C H A P T E R 13

Overview of AAA and the

Cisco PIX Firewall

This chapter presents authentication, authorization, and accounting, more commonly known as AAA. It discusses how the Cisco PIX Firewall is incorporated with AAA servers and the relationship between the Cisco PIX Firewall and the AAA server(s). This chapter also introduces the Cisco Secure Access Control Server (CSACS), a AAA server product offered by Cisco.

Chapter 6, “Getting Started with the Cisco PIX Firewall,” addresses the commands necessary to configure the Cisco PIX Firewall. You might remember that the importance of remembering the PIX commands was mentioned in the Introduction. In the real world, it is possible to navigate your way around a PIX and figure out a command's correct syntax. This is not possible in the testing environment. You are asked to select a command that performs a certain function from a list of very similar commands. It is very important that you understand the correct syntax for each PIX command.

How to Best Use This Chapter

If you are very familiar with AAA, but you aren't very familiar with the CSACS, you should skim the first half of this chapter to reinforce your knowledge of AAA and focus on the installation of CSACS. The AAA process is relatively simple to understand, although there are quite a few different configuration options. This chapter explains the AAA process, discusses how the Cisco PIX Firewall fits into this process, and covers the installation of CSACS.

“Do I Know This Already?” Quiz

The purpose of this quiz is to help you determine your current understanding of the topics covered in this chapter. Write down your answers and compare them to the answers in Appendix A. If you have to look at any references to correctly answer the questions about PIX functionality, you should read that portion and double-check your thinking by reviewing the Foundation Summary. The concepts in this chapter are the foundation for much of what you need to understand to pass the CSPFA Certification Exam. Unless you

Overview of AAA and the Cisco PIX Firewall 259

Foundation Topics

Overview of AAA and the Cisco PIX Firewall

Authentication, authorization, and accounting (AAA) has become an extremely important component in any network infrastructure. AAA is used in our everyday lives not only for network security, but also for physical security, or any other function that requires access control. This chapter discusses the AAA process, its components, the responsibilities of each component, and how the Cisco PIX Firewall fits into the equation.

Definition of AAA

The best way to understand AAA is to break up the pieces and look at them individually. The three components of AAA are distinctly different, and each has its own responsibility. AAA is now integrated into nearly every situation that requires access control. Access control can be applied to users, hosts on a network (such as servers and workstations), networking components (such as routers, switches, VPN appliances, and firewalls), and other automated devices that require access and that perform a function. This chapter discusses AAA as it pertains to a user, but you will see how the principles can apply to many automated functions. The three components of AAA are as follows:

•Authentication—The process of validating an identity. The identity that is being validated could be a user, a computer, a networking component, and so on. Authentication is by far the most important step. No access is granted until the requestor has been authenticated. There are three layers of user authentication:

—What the user knows—This normally is a user password or passphrase.

—What a user has—This normally is a user token or badge issued to the user by whomever has authority over what the user is attempting to access.

—What a user is—This area includes biometrics—checking the user's fingerprint or retinal scan against a stored image in the database.

Many organizations do not incorporate all three layers of authentication; however, it is very common to use a minimum of two layers at one time.

•Authorization—After the user has been authenticated, he or she is granted access rights to perform specific functions.

•Accounting—After the user is granted access, the accounting function tracks what tasks the user performed and saves that information is a log that can be reviewed later. Accountability of users and their actions is an issue that is becoming increasingly important in the security of enterprise networks.

The three functions of AAA can be performed by a single server or can be divided among several servers. Most large enterprise networks create a hierarchy of AAA servers, with the lower-level servers tending to user functions and the upper-level servers working as a central point for updating and distributing user information.