When it comes to authentication and authorization, we kind of think of it like
walking into a bank.
We walk into a bank and let's imagine we're a customer of the bank and we want
to have a
transaction or take out some money. The very first thing they're going to want
us to do at this bank
is they're going to want to know who we are. Silver likely will verify who we
are with maybe
one form of ID and maybe a bank card also. That'd be an example of two-factor
authentication,
something that we have. And if that bank card required a pin, that'd be
something that we know,
and then once they know who we are, we then would be authorized or not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then once they know who we are, we then would be authorized or not
authorized to make a
transaction, for example, to take out a bunch of money or take out a little bit
of money based on
what we have in our account. So for the authorization piece, I'm going to call
that permissions. Are we
allowed to do it? And then the third element is going to happen also once we
take out the money
or make a deposit, whatever our transaction is, they're also going to go ahead
and make a record
of it and that's accounting. And so authentication, authorization, and
accounting is the three A's
that make up AAA. Who are you? What are you allowed to do? And what did you do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that make up AAA. Who are you? What are you allowed to do? And what did you do
with accounting records?
And in this set of videos, we're going to focus on authentication and
authorization
regarding access and working with our Cisco devices. So let me clean this up a
little bit.
And then we also chat with you about why authentication and authorization are
very near and dear to
my heart. When I was working on my second CCIA for security with Cisco, I had
the unfortunate incident
locking myself out of my own router. And unfortunately, the only way around it
was to power it off.
That was back in the days when we had physical gear, physical racks there. I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That was back in the days when we had physical gear, physical racks there. I
had to power it off,
power it back on, and then pick up my configurations where I left out because
fortunately, I had not
saved my config to start up config. And as a result, when it booted back, I
just had to replace the
configs I did up to that point minus the part where I messed up and got the
authentication
authorization incorrect on the console port, which was my main access to this
router.
So as we talked about triple A, we could spend literally a whole day talking
about the thousands, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about the thousands,
no lie, thousands of options that we can configure regarding triple A. But my
goal,
this set of videos for us is to understand the basics, to see some of those
basics in action,
and then put you on a hands-on lab at the tail end so you can practice and
reinforce the skills
and configuration that we're talking about in this set of videos. So let's go
ahead and start off
with no triple A as a starting point because triple A new model is not enabled
by default
on a Cisco router. So what does that mean? If we want to access a router, how
can we get in?
We get in on a console port. If we have a connection to our console port, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We get in on a console port. If we have a connection to our console port,
either physically or virtually,
that'd be one access method into the router, we could come in through the VTY
lines, and that'd
be through things like telnet, if we're using that still, or SSH, to remotely
connect to that device.
And so by default, a Cisco router on the console, there is no authentication
required. And that's
a good thing because on a brand new router, you need to start accessing it
somehow. And then on the
VTY lines, if we have an enabled secret configured on the router and we have IP
connectivity to that
device, we could also connect via the VTY lines with a tool like telnet or SSH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
device, we could also connect via the VTY lines with a tool like telnet or SSH.
Again,
presuming the router is configured with IP addressing and supports those
services. Now, one of the
other options we have here, before we're using triple A, is we could also go to
the VTY lines,
we could say log in local, and then we create local user accounts, and then use
those user
accounts for authenticating users as they're managing and working with the
router. Unfortunately,
though, if we have five or six administrators, and we have a whole bunch of
routers, it's a pain in
the butt to go ahead and update those passwords if they're changed on every WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the butt to go ahead and update those passwords if they're changed on every
single device. It'd
be much better to have some type of central management for login access,
including authentication and
authorization of what an administrator is allowed to do. So most companies of
any significant size,
instead of using local user accounts for authenticating administrators on the
routers and switches,
they're going to be using a centralized authentication server. So we clean this
up a little bit. And
that's when we bring triple A into the picture, including the command triple A
new model, which
says we want to start using some of these additional authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
says we want to start using some of these additional authentication
authorization and accounting
commands, leveraging a centralized authentication server. Now, I call it here
an authentication
server. Let's imagine that this server right here, server one nug is our
centralized authentication
server. Now there's lots of different ways we could have that do the
authentication, we could use
LDAP, that'd be one option for authenticating our users with lightweight
directory access protocol.
We could have a server that's running radius, and that'd be another way to do
authentication
centrally based on all these devices. We can also use Cisco's TACX plus. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
centrally based on all these devices. We can also use Cisco's TACX plus. So
prior, there was TACX
and X TACX and TACX plus, but currently what we're using is TACX plus, but we
just call it
TACX. And for pronunciation, think of it like TAC like a thumbtack and the word
fax like that, TACX. That's how you pronounce this acronym. And it basically
boils down to the
language of love that's going to be used between a client, for example, like
our six, that's going
to be using a TACX server and the communication that goes back and forth. So
what types of things
can we control when we're using a centralized authentication server? And for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can we control when we're using a centralized authentication server? And for
this discussion,
I'm going to focus on using a TACX server here at 192 once you get 1.100. What
can we do
with a centralized TACX server with all of these routers for centralized
management?
Well, one thing we can do is we can go ahead and we can authenticate logins.
