Network Authentication

A user or device receives network access after presenting credentials and having them checked. Credentials may include a password, certificate, or hardware token; biometrics can serve as one factor in the authentication process. The system compares the data with a directory or another identity source before making an access decision. This step can apply to wired access, Wi-Fi, a VPN tunnel, or a managed device. The authentication result is normally passed to the authorization component.

verifies the identity of an entity attempting to connect. It protects financial data, intellectual property, and personal information held in corporate networks. An open network jack or publicly available Wi-Fi without identity checks can expose these resources to unauthorized users. Authentication does not determine the permitted operations; authorization is a separate stage. The result can also select a device or session policy, such as a VLAN or access-control profile. It may be recorded for later auditing.

AAA Model: Access Control

Network access can be described with the AAA model: Authentication, Authorization, and Accounting. These functions cover identity verification, permission assignment, and session records. Separating the functions helps assign responsibility and analyze events. Each function can use separate rules and data sources.

1. Authentication: Identity Verification

The first step confirms that a user or device is what it claims to be. NIST distinguishes factors based on knowledge, possession, and an inherent characteristic. Digital credentials can take several forms, and the method should match the risk of the protected resource:

Something you know: This includes passwords and PINs. The factor can be weak when users choose easily guessed passwords. Password policy and attempt limits affect its resistance.
Something you have:This is a physical object in the user's possession, such as a smart card, hardware security token, or smartphone receiving a one-time passcode. A lost device must be revoked and replaced.
Something you are: This involves biometric characteristics used to verify a person, such as a fingerprint, facial image, or iris image. Biometric templates require protection and a suitable account-recovery process.

Multi-Factor Authentication (MFA) uses at least two factors from different categories. For example, system access may require a password (something you know) and a code from a phone (something you have). Two credentials from the same category do not provide full MFA.

2. Authorization: Defining Your Permissions

After identity is confirmed, the system determines which operations and resources are available. This is authorization. Permissions can depend on the user role, group, device, location, and session state. A policy can apply least privilege and limit access to the required scope.

In a network, authorization defines a user's level of access. After authenticating, a central server instructs the network equipment (like a switch or access point) what rules to apply. This can include:

Assigning the user to a specific Virtual LAN (VLAN), for example, placing finance department employees in the secure 'Finance_VLAN'.
Applying specific Access Control Lists (ACLs) or firewall rules to their connection, with separate inbound and outbound rules where supported.
Implementing Quality of Service (QoS) policies to prioritize their traffic (e.g., giving higher priority to a manager's VoIP phone calls).

3. Accounting: Tracking Your Activity

The final pillar is accounting, which involves collecting and logging data about the user's session. A record can contain session start and stop events, used resources, and commands issued during administrative access.

Network accounting tracks metrics like session duration, transferred data, accessed resources, and issued commands, especially for administrative access to devices. This data is used to compare activity with policy and for:

Security Auditing and Forensics: Investigating security incidents by providing a clear trail of activity.
Billing: Charging users based on their network usage, as is common with internet service providers.
Capacity Planning: Analyzing usage patterns to plan for future network upgrades.

RADIUS and TACACS+: AAA Protocols

Centralized AAA protocols support identity verification, permission assignment, and session records. RADIUS is commonly used for network access, while TACACS+ is commonly used for device administration. The choice depends on supported methods, transport requirements, and the permission model.

RADIUS (Remote Authentication Dial-In User Service)

is a client/server protocol used for centralized AAA in network access. Switches and wireless access points act as RADIUS clients and forward requests to a server. The server can use a user database, directory, and security policies, makes the access decision, and sends a response to the client. Messages include Access-Request, Access-Accept, and Access-Reject; EAP exchanges can also use Access-Challenge. Classic RADIUS commonly uses UDP, with port 1812 for authentication and 1813 for accounting.

An 'Access-Accept' packet sent from the server to the switch can contain the authentication result and authorization attributes, such as a VLAN or ACL. In classic RADIUS, the User-Password attribute is protected by the mechanism specified by the protocol, but this does not encrypt the entire packet. Other data requires transport protection or a newer RADIUS variant supported by the deployment. The transport and method must match the credential-protection requirements of the deployment.

