Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network security architect must implement centralized AAA management for network administrators executing commands on enterprise routers across loss-prone WAN links. The solution must support per-command authorization policy enforcement, encrypt the entire packet payload during transit, and use a reliable connection-oriented transport protocol to guarantee delivery of accounting records. Which protocol and transport combination should the architect deploy?

  1. TACACS+ utilizing TCP port 49Answer
  2. B
    RADIUS utilizing UDP ports 1812 and 1813
  3. C
    TACACS+ utilizing UDP ports 1812 and 1813
  4. D
    RADIUS utilizing TCP port 49

Answer

TACACS+ utilizing TCP port 49
TACACS+ (Terminal Access Controller Access-Control System Plus) fully decouples the AAA functions, enabling separate per-command authorization checks for router administration. It encrypts the complete packet payload (except the standard header) and uses connection-oriented TCP on port 49, satisfying the WAN reliability and accounting delivery requirements.

Step-by-Step Solution

1
Analyze access control and authorization requirements
Identified requirement for granular per-command CLI authorization.
TACACS+ separates authorization from authentication, allowing distinct CLI command permission checks, whereas RADIUS couples them together.
2
Evaluate payload encryption requirements
Identified requirement for full packet payload encryption.
TACACS+ encrypts the entire payload body of the packet, while RADIUS only encrypts the password attribute in transit.
3
Determine transport protocol and port specifications
Selected TCP over port 49.
TACACS+ runs natively on connection-oriented TCP port 49 to provide reliable transmission over lossy WAN links.

Key Concept

Decoupled AAA architecture, payload encryption scope, and transport protocol characteristics of TACACS+ versus RADIUS.
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic