| 4.2 |  | Network Access Server (NAS) AAA Authentication Process |
| 4.2.2 |  | AAA server security options |

| Overview Cisco networking products support AAA access control using either a local security database or a remote security database. A local security database runs on the NAS for a small group of network users. A remote security database is a separate server running an AAA security protocol, providing AAA services for multiple pieces of network equipment and for many network users. Each of these options is detailed in the following sections.

Local security database
If there are one or two NASs providing access on a network, the administrators will probably want to store username and password security information on the NAS. This would be referred to as local authentication or a local security database . Local authentication characteristics are as follows:

- Used for small networks
- Username and password are stored in the Cisco router
- User authenticates against local security database in Cisco router
- Does not require an external database

The system administrator must populate the local security database by specifying username profiles for each user that might log in.

There are protocols for remote security databases as well. The next figure is an introduction to these systems.

Remote security servers – TACACS+ and RADIUS
TACACS+ and RADIUS are the two predominant security server protocols used for AAA with firewalls, routers, and NAS .

The Cisco Secure Access Control Server (ACS) is easily managed via standard browsers. It enables simple moves, adds, and changes to usernames, passwords, and network devices. It is implemented on both the UNIX and Windows NT/2000 server platforms.

The Cisco Secure ACS family of security servers is a comprehensive and flexible platform for securing network access for the following:

- Dialup via Cisco NAS and routers
- Router and switch console and vty port access for management
- PIX Security Appliance access
- VPN 3000 Series Concentrators, RADIUS only

Cisco Secure works closely with the NAS, router, VPN 3000 Concentrator, and PIX Security Appliance to implement a comprehensive security policy using the AAA architecture. It works with industry-leading token cards and servers.

| Web Links FreeRADIUS http://www.freeradius.org/