA with Cisco SDM – Summary
AAA Model—Network Security Architecture
• Authentication
– Who are you?
– “I am user student and my password validateme proves it.”
• Authorization
– What can you do? What can you access?
– “User student can access host serverXYZ using Telnet.”
• Accounting
– What did you do? How long did you do it? How often did you do it?
– “User student accessed host serverXYZ using Telnet for 15 minutes.”
Implementing Cisco AAA
• Administrative access—console, Telnet, and auxiliary access
• Remote user network access—Dial-up or VPN access
Cisco Secure ACS for Windows Server
Remote Client(Dial-Up Client) NAS
CorporateFile ServerConsole
Remote Client(VPN Client)
RouterCisco Secure ACS
Solution Engine
Internet
PSTN and ISDN
PSTN = public switched telephone network
Implementing Authentication Using Local Services
1. The client establishes a connection with the router.
2. The router prompts the user for a username and password.
3. The router authenticates the username and password in the local database. The user is authorized to access the network based on information in the local database.
PerimeterRouter
Remote Client
1
23
Implementing Authentication Using External Servers
1. The client establishes a connection with the router.
2. The router prompts the user for a username and password.
3. The router passes the username and password to the Cisco Secure ACS (server or engine).
4. The Cisco Secure ACS authenticates the user. The user is authorized to access the router (administrative access) or the network based on information found in the Cisco Secure ACS database.
PerimeterRouter
Remote Client
Cisco Secure ACS for
Windows Server
Cisco Secure ACS Solution
Engine
1
2
3
4
TACACS+ and RADIUS AAA Protocols
• Two different protocols are used to communicate between the AAA security servers and authenticating devices.
• Cisco Secure ACS supports both TACACS+ and RADIUS:
– TACACS+ remains more secure than RADIUS.
– RADIUS has a robust application programming interface and strong accounting.
Cisco Secure ACS
Firewall
Router NetworkAccessServer
TACACS+ RADIUS
Security Server
Authentication Methods and Ease of Use
Strongest
Weak
Au
then
tica
tio
n
Ease of use HighLow Ease of use HighLow
Token cards or soft tokens using OTPs
S/Key (OTP for terminal login)
Username and password (aging)
Username and password (static)
No username or password
Authentication—Remote PC Username and Password
Microsoft Windows dial-up networking connection: Username and Password fields
SecurityServer
Microsoft WindowsRemote PC
NAS
Username and password (TCP/IP PPP)
PSTN or ISDN
Authentication—Token Cards and Servers
Cisco SecureACS
(OTP)
Token Server
12
3
4
AAA Example—Authentication via PPP Link
• Password Authentication Protocol
– Clear text, repeated password
– Subject to eavesdropping and replay attacks
• Challenge Handshake Authentication Protocol
– Secret password, per remote user
– Challenge sent on link (random number)
– Challenge can be repeated periodically to prevent session hijacking
– CHAP response is Message Digest 5 hash of (challenge + secret) that provides authentication
– Robust against sniffing and replay attacks
• MS-CHAP version 1 (supported in Cisco IOS Release 11.3 and later) and version 1 or version 2 (supported in Cisco IOS Release 12.2 and later)
Network Access Server
TCP/IPand PPP
Client
PPP PPPPSTN or
ISDN
Authenticating Router Access
Telnet Host
LAN
Remote LANNetworkAccess
Console
Router
Remote Router Administrative
Access
Internet
Router Local Authentication Configuration Process
Here are the general steps required to configure a Cisco router for local authentication:
• Step 1: Secure access to privileged EXEC mode.
• Step 2: Enable AAA globally on the perimeter router with the aaa new-model command.
• Step 3: Configure AAA authentication lists.
• Step 4: Configure AAA authorization for use after the user has passed authentication.
• Step 5: Configure the AAA accounting options for how you want to write accounting records.
• Step 6: Verify the configuration.
Enable AAA Globally Using the aaa new-model Command
aaa new-model
router(config)#
router(config)# aaa new-model
username username password password
router(config)#
router(config)# username Joe106 password 1MugOJava
• Establishes AAA section in configuration file
• Sets username and password
aaa authentication login default local
• Helps prevent administrative access lockout while configuring AAA
router(config)#
aaa authentication Commands
• These aaa authentication commands are available in Cisco IOS Releases 12.2 and later.
