WEBVTT 1 00:00.000 --> 00:04.500 When it comes to authentication and authorization, we kind of think of it like 2 00:04.500 --> 00:05.520 walking into a bank. 3 00:05.520 --> 00:10.320 We walk into a bank and let's imagine we're a customer of the bank and we want 4 00:10.320 --> 00:10.640 to have a 5 00:10.640 --> 00:13.840 transaction or take out some money. The very first thing they're going to want 6 00:13.840 --> 00:15.120 us to do at this bank 7 00:15.120 --> 00:19.070 is they're going to want to know who we are. Silver likely will verify who we 8 00:19.070 --> 00:19.920 are with maybe 9 00:19.920 --> 00:24.410 one form of ID and maybe a bank card also. That'd be an example of two-factor 10 00:24.410 --> 00:25.520 authentication, 11 00:25.520 --> 00:28.690 something that we have. And if that bank card required a pin, that'd be 12 00:28.690 --> 00:29.600 something that we know, 13 00:29.920 --> 00:33.340 and then once they know who we are, we then would be authorized or not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:29.920 --> 00:33.340 and then once they know who we are, we then would be authorized or not 14 00:33.340 --> 00:34.560 authorized to make a 15 00:34.560 --> 00:38.560 transaction, for example, to take out a bunch of money or take out a little bit 16 00:38.560 --> 00:39.520 of money based on 17 00:39.520 --> 00:42.640 what we have in our account. So for the authorization piece, I'm going to call 18 00:42.640 --> 00:43.840 that permissions. Are we 19 00:43.840 --> 00:46.720 allowed to do it? And then the third element is going to happen also once we 20 00:46.720 --> 00:47.520 take out the money 21 00:47.520 --> 00:51.020 or make a deposit, whatever our transaction is, they're also going to go ahead 22 00:51.020 --> 00:51.600 and make a record 23 00:51.600 --> 00:55.700 of it and that's accounting. And so authentication, authorization, and 24 00:55.700 --> 00:57.280 accounting is the three A's 25 00:57.280 --> 01:01.440 that make up AAA. Who are you? What are you allowed to do? And what did you do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:57.280 --> 01:01.440 that make up AAA. Who are you? What are you allowed to do? And what did you do 26 01:01.440 --> 01:02.480 with accounting records? 27 01:02.480 --> 01:05.540 And in this set of videos, we're going to focus on authentication and 28 01:05.540 --> 01:06.320 authorization 29 01:06.320 --> 01:10.590 regarding access and working with our Cisco devices. So let me clean this up a 30 01:10.590 --> 01:11.040 little bit. 31 01:11.040 --> 01:14.640 And then we also chat with you about why authentication and authorization are 32 01:14.640 --> 01:15.760 very near and dear to 33 01:15.760 --> 01:21.110 my heart. When I was working on my second CCIA for security with Cisco, I had 34 01:21.110 --> 01:22.880 the unfortunate incident 35 01:23.600 --> 01:28.880 locking myself out of my own router. And unfortunately, the only way around it 36 01:28.880 --> 01:29.840 was to power it off. 37 01:29.840 --> 01:33.170 That was back in the days when we had physical gear, physical racks there. I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:29.840 --> 01:33.170 That was back in the days when we had physical gear, physical racks there. I 38 01:33.170 --> 01:34.400 had to power it off, 39 01:34.400 --> 01:38.480 power it back on, and then pick up my configurations where I left out because 40 01:38.480 --> 01:39.920 fortunately, I had not 41 01:39.920 --> 01:43.400 saved my config to start up config. And as a result, when it booted back, I 42 01:43.400 --> 01:44.720 just had to replace the 43 01:44.720 --> 01:48.850 configs I did up to that point minus the part where I messed up and got the 44 01:48.850 --> 01:49.920 authentication 45 01:49.920 --> 01:53.930 authorization incorrect on the console port, which was my main access to this 46 01:53.930 --> 01:54.560 router. 47 01:54.560 --> 01:58.870 So as we talked about triple A, we could spend literally a whole day talking 48 01:58.870 --> 02:00.560 about the thousands, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 48 01:58.870 --> 02:00.560 about the thousands, 49 02:00.560 --> 02:05.140 no lie, thousands of options that we can configure regarding triple A. But my 50 02:05.140 --> 02:05.520 goal, 51 02:05.520 --> 02:09.510 this set of videos for us is to understand the basics, to see some of those 52 02:09.510 --> 02:10.640 basics in action, 53 02:10.640 --> 02:14.340 and then put you on a hands-on lab at the tail end so you can practice and 54 02:14.340 --> 02:15.520 reinforce the skills 55 02:15.520 --> 