16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+

16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 5.1 (configure and verify device access control: 5.1.a lines and local user authentication, 5.1.b authentication and authorization using AAA) requires network engineers to configure and verify device access control, device hardening, and the Authentication, Authorization, and Accounting (AAA) framework. Candidates must master local infrastructure security baselines, password encryption algorithms (Type 7 vs. Type 5 vs. Type 8/9), Management Plane Protection (MPP), the protocol mechanics of RADIUS (RFC 2865/2866) versus TACACS+ (RFC 8907), Cisco Identity Services Engine (ISE) integration, and the transition from legacy hierarchical privilege levels (0–15) to granular Cisco IOS Parser Views and Role-Based Access Control (RBAC).

Securing enterprise infrastructure begins with hardening the network devices themselves. Routers and switches operate across three distinct functional planes: the Data Plane (hardware forwarding of user traffic), the Control Plane (routing protocols, signaling, and path computation), and the Management Plane (administrative access, monitoring, and orchestration). Compromise of the management plane grants an adversary complete control over the infrastructure, rendering data plane security controls obsolete.

+---------------------------------------------------------------------------------------------------+
|                         CISCO DEVICE HARDENING & MANAGEMENT PLANE PROTECTION                      |
+---------------------------------------------------------------------------------------------------+
|                                                                                                   |
|  [ IN-BAND MANAGEMENT ]                                 [ OUT-OF-BAND (OOB) MANAGEMENT ]          |
|   - Loopback / SVI Interface (Dedicated Mgmt VRF)        - Dedicated Physical Mgmt Port (Gig0/0)  |
|   - Strict Ingress Management Plane Protection (MPP)     - Completely Isolated L2/L3 Network      |
|   - Restrict to SSHv2 / HTTPS / SNMPv3 Only              - Zero Routing to User Data Planes       |
|                                                                                                   |
|  ================================== CISCO IOS-XE DEVICE HARDENING ===============================  |
|  |  [ LOCAL ACCESS CONTROLS ]                                                                   |  |
|  |   - 'service password-encryption' (Type 7 Obfuscation - REVERSIBLE, DO NOT RELY ON FOR ROOT) |  |
|  |   - 'enable algorithm-type scrypt secret' (Type 9 scrypt) / 'sha256' (Type 8 PBKDF2)         |  |
|  |   - VTY Line Protection: 'transport input ssh', 'exec-timeout 10 0', 'access-class' ACL       |  |
|  |   - Login Enhancements: 'login block-for 300 attempts 3 within 60' (DoS / Brute-Force Guard)  |  |
|  |   - Legal Notification Banners: 'banner motd', 'banner login' (Avoid 'Welcome' wording)       |  |
|  |                                                                                              |  |
|  |  [ SERVICE MINIMIZATION (ATTACK SURFACE REDUCTION) ]                                         |  |
|  |   - 'no ip http server' / 'ip http secure-server' (Disable cleartext HTTP)                   |  |
|  |   - 'no ip finger', 'no ip source-route', 'no ip bootp server', 'no service config'          |  |
|  |   - 'no cdp run' (on external untrusted perimeter interfaces)                                |  |
|  |   - NTP Authentication & Access-Groups: 'ntp authenticate', 'ntp access-group peer <ACL>'    |  |
|  ==============================================================================================  |
|                                                                                                   |
|  [ CENTRALIZED AAA & IDENTITY ]                                                                   |
|   - TACACS+ (TCP 49): Device Admin, Granular Per-Command Authz, Full Payload Encryption           |
|   - RADIUS (UDP 1812/1813): 802.1X Network Access, WebAuth, Password-Only MD5 Encryption          |
|   - Cisco ISE: Centralized Policy Administration Node (PAN) & Policy Service Node (PSN) Clustered |
+---------------------------------------------------------------------------------------------------+

1. Local Device Hardening & Cryptographic Password Security

To establish a defensible baseline, unneeded legacy network services must be disabled, console and virtual terminal (VTY) lines locked down, and strong cryptographic algorithms enforced for all stored credentials.

