Examkin

Question

Difficulty: HardVirtual Private Networks and Remote Access Security

An enterprise is upgrading its remote access infrastructure for network administrators who connect via remote VPN sessions to manage core routers and firewalls. The security policy mandates a central AAA authentication service that encrypts the entire packet payload during communication between the VPN gateway and the authentication server, while also supporting granular, command-level authorization. Which protocol should the network engineer configure on the VPN gateway to meet these security requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    L2TP
  4. D
    Kerberos

Answer

TACACS+ is the correct protocol because it encrypts the entire packet payload and decouples authentication from authorization to allow per-command authorization for network management.
TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative access control over network infrastructure. It runs over TCP (port 49), encrypts the entire payload of every packet exchanged between the NAS (VPN gateway) and the AAA server, and cleanly separates authentication, authorization, and accounting. This architecture allows administrators to enforce per-command authorization policies for remote access users.

Step-by-Step Solution

1
Analyze the requirements for payload encryption in AAA server communication.
TACACS+ encrypts the complete body of the packet, whereas RADIUS encrypts only the password attribute.
Protecting all administrative data during AAA transmission requires full-payload encryption.
2
Evaluate protocol support for modular separation of AAA functions.
TACACS+ separates authentication, authorization, and accounting into distinct operations, enabling command-by-command authorization rules.
RADIUS combines authentication and authorization into single request/response pairs, preventing granular command-level restriction.
3
Select the protocol that satisfies both encryption and granular control constraints.
TACACS+ fulfills both requirements.
It runs over TCP port 49 and supports granular control with full-packet encryption.

Key Concept

TACACS+ vs RADIUS AAA Architecture in Remote Access Security
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic