-: Network Access Protocols. 2 2
In this lesson, we're going to discuss 3 3
the different network access protocols 4 4
that are used in our networks, 5 5
including RADIUS, TACACS+, 802.1x and EAP. 6 6
The first network access protocol we're going to discuss is 7 7
RADIUS, or the Remote Authentication Dial-In User Service. 8 8
RADIUS provides a centralized administration of dial-up VPN 9 9
and wireless network authentication. 10 10
RADIUS supports the use of 802.1x and EAP, 11 11
the Extensible Authentication Protocol. 12 12
Both of which we're going to discuss in just a moment. 13 13
RADIUS is considered a client server protocol 14 14
and it operates within layer 7 of the OSI model. 15 15
This is the application layer. 16 16
It's going to utilize UDP for making its connections, 17 17
making it fairly fast 18 18
during authentication to authorization. 19 19
Now, to implement RADIUS, 20 20
you need to usually run it on a separate server, 21 21
but this can be loaded up on the same server 22 22
as your Windows domain controller 23 23
if you're using a smaller domain environment. 24 24
RADIUS is going to be used to authenticate users, 25 25
authorize them to services, 26 26
and account for their usage of those services. 27 27
This means it's considered an AAA, 28 28
or Authentication, Authorization and Accounting service. 29 29
For network connectivity RADIUS is commonly 30 30
going to use port 1812 for authentication messages 31 31
and port 1813 for accounting messages. 32 32
But some proprietary versions of RADIUS 33 33
may also use port 1645 and 1646 for these purposes. 34 34
Now, while RADIUS is a cross platform standard, 35 35
there is a proprietary protocol from Cisco known as TACACS+, 36 36
which is similar in functionality. 37 37
Now this is our second network access protocol 38 38
that we need to discuss. 39 39
This is known as Terminal Access Controller Access Control 40 40
System Plus, or TACACS+. 41 41
Now TACACS+ is going to be used to perform 42 42
the role of an authenticator in an 802.1x network, 43 43
just like RADIUS can. 44 44
It's really up to you to determine which one 45 45
is going to be best for your organization's needs 46 46
in coordinating with your network engineers 47 47
and your cybersecurity team to decide 48 48
if you're going to use RADIUS or TACACS+. 49 49
Personally, I like to use RADIUS almost exclusively 50 50
within my organization because I've found that TACACS+ 51 51
is a little bit slower to operate 52 52
because it relies on TCP instead of UDP. 53 53
Also, if you're going to use TACACS+ 54 54
you need to make sure you have port 49 open and available, 55 55
so clients can access the TACACS+ server 56 56
and communicate without any issues. 57 57
Now, even though I said, I prefer to use RADIUS, 58 58
TACACS+ does have some benefits. 59 59
In developing TACACS+ Cisco has included 60 60
some additional security and its server 61 61
is going to independently conduct authentication, 62 62
authorization and accounting processes. 63 63
TACACS+ also supports all network protocols 64 64
where RADIUS doesn't support the remote access protocol, 65 65
net bios frame protocol, and a few others. 66 66
Overall, TACACS+ is a really good choice, 67 67
but only if you're going to be using Cisco devices 68 68
exclusively across your network. 69 69
If you're like me and you prefer 70 70
to have cross-platform capability, 71 71
then you're going to want to use RADIUS 72 72
for your implementations instead. 73 73
As we've been discussing RADIUS and TACACS+ 74 74
I've mentioned 802.1x and EAP a couple of times. 75 75
So let's circle back and cover those topics right now. 76 76
The third network access protocol 77 77
we need to discuss is 802.1x. 78 78
Now, 802.1x is a standardized framework 79 79
that's used for port-based authentication 80 80
on both wired and wireless networks. 81 81
Now, since 802.1x is just a framework, 82 82
it's actually going to utilize other mechanisms 83 83
to do the real authentication for us, 84 84
things like RADIUS and TACACS+ that we just spoke about. 85 85
Now, for authentication to occur under 802.1x, 86 86
there are three roles that are required. 87 87
There's a supplicant, an authenticator, 88 88
and an authentication server. 89 89
First, we have our supplicant. 90 90
This is the device or the user that's requesting access 91 91