02:19.230 and configuration that we're talking about in this set of videos. So let's go 56 02:19.230 --> 02:20.240 ahead and start off 57 02:20.240 --> 02:24.640 with no triple A as a starting point because triple A new model is not enabled 58 02:24.640 --> 02:25.360 by default 59 02:25.360 --> 02:28.720 on a Cisco router. So what does that mean? If we want to access a router, how 60 02:28.720 --> 02:29.280 can we get in? 61 02:29.280 --> 02:32.940 We get in on a console port. If we have a connection to our console port, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 61 02:29.280 --> 02:32.940 We get in on a console port. If we have a connection to our console port, 62 02:32.940 --> 02:34.160 either physically or virtually, 63 02:34.160 --> 02:38.000 that'd be one access method into the router, we could come in through the VTY 64 02:38.000 --> 02:38.640 lines, and that'd 65 02:38.640 --> 02:43.090 be through things like telnet, if we're using that still, or SSH, to remotely 66 02:43.090 --> 02:44.640 connect to that device. 67 02:44.640 --> 02:48.960 And so by default, a Cisco router on the console, there is no authentication 68 02:48.960 --> 02:49.680 required. And that's 69 02:49.680 --> 02:52.840 a good thing because on a brand new router, you need to start accessing it 70 02:52.840 --> 02:53.840 somehow. And then on the 71 02:53.840 --> 02:57.460 VTY lines, if we have an enabled secret configured on the router and we have IP 72 02:57.460 --> 02:58.400 connectivity to that 73 02:58.400 --> 03:03.280 device, we could also connect via the VTY lines with a tool like telnet or SSH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 73 02:58.400 --> 03:03.280 device, we could also connect via the VTY lines with a tool like telnet or SSH. 74 03:03.280 --> 03:03.520 Again, 75 03:03.520 --> 03:07.200 presuming the router is configured with IP addressing and supports those 76 03:07.200 --> 03:08.320 services. Now, one of the 77 03:08.320 --> 03:11.780 other options we have here, before we're using triple A, is we could also go to 78 03:11.780 --> 03:12.480 the VTY lines, 79 03:12.480 --> 03:16.790 we could say log in local, and then we create local user accounts, and then use 80 03:16.790 --> 03:17.360 those user 81 03:17.360 --> 03:20.460 accounts for authenticating users as they're managing and working with the 82 03:20.460 --> 03:21.520 router. Unfortunately, 83 03:21.520 --> 03:25.470 though, if we have five or six administrators, and we have a whole bunch of 84 03:25.470 --> 03:26.880 routers, it's a pain in 85 03:26.880 --> 03:31.240 the butt to go ahead and update those passwords if they're changed on every WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 03:26.880 --> 03:31.240 the butt to go ahead and update those passwords if they're changed on every 86 03:31.240 --> 03:32.480 single device. It'd 87 03:32.480 --> 03:37.080 be much better to have some type of central management for login access, 88 03:37.080 --> 03:39.120 including authentication and 89 03:39.120 --> 03:43.040 authorization of what an administrator is allowed to do. So most companies of 90 03:43.040 --> 03:44.160 any significant size, 91 03:44.160 --> 03:47.570 instead of using local user accounts for authenticating administrators on the 92 03:47.570 --> 03:48.640 routers and switches, 93 03:48.640 --> 03:52.430 they're going to be using a centralized authentication server. So we clean this 94 03:52.430 --> 03:54.080 up a little bit. And 95 03:54.080 --> 03:58.040 that's when we bring triple A into the picture, including the command triple A 96 03:58.040 --> 03:58.960 new model, which 97 03:58.960 --> 04:02.120 says we want to start using some of these additional authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 03:58.960 --> 04:02.120 says we want to start using some of these additional authentication 98 04:02.120 --> 04:03.520 authorization and accounting 99 04:03.520 --> 04:07.250 commands, leveraging a centralized authentication server. Now, I call it here 100 04:07.250 --> 04:08.160 an authentication 101 04:08.160 --> 04:11.400 server. Let's imagine that this server right here, server one nug is our 102 04:11.400 --> 04:12.640 centralized authentication 103 04:12.640 --> 04:15.530 server. Now there's lots of different ways we could have that do the 104 04:15.530 --> 04:16.800 authentication, we could use 105 04:16.800 --> 04:20.430 LDAP, that'd be one option for authenticating our users with lightweight 106 04:20.430 --> 04:22.160 directory access protocol. 