Authentication verifies who a user or system is; authorization then determines which resources, services, files, or Cisco IOS commands that authenticated subject may access. Accounting records subsequent activity, completing the AAA access-control framework. section 11.4 section 11.4.1
Separate the three AAA questions:
- Authentication asks, “Who are you?” and verifies a user’s or system’s identity, ideally with multifactor authentication. section 11.4.1
- Authorization asks, “What are you allowed to do?” and grants permissions after authentication succeeds. section 11.4.1
- Accounting asks, “What did you do?” by logging activities for audits, troubleshooting, and behavior analysis. section 11.4.1
Centralized AAA commonly uses these protocols:
- RADIUS combines authentication and authorization, uses UDP ports 1812 and 1813, encrypts only passwords, and typically supports network access. section 11.4.2
- TACACS+ separates authentication, authorization, and accounting, uses TCP port 49, encrypts all messages, and typically supports device administration. section 11.4.2
- Cisco Identity Services Engine provides a centralized AAA server solution for controlling credentials, permissions, and activity records. section 11.4.2
Bearer authentication for an API
A client obtains an access token from an authorization server, then presents that token when requesting protected resources from the resource server. HTTPS protects the token during transmission because interception could enable unauthorized access. section 23.3.2
Table 11.1 RADIUS and TACACS+ (view table figure)
| RADIUS |
TACACS+ |
|---|---|
| Open standard |
Created by Cisco but now open standard |
| Combines authentication and authorization into a single operation |
Keeps all three AAA components separate |
| UDP ports 1812 and 1813 |
TCP port 49 |
| Encrypts passwords only |
Encrypts all communications |
| Typically used for network access |
Typically used for device administration |
Compare RADIUS and TACACS+ by AAA separation, transport, ports, encryption coverage, and typical deployment. section 11.4.2
