User Mode and Privileged Mode AAA Authentication

Thu, 28 Jan 2016 | Routing and Switching

The term authentication, authorization, and accounting (AAA) refers to a variety of common security features. This section focuses on the first "A" in AAA—authentication—and how it is used to manage access to a router or IOS switch's user mode and privileged mode.

The strongest authentication method to protect the CLI is to use a TACACS+ or RADIUS server. The Cisco Secure Access Control Server (ACS) is a Cisco Systems software product that can be installed on Unix, Linux, and several Windows platforms, holding the set of usernames and passwords used for authentication. The routers and switches then need to receive the username and password from the user, send it as encrypted traffic to the server, and receive a reply—either accepting or rejecting the user. Table 21-2 summarizes some of the key facts about RADIUS and TACACS+.

Table 21-2 Comparing RADIUS and TACACS+ for Authentication

KEY POINT

Table 21-2 Comparing RADIUS and TACACS+ for Authentication

	RADIUS	TACACS+
Scope of Encryption: packet payload or just the password	Password only	Entire payload
Layer 4 Protocol	UDP	TCP
Well-Known Port/IOS Default Port Used for authentication	1812/16451	49/49
Standard or Cisco-Proprietary	RFC 2865	Proprietary

^Radius originally defined port 1645 as the well-known port, which was later changed to port 1812.

Using a Default Set of Authentication Methods

AAA authentication configuration includes commands by which a set of authentication methods is defined. A single authentication method is exactly what it sounds like—a way to authenticate a user. For example, one method is to ask a RADIUS server to authenticate a login user; another is to let a router look at a set of locally defined username commands. A set of configuration methods represents an ordered list of authentication methods, each of which is tried in order until one of the methods returns an authentication response, either accepting or rejecting the user.

The simplest AAA configuration defines a default set of authentication methods used for all router or switch logins, plus a second set of default authentication methods used by the enable command. The defined default login authentication methods apply to all login access—console, Telnet, and aux (routers only). The default authentication methods used by the enable command simply dictate what Cisco IOS does when a user types the enable command. The overall configuration uses the following general steps:

KEY POINT

Step 1 Step 2

Step 3

Step 4

Enable AAA authentication with the aaa new-model global command.

If using RADIUS or TACACS+, define the IP address(es) and encryption keys used by the server(s) by using the radius-server host, radius-server key, tacacs-server host, and tacacs-server key commands.

Define the default set of authentication methods used for all CLI access by using the aaa authentication login default command.

Define the default set of authentication methods used for enable-mode access by using the aaa authentication enable default command.

Example 21-4 shows a sample router configuration using these commands. In this case, two RADIUS servers are configured. One of the servers uses the Cisco IOS default port of 1645, and the other uses the reserved well-known port 1812. Per the following configuration, this router attempts the following authentication:

■ When a login attempt is made, Cisco IOS attempts authentication using the first RADIUS server; if there's no response, IOS tries the second RADIUS server; if there's no response, the user is allowed in (authentication mode none).

■ When any user issues the enable command, the router tries the RADIUS servers, in order; if none of the RADIUS servers replies, the router will accept the single username/password configured on the router of cisco/cisco.

Example 21-4 Differences in Hashed/Encrypted Enable Passwords

! The next command shows that the enable secret password is still configured, ! but it will not be used. The username command defines a user/password that will be used for enable authentication if the RADIUS servers are not reachable. Note that the 0 in the username command means the password is not encrypted.

Example 21-4 Differences in Hashed/Encrypted Enable Passwords (Continued)

R1# show running-config

! lines omitted for brevity enable secret 5 $1$GvDM$ux/PhTwSscDNOyNIyr5Be/ username cisco password 0 cisco

! Next, AAA is enabled, and the default enable and login authentication is ! defined, aaa new-model aaa authentication enable default group radius local aaa authentication login default group radius none

! Next, the two RADIUS servers are configured. The port numbers were omitted when ! the radius-server host 10.1.1.2 command was issued, and IOS filled in its ! default. Similarly, radius-server host 10.1.1.1 auth-port 1812 was issued, with IOS adding the accounting port number default into the command.

radius-server host 10.1.1.1 auth-port 1812 acct-port 1646 radius-server host 10.1.1.2 auth-port 1645 acct-port 1646 radius-server key cisco

Before adding AAA configuration, both the console and vtys had both the login and password commands as listed in Example 21-1. The act of enabling AAA deleted the login command, which now by default uses the settings on global command aaa authentication login default. The passwords remaining below would be used only if the aaa authentication login command listed a method of "line."

line con 0 password cisco line vty 0 4 password cisco

Using Multiple Authentication Methods

AAA authentication allows reference to multiple servers and to multiple authentication methods so that a user can be authenticated even if one authentication method is not working. The aaa authentication command supports up to four methods on a single command. Additionally, there is no practical limit to the number of RADIUS or TACACS+ servers that can be referenced in a RADIUS or TACACS+ server group. The logic used by Cisco IOS when using these methods is as follows:

key ■ Use the first listed method first; if that method does not respond, move on to the next, and then POINT the next, and so on until a method responds. Use the first-responding-method's decision (allow or reject).

