AAA and RADIUS

1. Explain each of the three A’s as you would to a non-technical family member. Use an analogy or a story.
   • Authentication is a means of verifying that the person trying to get in is who they say they are. It could be compared to someone going through Customs to enter the U.S. to study at university. CBP will check their identification to make sure they are who they say they are and that they are not forbidden to enter.
   • Authorization means the person is only allowed to do what they have permission to do. The person entering the U.S. may be allowed to study, but their visa may not permit them to get a job. For that, they need to request that their visa be amended to allow them to work. If they don't get the additional permission, then they cannot engage in that activity.
   • Accounting keeps track of what they are doing while in the system and creates reports. This is like having the university track that the student is attending their classes and letting CBP know if they are attending or if they stop going to class so that action may be taken if they are doing things they should not be.
2. What should the administrator do if the ACS server fails to authenticate a user during AAA implementation?
   • The AAA methodology should include a backup AAA procedure to be performed within the system being accessed itself.
3. What is the role of the NAS in the AAA implementation using an ACS server? Use a diagram.
   • The NAS sends the access request to the ACS server and either grants or denies the actual access based on the feedback from the ACS.

Source: Geeks for Geeks

1. What are the benefits of using RADIUS for authentication and authorization?
   • RADIUS provides a centralized system for authenticating user requests through virtually all methods of accessing a network. It is scalable and can be networked with other RADIUS devices to cover a vast area.
2. What is RADIUS and what does it stand for?
   • RADIUS stands for Remote Authentication Dial-In User Service. It is a an authentication protocol that receives authentication requests from NAS servers to either allow or deny access to the requested network. It validates requests using one of two methods: Password Identification Protocol (PAP), or CHallenge Handshake Authentication Protocol (CHAP), which is the more secure of the two.
3. Research: What encryption algorithms does RADIUS use?
   • Symmetric encryption using the MD5 hashing algorithm.

Sources: Tech Target, Stack Exchange