Network Security · Topic 3 of 7
Identity and Access Management
Compare AAA, multifactor authentication, SSO, RADIUS, TACACS+, LDAP, SAML, Kerberos and 802.1X port based authentication used to control network access.
- 5 min
- Includes a diagram
- AAA is authentication, authorization and accounting.
- MFA uses two or more different factor types. A password and a code is MFA, while two passwords is not.
- RADIUS uses UDP 1812 and 1813 and is used for network access. TACACS+ uses TCP 49 and encrypts the full payload.
What it is
Identity and access management (IAM) decides who may use the network and what they may do. It rests on three steps known as authentication, authorization and accounting (AAA).
The exam asks you to match the right protocol to a need: central login for network devices, a single sign on for web applications, or port based access control on a switch.
How it works
AAA
| Step | Question it answers |
|---|---|
| Authentication | Who are you? |
| Authorization | What are you allowed to do? |
| Accounting | What did you do, and when? |
Accounting records, such as logins and commands, support troubleshooting, audits and investigations.
Authentication factors
| Factor | Example |
|---|---|
| Something you know | Password or personal identification number (PIN) |
| Something you have | Smart card, hardware token, phone app code |
| Something you are | Fingerprint or face scan |
| Somewhere you are | Location, as used in geofencing |
Multifactor authentication (MFA) needs two or more different factors. A password plus a one time code from an app is MFA. Two passwords are not, because both are the same factor type.
Single sign on (SSO) lets a user log in once and then reach several systems without another prompt. It reduces password fatigue but makes the first login more valuable to protect.
Central login for network devices
Remote Authentication Dial In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) both let network devices check logins against a central server.
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Transport | User Datagram Protocol (UDP), ports 1812 (authentication) and 1813 (accounting) | Transmission Control Protocol (TCP), port 49 |
| Encryption | Encrypts the password only | Encrypts the whole payload |
| Common use | Network access: Wi-Fi, virtual private network (VPN) and 802.1X | Administrator access to network devices |
| AAA | Combines authentication and authorization | Separates authentication, authorization and accounting |
Choose RADIUS for user network access and TACACS+ when you need per command control over administrators on routers and switches. TACACS+ was developed by Cisco and is widely used.
Directory and federation protocols
The Lightweight Directory Access Protocol (LDAP) queries a directory of users, groups and devices, such as Active Directory. It uses port 389, and LDAPS uses port 636 with encryption.
Kerberos is a ticket based protocol that lets a user prove identity without sending the password over the network. It depends on synchronized clocks and uses port 88.
The Security Assertion Markup Language (SAML) lets an identity provider vouch for a user to a web service. It is common for SSO to cloud applications, so the application never sees the password.
802.1X port based access control
The Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard makes a device prove its identity before the switch port or Wi-Fi association is opened for normal traffic. It has three roles.
| Role | Device |
|---|---|
| Supplicant | The client that wants access |
| Authenticator | The switch or access point that guards the port |
| Authentication server | Usually a RADIUS server that checks the credentials |
If authentication succeeds, the port is opened, and the server can place the device in a specific virtual LAN (VLAN). If it fails, the port stays closed or the device is placed in a restricted VLAN. The credentials travel between the supplicant and the server inside the Extensible Authentication Protocol (EAP).
Local authentication and authorization models
Local authentication keeps accounts on each device. It still works when the central server is unreachable, but it does not scale and is hard to audit, so central AAA is preferred.
Role based access control (RBAC) grants permissions by role. Time based access limits when an account can be used, and geofencing limits where. Least privilege applies to all of them.
What to remember for the exam
- AAA is authentication, authorization and accounting.
- MFA uses two or more different factor types. A password and a code is MFA, while two passwords is not.
- RADIUS uses UDP 1812 and 1813 and is used for network access. TACACS+ uses TCP 49 and encrypts the full payload.
- TACACS+ separates authentication, authorization and accounting, and suits device administration.
- LDAP queries a directory on port 389, and LDAPS uses 636.
- Kerberos uses tickets and port 88 and needs synchronized time.
- SAML supports SSO across web applications using an identity provider.
- 802.1X has a supplicant, an authenticator and an authentication server.
When a question mentions "each command an administrator types must be authorized", the answer is TACACS+. For wireless or VPN user login, think RADIUS.
Common mistakes
Calling two passwords MFA. They are the same factor. MFA needs different factor types.
Mixing RADIUS and TACACS+ transports. RADIUS uses UDP and TACACS+ uses TCP.
Confusing authentication with authorization. Logging in proves who you are, and authorization decides what you can reach.
Believing SSO removes risk. It lowers password fatigue, but one compromised account reaches many systems.
Forgetting clock sync for Kerberos. Large time differences cause authentication failures.
Do not use LDAP without encryption for sensitive lookups. Plain LDAP sends data in clear text, so use LDAPS or a Transport Layer Security (TLS) protected connection.
Check yourself
Try these three.
Which protocol encrypts the whole payload and separates AAA functions?
TACACS+, which uses TCP port 49.
What are the three roles in 802.1X?
The supplicant, the authenticator and the authentication server.
What makes an authentication method multifactor?
It uses two or more different types of factor, such as something you know and something you have.
Topic 3 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.