1. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir CCNP-SWITCHING 300-115 Mohamed Samir YouTube channel Double CCIEs #27042(R/S&SP)

2. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Part VII: Securing Switched Networks

3. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Managing Switch Users

4. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir AAA Authentication: Who is the user? Authorization: What is the user allowed to do? Accounting: What did the user do? AAA functions that are centralized, standardized, resilient, and flexible. Cisco switches can use the following two protocols to communicate with AAA servers: TACACS+: A Cisco proprietary secure and encrypted over TCP port 49 RADIUS: A standards-based uses UDP ports 1812 and 1813 (accounting), but is not completely encrypted

5. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Configuring Authentication Switch(config)# aaa new-model Switch(config)# username lastresort password MySecretP@ssw0rd Switch(config)# tacacs-server host 192.168.10.10 key t@c@csk3y Switch(config)# tacacs-server host 192.168.10.11 key t@c@csk3y Switch(config)# aaa group server tacacs+ myauthservers Switch(config-sg)# server 192.168.10.10 Switch(config-sg)# server 192.168.10.11 Switch(config-sg)# exit Switch(config)# aaa authentication login myauth group myauthservers local Switch(config)# line vty 0 15 Switch(config-line)# login authentication myauth

6. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Configuring Authorization Switch(config)# aaa authorization {commands | config-commands| configuration | exec | network | reverse-access} {default |list-name} method1 [method2...] For specific line Switch(config-line)# authorization {commands level | exec | reverse- access} {default | list-name} For all line Switch(config)# aaa authorization exec default group myauthservers none

7. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Configuring Accounting Switch(config)# aaa accounting {system | exec | commands level} {default | list-name} {start-stop | stop-only | wait-start | none} method1 [method2 For specific line Switch(config-line)# accounting {commands level | connection | exec} {default | list-name}

8. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Any questions ?

9. © 2015 Mohamed Samir YouTube channel All rights reserved. www.mohamedsamir.comMohamed Samir Thank you for your time ! شكرا جزاكم الله خير