| 4.2 |  | Network Access Server (NAS) AAA Authentication Process |
| 4.2.1 |  | Overview of NAS |

| As the name implies, it is the job of the NAS to provide remote users with access to network devices and resources. Given its function, it is imperative that the NAS be secured correctly. Typically, the NAS will be a router, located on the perimeter network, which provides two types of network access:

1. Remote management, or character mode
2. Remote network access, or packet mode

Remote management
Remote management encompasses character mode access to network equipment. As was discussed in section one of this module, this communication can take place across various line types supported by the router. These include the console line, auxiliary line, asynchronous (tty) lines, and virtual terminal (vty) lines. The communication over these lines can be established through either a Telnet, or preferably, a more secure SSH session. Configuring the NAS for remote management is covered in this module.

Remote network access
Remote network access encompasses packet mode access to the network. Access can take the form of an analog Public Switched Telephone Network (PSTN) connection or a digital ISDN connection. The remote user simply needs the appropriate application software, protocol stacks, and link-layer drivers to connect to the NAS. This technology is especially useful to employees that travel often, who are in small remote offices that do not have bandwidth requirements to justify a more expensive Frame Relay or leased-line connection, or who operate out of their house and connect via dialup, DSL, or cable modem.

Authentication can present a problem when dialing in with PPP using dial-on-demand or multilink. In this case, a static password is assigned for the PPP connection and an access list restricts the user to Telnet to the access server. Once connected to the line vty number, users can use the lock-and-key feature to open the access list or can merge their interface configuration with a virtual template from a TACACS+ server to replace the access list. This is also known as double authentication. The authentication method should be chosen and implemented based on the guidelines established in the network security policy.

Configuring remote network access is beyond the scope of this class, but is discussed in more depth in the CCNP Semester 2 curriculum.