Groups of AAA servers

• By default, Cisco ios automatically groups RADIUS & TACACS+ servers configured with the radius-server host & tacacs-server host commands into groups
• The aaa authentication command includes the keyword group radius or group tacacs+ to refer to these default groups.
• By default, all defined RADIUS servers end up in the radius group, and all defined TACACS+ servers end up in the tacacs+ group.
• In case of large servers, make different sets of RADIUS or TACACS+ servers.
• servers can be grouped by name using the command
•  aaa authentication enable default group fred local
• aaa authentication login default group fred none

Authentication Methods for login & enable

METHODE	MEANING
Group radius	Use the configured RADIUS servers
Group tacacs+	Use the configured TACACS+ servers
Group name	Use a defined group of either RADIUS or TACACS+ servers
Enable	Use the enable password, based on enable secret or enable password commands
Line	Use the password defined by the password command in line configuration mode
Local	Use username commands in the local configuration (username is case insensitive but password is case sensitive)
Local-case	Use username commands in the local configuration (both username & password are case sensitive)
None	No authentication required, user automatically authenticated

Using Multiple Authentication Methods

• AAA authentication allow multiple servers & multiple authentication methods.
• So user can be authenticated even if one authentication method is not working.
• The aaa authentication command supports up to four methods on a single command.
• No limit to the number of RADIUS or TACACS+ servers that can be referenced.
• Logic used by IOS when using these methods are:
• Based on the 1st listed method first, if that methode not respond, move to the next & then next & so on until a method responds. Use the first- responding-server's decision (allow or reject).
• If no response occurs for any method, reject the request.
• 
  

Default Authentication Methodes

• General steps:
• enable AAA authentication with the aaa new-model global command.
• If using RADIUS or TACACS+, define the ip addresses & encryption keys used by servers by using the following  commands.
• radius-server host, 
• radius-server key, 
• tacacs-server host 
• tacacs-server key 
• Define the default set of authentication methodes used for all CLI access by using command
• aaa authentication login default
• Define the default set of authentication method used for enable-mode access by using command
• aaa authentication enable default
• For example by using above steps configure 2 RADIUS servers are configured.
• One of the serveres uses ios default port 1645
• Other one uses the reserved well known port 1812.

AAA: AUTHENTICATION

• AAA Refers to a variety of common security features.
• AAA: Authentication, Authorization & Accounting
• The strongest authentication method to protect CLI are:
• TACACS+ 
• RADIUS server 
• The Cisco Secure Access Control Server (ACS) 
• It is a cisco systems software product
• It can be installed on unix, linux & several windows platforms.
• It holds a set of usernames & passwords used for authentication
• Routers & Switches send Usernames & passwords from users are sent to server in encrypted manner.
• 
  

• 	RADIUS	TACACS+
  Scope of Encryption: Packet payload or just the password	Password only	Entire Payload
  Layer 4 Protocol	UDP	TCP
  Well-known Port/IOS default port used for authentication	1812/1645	49/49
  Standard or CISCO Proprietary	RFC 2865	Proprietary