© 2015 Mohamed Samir YouTube channel All rights reserved. Samir CCNP-SWITCHING Mohamed Samir YouTube channel Double CCIEs #27042(R/S&SP)

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Part VII: Securing Switched Networks

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Managing Switch Users

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir AAA Authentication: Who is the user? Authorization: What is the user allowed to do? Accounting: What did the user do? AAA functions that are centralized, standardized, resilient, and flexible. Cisco switches can use the following two protocols to communicate with AAA servers: TACACS+: A Cisco proprietary secure and encrypted over TCP port 49 RADIUS: A standards-based uses UDP ports 1812 and 1813 (accounting), but is not completely encrypted

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Configuring Authentication Switch(config)# aaa new-model Switch(config)# username lastresort password Switch(config)# tacacs-server host key Switch(config)# tacacs-server host key Switch(config)# aaa group server tacacs+ myauthservers Switch(config-sg)# server Switch(config-sg)# server Switch(config-sg)# exit Switch(config)# aaa authentication login myauth group myauthservers local Switch(config)# line vty 0 15 Switch(config-line)# login authentication myauth

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Configuring Authorization Switch(config)# aaa authorization {commands | config-commands| configuration | exec | network | reverse-access} {default |list-name} method1 [method2...] For specific line Switch(config-line)# authorization {commands level | exec | reverse- access} {default | list-name} For all line Switch(config)# aaa authorization exec default group myauthservers none

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Configuring Accounting Switch(config)# aaa accounting {system | exec | commands level} {default | list-name} {start-stop | stop-only | wait-start | none} method1 [method2 For specific line Switch(config-line)# accounting {commands level | connection | exec} {default | list-name}

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Any questions ?

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Thank you for your time ! شكرا جزاكم الله خير