Packet Tracer file (PT Version 7.1): [ Ссылка ]
Get the Packet Tracer course for only $10 by clicking here: [ Ссылка ]
Get my ICND1 and ICND2 courses for $10 here: [ Ссылка ] (you will get ICND2 as a free bonus when you buy the ICND1 course).
For lots more content, visit [ Ссылка ] - learn about GNS3, CCNA, Packet Tracer, Python, Ansible and much, much more.
#CCNA #PacketTracer #CCENT
Two prominent security protocols used to control access into networks are Cisco TACACS+ and RADIUS. The RADIUS specification is described in RFC 2865 leavingcisco.com, which obsoletes RFC 2138 leavingcisco.com. Cisco is committed to supporting both protocols with the best of class offerings. It is not the intention of Cisco to compete with RADIUS or influence users to use TACACS+. You should choose the solution that best meets your needs. This document discusses the differences between TACACS+ and RADIUS, so that you can make an informed choice.
Cisco has supported the RADIUS protocol since Cisco IOS® Software Release 11.1 in February 1996. Cisco continues to enhance the RADIUS Client with new features and capabilities, supporting RADIUS as a standard.
Cisco seriously evaluated RADIUS as a security protocol before it developed TACACS+. Many features were included in the TACACS+ protocol to meet the needs of the growing security market. The protocol was designed to scale as networks grow, and to adapt to new security technology as the market matures. The underlying architecture of the TACACS+ protocol complements the independent authentication, authorization, and accounting (AAA) architecture.
RADIUS uses UDP while TACACS+ uses TCP. TCP offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best-effort delivery. RADIUS requires additional programmable variables such as re-transmit attempts and time-outs to compensate for best-effort transport, but it lacks the level of built-in support that a TCP transport offers:
TCP usage provides a separate acknowledgment that a request has been received, within (approximately) a network round-trip time (RTT), regardless of how loaded and slow the backend authentication mechanism (a TCP acknowledgment) might be.
TCP provides immediate indication of a crashed, or not running, server by a reset (RST). You can determine when a server crashes and returns to service if you use long-lived TCP connections. UDP cannot tell the difference between a server that is down, a slow server, and a non-existent server.
Using TCP keepalives, server crashes can be detected out-of-band with actual requests. Connections to multiple servers can be maintained simultaneously, and you only need to send messages to the ones that are known to be up and running.
TCP is more scalable and adapts to growing, as well as congested, networks.
Transcription:
So let’s run a simulation in packet tracer.
I’ll go to simulation mode.
Here’s the console of router 1 and I’ll login with my username david, password is cisco.
Notice I’m logging in to the console of the router but TCP packet is generated and it’s sent to the AAA server. Inbound PDU received by the server has a source of the router, destination is the AAA server; port number is 49. So this is a TACACS TCP packet. Packet goes back. A TACACS packet is now sent to the TACACS server.
So if I click on that, notice the inbound PDU shows us that the source of the packet is the router, destination is the TACACS server.
Scrolling down in the TCP header, we can see that the destination is port 49.
This is a TACACS packet. Notice data is encrypted. TACACS encrypts the data between the router and the server, but there we can see clearly that it's TACACS packets going to the TACACS server.
The AAA server is sending back a TACACS packet to the router. So the source is the TACACS server or AAA server, destination is the router. We can see the TCP source port is 49, going to the ephemeral or random port number on the router. We can see it’s TACACS packet.
So the packet gets sent back to the router that process will continue until authentication has been completed.
Notice here we're seeing Spanning Tree messages but at this point I’ve now logged into the router...
