topic Re: AAA in Network Access Control

AAA

saidfrh — Sun, 10 Mar 2019 23:15:36 GMT

The sh run on the router displays 'no aaa new-model'. SSH has been activated with users authenticating with local data base. Why is the router showing 'no aaa new-model'?

How can we secure a server on the LAN using AAA?

Re: AAA

Collin Clark — Wed, 31 Dec 2008 17:52:51 GMT

You can use SSH and the local user database w/o AAA, it isn't required.

How can we secure a server on the LAN using AAA?

Can you explain this further?

Re: AAA

saidfrh — Wed, 31 Dec 2008 18:04:59 GMT

On another note, could you explain what 'no ip source-route' refers to? Is the above to prevent routing loops, routing updates can not send back to port that update was received from?

Re: AAA

Collin Clark — Wed, 31 Dec 2008 18:11:58 GMT

IP source routing allows the sender of an IP packet to control the route that packet will take to reach the destination endpoint. By default, IP source routing is disabled on the routers and should only be enabled if your network needs call for it.

routing updates can not send back to port that update was received from?

That's called split-horizon

Re: AAA

Collin Clark — Wed, 31 Dec 2008 18:33:29 GMT

Here are some commands that you might want to enter to increase the security and usability of your devices.

no service pad

no service config

no service finger

no ip icmp redirect

no ip bootp server

no ip identd

no ip finger

no ip gratuitous-arps

no ip source-route

service sequence-numbers

service tcp-keepalives-in

service tcp-keepalives-out

no service udp-small-servers

no service tcp-small-servers

service timestamps debug datetime localtime show-timezone

service timestamps log datetime localtime show-timezone

service password-encryption

Re: AAA

saidfrh — Wed, 31 Dec 2008 18:37:43 GMT

What does ip gratuitous-arps refer to?

Re: AAA

Collin Clark — Wed, 31 Dec 2008 18:40:33 GMT

A Cisco router will send out a gratuitous ARP message when a client connects and negotiates an address over a PPP connection. This transmission occurs even when the client receives the address from a local address pool. By default it's off, but we like to make sure by entering the command.

Re: AAA

saidfrh — Wed, 31 Dec 2008 18:45:14 GMT

ARP request is a broadcast to local hosts by the router, seeking the MAC address of a host with known IP address. So, when the ARP request goes through a PtP, the action is refered as a gratuitous ARP, Yes?

Re: AAA

Collin Clark — Wed, 31 Dec 2008 18:50:28 GMT

Actually the router sends ARPs on behalf of the device.