Wired Ethernet networks don't have any authentication by default to access the network.
All you need to do is plug your Ethernet cable into a switch and you'll gain access to the network with
no authentication, no authorization and no accounting, triple A or authentication authorization and
accounting, is a way to centralize policies that are applied to network devices.
As an example, you could centralize the authentication of users by using a triple A server such as
Cisco Secure ACS, authentication means that you are authenticating a username and password before
a user can access the network or a device on the network.
Authorization determines what you are allowed to do once you've been authenticated.
So are you, as an example, allowed to go to privilege mode or enable mode on a router?
Are you allowed to access a server on the network?
Accounting is a log of what's happened on the network.
So as an example, you could log users attempts to access a network device via Telnet or SSH.
In a moment, I'll demonstrate triple A using a GNS3 network where I have a Cisco ACS server connected.
The server is running within VMware, but is connected via a GNS3 switch to multiple network devices,
I'll configure the network to use local authentication and then we'll centralize the authentication so
that logins are authorized from a Central ACS server rather than having a local username and password
database on each network device.
Now to stop anyone just accessing your network.
You can implement identity based authentication or identity based networks by using a protocol called
802.1x.
The IEEE 802.1x standard allows you to implement identity based networking, where a client machine
has to present a username and password before they can gain access to the network.
In 802.1x, you have three components or three roles.
The client, also known as the Supplicant, is a PC such as a Windows PC running a a802.1x compliant
client software.
An authenticator doesn't authenticate the client, but sends authentication information through to an
authentication server.
The authenticator would be something like an Ethernet switch, which is controlling access to the network.
The client PC is connected to a port on the switch, acting as the authenticator, and no frames from
the client are permitted except 802.1x frames before authentication takes place.
So when the client sends traffic to the switch, acting as the authenticator, it will send an 802.
.1x challenge to the client asking for authentication information.
A username and password is sent to the switch, but the switch doesn't read that information, but passes
it on to the authentication server, which could be a Radius or Tacacs server, Radius and Tacacs are
the protocols used between the authenticator and authentication server.
The authentication server validates the credentials of the client.
In other words, it makes sure that the client username and password are correct and that the client
is allowed to access the network.
If the username and password are correct, the authentication server sends a message to the authenticator
or switch, which then permits the client to access to the network.
The authenticator sends a successful authentication message to the client
and now when the client forwards traffic such as HTTP or Telnet traffic, that is permitted onto the
network.
The important thing with 802.1x is that the client cannot access the network until authentication
has succeeded based on the information stored in the authentication server and authentication server
could use a local database or it could use a centralized directory such as Active Directory for the
storing of usernames and passwords.