21-3
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 21 Configuring Switch Access Using AAA
Understanding How Authentication Works
Understanding How Authentication Works
controls access to network devices by exchanging Network Access Server (NAS)
information between a network device and a centralized database to determine the identity of a user or
an entity. is an enhanced version of TACACS, a User Datagram Protocol (UDP)-based
access-control protocol specified by RFC 1492. uses TCP to ensure reliable delivery and
encrypt all traffic between the server and the daemon on a network device.
works with many authentication types, including fixed password, one-time password, and
challenge-response authentication. authentication usually occurs in these instances:
•
When you first log on to a machine
•
When you send a service request that requires privileged access
When you request privileged or restricted services, encrypts your user password information
using the MD5 encryption algorithm and adds a packet header. This header information
identifies the packet type being sent (for example, an authentication packet), the packet sequence
number, the encryption type used, and the total packet length. The protocol then forwards
the packet to the server.
A server can provide authentication, authorization, and accounting functions. These
services, while all part of , are independent of one another, so a given
configuration can use any or all of the three services.
When the server receives the packet, it does the following:
•
Authenticates the user information and notifies the client that authentication has either passed or
failed.
•
Notifies the client that authentication will continue and that the client must provide additional
information. This challenge-response process can continue through multiple iterations until
authentication either passes or fails.
You can configure a key on the client and server. If you configure a key on the switch, it
must be the same as the one configured on the servers. The clients and servers
use the key to encrypt all packets transmitted. If you do not configure a key,
packets are not encrypted.
You can configure the following parameters on the switch:
•
Enable or disable authentication to determine if a user has permission to access the
switch
•
Enable or disable authentication to determine if a user has permission to enter privileged
mode
•
Specify a key used to encrypt the protocol packets
•
Specify the server on which the server daemon resides
•
Set the number of login attempts allowed
•
Set the timeout interval for server daemon response
•
Enable or disable the directed-request option
authentication is disabled by default. You can enable authentication and local
authentication at the same time.
When local authentication is disabled, if you disable all other authentication methods, local
authentication is reenabled automatically.
