3

I'm trying to learn how can one protect routers (using Cisco Packet Tracer) and I found out I can set local password to authenticate access to the router privileged and configuration mode. However, I see I can also do it using a RADIUS Server.

The thing that I don't understand is how this last method is better in terms of security than local authentication. I know the password and username are sent to the RADIUS Server encrypted using a shared secret between server and router, in this case, but if you authenticate locally no-one can sniff your packets anyway, so I don't see the point. I guess it's something related to remote access to configurate the router (not sure though), but again I don't understand what would you gain in this case if you used RADIUS vs local.

  • 1
    With a RADIUS server, you an have a single point for authentication of all your devices and other things, e.g 802.1X. If you have a dozen routers and 100 switches, you do not need to change every one of them for account maintenance. – Ron Maupin Dec 15 '18 at 21:54
  • thanks for the answer, but in the case you had only one device you want to authenticate to, how would RADIUS be better than local? @RonMaupin – Johnny Dec 15 '18 at 22:17
  • For a single device, it would be unusual to use a RADIUS server, unless you already have one for a different purpose, then it may make sense to do all your authentication on a single infrastructure. – Ron Maupin Dec 15 '18 at 22:19
2

There are two main benefits:

  • Convenience, which for managing large numbers of networking equipment means that everything is up-to-date and not missed.
  • Single point of reference which can be instantly changed.

The second is extremely important for personnel changes. When a trusted employee leaves, it's common practice to immediately remove their security access. It's only respectful: if something goes wrong in the following period, this ensures that they are excluded from suspicion.

  • Thanks!! So I guess the security benefits are not related to remote access to the router and that the encryption using the shared secret is only used to ensure the confidentiality in the exchange of credentials and not an improvement of the local authentication, right? @jonathanjo – Johnny Dec 15 '18 at 22:15
  • That's correct: the benefits of RADIUS/TACACS+/LDAP are all in the fact you have up-to-date central information. The risks of interception and eavesdropping are normally addressed by having a management network, as inaccessible as possible to potential intruders. – jonathanjo Dec 15 '18 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.