107 04:22.160 --> 04:25.740 We could have a server that's running radius, and that'd be another way to do 108 04:25.740 --> 04:26.640 authentication 109 04:26.640 --> 04:31.040 centrally based on all these devices. We can also use Cisco's TACX plus. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 04:26.640 --> 04:31.040 centrally based on all these devices. We can also use Cisco's TACX plus. So 110 04:31.040 --> 04:32.480 prior, there was TACX 111 04:32.480 --> 04:37.390 and X TACX and TACX plus, but currently what we're using is TACX plus, but we 112 04:37.390 --> 04:38.000 just call it 113 04:38.000 --> 04:43.440 TACX. And for pronunciation, think of it like TAC like a thumbtack and the word 114 04:43.440 --> 04:47.730 fax like that, TACX. That's how you pronounce this acronym. And it basically 115 04:47.730 --> 04:48.320 boils down to the 116 04:48.320 --> 04:52.020 language of love that's going to be used between a client, for example, like 117 04:52.020 --> 04:52.800 our six, that's going 118 04:52.800 --> 04:56.300 to be using a TACX server and the communication that goes back and forth. So 119 04:56.300 --> 04:57.120 what types of things 120 04:57.120 --> 05:00.780 can we control when we're using a centralized authentication server? And for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 120 04:57.120 --> 05:00.780 can we control when we're using a centralized authentication server? And for 121 05:00.780 --> 05:01.600 this discussion, 122 05:01.600 --> 05:06.220 I'm going to focus on using a TACX server here at 192 once you get 1.100. What 123 05:06.220 --> 05:06.880 can we do 124 05:06.880 --> 05:10.590 with a centralized TACX server with all of these routers for centralized 125 05:10.590 --> 05:11.440 management? 126 05:11.440 --> 05:15.650 Well, one thing we can do is we can go ahead and we can authenticate logins. 127 05:15.650 --> 05:16.080 Now that can be 128 05:16.080 --> 05:20.560 logins to the console, which by default are going to be off. If we have triple 129 05:20.560 --> 05:21.520 A new model enabled, 130 05:21.520 --> 05:25.610 we can do authentication at the VTY lines, which if we enable triple A new 131 05:25.610 --> 05:26.560 model is going to be 132 05:26.560 --> 05:30.000 on by default. Another thing we can do is we can go ahead and we can do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 133 05:30.000 --> 05:31.360 authorization. An example 134 05:31.360 --> 05:34.820 would be if we want to do authorization before we even give the user an exec 135 05:34.820 --> 05:35.760 prompt, we can do 136 05:35.760 --> 05:40.260 authorization of an exec prompt. Effectively, it's a shell authorization. If we 137 05:40.260 --> 05:40.720 want to do 138 05:40.720 --> 05:45.020 authorization for commands that they might try to issue, we can do that as well 139 05:45.020 --> 05:45.920 . So if the user 140 05:45.920 --> 05:49.860 logs in successfully right here and they start issuing commands, before this is 141 05:49.860 --> 05:50.320 go router, 142 05:50.320 --> 05:53.730 excuse those commands, it's going to check with a TACX server and say, Hey, he 143 05:53.730 --> 05:54.560 's trying to he or 144 05:54.560 --> 05:57.830 she is trying to do this command or that command. And then unless it gets a 145 05:57.830 --> 05:58.720 message back from the 146 05:58.720 --> 06:02.660 TACX server saying that's allowed, the router actually won't let it process. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 146 05:58.720 --> 06:02.660 TACX server saying that's allowed, the router actually won't let it process. 147 06:02.660 --> 06:03.040 Another thing that 148 06:03.040 --> 06:07.330 we can do authorization for is once we're in configuration mode on a Cisco 149 06:07.330 --> 06:08.480 router, by default, 150 06:08.480 --> 06:12.840 even with triple A currently set up by default, the actual commands once in 151 06:12.840 --> 06:14.080 configuration mode 152 06:14.080 --> 06:17.880 are not checked with at the triple A server. So we could also go ahead and do 153 06:17.880 --> 06:18.960 authorization of 154 06:18.960 --> 06:22.800 each and every config command as well. So an example of the difference between 155 06:22.800 --> 06:23.280 commands and 156 06:23.280 --> 06:27.600 config commands would be show commands, for example, in privilege mode or 157 06:27.600 --> 06:29.200 clearing a routing process, 158 06:29.200 --> 06:32.590 would be another example of a command. And then config commands would be any of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 158 06:29.200 --> 06:32.590 would be another example of a command. And then config commands would be any of 159 06:32.590 --> 06:32.880 the commands 160 06:32.880 --> 06:36.260 that are done within configuration mode, things like creating a new loopback 161 06:36.260 --> 06:37.120 interface or shutting 162 06:37.120 --> 06:40.350 down a port or adding a routing protocol. And then for the accounting piece, we 163 06:40.350 --> 06:41.040 can also send a 164 06:41.040 --> 06:46.180 records regarding exactly what the users did as a history and reporting tool 165 06:46.180 --> 06:47.040 for what those users 166 06:47.040 --> 06:49.980 did when they were logged in. So for our discussion and this set of videos, we 167 06:49.980 --> 06:51.280 're going to focus on 168 06:51.280 --> 06:54.980 authentication, who the individual is, and what they're allowed to do. Are they 169 06:54.980 --> 06:55.600 allowed to get an 170 06:55.600 --> 06:59.550 exact shell? Are they allowed to issue commands? Are they allowed to issue 171 06:59.550 --> 07:00.320 further configuration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 06:59.550 --> 07:00.320 further configuration 172 07:00.320 --> 07:04.120 commands? Now, because there's so many options and nerd knobs that we could 173 07:04.120 --> 07:05.200 tweak in working with 174 07:05.200 --> 07:09.570 triple A, let's talk about a few options for configuring the authentication and 175 07:09.570 --> 07:10.720 the authorization 176 07:10.720 --> 07:14.550 on a Cisco router. So let me clean some of this up and let's talk about that 177 07:14.550 --> 07:15.600 next. Let's imagine 178 07:15.600 --> 07:20.310 that we want to authenticate users when they connect to the console one way. 179 07:20.310 --> 07:20.880 And we want to 180 07:20.880 --> 07:24.560 authenticate users if they connect to the VTY lines, so what console zero here, 181 07:24.560 --> 07:25.280 if they connect to the 182 07:25.280 --> 07:28.850 VTY lines, we want to authenticate them a different way. How do we go about 183 07:28.850 --> 07:30.320 that? Well, one way of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 07:28.850 --> 07:30.320 that? Well, one way of 184 07:30.320 --> 07:34.120 implementing that is to create something called a method list. Think of a 185 07:34.120 --> 07:35.440 method list as an object 186 07:35.440 --> 07:39.690 says how I'm going to do this, for example, for authentication, we can make a 187 07:39.690 --> 07:40.800 method list called 188 07:40.800 --> 07:44.670 use tack. And for this method list that we name and name method list for use 189 07:44.670 --> 07:45.680 tack, we could go and 190 07:45.680 --> 07:49.600 specify that we want to use a tack X plus server. And then as a fallback, if 191 07:49.600 --> 07:51.040 that tack X server is 192 07:51.040 --> 07:54.490 not reachable, we could go ahead and specify another method, for example, like 193 07:54.490 --> 07:55.200 a radius server, 194 07:55.200 --> 07:58.390 presuming we have a radius server configured. And if that's not reachable, we 195 07:58.390 --> 07:58.880 can have another 196 07:58.880 --> 08:02.880 fallback. And we can say, for example, local, meaning the local configuration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 196 07:58.880 --> 08:02.880 fallback. And we can say, for example, local, meaning the local configuration 197 08:02.880 --> 08:03.840 on the router, 198 08:03.840 --> 08:08.320 as a fallback method, if tack X and radius are both not reachable, then we can 199 08:08.320 --> 08:08.960 apply this method 200 08:08.960 --> 08:13.470 list called use tack to the console port. And that would control access to the 201 08:13.470 --> 08:14.160 console for 202 08:14.160 --> 08:17.520 authenticating logins. And for the VTY lines, maybe we make a second method 203 08:17.520 --> 08:18.240 list, a different 204 08:18.240 --> 08:22.160 method list called method two, it's just a name here. And for that method list, 205 08:22.160 --> 08:23.360 perhaps we say we 206 08:23.360 --> 08:27.760 want to use tack X plus similar to the first method list, but as a fallback, we 207 08:27.760 --> 08:28.480 use local. And 208 08:28.480 --> 08:31.550 we could actually create a third method list, let's call this method list three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 208 08:28.480 --> 08:31.550 we could actually create a third method list, let's call this method list three 209 08:31.550 --> 08:32.320 . And for that one, 210 08:32.320 --> 08:36.530 maybe we don't want to use a remote server, but we want to go ahead and use the 211 08:36.530 --> 08:37.440 local database, 212 08:37.440 --> 08:40.390 meaning the local configuration on the router for