ccna 200-301: lab assessments online

ccna 200-301: lab assessments online.5.1 Configuring Server-Based AAA Authorization3.5.1.1 Introduction to Server-Based AAA AuthorizationWhile authentication is concerned with ensuring that a device or end user is legitimate, authorization is concerned with allowing and disallowing access to authenticated users.3.5 Server-Based AAA Authorization and Auditing 77access to specific areas and processes on the network.The TACACS+ protocol allows authentication to be separated from authorization. A router can be configured to restrict users to perform only specific functions after they have been successfully authenticated. Authorization can be configured in both character mode (perform authorization) and packet mode (network authorization). Remember that RADIUS does not separate authentication from the authorization process.Another important aspect of authorization is the ability to control user access to specific services. Controlling access to configuration commands greatly simplifies the security of infrastructure in large enterprise networks. Cisco Security Per-user privilege settings on ACS simplify the configuration of network devices.For example, an authorized user can be allowed to use the showversion command but not the configureterminal command. The router learns which commands a user can execute by querying the ACS. The ACS sends an ACCEPT response when the user executes the showversion command, and a REJECT response if the user executes the configure terminal command.TACACS+ creates a new TCP session for each authorization request by default, which can create a delay while the user enters commands. Cisco Security ACS improves performance by supporting persistent TCP sessions.3.5.1.2 AAA Authorization Types