cisco certification network

cisco certification network.4.10 Implementation of Identity and Access Control Mechanisms There are several methods, techniques, and protocols available to implement identity and access control. This section will explore the implementation of several common identity and access control mechanisms.4.10.1 Authentication, Authorization, and Bookkeeping Protocols There are several protocols that can be used to grant users access to a network or system, to provide information related to access rights, and, after successful authentication and authorization, to monitor, audit, and bookkeep the user's actions. Such a protocol is called an authentication, authorization, and accounting (AAA) protocol. Some of the better known AAA protocols include RADIUS, TACACS+, and Diametero The following section provides background information on these three protocols.The RADIUS protocol Remote Authentication Dial.In User Service (RADIUS) protocol is an AAA protocol whose primary purpose is to provide network access (access) services. Because it is exceptionally flexible, the protocol is also widely used in scenarios other than network access. The authentication and authorization functions of the RADIUS protocol are defined in RFC 2865, and the accounting functions are defined in RFC 2866o RADIUS is a client server protocol. In RADIUS protocol jargon, a client is an access server, an entity that receives access requests from users, and a server is typically a computer running a RADIUS service that provides authentication and authorization responses that contain all the information the access server uses to provide services to users. A RADIUS server can act as a proxy device for other RADIUS servers or other authentication systems. In addition, the RADIUS protocol supports multiple authentication mechanisms, such as PPPPAP, CHAP, and EAP. the RADIUS protocol can also be extended through the attribute fields of its protocol messages. For example, network device vendors can use the RADIUS protocol message'svendor.specific (type 26) attribute of a RADIUS protocol message to convey vendor-specific information. An example of a typical RADIUS server deployment is shown in Figure 4-12.Figure 4-12 How a RADIUS server is deployed In most cases, the RADIUS server performs authentication and authorization functions over UDP port 1812,4.10 Implementation of the Identity and Access Control Mechanism 203exercising accounting functions through port 1813, both of which are officially assigned RADIUS service port numbers. Earlier RADIUS implementations exercised authentication and authorization functions over UDP port 1645 and bookkeeping functions over port 1646. During the authentication and authorization phases, the following types of RADIUS protocol messages are involved.1. The access server sends anThe RADIUS server sends an ACCESS-REQUEST message containing the user's identity, password, and other information (for example, IP address) related to the host to which the user is requesting access.2. The RADIUS server can reply to the following 3 different RADIUS protocol messages.