Cisco Password Encryption Types and Hashing Algorithms

Cisco IOS-XE supports multiple credential storage formats, each identified by a numeric prefix in the running configuration:

! Modern Recommended Password Hardening Configuration
Router(config)# service password-encryption
Router(config)# enable algorithm-type scrypt secret C!scoSecur1ty#2026
Router(config)# username admin algorithm-type scrypt privilege 15 secret AdminStr0ngP@ss#99

Management Plane Protection (MPP) & Login Enhancements

• Management Plane Protection (MPP): Restricts which physical or logical interfaces accept incoming management traffic (SSH, Telnet, SNMP, HTTP, HTTPS). For example, MPP can dictate that SSH is permitted exclusively on GigabitEthernet0/0 (dedicated Out-of-Band management port) or Loopback0, instantly dropping management packets arriving on transit data interfaces.
• Login Enhancements (Quiet Mode): Defends against automated brute-force attacks by locking out login attempts if repeated authentication failures occur:

  Router(config)# login block-for 300 attempts 3 within 60
  Router(config)# login quiet-mode access-class ADMIN-HOSTS
  Router(config)# login delay 2
  Router(config)# login on-failure log
  Router(config)# login on-success log
  

  • login block-for 300 attempts 3 within 60: If 3 failed login attempts occur within 60 seconds, the router enters Quiet Mode for 300 seconds (5 minutes), dropping all non-exempt VTY login attempts.
  • login quiet-mode access-class ADMIN-HOSTS: Allows trusted administrative hosts defined in the specified ACL to bypass Quiet Mode lockouts.

Network Time Protocol (NTP) Security

Accurate, tamper-proof timestamps are mandatory for syslog analysis, digital certificate validation (X.509 PKI), and audit compliance:

1. NTP Authentication: Ensures clock updates are accepted only from authorized NTP servers possessing the shared symmetric key:

   Router(config)# ntp authenticate
   Router(config)# ntp authentication-key 1 md5 CiscoNTPKey#2026
   Router(config)# ntp trusted-key 1
   Router(config)# ntp server 10.1.100.50 key 1
   

2. NTP Access-Groups: Restricts NTP control packets using four hierarchical access levels:
   • peer: Allows time synchronization and allows the router to respond to time requests and control queries.
   • serve: Prevents synchronization from the remote host, but allows the router to serve time and respond to control queries.
   • serve-only: Allows the router only to serve time to the remote host (no control queries).
   • query-only: Allows the router only to query the remote host for control/status information.

2. AAA Security Architecture & Method List Fallback Mechanics

The AAA (Authentication, Authorization, and Accounting) framework provides a modular, scalable architecture for controlling access to network infrastructure:

+---------------------------------------------------------------------------------------------------+
|                             THE THREE PILLARS OF AAA ARCHITECTURE                                 |
+---------------------------------------------------------------------------------------------------+
|  1. AUTHENTICATION (Who are you?)                                                                 |
|     - Verifies the identity of the user, administrator, or connecting endpoint.                   |
|     - Mechanisms: Local database usernames/secrets, RADIUS/TACACS+ credentials, 802.1X EAP certs.|
|                                                                                                   |
|  2. AUTHORIZATION (What are you allowed to do?)                                                   |
|     - Determines which services, commands, privilege levels, or network resources are permitted.  |
|     - Mechanisms: Downloadable ACLs (dACLs), SGT tags, per-command authorization, AV-pairs.       |
|                                                                                                   |
|  3. ACCOUNTING (What did you do?)                                                                 |
|     - Records what the user executed, when they logged in, session duration, and data exchanged.  |
|     - Mechanisms: Start-Stop records, command execution audit logs, RADIUS session accounting.   |
+---------------------------------------------------------------------------------------------------+

Method Lists and Fallback Logic

In Cisco IOS-XE, AAA policies are applied through Method Lists. A method list defines a sequential list of authentication or authorization methods to query:

• Default Method List: Automatically applied to all interfaces and lines unless explicitly overridden (aaa authentication login default group ISE-TACACS local).
• Named Method List: A custom list applied explicitly to specific interfaces, line VTYs, or console ports (aaa authentication login VTY-LOGIN group ISE-TACACS local).

[!CRITICAL] The Fallback Golden Rule: Cisco IOS-XE method lists proceed to the next method in the sequence ONLY if the preceding server/method is completely UNRESPONSIVE or UNREACHABLE (e.g., network timeout, server down). If the primary server responds with an AUTHENTICATION REJECT / ACCESS-DENIED (such as an incorrect password or disabled user account), the authentication process TERMINATES IMMEDIATELY and access is denied. It will NEVER fall back to subsequent methods upon a rejection.

3. RADIUS vs. TACACS+: Protocol Deep-Dive

Network administrators must select the appropriate security protocol based on whether the objective is Device Administration or Network Access Control.

