Cisco 2509 - Router - EN User Manual page 47

Chapter 1 Overview of Cisco Secure ACS
Basic Password Configurations
Note
Advanced Password Configurations
78-14696-01, Version 3.1
There are several basic password configurations:
These configurations are all classed as inbound authentication.
• Single password for ASCII/PAP/CHAP/MS-CHAP/ARAP—This is the
most convenient method for both the administrator when setting up accounts
and the user when obtaining authentication. However, because the CHAP
password is the same as the PAP password, and the PAP password is
transmitted in clear text during an ASCII/PAP login, there is the chance that
the CHAP password can be compromised.
Separate passwords for ASCII/PAP and CHAP/MS-CHAP/ARAP—For a
•
higher level of security, users can be given two separate passwords. If the
ASCII/PAP password is compromised, the CHAP/ARAP password can
remain secure.
External user database authentication—For authentication by an external
•
user database, the user does not need a password stored in the CiscoSecure
user database. Instead, Cisco Secure ACS records which external user
database it should query to authenticate the user.
Cisco Secure ACS supports the following advanced password configurations:
Inbound passwords—Passwords used by most Cisco Secure ACS users.
•
These are supported by both the TACACS+ and RADIUS protocols. They are
held internally to the CiscoSecure user database and are not usually given up
to an external source if an outbound password has been configured.
• Outbound passwords—The TACACS+ protocol supports outbound
passwords that can be used, for example, when a AAA client has to be
authenticated by another AAA client and end-user client. Passwords from the
CiscoSecure user database are then sent back to the second AAA client and
end-user client.
Token caching—When token caching is enabled, ISDN users can connect
•
(for a limited time) a second B Channel using the same OTP entered during
original authentication. For greater security, the B-Channel authentication
request from the AAA client should include the OTP in the username value
User Guide for Cisco Secure ACS for Windows Server
AAA Server Functions and Concepts
1-13