Administrative access to a specific network device should be secured so that only authenticated users can access the device.
特定網路裝置的管理存取應加以保護，使只有經過驗證的使用者才能存取該裝置。
In a small network, local authentication is often used. When you have more than a few user accounts in a local device database, managing those user accounts becomes more complex. For example, if you have 100 network devices, adding one user account means that you have to add this user account on all 100 devices in the network. Also, when you add one network device to the network, you have to add all user accounts to the local device database to enable all users to access that device.
在小型網路中，通常會使用本地驗證。當本地裝置資料庫中的使用者帳號超過幾個時，管理這些帳號就會變得更複雜。舉例來說，如果你有 100 台網路裝置，新增一個使用者帳號就代表你必須在網路中所有 100 台裝置上都新增這個帳號。同樣地，當你在網路中新增一台網路裝置時，也必須把所有使用者帳號都加到該裝置的本地資料庫，才能讓所有使用者存取這台裝置。
Because maintaining the local database for each network device for the size of the network is usually not feasible, you can use an external authentication, authorization, and accounting (AAA) server that will manage all user and administrative access needs for an entire network.
由於依網路規模為每台網路裝置維護本地資料庫通常不可行，你可以使用外部的驗證、授權與記帳（AAA）伺服器，由它來管理整個網路的所有使用者與管理存取需求。
AAA refers to a security architecture for distributed systems that enables control over which users are allowed access to which services and keeps track of how many resources they have used. It is a framework that supports and provides these services:
AAA 是一種用於分散式系統的安全架構，可控管允許哪些使用者存取哪些服務，並追蹤他們使用了多少資源。它是一個支援並提供以下服務的框架：
- Authentication: This service identifies users, including login and password dialog, challenge and response, messaging support, and encryption, depending on the security protocol that you select.驗證（Authentication）：此服務用於識別使用者，包含登入與密碼對話、挑戰與回應、訊息支援，以及依你所選安全通訊協定而定的加密。
- Authorization: This service provides access control by assembling a set of attributes that describe what the user is authorized to perform.授權（Authorization）：此服務藉由組合一組屬性，描述該使用者被授權執行哪些動作，藉此提供存取控制。
- Accounting: This service provides the method for collecting information, logging the information locally, and sending the information to the AAA server for billing, auditing, and reporting.記帳（Accounting）：此服務提供收集資訊、在本地記錄資訊，並將資訊傳送到 AAA 伺服器以進行計費、稽核與報告的方法。
To better understand the three services, imagine attending an invitation-only event. Authentication can be compared to being stopped at the office lobby by a security guard. After you provide a driver’s license to validate that you are on the guest list, you are given an access badge. Authorization relates to which doors the access badge opens in the building. Your access is restricted by the badge policy. Accounting is the system that tracks your movements through the building and records which doors you accessed with your badge and whether access was permitted or denied.
為了更容易理解這三種服務，可以想像參加一場僅限受邀者出席的活動。驗證就像在辦公室大廳被保全人員攔下，你出示駕照以證明自己在賓客名單上之後，會拿到一張門禁識別證。授權則與這張識別證能開啟大樓中哪些門有關，你的存取範圍受到識別證政策的限制。記帳則是追蹤你在大樓內移動狀況的系統，記錄你用識別證進出過哪些門，以及該次存取是被允許還是被拒絕。
Here are the two most popular options for external AAA:
以下是兩種最常見的外部 AAA 選項：
- RADIUS:RADIUS is an open standard that combines authentication and authorization services as a single process—after users are authenticated, they are also authorized. It uses UDP for the authentication and authorization service.RADIUS：RADIUS 是一種開放標準，將驗證與授權服務合併為單一流程，使用者通過驗證後也同時獲得授權。它使用 UDP 提供驗證與授權服務。
- TACACS+: TACACS+ is a Cisco proprietary security mechanism that separates AAA services. Because it has separated services, you can, for example, use TACACS+ only for authorization and accounting, while using another method of authentication. It uses TCP for all three services.TACACS+：TACACS+ 是 Cisco 專屬的安全機制，將 AAA 服務分開處理。由於服務彼此分離，你可以只用 TACACS+ 處理授權與記帳，而驗證則使用其他方法。它針對這三種服務都使用 TCP。
By using the RADIUS or TACACS+ authentication, all authentication requests are relayed to the external server, which permits (access—allow) or denies (access—reject) the user according to its user database. The server then instructs the network device to permit or deny access.