authentication. So maybe we 213 08:40.390 --> 08:41.440 have one specific 214 08:41.440 --> 08:46.020 VTY line with a unique port configured that we want as a backup. And when we 215 08:46.020 --> 08:46.720 connect to that 216 08:46.720 --> 08:49.970 specific VTY line, it's going to use the local database. And then using the 217 08:49.970 --> 08:51.280 specific method list, 218 08:51.280 --> 08:55.300 based on the line that we want to connect to, we can control and use different 219 08:55.300 --> 08:56.000 methods for the 220 08:56.000 --> 09:00.450 authentication. And it's a similar process for authorization, we can make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 220 08:56.000 --> 09:00.450 authentication. And it's a similar process for authorization, we can make 221 09:00.450 --> 09:01.760 method lists regarding 222 09:01.760 --> 09:06.090 authorization as well. And one might use tack X plus, and then a radius and 223 09:06.090 --> 09:07.040 local, a different 224 09:07.040 --> 09:10.850 method list could use just tack X plus, and then a fallback of local, and a 225 09:10.850 --> 09:11.680 different method list 226 09:11.680 --> 09:15.430 for authorization could just use, for example, local. So the key is we create 227 09:15.430 --> 09:16.240 our method list, 228 09:16.240 --> 09:20.320 say how we want to do the authentication and or authorization. And then we 229 09:20.320 --> 09:21.040 simply apply those 230 09:21.040 --> 09:25.320 specific method lists to the areas, for example, line console zero, or the 231 09:25.320 --> 09:26.800 auxiliary line, or the 232 09:26.800 --> 09:31.150 VTY lines, where we want those methods applied. We also have the ability to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 232 09:26.800 --> 09:31.150 VTY lines, where we want those methods applied. We also have the ability to 233 09:31.150 --> 09:32.400 configure details, 234 09:32.400 --> 09:36.030 such as an authentication banner. So when a user logs on, we can provide a 235 09:36.030 --> 09:37.040 specific banner, 236 09:37.040 --> 09:41.590 we can provide specific error messages, we can also do lockouts. So if a user 237 09:41.590 --> 09:42.480 fails a login 238 09:42.480 --> 09:45.850 attempt, for example, three or four times, we can specify that that user is 239 09:45.850 --> 09:46.800 locked out. And all 240 09:46.800 --> 09:49.910 that configuration here is going to be done at the router. Now behind the 241 09:49.910 --> 09:51.600 scenes, we have some other 242 09:51.600 --> 09:56.820 amazing tools. Long time ago, we had ACS, the access control server, I'm dating 243 09:56.820 --> 09:57.760 myself. And now 244 09:57.760 --> 10:02.010 we have ice, the identity services engine, which has all the controls and bells WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 244 09:57.760 --> 10:02.010 we have ice, the identity services engine, which has all the controls and bells 245 10:02.010 --> 10:03.040 and whistles to 246 10:03.040 --> 10:06.550 identify what a user once they authenticate is allowed to do based on 247 10:06.550 --> 10:07.920 authorization. And our 248 10:07.920 --> 10:12.470 entire focus in this set of videos is to focus on the configuration here at the 249 10:12.470 --> 10:13.680 routers themselves. 250 10:13.680 --> 10:19.310 So at the end of the day, if we had a user named user one here on the server, 251 10:19.310 --> 10:20.240 and we can figure 252 10:20.240 --> 10:23.640 how that user was able to log in and what that user is able to do, once they're 253 10:23.640 --> 10:24.160 logged in, 254 10:24.160 --> 10:27.720 we could then apply our triplet configuration with centralized authentication 255 10:27.720 --> 10:28.640 to router seven 256 10:28.640 --> 10:32.240 and router five, router three, and router one. And then when the user logs into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 256 10:28.640 --> 10:32.240 and router five, router three, and router one. And then when the user logs into 257 10:32.240 --> 10:33.040 any of these routers, 258 10:33.040 --> 10:37.040 on the back end, they're all checking in and leveraging the triplet server for 259 10:37.040 --> 10:37.840 the authentication 260 10:37.840 --> 10:41.520 and authorization. So with that in mind, in the next video, I'd like to walk 261 10:41.520 --> 10:42.240 you through some of the 262 10:42.240 --> 10:46.390 basic starting positions for setting up authentication and it is local 263 10:46.390 --> 10:48.480 authentication on a Cisco router. 264 10:48.480 --> 10:52.000 So we'll do up the next video and I'll see you there in just a moment.