Pass your certification exam. Faster. Guaranteed.

ACF M21 - Remote Authentication Services.mp4 Transcription

Welcome to our Remote Authentication Services module. As working from remote locations becomes more popular, it is important that we have a centralized system to provide for authentication, authorization, and accounting. We commonly refer to these devices as triple a servers, which are responsible for those three tasks. Authentication, authorization, and accounting.

And this is usually for wi-fi networks or VPN clients, or sometimes for both. With these systems the authentication credentials can be stored on one security server, rather than having to store the credentials on every individual device such as on each wireless router. This makes the management process much more streamlined.

Enterprise versions of WPA, Wi-Fi Protected Access, or WPA 2 support the IEEE 802.1x standard which allows users to be authenticated with individual user names and passwords, or even digital certificates to a central AAA server. This is much better than the traditional access where a user clicks on the network name and then enters a pre-shared key.

With that type of system it is easy for attackers to break the security, and also there is no accountability for which individual user is taking which action since all of the users are sharing the same key. TACACS+ is a Cisco technology. And stands for Terminal Access Controller Access Control System Plus.

This is a proprietary authentication protocol that is used to authenticate remote users. It splits up the authentication, authorization, and auditing features, and does have stronger encryption for the authentication traffic to avoid unauthorized individuals gaining access to the system. And it also uses public key infrastructure credentials in the form of digital certificates.

The Remote Authentication Dial-In User Service or RADIUS was originally used by dial-up users connecting with their modems to their corporate networks. But now we primarily use it for wi-fi and virtual private networks. Users will connect to a radius client, which is an authenticator that communicates with a radius server to verify that their credentials are valid.

Radius servers will typically have a database of users, and their credentials who are permitted to remotely access the system. Or they can be integrated with Microsoft active directory so that administrators do not have to manage two separate databases of users. The communication that occurs on your local area network between the radius server, and the radius client is protected by a simple pre-shared key to avoid eavesdropping.

Diameter was developed as an improvement to radius. An easy way to remember this is that in geometry the diameter is double the radius. This protocol was designed as a next generation of radius, but it's not backwards compatible with radius. It does offer an upgrade path to easily upgrade from radius to diameter when necessary.

It's much more flexible because it can authenticate with a lot of different types of devices over different types of connections. And diameter is mostly used by cellular service providers to authenticate their users. This concludes our remote authentication services model. Thank you for watching.