Now that can be
logins to the console, which by default are going to be off. If we have triple
A new model enabled,
we can do authentication at the VTY lines, which if we enable triple A new
model is going to be
on by default. Another thing we can do is we can go ahead and we can do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authorization. An example
would be if we want to do authorization before we even give the user an exec
prompt, we can do
authorization of an exec prompt. Effectively, it's a shell authorization. If we
want to do
authorization for commands that they might try to issue, we can do that as well
. So if the user
logs in successfully right here and they start issuing commands, before this is
go router,
excuse those commands, it's going to check with a TACX server and say, Hey, he
's trying to he or
she is trying to do this command or that command. And then unless it gets a
message back from the
TACX server saying that's allowed, the router actually won't let it process. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
TACX server saying that's allowed, the router actually won't let it process.
Another thing that
we can do authorization for is once we're in configuration mode on a Cisco
router, by default,
even with triple A currently set up by default, the actual commands once in
configuration mode
are not checked with at the triple A server. So we could also go ahead and do
authorization of
each and every config command as well. So an example of the difference between
commands and
config commands would be show commands, for example, in privilege mode or
clearing a routing process,
would be another example of a command. And then config commands would be any of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would be another example of a command. And then config commands would be any of
the commands
that are done within configuration mode, things like creating a new loopback
interface or shutting
down a port or adding a routing protocol. And then for the accounting piece, we
can also send a
records regarding exactly what the users did as a history and reporting tool
for what those users
did when they were logged in. So for our discussion and this set of videos, we
're going to focus on
authentication, who the individual is, and what they're allowed to do. Are they
allowed to get an
exact shell? Are they allowed to issue commands? Are they allowed to issue
further configuration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
further configuration
commands? Now, because there's so many options and nerd knobs that we could
tweak in working with
triple A, let's talk about a few options for configuring the authentication and
the authorization
on a Cisco router. So let me clean some of this up and let's talk about that
next. Let's imagine
that we want to authenticate users when they connect to the console one way.
And we want to
authenticate users if they connect to the VTY lines, so what console zero here,
if they connect to the
VTY lines, we want to authenticate them a different way. How do we go about
that? Well, one way of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that? Well, one way of
implementing that is to create something called a method list. Think of a
method list as an object
says how I'm going to do this, for example, for authentication, we can make a
method list called
use tack. And for this method list that we name and name method list for use
tack, we could go and
specify that we want to use a tack X plus server. And then as a fallback, if
that tack X server is
not reachable, we could go ahead and specify another method, for example, like
a radius server,
presuming we have a radius server configured. And if that's not reachable, we
can have another
fallback. And we can say, for example, local, meaning the local configuration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
fallback. And we can say, for example, local, meaning the local configuration
on the router,
as a fallback method, if tack X and radius are both not reachable, then we can
apply this method
list called use tack to the console port. And that would control access to the
console for
authenticating logins. And for the VTY lines, maybe we make a second method
list, a different
method list called method two, it's just a name here. And for that method list,
perhaps we say we
want to use tack X plus similar to the first method list, but as a fallback, we
use local. And
we could actually create a third method list, let's call this method list three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could actually create a third method list, let's call this method list three
. And for that one,
maybe we don't want to use a remote server, but we want to go ahead and use the
local database,
meaning the local configuration on the router for authentication. So maybe we
have one specific
VTY line with a unique port configured that we want as a backup. And when we
connect to that
specific VTY line, it's going to use the local database. And then using the
specific method list,
based on the line that we want to connect to, we can control and use different
methods for the
authentication. And it's a similar process for authorization, we can make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authentication. And it's a similar process for authorization, we can make
method lists regarding
authorization as well. And one might use tack X plus, and then a radius and
local, a different
method list could use just tack X plus, and then a fallback of local, and a
different method list
for authorization could just use, for example, local. So the key is we create
our method list,
say how we want to do the authentication and or authorization. And then we
simply apply those
specific method lists to the areas, for example, line console zero, or the
auxiliary line, or the
VTY lines, where we want those methods applied. We also have the ability to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VTY lines, where we want those methods applied. We also have the ability to
configure details,
such as an authentication banner. So when a user logs on, we can provide a
specific banner,
we can provide specific error messages, we can also do lockouts. So if a user
fails a login
attempt, for example, three or four times, we can specify that that user is
locked out. And all
that configuration here is going to be done at the router. Now behind the
scenes, we have some other
amazing tools. Long time ago, we had ACS, the access control server, I'm dating
myself. And now
we have ice, the identity services engine, which has all the controls and bells WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we have ice, the identity services engine, which has all the controls and bells
and whistles to
identify what a user once they authenticate is allowed to do based on
authorization. And our
entire focus in this set of videos is to focus on the configuration here at the
routers themselves.
So at the end of the day, if we had a user named user one here on the server,
and we can figure
how that user was able to log in and what that user is able to do, once they're
logged in,
we could then apply our triplet configuration with centralized authentication
to router seven
and router five, router three, and router one. And then when the user logs into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and router five, router three, and router one. And then when the user logs into
any of these routers,
on the back end, they're all checking in and leveraging the triplet server for
the authentication
and authorization. So with that in mind, in the next video, I'd like to walk
you through some of the
basic starting positions for setting up authentication and it is local
authentication on a Cisco router.
So we'll do up the next video and I'll see you there in just a moment.