Cisco CCNP Enterprise (ENCOR 350-401) · lesson 10 of 12 · 30 min
AAA: Authentication, Authorization, Accounting
AAA is the framework for controlling who can access network devices and what they can do. It is the foundation of enterprise network security. RADIUS vs TACACS+: RADIUS is for network access (who can connect to the network). TACACS+ is for device administration (who can log into routers/switches and what commands they can run). TACACS+ encrypts the entire packet; RADIUS only encrypts the password.
802.1X: Port-Based Network Access Control
802.1X controls access to the network at the port level. A device must authenticate before the switch port is opened. This prevents unauthorized devices from connecting to the network. The 802.1X process: Supplicant connects → Authenticator sends EAP-Request/Identity → Supplicant sends credentials → Authenticator forwards to RADIUS → RADIUS validates → RADIUS sends Access-Accept or Access-Reject → Authenticator opens or blocks port.
802.1X Port States and MAB
MAB (MAC Authentication Bypass) is used for devices that can’t run 802.1X (printers, IP phones, cameras). The switch sends the device’s MAC address to RADIUS as the username and password. RADIUS checks a MAC database and grants or denies access.
MACsec: Layer 2 Encryption
MACsec (IEEE 802.1AE) provides hop-by-hop encryption at Layer 2. Unlike IPsec which encrypts at Layer 3, MACsec encrypts Ethernet frames between directly connected devices — switches, routers, and end devices. MACsec vs IPsec MACsec encrypts at Layer 2 — hop by hop between directly connected devices. IPsec encrypts at Layer 3 — end to end between IP endpoints. MACsec is faster (hardware-accelerated on modern switches) and protects against insider threats on the LAN. IPsec is used for WAN/VPN encryption.
Control Plane Policing (CoPP)
The control plane processes routing protocol packets, management traffic, and other CPU-bound traffic. Without protection, an attacker can flood the control plane and crash the router. CoPP applies QoS policies to control plane traffic to rate-limit or drop malicious traffic.
Flashcard Drill
RADIUS UDP 1812/1813 — encrypts password only. Used for network access (802.1X, VPN, wireless). TACACS+ TCP 49 — encrypts entire payload. Used for device administration (router/switch login, command authorization). 802.1X supplicant The end device requesting network access — must authenticate before the switch port opens. 802.1X authenticator The switch or AP enforcing access control — forwards EAP messages between supplicant and RADIUS. EAP-TLS Mutual certificate authentication — strongest EAP method. Both client and server present certificates. MAB MAC Authentication Bypass — for devices without 802.1X support. Switch sends MAC address to RADIUS as credentials. MACsec IEEE 802.1AE — Layer 2 hop-by-hop encryption using AES-GCM. Protects Ethernet frames between directly connected devices. CoPP Control Plane Policing — rate-limits traffic destined for the router CPU to prevent control plane exhaustion attacks. Guest VLAN 802.1X port state — assigned when no supplicant responds. Provides limited access for non-802.1X devices.
Knowledge Check — 12 Questions
Network Security: AAA, 802.1X & MACsec
Which AAA protocol encrypts the entire payload and is preferred for device administration?
- RADIUS
- TACACS+
- Diameter
- LDAP
Answer: TACACS+
TACACS+ uses TCP 49 and encrypts the entire payload — preferred for device administration (router/switch login and command authorization).
In 802.1X, which device forwards EAP messages between the supplicant and RADIUS server?
- Supplicant
- Authentication server
- Authenticator
- Certificate authority
Answer: Authenticator
The authenticator (switch or AP) is the middleman — it forwards EAP messages between the supplicant and the RADIUS authentication server.
Which EAP method requires both client and server certificates?
- PEAP
- EAP-MD5
- EAP-TLS
- EAP-FAST
Answer: EAP-TLS
EAP-TLS requires mutual certificate authentication — both the client and server present certificates. It is the strongest EAP method but requires a PKI.
What is MAB used for?
- Encrypting MAC addresses
- Authenticating devices that cannot run 802.1X
- Bypassing RADIUS authentication
- Assigning VLANs based on MAC address
Answer: Authenticating devices that cannot run 802.1X
MAB (MAC Authentication Bypass) allows devices without 802.1X support (printers, cameras) to authenticate using their MAC address.
What layer does MACsec encrypt at?
- Layer 1
- Layer 2
- Layer 3
- Layer 4
Answer: Layer 2
MACsec (IEEE 802.1AE) encrypts at Layer 2 — it encrypts Ethernet frames hop-by-hop between directly connected devices.
RADIUS uses UDP port _____ for authentication.
Answer: 1812
RADIUS uses UDP 1812 for authentication and authorization, and UDP 1813 for accounting.
What 802.1X port state is assigned when the RADIUS server is unreachable?
- Guest VLAN
- Auth-fail VLAN
- Critical VLAN
- Unauthorized
Answer: Critical VLAN
The Critical VLAN (also called Critical Authentication) is assigned when the RADIUS server is unreachable — maintains network access during an outage.
What is the purpose of CoPP?
- Encrypt control plane traffic
- Rate-limit traffic to the router CPU to prevent exhaustion attacks
- Prioritize routing protocol traffic
- Filter BGP routes
Answer: Rate-limit traffic to the router CPU to prevent exhaustion attacks
CoPP (Control Plane Policing) applies QoS policies to traffic destined for the router CPU, preventing attackers from overwhelming the control plane.
RADIUS encrypts the entire authentication packet.
- True
- False
Answer: False
RADIUS only encrypts the password field. TACACS+ encrypts the entire payload — this is a key difference between the two protocols.
Which protocol does MACsec use for key exchange?
- IKE
- MKA (MACsec Key Agreement)
- ISAKMP
- Diffie-Hellman directly
Answer: MKA (MACsec Key Agreement)
MKA (MACsec Key Agreement) is the key management protocol for MACsec. It typically uses 802.1X EAP-TLS to derive the session keys.
What is the key difference between MACsec and IPsec?
- MACsec is slower
- MACsec encrypts Layer 2 hop-by-hop; IPsec encrypts Layer 3 end-to-end
- IPsec is for LAN; MACsec is for WAN
- MACsec uses certificates; IPsec uses pre-shared keys
Answer: MACsec encrypts Layer 2 hop-by-hop; IPsec encrypts Layer 3 end-to-end
MACsec encrypts Ethernet frames between directly connected devices (hop-by-hop). IPsec encrypts IP packets between endpoints (end-to-end).
Which 802.1X port state provides limited access when authentication fails?
- Guest VLAN
- Auth-fail VLAN
- Critical VLAN
- Unauthorized
Answer: Auth-fail VLAN
The Auth-fail VLAN is assigned when authentication fails (wrong credentials). It provides limited access for troubleshooting.
Previous lesson: QoS: classification, marking (DSCP/CoS), queuing (CBWFQ/LLQ), policing, shaping, congestion avoidance
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: SD-WAN architecture: vEdge, vSmart, vBond, vManage; overlay/underlay, OMP, policies