TACACS+ (Terminal Access Controller Access-Control System Plus)

is a protocol developed by Cisco and used primarily for centralized administrative access to routers, switches, and other devices. RADIUS is more common for network access, while TACACS+ can control device logins and command permissions. Classic TACACS+ uses TCP port 49. The TACACS+ over TLS 1.3 profile protects the communication at the TLS layer.

TACACS+ has several properties that distinguish it from RADIUS in this context:

Separation of AAA: TACACS+ treats authentication, authorization, and accounting as separate processes. After authentication, a separate stage can determine privileges for individual commands, while accounting is handled independently. This supports granular administrative control.
Protection of message contents: Classic TACACS+ obfuscates the packet body exchanged by the device and server, but this is not modern encryption that provides confidentiality and integrity. TACACS+ transported through TLS 1.3 provides protection at the TLS layer, including confidentiality and communication integrity.
TCP transport: TACACS+ uses TCP, so the communication has connection-oriented transport and reliable delivery mechanisms. Classic RADIUS uses UDP, so retransmission and reliability are handled by the RADIUS protocol or deployment.

EAP and 802.1X: Access Control Frameworks

RADIUS provides communication with the server, while the end device and the switch or access point need rules for exchanging authentication messages. The Extensible Authentication Protocol (EAP) and IEEE 802.1X provide these functions. EAP defines the message exchange, while 802.1X binds the decision to a LAN or WLAN port.

EAP (Extensible Authentication Protocol)

is not an authentication method. It defines an exchange framework in which a client and server can negotiate one of the EAP methods. Individual methods provide different security properties and requirements. The choice affects certificate management, credential protection, and the identity source used by the server.

Popular EAP methods include:

EAP-TLS (Transport Layer Security): It requires a digital certificate on the server and client, enabling mutual authentication when both sides validate the certificates. Certificate lifecycle management is part of the deployment.
PEAP (Protected EAP): The server presents a certificate to the client and creates a TLS tunnel. Inside the tunnel, the client can use an inner method, often a username and password (MS-CHAPv2). The client should validate the server certificate.
EAP-TTLS (Tunneled TLS): It similarly creates a TLS tunnel but allows a wider choice of inner authentication methods. The inner method is negotiated inside the tunnel, and both sides must use compatible configuration.

IEEE 802.1X: Port-Based Access Control

is the standard that brings authentication to the physical point of connection. It defines a mechanism for Port-Based Network Access Control (PNAC), in which controlled and uncontrolled ports have different permitted traffic.

When a device plugs into an 802.1X-enabled switch port, the port initially blocks user traffic and allows EAPOL messages. The switch, acting as the authenticator, relays the EAP exchange to a RADIUS server. After successful authentication and an 'Access-Accept' response, it configures the port and permits normal traffic according to assigned VLAN, ACL, or QoS parameters. After rejection, the port remains restricted or can be placed in a guest or quarantine network, depending on policy.

Example Authentication Flow

The following flow shows these components in a corporate environment. An employee tries to connect a laptop to the company Wi-Fi. After the session, the device also sends accounting data.

Connection Attempt: The employee selects the corporate Wi-Fi SSID. The employee's laptop (the supplicant) attempts to connect to a wireless access point (the authenticator).
802.1X Initiation: The access point detects the new device. Because the network uses WPA2/WPA3-Enterprise, the AP starts 802.1X, blocks regular traffic, and sends an EAP identity request to the laptop.
EAP/RADIUS Conversation: The laptop responds with a username. The AP wraps the EAP message in a RADIUS 'Access-Request' packet and sends it to the central RADIUS server. The server begins PEAP and creates a TLS tunnel with the laptop, relaying messages through the AP.
Credential Verification: Inside the TLS tunnel, the laptop sends a password. The RADIUS server verifies the username and password against the company's Active Directory.
Authorization Decision: After successful verification, the RADIUS server sends a 'RADIUS Access-Accept' packet with authorization attributes to the access point. Based on the user's membership in the marketing department, the server assigns 'VLAN 30' (Marketing) and the 'Marketing-ACL'.
Access Granted: The access point applies the VLAN and ACL settings to the wireless session and passes an EAP-Success message. The laptop receives the access level assigned to the user's role.
Accounting Start: The access point sends a 'RADIUS Accounting-Start' packet to the server to record the session start, device address, and assigned parameters. After disconnection, it sends an 'Accounting-Stop' packet, completing the AAA record.