What's changed: Initial version
5.1Device access control (lines, local authentication, AAA)
Covers applying local user authentication to line vty / line console and centralizing control with AAA (authentication, authorization, accounting). It frames the difference between TACACS+ (TCP 49, separates the AAA functions, encrypts the entire packet) and RADIUS (UDP 1812/1813, combines authentication and authorization, encrypts only the password) as design judgment: who may run which commands, and whether you get locked out when the server fails.
Securing a network device starts not with protecting the traffic that passes through it but with protecting access to the device itself. If everyone shares one privileged password and types the same enable, you cannot trace who did what, and you cannot revoke a departing employee's account. ENCOR tests this area as operational design: which authentication method you bind to each line (console/VTY), which AAA server you choose and how the device behaves when it fails, and where you draw the line on privilege levels and command authorization. The essence is not the username command but the judgment to foresee whether the very act of applying the configuration locks you out.
5.1.1Lines and local user authentication
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.