Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.1
Information about AAA
Downloads: This chapterpdf (PDF - 195.0KB) The complete bookPDF (PDF - 14.31MB) | The complete bookePub (ePub - 2.89MB) | The complete bookMobi (Mobi - 4.37MB) | Feedback

Table of Contents

Information About AAA

Authentication

Authorization

Accounting

Interaction Between Authentication, Authorization, and Accounting

AAA Servers

AAA Server Groups

Local Database Support

Summary of AAA Service Support

Information About AAA

This chapter describes authentication, authorization, and accounting (AAA, pronounced “triple A”). AAA is a a set of services for controlling access to computer resources, enforcing policies, assessing usage, and providing the information necessary to bill for services. These processes are considered important for effective network management and security.

This chapter includes the following sections:

Authentication

Authentication provides a way to identify a user, typically by having the user enter a valid username and valid password before access is granted. The AAA server compares a user's authentication credentials with other user credentials stored in a database. If the credentials match, the user is permitted access to the network. If the credentials do not match, authentication fails and network access is denied.

You can configure the ASA to authenticate the following items:

  • All administrative connections to the ASA, including the following sessions:

Telnet

SSH. For more information, see Chapter41, “Configuring Management Access”

Serial console

ASDM using HTTPS

VPN management access

Authorization

Authorization is the process of enforcing policies: determining what types of activities, resources, or services a user is permitted to access. After a user is authenticated, that user may be authorized for different types of access or activity.

You can configure the ASA to authorize the following items:

Accounting

Accounting measures the resources a user consumes during access, which may include the amount of system time or the amount of data that a user has sent or received during a session. Accounting is carried out through the logging of session statistics and usage information, which is used for authorization control, billing, trend analysis, resource utilization, and capacity planning activities.

Interaction Between Authentication, Authorization, and Accounting

You can use authentication alone or with authorization and accounting. Authorization always requires a user to be authenticated first. You can use accounting alone, or with authentication and authorization.

AAA Servers

The AAA server is a network server that is used for access control. Authentication identifies the user. Authorization implements policies that determine which resources and services an authenticated user may access. Accounting keeps track of time and data resources that are used for billing and analysis.

AAA Server Groups

If you want to use an external AAA server for authentication, authorization, or accounting, you must first create at least one AAA server group per AAA protocol and add one or more servers to each group. You identify AAA server groups by name. Each server group is specific to one type of server or service.

Local Database Support

The ASA maintains a local database that you can populate with user profiles. You can use a local database instead of AAA servers to provide user authentication, authorization, and accounting. For more information, see Chapter33, “Configuring the Local Database for AAA”

Summary of AAA Service Support

Table 32-1 provides cross-references to the configuration guide chapters that describe support for specific AAA service types.

 

Table 32-1 AAA Service Support

AAA Service
Configuration Guide Cross-Reference

Certificates

See Chapter40, “Configuring Digital Certificates”

HTTP Form

See “Configuring Clientless SSL VPN Users,” of the VPN configuration guide.

Identity Firewall

See Chapter38, “Configuring the Identity Firewall”

Kerberos

See the “Microsoft Kerberos Constrained Delegation Solution” of the VPN configuration guide.

LDAP

See Chapter36, “Configuring LDAP Servers for AAA”

Local Database

See Chapter33, “Configuring the Local Database for AAA”

NT

See Chapter37, “Configuring Windows NT Servers for AAA”

RADIUS

See Chapter34, “Configuring RADIUS Servers for AAA”

RSA/SDI

See the following chapters of the VPN configuration guide:

TACACS+

See Chapter35, “Configuring TACACS+ Servers for AAA”

TrustSec

See Chapter39, “Configuring the ASA to Integrate with Cisco TrustSec”