| 11.1 |  | AAA |
| 11.1.4 |  | TACACS+ and RADIUS |

| In module 4, the TACACS+ and RADIUS servers were introduced and their compatibility with Cisco routers was examined. Both of these protocols play an important role in providing AAA services to the PIX Security Appliance as well. For that reason a review of each of these protocols is important.

TACACS+
TACACS+ is the enhanced and continually improved version of TACACS. TACACS+ allows a TACACS+ server to provide the services of AAA independently. Each AAA service can be tied into its own database or can use the other services available on that server or network.

The rich feature set of the TACACS+ client/server security protocol is fully supported in Cisco Secure ACS software and can be implemented fully in conjunction with the PIX Security Appliance. TACACS+ features include the following:

- Using TCP packets for reliable data transport between the remote client and security server
- Encrypted links between the remote client and security server
- Support of Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft CHAP (MS-CHAP) authentication
- Support for both LAN and WAN environments
- Support of Serial Line Internet Protocol (SLIP), Point-to-Point Protocol (PPP), and AppleTalk Remote Access (ARA) for dialup security with auto-command supported
- Support for callback

As part of its support for TACACS+, the PIX Security Appliance supports the following AAA protocols and servers:

- Cisco Secure ACS for Windows NT (Cisco Secure ACS-NT)
- Cisco Secure ACS for UNIX (Cisco Secure ACS-UNIX)
- TACACS+ freeware

RADIUS
RADIUS consists of a server and client and uses the UDP protocol for data transmissions. The server runs on a central computer, typically at the site of the customer, while the clients reside in dialup access servers that can be distributed throughout the network. Again, RADIUS is supported by Cisco Secure ACS and can be implemented in conjunction with the PIX Security Appliance. However, the PIX does not natively support authorization to RADIUS servers. Downloadable ACLs, which will be discussed later in this module, provide a way to circumvent this problem.

The RADIUS AAA protocol provides a number of features that include the following:

- Transactions that are authenticated using a shared secret key between the server and the client
- Encrypted passwords and usernames
- Support of PAP, CHAP, and MS-CHAP authentication
- Support for both LAN and WAN environments
- Authorization of traffic defined by ACLs

As part of its RADIUS support, the PIX Security Appliance supports the following AAA protocols and servers:

- Cisco Secure ACS-NT
- Cisco Secure ACS-UNIX
- Livingston
- Merit

It is important to remember that while the PIX Security Appliance supports both TACACS+ and RADIUS authentication, it is only able to natively support TACACS+ for authorization.