• Each of these commands has its own syntax and options (methods).
aaa authentication arapaaa authentication banneraaa authentication enable defaultaaa authentication fail-messageaaa authentication local-overrideaaa authentication loginaaa authentication nasiaaa authentication password-promptaaa authentication pppaaa authentication username-prompt
router(config)#
aaa authentication login Command
aaa authentication login {default | list-name} method1 [method2...]
router(config)#
router(config)# aaa authentication login default enable
router(config)# aaa authentication login console-in local
router(config)# aaa authentication login tty-in line
aaa authentication ppp Command
aaa authentication ppp {default | list-name} method1 [method2...]
router(config)#
router(config)# aaa authen ppp default local
router(config)# aaa authen ppp dial-in local none
aaa authentication enable default Command
aaa authentication enable default method1[method2...]
router(config)#
router(config)# aaa authentication enable default group tacacs+ enable none
Apply Authentication Commands to Lines and Interfaces
• Authentication commands can be applied to lines or interfaces.
router(config)# line console 0router(config-line)# login authentication console-inrouter(config)# int s3/0router(config-if)# ppp authentication chap dial-in
Note: It is recommended that you always define a default list for AAA to provide “last resort”authentication on all lines and interfaces protected by AAA.
aaa authorization Command
aaa authorization {network | exec | commands level | reverse-access | configuration} {default | list-name} method1 [method2...]
router(config)#
router(config)# aaa authorization commands 1 alpha local
router(config)# aaa authorization commands 15 bravo local
router(config)# aaa authorization network charlie local none
router(config)# aaa authorization exec delta if-authenticated
router(config)# aaa authorization commands 15 default local
aaa accounting Command
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] group groupname
router(config)#
router(config)# aaa accounting commands 15 default stop-only group tacacs+
router(config)# aaa accounting auth-proxy default start-stop group tacacs+
Troubleshooting AAA Using debug Commands
debug aaa authentication
router#
• Use this command to help troubleshoot AAA authentication problems
debug aaa accounting
router#
• Use this command to help troubleshoot AAA accounting problems
debug aaa authorization
router#
• Use this command to help troubleshoot AAA authorization problems
Troubleshooting AAA Using the debug aaa authentication Command
router# debug aaa authentication113123: Feb 4 10:11:19.305 CST: AAA/MEMORY: create_user (0x619C4940) user=''ruser='' port='tty1' rem_addr='async/81560' authen_type=ASCII service=LOGIN
priv=1113124: Feb 4 10:11:19.305 CST: AAA/AUTHEN/START (2784097690): port='tty1'
list=''action=LOGIN service=LOGIN113125: Feb 4 10:11:19.305 CST: AAA/AUTHEN/START (2784097690): using "default"
list113126: Feb 4 10:11:19.305 CST: AAA/AUTHEN/START (2784097690): Method=LOCAL113127: Feb 4 10:11:19.305 CST: AAA/AUTHEN (2784097690): status = GETUSER113128: Feb 4 10:11:26.305 CST: AAA/AUTHEN/CONT (2784097690): continue_login(user='(undef)')113129: Feb 4 10:11:26.305 CST: AAA/AUTHEN (2784097690): status = GETUSER113130: Feb 4 10:11:26.305 CST: AAA/AUTHEN/CONT (2784097690): Method=LOCAL113131: Feb 4 10:11:26.305 CST: AAA/AUTHEN (2784097690): status = GETPASS113132: Feb 4 10:11:28.145 CST: AAA/AUTHEN/CONT (2784097690): continue_login(user='diallocal')113133: Feb 4 10:11:28.145 CST: AAA/AUTHEN (2784097690): status = GETPASS113134: Feb 4 10:11:28.145 CST: AAA/AUTHEN/CONT (2784097690): Method=LOCAL113135: Feb 4 10:11:28.145 CST: AAA/AUTHEN (2784097690): status = PASS
Troubleshooting AAA Using the debug aaa accounting Command
router# debug aaa accounting16:49:21: AAA/ACCT: EXEC acct start, line 1016:49:32: AAA/ACCT: Connect start, line 10, glare16:49:47: AAA/ACCT: Connection acct stop:task_id=70 service=exec port=10 protocol=telnet address=172.31.3.78 cmd=glare bytes_in=308 bytes_out=76 paks_in=45 paks_out=54 elapsed_time=14
Configuring AAA with Cisco SDM
1
2
3
Summary• AAA services provide a higher degree of scalability than the line-level and
privileged EXEC authentication • AAA services may be self-contained in the router or network access server (NAS)
itself. This form of authentication is also known as local authentication • In situations where local authentication will not scale well, such as for many remote
clients connecting to the network from different locations, it is better to implement a remote security database.
• TACACS+ and RADIUS are the two predominant AAA protocols used by Cisco security appliances, routers, and switches for implementing AAA with a remote security database.
• The most common authentication method is the use of a username and password. Authentication strength varies from the weakest which is to use a database of usernames and passwords to the strongest which is to use OTPs.
• PPP enables authentication between remote clients and servers using PAP, CHAP, or MS-CHAP.
• Administrative access to a router and remote LAN access through perimeter routers is secured using aaa comands.
• To configure AAA for local authentication on a router, first enable AAA with the aaanew-model command, second specify a username and password with the usnernameusername password password command, and third specify local authentication with the aaa authentication login default local command.
• There are three commands to use when debugging AAA: debug aaa authentication, debug aaa authorization, and debug aaa accounting
• You can configure AAA with Cisco SDM by following the Configure > Additional Tasks> AAA path.
New Horizons' Partners