background image
372 Chapter 12: Using AAA to Scale Access Control in an Expanding Network
Foundation Topics
AAA Overview
AAA provides a method for setting up access control on a router. Access control provides a
means to declare who (authentication) can access the network, what (authorization) the users
can do, and what (tracking or accounting) the user has done. AAA provides a method to control
and configure these three independent security functions.
CiscoSecure ACS (Access Control Server) provides authentication, authorization, and
accounting and is used in many of the BCRAN classes as the AAA server. This does not mean
that CiscoSecure is the only AAA server. CiscoSecure is only one of the AAA server software
packages that is available. CiscoSecure comes bundled with the following:
·
AAA Server--This is the basic AAA functionality for authentication, authorization, and
accounting.
·
Netscape Fastrack Server--This piece of software provides an interface function to the
GUI Admin Client. Admin Client enables the administrator to manage the CiscoSecure
ACS database through Netscape or Internet Explorer. The Web-based interface enables
logins to the ACS database to perform system administrator tasks. ACS stores these
modifications in its relational database management system (RDBMS) (or in another
supported RDBMS).
·
An RDBMS--The ACS server can operate with an external RDBMS or the Oracle and
Sybase Enterprise database applications because it uses the open database connectivity
(ODBC) interface. The RDBMS that is bundled with the CiscoSecure package is
SQLAnywhere and is a nonscalable RDBMS.
Authentication
Authentication identifies users. During the authentication process, the user login (name) and
password are checked against the AAA database. Also, depending on the protocol, AAA
supports encryption.
Authentication determines who the user is. Passing the authentication test enables access to the
network. This process is only one of the components for user control with AAA. Once the
userid and password are accepted, AAA can be used to define what the user is then authorized
to do.