■ If a method refers to a set of more than one server, try the first server, with "first" being based on the order of the commands in the configuration file. If no response, move on to the next sequential server, and so on, until a server responds. Use the first-responding-server's decision (allow or reject).

If no response occurs for any method, reject the request.

For example, Example 21-4 listed RADIUS servers 10.1.1.1 and 10.1.1.2, in that order, so those servers would be checked in that same order. If neither replies, then the next method would be used—none for login sessions (meaning automatically allow the user in), and local (meaning authenticate based on configured username commands).

Table 21-3 lists the authentication methods allowed for login and enable (privileged exec) mode, along with a brief description.

Table 21-3 Authentication Methods for Login and Enable

KEY POINT

Method	Meaning
group radius	Use the configured RADIUS servers
group tacacs+	Use the configured TACACS+ servers
group name	Use a defined group of either RADIUS or TACACS+ servers
enable	Use the enable password, based on enable secret or enable password commands
line1	Use the password defined by the password command in line configuration mode
local	Use username commands in the local configuration; treats the username as case insensitive, but the password as case sensitive
local-case	Use username commands in the local configuration; treats both the username and password as case sensitive
none	No authentication required; user is automatically authenticated

1Cannot be used for enable authentication.

KEY POINT

1Cannot be used for enable authentication.

Groups of AAA Servers

By default, Cisco IOS automatically groups RADIUS and TACACS+ servers configured with the radius-server host and tacacs-server host commands into groups, aptly named radius and tacacs+. The aaa authentication command includes the keywords group radius or group tacacs+ to refer to these default groups. By default, all defined RADIUS servers end up in the radius group, and all defined TACACS+ servers end up in the tacacs+ group.

In some cases, particularly with larger-scale dial implementations, a design may call for the separation of different sets of RADIUS or TACACS+ servers. To do so, servers can be grouped by name. Example 21-5 shows an example configuration with two servers in a RADIUS group named fred, and shows how the aaa authentication command can refer to the group.

Example 21-5 Configuring a RADIUS Server Group

! The next three commands create RADIUS group fred. Note that the servers are configured inside AAA group config mode, using the server subcommand. Note that

IOS added the auth-port and acct-port parameters automatically.

Example 21-5 Configuring a RADIUS Server Group (Continued) R1(config)# aaa group server radius fred
R1(config-group)# server 10.1.1.3	auth-port 1645 acct-port 1646
R1(config-group)# server 10.1.1.4	auth-port 1645 acct-port 1646
! To use group fred instead of the default group, the aaa authentication

! commands need to refer to group fred, as shown next, aaa new-model aaa authentication enable default group fred local aaa authentication login default group fred none

Overriding the Defaults for Login Security

The console, vty, and aux (routers only) lines can override the use of the default login authentication methods. To do so, in line configuration mode, the login authentication name command is used to point to a named set of configuration methods. Example 21-6 shows a named group of configuration methods called for-console, for-vty, and for-aux, with each applied to the related login method. Each of the named groups defines a different set of authentication methods. Example 21-6 shows an example that implements the following requirements:

■ console—Try the RADIUS servers, and use the line password if no response

■ vty—Try the RADIUS servers, and use local usernames/passwords if no response

■ aux—Try the RADIUS servers, and do not authenticate if no response

Example 21-6 Overriding the Default Login Authentication Method

! The configuration shown here has been added to the configuration from earlier ! examples.

aaa authentication login for-console group radius line aaa authentication login for-vty group radius local aaa authentication login for-aux group radius

! The methods are enabled below with the login authentication commands. Note that ! the local passwords still exist on the console and vtys; for the console, ! that password would be used (based on the line keyword in the aaa authentication command above) if the RADIUS servers are all nonresponsive. However, the vty password command would not be used by this configuration.

line con 0 password 7 14141B180F0B

Cisco Certified Expert

» Routing and Switching