+---------------------------------------------------------------------------------------------------+
|                         RADIUS VS. TACACS+ ARCHITECTURAL COMPARISON                               |
+---------------------------------------------------------------------------------------------------+
|  Architectural Feature      | RADIUS (RFC 2865 / RFC 2866)        | TACACS+ (RFC 8907 / Cisco)    |
| :-------------------------- | :---------------------------------- | :---------------------------- |
| **Primary Standard**        | IETF Open Standard (RFC 2865/2866)   | Cisco Open Standard (RFC 8907)|
| **Transport Layer & Port**  | UDP Port 1812 (Auth/Authz)          | TCP Port 49                   |
|                             | UDP Port 1813 (Accounting)          | (Reliable connection-oriented)|
|                             | *(Legacy: UDP 1645 / 1646)*         |                               |
| **Packet Encryption**       | **Password Field Only**             | **Entire Packet Payload**     |
|                             | (Rest of packet is CLEARTEXT)       | (Only 12-byte header clear)   |
| **AAA Separation**          | **Coupled:** Combines Auth & Authz  | **Decoupled:** Strict separate|
|                             | into single Access-Request/Accept   | Auth, Authz, and Acct phases  |
| **Command Authorization**   | No (Impractical / Unscalable)       | **Yes: Per-Command Authz**    |
|                             | (Only assigns privilege level)      | (Queries server on every CLI) |
| **Primary Enterprise Role** | **Network Access Control (NAC)**    | **Device Administration**     |
|                             | (802.1X, Wireless, VPN, WebAuth)    | (Router/Switch CLI admin)     |
+---------------------------------------------------------------------------------------------------+

Packet Encryption Differences & Security Implications

• RADIUS Cryptography: RADIUS encapsulates the user password inside an encrypted attribute using an MD5-based XOR stream cipher derived from the shared secret and request authenticator. However, all other packet fields—including the username, client IP address, queried services, vendor-specific attributes (VSAs), and authorization attributes—are transmitted across the wire in unencrypted plain text. An eavesdropper sniffing the management VLAN can intercept user identities and network topology metadata.
• TACACS+ Cryptography: TACACS+ encrypts the entire body / payload of every packet using MD5 with the shared secret key. Only the standard 12-byte TACACS+ header (containing the sequence number, flags, session ID, and encrypted payload length) is visible in cleartext. This prevents unauthorized inspection of usernames, executed CLI commands, and server authorization responses.

Decoupled AAA vs. Coupled Architecture

• In TACACS+, because authentication, authorization, and accounting are fully independent, a device can authenticate a user locally (or via Kerberos) and then query TACACS+ exclusively for command authorization. Furthermore, during an active management session, every single command typed by an engineer (e.g., show running-config or reload) triggers an independent AUTHORIZATION-REQUEST to the TACACS+ server, allowing Cisco ISE to approve or deny individual commands in real time.
• In RADIUS, authentication and authorization are inherently coupled. When the authentication server returns an Access-Accept, it embeds all authorization attributes (such as VLAN ID or downloadable ACL) inside the same packet. RADIUS cannot perform per-command authorization.

4. Privilege Levels (0–15) vs. Cisco IOS Parser Views (RBAC)

Granular administrative access can be enforced using legacy privilege levels or modern Cisco IOS Parser Views.

Legacy Privilege Levels (0 to 15)

Cisco IOS historically provides 16 hierarchical privilege levels:

• Level 0 (Reserved): Minimal basic access. Includes only enable, exit, help, and logout.
• Level 1 (Default User EXEC): Normal non-privileged mode (Router>). Allows basic monitoring (show commands without sensitive info, ping).
• Level 15 (Privileged EXEC / Enable): Full administrative root access (Router#). Unrestricted access to all configuration and debug commands.
• Levels 2 through 14 (Custom User Levels): Can be defined manually (privilege exec level 5 show ip route).

+---------------------------------------------------------------------------------------------------+
|                         CRITICAL LIMITATIONS OF HIERARCHICAL PRIVILEGE LEVELS                     |
+---------------------------------------------------------------------------------------------------+
|  1. Strict Hierarchical Inheritance:                                                              |
|     Higher privilege levels automatically inherit ALL commands assigned to lower levels. For       |
|     example, a Level 10 user inherently possesses all Level 1 through Level 9 commands.          |
|                                                                                                   |
|  2. Configuration Fragility:                                                                      |
|     Assigning multi-word subcommands (e.g., 'show ip ospf neighbor') requires manually granting   |
|     every parent keyword ('show', 'show ip', 'show ip ospf'), often accidentally exposing        |
|     unintended commands.                                                                          |
|                                                                                                   |
|  3. Lack of True Role Separation:                                                                 |
|     Impossible to create two distinct roles at the same level (e.g., Tier-1 Helpdesk vs Junior   |
|     Security Admin) with mutually exclusive command subsets using privilege levels alone.        |
+---------------------------------------------------------------------------------------------------+

Cisco IOS Parser Views & Role-Based Access Control (RBAC)

Cisco IOS Parser Views provide true Role-Based Access Control (RBAC) by creating explicit, non-hierarchical command profiles without privilege level constraints.

