Network Access Device Administration

What this chapter covers

This chapter is about controlling who can log in to the network devices themselves, and what they can do there.

Earlier chapters used RADIUS to control the users and devices that join the network. Here the subject changes to the administrators of the network. The chapter compares the AAA protocols and then shows how ISE runs TACACS+ for device administration.

It is a short chapter, and the comparison of RADIUS and TACACS+ is worth knowing well.

How the topics fit together

First you learn the protocols, then you apply the right one to administrators.

The two topics follow that order:

• AAA protocols explain authentication, authorization and accounting, and compare RADIUS and TACACS+ on ports, encryption and use.
• TACACS+ device administration shows the Device Admin service, command sets, profiles, the device settings and accounting.

The same three questions sit behind both protocols, and the difference is the setting. RADIUS answers them for an endpoint that joins the network, and TACACS+ answers them for a person who types commands on a device.

Because the settings differ, the policy results differ too. Network access returns VLANs and ACLs, and device administration returns command sets and privilege levels.

Keep this split in mind when you read exam scenarios. The wording of the question usually tells you which side you are on.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the protocols page first and memorise the comparison table. Then, in a lab, put a switch on TACACS+ with a local fallback, and watch the logins and commands in the TACACS live logs.