AAA Authentication types and methods - Setting for Admin or general user access

I have a few questions about the authentication options (methods) available on the NAS.

1)  Is arap, nasi, and ppp only used for network access, meaning that it has no effect on the user who is using the authentication but only effects whether the user can use that particular protocol to connect to the network?

2)  What is the 'enable' option for?  Can you give me an example?

3)  When the 'default' method is used and is automatically applied to all lines, does this mean all lines or all lines and interfaces on the router?  For example, if I have a 2521 with con, aux, vty, serial 0 3 (serial 3 is async for dialin), and isdn, are all these lines/interfaces under the control of the 'default' authentication unless configured otherwise?

4)  Would I ever use the AAA NAS without the CSACS or similar server to control authorization for user access?  I don't see much in the way of network service control on the NAS username options?


Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ppp is the encapsulation of layer 2, consider it as physical pipe, which support other upper layer protocols ... you may carry anyother protocol end to end until and unless both ends are supporting the protocols ...

when you are accessing your server via dial-up or any other means... it certainly depends on the hardware and the flexibility it provides on the particular interfaces ... and obviously your ios ...

most of the time ppp is used as protocol and two authentication procedures are supported ...

these are ...
- ppp authentication pap
- ppp authentication chap
- aaa authentication arap (if you have support of arap)

chap - challenge handshake authentication protocol is a little more complex than pap (password authentication protocol).

For home users to dial-in we prefer pap.

in cisco ... enable commands enables a certain option on a particular place ...

You need to configure authenticaion on physical interfaces like serials and bri, etc separately ... remember each physical interface is associated with a line ...

HeadOffice#sh line
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
     0 CTY              -    -      -    -    -      0       0     0/0       -
    39 TTY 115200/115200- inout     -    -    -      0       0     0/0     Se1/6
    40 TTY 115200/115200- inout     -    -    -      0       0     0/0     Se1/7
    65 AUX 115200/115200- inout     -    -    -      2       0   470/0       -
*   66 VTY              -    -      -    -    -     76       0     0/0       -
*   67 VTY              -    -      -    -    -     25       0     0/0       -
*   68 VTY              -    -      -    -    -     11       0     0/0       -
    69 VTY              -    -      -    -    -      5       0     0/0       -
    70 VTY              -    -      -    -    -      2       0     0/0       -

while on the vty lines you can deploy configuration in a bundle fashion... like ...

line vty 0 4
login sheeraz
password sheeraz

you can use AAA without TACACS or RADIUS on router or access server and you can define username and respective passwords ... let me show you the sample config ...

username ABC-KHI password 7 xxxxxxxxxx
aaa new-model
aaa authentication login default local
aaa authentication login NO_AUTHEN none
aaa authentication ppp default local
aaa session-id common    
radius-server authorization permit missing Service-Type

try this ... because i m successfully configured usernames on my router using this ...
benje02Author Commented:
So authenticating a user is a two step process?  One step is the layer 2 protocol they can use to access the network and the other is how their user ID will be authenticated?  Are both commands below needed for a dialup user to access the NAS?

aaa authentication login default local  (user ID/password part??)
aaa authentication ppp default local  (network access method??)

What I meant by the 'enable' is its use in the authentication command, for example;  

pita(config)#aaa authen enable default ?
  enable  Use enable password for authentication.
  group   Use Server-group
  line      Use line password for authentication.
  none    NO authentication.

What does this command do?  This seems redundent with the login option.  See below;

pita(config)#aaa authen login default ?
  enable         Use enable password for authentication.
  group          Use Server-group
  krb5            Use Kerberos 5 authentication.
  krb5-telnet   Allow logins only if already authenticated via Kerberos V
  line             Use line password for authentication.
  local           Use local username authentication.
  local-case    Use case-sensitive local username authentication.
  none         NO authentication.

If each physical interface is associated with a line, then why are some serial interfaces not showing up in the 'show line' command?  Only the serial interfaces that I can change the hardware to async show up.

Hi there

>pita(config)#aaa authen enable default
Here enable specifies that the user can access the enable mode on the router/access server

>pita(config)#aaa authen login default
This command is not complete. You still have to select one of the options listed for login level access.

>If each physical interface is associated with a line, then why are some serial interfaces not showing up in the 'show line' command?
It depends on the type of card you have installed in the router. Not all serail cards can be configured for async.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.