to the network, such as PC1 in this example. 92 92
Then we have the authenticator, 93 93
which is the device through which the supplicant 94 94
is requesting to access the network. 95 95
Normally, this is going to be something like a switch, 96 96
a wireless access point or a VPN concentrator. 97 97
Finally, there's the authentication server. 98 98
This is going to be the centralized device 99 99
that performs the authentication. 100 100
Normally this will be your RADIUS or your TACACS+ server. 101 101
802.1x is a great thing to have in your networks, 102 102
because it is one of the best protections that you can add 103 103
to your internal network conductivity, 104 104
to prevent rogue devices from getting access 105 105
to your organization's devices and connections. 106 106
As I said, this is port-based authentication. 107 107
So anything that connects to a switch 108 108
or wireless access point or a VPN concentrator 109 109
could be required to present itself 110 110
for authentication using 802.1x 111 111
prior to getting access to the entire network. 112 112
Another feature of 802.1x is the ability to encapsulate EAP. 113 113
This is our fourth network access protocol 114 114
that we need to discuss, known as EAP, 115 115
or the Extensible Authentication Protocol, 116 116
which can happen over a wired or wireless connection. 117 117
Now, EAP is actually not a single protocol by itself, 118 118
but actually a framework in a series of protocols 119 119
that allows for numerous different mechanisms 120 120
of authentication, including things like simple passwords, 121 121
digital certificates, and public key infrastructures. 122 122
There are many different variants of EAP, 123 123
such as EAP-MD5, EAP-TLS, EAP-TTLS, 124 124
EAP-FAST and EAP-PEAP. 125 125
Now, EAP-MD5 is a variant of EAP that utilizes 126 126
simple passwords and the challenge handshake 127 127
authentication process to provide 128 128
remote access authentication. 129 129
If you're using this method, 130 130
you have to ensure you're using long, strong, 131 131
and complex passwords in order for you to maintain 132 132
the security of your systems. 133 133
EAP-MD5 is a one-way authentication process, 134 134
and it's not going to provide mutual authentication 135 135
like some of the other versions will. 136 136
EAP-TLS is a form of EAP that uses public key infrastructure 137 137
with digital certificates being installed on both the client 138 138
and the server as a method of authentication. 139 139
This makes it immune to password-based attacks 140 140
since neither side is going to use a password. 141 141
And instead they're going to be using digital certificates 142 142
to identify themselves. 143 143
This is considered a form of mutual authentication 144 144
between both devices, the client and the server, 145 145
because each of them is going to authenticate 146 146
with the other one. 147 147
Now, another variant of this is known as EAP-TTLS. 148 148
This requires a digital certificate on the server, 149 149
but not on the client. 150 150
Instead, the client's going to use a password 151 151
for its authentication. 152 152
This makes it more secure than a traditional EAP-MD5, 153 153
which just uses passwords, 154 154
but it is less secure than EAP-TLS 155 155
because we're now only using one digital certificate 156 156
instead of two. 157 157
Our fourth variant of EAP is EAP-FAST, 158 158
or EAP Flexible Authentication via Secure Tunneling. 159 159
EAP-FAST is going to use protected access credentials 160 160
instead of a certificate to establish mutual authentication 161 161
between the two devices. 162 162
Now, our fifth and final variant of EAP is known as PEAP, 163 163
or Protected EAP. 164 164
This variant also supports mutual authentication 165 165
by using server certificates 166 166
and the Microsoft active directory database 167 167
for it to authenticate a password from the client. 168 168
Now, in addition to all these cross-platform 169 169
variants of EAP, 170 170
there's also a proprietary protocol 171 171
that was developed by Cisco, 172 172
known as LEAP or the Lightweight EAP. 173 173
Now, since it's proprietary, 174 174
it only works on Cisco based devices. 175 175
So, unless you have all Cisco devices in your network, 176 176
you should stick with using standard EAP 177 177
in your networks instead.