Configuring AAA on the Infrastructure Devices
The network administrator configures authentication, authorization, and accounting (AAA) for administrative access to all routers within the network. The network administrator uses command authorization to enforce which commands users can invoke and execute in the routers. Example 12-11 shows a AAA configuration template used for all routers within the organization:
Example 12-11 AAA Configuration on Routers aaa new-model aaa authentication login default group tacacs+ local tacacs-server host 172.18.85.181 tacacs-server key 1qaz2wsx
The aaa new-model command enables the AAA security services. The aaa authentication command defines the default method list. Incoming logins on all interfaces (by default) use TACACS+ for authentication. If no TACACS+ server responds, the network access server uses the information contained in the local username database for authentication. The tacacs-server host command identifies the TACACS+ server as having an IP address of 172.18.85.181. The tacacs-server key command defines the shared encryption key to be 1qaz2wsx.
The administrator also configures AAA on the Cisco ASAs for Telnet, Secure Shell (SSH), HTTPS, and serial console access. The commands used are shown in Example 12-12.
In this example, authentication is performed using an external TACACS+ server (that is, Cisco Secure ACS).
Example 12-12 Cisco ASA AAA Configuration
!The following commands define a TACACS+ server and limit the number of failed attempts to 4.The server group name is svrgrp
aaa-server svrgrp protocol tacacs+ max-failed-attempts 4
!The TACACS+ server (172.18.85.101) and a shared secret (1qaz2wsx) are defined. The timeout is set to 5 seconds.
aaa-server svrgrp host 172.18.85.101 1qaz2wsx timeout 5 !
!Telnet authentication aaa authentication telnet console svrgrp !
!Serial console port authentication aaa authentication serial console svrgrp !
!HTTPS authentication for ASDM connections aaa authentication secure-http-client
Cisco Secure ACS is used as the TACACS+ server. The following steps are taken to add the routers and the Cisco ASAs as authentication clients on Cisco Secure ACS:
Step 1 Log in to the Cisco Secure ACS web admin console.
Step 2 Choose Network Configuration on the left, and click Add Entry to add an entry for the Cisco ASAs or routers in either the TACACS+ or RADIUS server database.
Step 3 Choose the server database according to the routers and Cisco ASA configurations. Because TACACS+ is used in this example, choose TACACS+ (Cisco IOS) under the Authenticate Using drop-down menu.
Step 4 Configure the shared key. This key is used for authentication between the authentication client (router or Cisco ASA) and Cisco Secure ACS.
Case Study of a Large Enterprise
Company-C is a large enterprise that offers numerous information technology products and services. Over the past few years, this company has been growing at a fast pace. Recently, Company-C acquired Company-A and Company-B. The Raleigh and Atlanta offices of Company-A became branch offices, and the Chicago office of Company-B became a regional office, as illustrated in Figure 12-58. The headquarters is located in New York City.
- Call Center
The following is a high-level explanation of the New York office topology:
• At the Internet edge, a pair of Cisco Catalyst 6500 switches is deployed with FWSMs.
• A cluster of Cisco ASAs is configured for IPsec- and SSL-based remote access VPN.
• Cisco routers are configured to terminate IPsec site-to-site VPN tunnels to the branch offices and the regional office.
• The user population includes the following:
— A call center of more than 100 customer service representatives
— The executive floor
— Sales representatives
— Engineering
• A large data center is also located at the New York office.
With the dramatic growth, Company-C staff members initiate several corporate initiatives and projects to increase the security of the network. The following sections include information about different techniques and methodologies that Company-C staff members use.
Continue reading here: Configuring IPsec Remote Access VPN
Was this article helpful?