Default Authentication Methodes

• General steps:
• enable AAA authentication with the aaa new-model global command.
• If using RADIUS or TACACS+, define the ip addresses & encryption keys used by servers by using the following  commands.
• radius-server host, 
• radius-server key, 
• tacacs-server host 
• tacacs-server key 
• Define the default set of authentication methodes used for all CLI access by using command
• aaa authentication login default
• Define the default set of authentication method used for enable-mode access by using command
• aaa authentication enable default
• For example by using above steps configure 2 RADIUS servers are configured.
• One of the serveres uses ios default port 1645
• Other one uses the reserved well known port 1812.

AAA: AUTHENTICATION

• AAA Refers to a variety of common security features.
• AAA: Authentication, Authorization & Accounting
• The strongest authentication method to protect CLI are:
• TACACS+ 
• RADIUS server 
• The Cisco Secure Access Control Server (ACS) 
• It is a cisco systems software product
• It can be installed on unix, linux & several windows platforms.
• It holds a set of usernames & passwords used for authentication
• Routers & Switches send Usernames & passwords from users are sent to server in encrypted manner.
• 
  

• 	RADIUS	TACACS+
  Scope of Encryption: Packet payload or just the password	Password only	Entire Payload
  Layer 4 Protocol	UDP	TCP
  Well-known Port/IOS default port used for authentication	1812/1645	49/49
  Standard or CISCO Proprietary	RFC 2865	Proprietary

SSH: SECURE SHELL PROTOCOL

• telnet traffic is sent in a clear text way, so it is not secure.
• It is a client/server protocol that encrypt the traffic in and out through vty ports.
• By default cisco router & switches act as SSH clients.
• To make CISCO router & switches act as SSH servers they must be configured.
• Authentications is required to connect clients.
• This authentication can be username & password or authentication with a AAA server .
• There are 2 versions in SSH
• Version 2 more secure than the Version 1.
• Cisco devices supports both versions.
• Must specify which version u want use.
• Configuring basic SSH Server requires following steps:
• Check IOS support ssh or not.
• Configure a host name (if already config leave it)
• Config a domain name. (if already  config leave  it)
• Config a client authentication method.
• Router or Switch generate RSA keys that will be used to encrypt the session.
• specify the SSH version, if u want to use version 2.
• Disable telnet on the VTY lines.
• Enable SSH on the VTY lines.
• 
  

SECUIRITY

• 3 Modes to access the user mode is:
• CONSOLE
• AUX
• TELNET
• Simple user mode CLI password protection
• line con 0
•   login
•   password cisco
• line vty 0 15
•   login
•   password cisco
• these passwords are stored as clear text in the configuration
• these passwords are encrypted by  service password-encryption command
• service password-encryption
• line console 0
•     password 7 "type pass here"
•    login
• line vty 0 4
•     password 7 "type pass here"
•     login
• after service password-encryption command is added to configuration, all clear text passwords in the running configuration are changed to an encrypted value.
• Untill copy run start , passwords in startup config are not encrypted.
• no service password-encryption command cannot automatically decrypt the encrypted passwords.
• This type encryption is weak, using some public tools can easily decrypt the passwords.

PIM-DM

PIM- Dense Mode:

• used in a situation:
• networks where many multicast clients are tightly spaced together in small networks.