User's Manual

109
Users Manual of CS-6306R
Chapter 6. Security Configuration
AAAConfiguration 6.1
6.1.1 AAA Overview
Access control is the way to control access to the network and services. Authentication, authorization, and
accounting (AAA) network security services provide the primary framework through which you set up access
control on your router or access server.
6.1.1.1 AAA Security Service
AAA is an architectural framework for configuring a set of three independent security functions in a consistent
manner. AAA provides a modular way of performing the following services:
• Authentication -- Provides the method of identifying users, including login and password dialog, challenge
and response, messaging support, and, depending on the security protocol you select, encryption.
Authentication is the way a user is identified prior to being allowed access to the network and network
services. You configure AAA authentication by defining a named list of authentication methods, and then
applying that list to various interfaces. The method list defines the types of authentication to be performed and
the sequence in which they will be performed; it must be applied to a specific interface before any of the
defined authentication methods will be performed. The only exception is the default method list (which is
named "default"). The default method list is automatically applied to all interfaces if no other method list is
defined. A defined method list overrides the default method list.
All authentication methods, except for local, line password, and enable authentication, must be defined
through AAA. For information about configuring all authentication methods, including those implemented
outside of the AAA security services, refer to the chapter "Configuring Authentication."
• Authorization -- Provides the method for remote access control, including one-time authorization or
authorization for each service, per-user account list and profile, user group support, and support of IP, IPX,
ARA, and Telnet.
AAA authorization works by assembling a set of attributes that describe what the user is authorized to perform.
These attributes are compared to the information contained in a database for a given user and the result is
returned to AAA to determine the user's actual capabilities and restrictions. The database can be located
locally on the access server or router or it can be hosted remotely on a RADIUS or TACACS+ security server.
Remote security servers, such as RADIUS and TACACS+, authorize users for specific rights by associating
attribute-value (AV) pairs, which define those rights with the appropriate user. All authorization methods must
be defined through AAA.