2.5Device management access

Operating routers, switches, and WLCs means choosing a safe path to each device's CLI or GUI and controlling who may log in there. CCNA tests the difference between in-band and out-of-band access, when to use cleartext Telnet versus encrypted SSH, and the characteristics of TACACS+ and RADIUS, which centralize AAA on an external authentication server instead of giving each device its own local users—all from a configuration and security standpoint.

2.5.1Console, Telnet, SSH, and HTTP(S)

• The console is out-of-band access into the CLI via a cable directly attached to the device's console port. It works even with no network connectivity, making it the last resort for initial setup and recovery. Configured under line console 0.
• Telnet (TCP 23) reaches the CLI over the network (in-band), but sends username, password, and all activity in cleartext, so it is extremely vulnerable to eavesdropping and is discouraged. SSH (TCP 22) is also in-band but encrypts the entire session, so remote management must use SSH. On the VTY lines (line vty 0 15), transport input ssh rejects Telnet and allows SSH only.
• To enable SSH, set a hostname and domain name (hostname / ip domain-name), generate an RSA key (crypto key generate rsa), and combine local users (username ... secret ...) with login local on the VTY lines. HTTP/HTTPS is web-GUI management—HTTP is cleartext, HTTPS is encrypted. WLC management is mainly via the HTTPS GUI; the secure approach is to enable ip http secure-server (HTTPS) and disable cleartext HTTP.

2.5.2AAA and TACACS+ / RADIUS

• AAA stands for authentication (who you are), authorization (what you may do), and accounting (a record of what you did). Because giving each device its own local users is unwieldy, AAA is centralized on an external authentication server, and devices query that server on each login.
• TACACS+ is a Cisco-proprietary AAA protocol (TCP 49). It handles authentication, authorization, and accounting separately, making it strong at fine-grained per-command authorization (which user may run which command). It encrypts the entire packet payload. Preferred for administrator access control on network devices.
• RADIUS is the industry-standard AAA protocol (UDP, 1812 for authentication/authorization and 1813 for accounting). It combines authentication and authorization into one exchange and encrypts only the password (other attributes are cleartext). Widely used for wireless/wired user authentication (802.1X).

A network team is revisiting administrator access to dozens of routers and switches. Initially each device had its own local users and remote management was over Telnet, but because Telnet sends credentials and activity entirely in cleartext, there was a flagged risk of the admin password leaking to LAN eavesdropping. First, every device's VTY lines are changed to transport input ssh to allow only SSH, with hostname/domain-name set and an RSA key generated via crypto key generate rsa, moving to encrypted remote management (and disabling cleartext HTTP in favor of the HTTPS GUI). Next, managing local users per device is unwieldy—every hire or departure means editing all devices—so the team centralizes AAA on an external authentication server. Here the requirements are: "control finely, per user role, which commands an admin may run (command authorization)" and "encrypt the entire packet, including the record of activity, not just credentials." For these, TACACS+ (Cisco-proprietary, TCP 49), which handles authentication, authorization, and accounting separately and encrypts the whole payload, is optimal. If, instead, the requirement were "authenticate wireless/wired end users with 802.1X," you would choose RADIUS (UDP 1812/1813), an industry standard that pairs well with a multi-vendor authentication backend. RADIUS combines authentication and authorization and encrypts only the password, so it is less suited to fine-grained per-command admin authorization, but it is well suited to handling large volumes of user authentication simply. The typical AAA design axis is therefore: TACACS+ for device-administrator access control, RADIUS for end-user authentication.

2.5.3Section summary

• Console = out-of-band, direct (last resort for setup/recovery); Telnet = cleartext, discouraged; SSH = encrypted, mandatory for remote management (transport input ssh on VTY); HTTP/HTTPS = web GUI (restrict to HTTPS)
• AAA = centralize authentication, authorization, accounting on an external server. TACACS+ = Cisco-proprietary, TCP 49, separates AAA, encrypts the whole payload (for device admins)
• RADIUS = industry standard, UDP 1812/1813, combines authentication and authorization, encrypts only the password (for wireless/wired user auth = 802.1X). Use TACACS+ for admin access control, RADIUS for end-user authentication