计算机网络安全技术与实施（旧） 思科网络学院CCNA Security资源 第3章AAA.pptx

AAA;Managing administrative infrastructure access is crucial. Methods: Password only Local database AAA Local Authentication (self-contained AAA) AAA Server-based;Password Only Method;It provides greater security than a simple password. It’s a cost effective and easily implemented security solution.;The problem is this local database has to be replicated on several devices … A better scalable solution is to use AAA.;AAA is an architectural framework for configuring:;AAA Security Services;Cisco IOS routers can implement AAA using either:;Also called “Self-contained AAA”, it provides the method of identifying users: Includes login and password dialog, challenge and response, messaging support, … It’s configured by: Defining a “named” list of authentication methods. Applying that list to various interfaces (console, aux, vty). The only exception is the default method list (“default”) which is automatically applied to all interfaces if no other method list is defined. ;The named or default authentication method defines: The types of authentication to be performed. The sequence in which they will be performed. It MUST be applied to a specific interface before any of the defined authentication methods will be performed.;The client establishes a connection with the router. The AAA router prompts the user for a username and password. The router authenticates the username and password using the local database and the user is authorized to access the network based on information in the local database.;Using Cisco Access Control Server (ACS) is the most scalable because all infrastructure devices access a central server. Fault tolerant because multiple ACS can be configured. Enterprise solution. The actual server can be: Cisco Secure ACS for Windows Server: AAA services on the router contacts a Cisco Secure Access Control Server (ACS) system for user and administrator authentication. Cisco Secure ACS Solution Engine: AAA services on the router or NAS contact an external C