使用 RADIUS 或 TACACS+ 驗證時，所有驗證請求都會轉送到外部伺服器，該伺服器會依其使用者資料庫允許（access-allow）或拒絕（access-reject）該使用者。伺服器接著會指示網路裝置允許或拒絕存取。
The figure shows the external authentication process:
下圖顯示外部驗證流程：
- A host connects to the network. At this point, the host is prompted for a username and password.主機連上網路。此時，主機會被要求輸入使用者名稱與密碼。
- The network device passes a RADIUS/TACACS+ access request, along with user credentials, to the authentication server.網路裝置會將 RADIUS/TACACS+ 存取請求連同使用者憑證一併傳送給驗證伺服器。
- The authentication server uses an identity that is stored to validate user credentials, and sends a RADIUS/TACACS+ response (Access-Accept or Access-Reject) to the network device.驗證伺服器使用儲存的身分資訊來驗證使用者憑證，並將 RADIUS/TACACS+ 回應（Access-Accept 或 Access-Reject）傳送給網路裝置。
- The network device will apply the decision.網路裝置會套用此決定。
IEEE 802.1X
IEEE 802.1X
The access layer is the point at which user devices connect to the network. This layer, therefore, is the connection point between the network and any client device. So, protecting the access layer is important for protecting other users, applications, and the network itself from human errors and malicious attacks. Network access control at the access layer can be managed by using the IEEE 802.1X protocol to secure the physical ports where end users connect. A network where each user is verified before they access it is called an identity-based network.
存取層是使用者裝置連接到網路的位置，因此這一層是網路與任何用戶端裝置之間的連接點。保護存取層對於保護其他使用者、應用程式以及網路本身，使其免受人為錯誤與惡意攻擊的影響，是十分重要的。存取層的網路存取控制可以透過 IEEE 802.1X 通訊協定來管理，以保護終端使用者連接的實體連接埠。每個使用者在存取網路前都會先經過驗證的網路，稱為身分識別網路（identity-based network）。
Identity-based networking allows you to verify users when they connect to a switch port. Identity-based networking authenticates users and places them in the right VLAN, based on their identity. Should any users fail to pass the authentication process, their access can be rejected, or they might be simply put in a guest VLAN.
身分識別網路可讓你在使用者連接到交換器連接埠時進行驗證。身分識別網路會驗證使用者，並依其身分將其放入正確的 VLAN。若有使用者未通過驗證流程，其存取可能會被拒絕，或者僅被放入來賓 VLAN。
The IEEE 802.1X standard allows you to implement identity-based networking based on a client-server access control model. The following three roles are defined by the standard:
IEEE 802.1X 標準讓你能以主從式存取控制模型實作身分識別網路。該標準定義了以下三種角色：
- Client:Also known as the supplicant, it is the workstation with 802.1X-compliant client software.用戶端（Client）：也稱為請求方（supplicant），是安裝了符合 802.1X 標準之用戶端軟體的工作站。
- Authenticator: Usually the switch, which controls the physical access to the network; it acts as a proxy between the client and authentication server.驗證者（Authenticator）：通常是交換器，負責控制對網路的實體存取；它扮演用戶端與驗證伺服器之間的代理角色。
- Authentication server (RADIUS):The server that authenticates each client that connects to a switch port before making available any services that the switch or the LAN offer.驗證伺服器（RADIUS）：在提供交換器或 LAN 的任何服務之前，先驗證每個連接到交換器連接埠之用戶端的伺服器。
The procedure of a client connecting to a network with 802.1X port-based authentication has five stages:
用戶端以 802.1X 連接埠式驗證連接到網路的程序共有五個階段：
- Session initiation: The client sends a request to initiate the authentication or the authenticator detects a link on a port and initiates the authentication.工作階段起始（Session initiation）：用戶端傳送請求以啟動驗證，或者驗證者偵測到連接埠上出現連線後啟動驗證。
- Session authentication: The authenticator relays messages between the client and the authentication (RADIUS) server. The client sends the credentials to the RADIUS server.工作階段驗證（Session authentication）：驗證者在用戶端與驗證（RADIUS）伺服器之間轉送訊息。用戶端會將憑證傳送給 RADIUS 伺服器。
- Session authorization: The RADIUS server validates the received credentials and if valid credentials were submitted, the server sends a message to the authenticator to allow the client access to the port. If the credentials are not valid, the RADIUS server sends a message to the authenticator to deny access to the client.工作階段授權（Session authorization）：RADIUS 伺服器驗證收到的憑證，若憑證有效，伺服器會傳送訊息給驗證者，允許該用戶端存取連接埠；若憑證無效，RADIUS 伺服器會傳送訊息給驗證者，拒絕該用戶端存取。
- Session accounting: When the client is connected to the network, the authenticator collects the session data and sends it to the RADIUS server.工作階段記帳（Session accounting）：當用戶端連上網路後，驗證者會收集該工作階段的資料並傳送給 RADIUS 伺服器。
- Session termination: When the client disconnects from the network, the session is terminated immediately.工作階段終止（Session termination）：當用戶端從網路斷線時，工作階段會立即終止。