AAA Authentication, Authorization, and Accounting Difference between Authentication (AuthC) and Authorization (AuthZ) AuthC tells the server who I am e.g. Rick McGee AuthZ serve tells me what I'm allowed to do e.g. Make a change to an interface = Yes/No Local Users With Role Based Access Control (RBAC) RADIUS Users (can use TACACS+ as well) On a N7K, network-admin assumes vdc-admin role upon a "switchto" a different VDC as well as network-operator to vdc-operator If you happen to look yourself out of the another VDC you can always log into the default VDC to change that password (like a backdoor) RBAC Uses a multi-level access for local users Limits the commands that can be run by a user in NX-OS Can be handed down form RADIUS Can limit the domain in which a user can make changes E.g. Only within specific VRF's Only within specific VLAN's Only within specific Interfaces SNMPv3 Same as SNMPv2, except the addition of cryptographic security SNMPv1,v2 only used a simple clear-text password (community string) SNMPv2 message contains security parameters which are encoded as an octet string Confidentiality- Encryption of packets Integrity- Message integrity to ensure that a packet has not been tampered within transit Authentication- Who is making the request/response sh run | in user  Configuration username "xxxxxxx" pass "xxxxxxx" role vdc-operator  show role  You also have priv-0 - priv-15 just like in IOS You can also create your own role with "role name XXXXX" This you can get very granular with with following attributes  can configured rules under the role command syntax (config-role)  You can create 256 rules per role assign role to user Contractor user Contractor pass cisco role SHOW-INT conf t radius-server host 192.168.0.xxx key cisco123 aaa group server radius ISE (this will put you in the (config-radius) prompt) server 192.168.0.xxx use-vfr management exit aaa authentication login default group ISE aaa authentication login default fallback error local (local DB on switch) snmp-server host x.x.x.x version 3 ? this can be: auth Use the SNMPv3 authNoPriv Security Level noauth Use the SNMPv3 noAuthNoPriv Security level priv Use the SNMPv3 AuthPriv Security level snmp-server user xxxx auth md5 cisco priv cisco snmp-server host x.x.x.x use-vrf management |
Blog >