+---------------------------------------------------------------------------------------------------+
|                             PARSER VIEW ARCHITECTURE & TYPES                                      |
+---------------------------------------------------------------------------------------------------+
|  View Type      | Operational Characteristics & Functionality                                     |
| :-------------- | :------------------------------------------------------------------------------- |
| **Root View**   | The master view (equivalent to Level 15). Required to create, edit, or delete    |
|                 | other parser views. Activated using 'enable view'.                               |
| **Parser View** | A custom, granular role profile containing explicitly included/excluded CLI      |
|                 | commands (e.g., NOC-VIEW permitting only interface bouncing and routing checks). |
| **Superview**   | An administrative aggregation view that combines multiple existing parser views   |
|                 | into a unified profile (e.g., combining NOC-VIEW and SECURITY-VIEW).             |
+---------------------------------------------------------------------------------------------------+

! Configuring Cisco IOS Parser Views (RBAC)
Router(config)# aaa new-model
Router(config)# enable view
Password: <Root-Password>
!
! Create Granular NOC View
Router(config)# parser view NOC-VIEW
Router(config-view)# secret NOCViewP@ss#2026
Router(config-view)# commands exec include show ip route
Router(config-view)# commands exec include show ip interface brief
Router(config-view)# commands exec include show interface
Router(config-view)# commands exec include ping
Router(config-view)# commands exec include traceroute
Router(config-view)# commands exec include clear ip ospf process
!
! Create Superview Combining Multiple Roles
Router(config)# parser view SENIOR-OPERATIONS superview
Router(config-view)# secret SuperViewP@ss#2026
Router(config-view)# view NOC-VIEW
Router(config-view)# view SECURITY-MONITOR-VIEW

5. Cisco IOS-XE AAA & ISE Integration Configuration

Deploying enterprise AAA on Cisco IOS-XE requires defining server groups, configuring dead-server detection parameters, and applying method lists across device access lines.

! Step 1: Enable AAA Subsystem
aaa new-model
!
! Step 2: Configure TACACS+ Servers (Cisco ISE Policy Service Nodes)
tacacs server ISE-PSN-01
 address ipv4 10.1.100.21
 key 6 05280F1C22435B ! Type 6 Encrypted Pre-Shared Secret Key
 timeout 3
tacacs server ISE-PSN-02
 address ipv4 10.1.100.22
 key 6 05280F1C22435B
 timeout 3
!
! Step 3: Group TACACS+ Servers with Automated Dead-Server Detection
aaa group server tacacs+ TACACS-ISE-CLUSTER
 server name ISE-PSN-01
 server name ISE-PSN-02
 ip tacacs source-interface Loopback0
 deadtime 15
!
! Step 4: Configure RADIUS Servers for Network Access / 802.1X
radius server ISE-RADIUS-01
 address ipv4 10.1.100.21 auth-port 1812 acct-port 1813
 key 6 070C285F4D0648
 timeout 3
 retransmit 2
radius server ISE-RADIUS-02
 address ipv4 10.1.100.22 auth-port 1812 acct-port 1813
 key 6 070C285F4D0648
 timeout 3
 retransmit 2
!
aaa group server radius RADIUS-ISE-CLUSTER
 server name ISE-RADIUS-01
 server name ISE-RADIUS-02
 ip radius source-interface Loopback0
!
! Step 5: Define AAA Method Lists with Deterministic Fallback to Local DB
aaa authentication login default group TACACS-ISE-CLUSTER local
aaa authentication login CONSOLE-AUTH none
aaa authorization exec default group TACACS-ISE-CLUSTER local
aaa authorization commands 15 default group TACACS-ISE-CLUSTER local
aaa accounting exec default start-stop group TACACS-ISE-CLUSTER
aaa accounting commands 15 default start-stop group TACACS-ISE-CLUSTER
!
! Step 6: Apply Method Lists to Console and VTY Lines
line con 0
 exec-timeout 10 0
 login authentication CONSOLE-AUTH
line vty 0 15
 exec-timeout 10 0
 transport input ssh
 login authentication default
 authorization exec default
 authorization commands 15 default

Operational Verification Commands

Router# show aaa servers
TACACS+ Server: ISE-PSN-01 (10.1.100.21:49) 
  Socket opens: 142, Socket closes: 142, Socket aborts: 0
  Socket errors: 0, Socket Timeouts: 0
  Failed connects: 0, Total messages sent: 420, Total messages recv: 420
  State: ALIVE
TACACS+ Server: ISE-PSN-02 (10.1.100.22:49)
  State: ALIVE

Router# test aaa group TACACS-ISE-CLUSTER admin C!scoSecur1ty#2026 legacy
Attempting authentication test to server-group TACACS-ISE-CLUSTER using tacacs+
User was successfully authenticated.