Security Concepts, Threats, AAA and VPNs

Exam topics covered

5.1 Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques)

5.2 Describe security program elements (user awareness, training, and physical access control)

5.5 Describe IPsec remote access and site-to-site VPNs

5.8 Differentiate authentication, authorization, and accounting concepts

Foundation. Every chapter so far has been about making the network work. Part V is about keeping it working when someone wants it not to. This chapter supplies the vocabulary and mental models that the rest of the security chapters build on: what a threat, a vulnerability and an exploit actually are; the families of attacks you will meet on the exam; how a security program combines people, process and technology; how AAA controls who may manage your devices and join your network; and how VPNs protect traffic that has to cross networks you do not control. The exam tests this material with definition questions, so learn the terms precisely: small wording differences (authentication versus authorization, RADIUS versus TACACS+, AH versus ESP) are where the distractors hide.

28.1 Key Security Concepts

28.1.1 The CIA triad

The goals of security are described by three properties, the CIA triad. Every attack damages at least one of them and every control protects at least one.

Confidentiality: only authorized people and systems can read the data. Encryption, access control lists and file permissions protect confidentiality. A packet capture of an unencrypted Telnet session is a confidentiality failure.

Integrity: data is not changed, in transit or at rest, without detection. Hashes, message authentication codes (HMAC) and digital signatures protect integrity. An attacker silently changing a routing update or a bank transfer amount is an integrity failure. Availability: authorized users can reach the systems and data when they need them. Redundancy (HSRP, EtherChannel, dual WAN links), capacity planning and DoS protection protect availability.

Figure 28-1 The CIA triad: the three properties every security control tries to protect.

28.1.2 Assets, vulnerabilities, threats, exploits and mitigation Blueprint topic 5.1 uses four words with precise meanings. Start with the thing you are protecting.

An asset is anything of value to the organization: servers, customer data, intellectual property, network devices, even the organization's reputation.

A vulnerability is a weakness that could be used to compromise an asset. Examples: an unpatched IOS image with a known bug, a router still using the default password, Telnet enabled on VTY lines, an open wiring closet, an employee who has never heard of phishing.

A threat is the potential for someone or something to take advantage of a vulnerability. The threat actor is the person or group (a criminal gang, a disgruntled insider, a nation state, a script kiddie) behind it.

An exploit is the actual tool, code or technique that takes advantage of a specific vulnerability. A published proof-of-concept script for a web server bug is an exploit; so is a phishing email crafted to steal VPN credentials.

Mitigation is any technique that reduces the likelihood or impact of a threat: patching, hardening, ACLs, firewalls, encryption, training, physical locks.

Risk is the likelihood that a threat exploits a vulnerability combined with the impact if it does. You mitigate risk to an acceptable level, transfer it (insurance) or knowingly accept it. Threat actor

Figure 28-2 A threat actor uses an exploit against a vulnerability to reach an asset; mitigation breaks the chain.

28.2 Common Attack Types

You must recognize attacks from a short description and know the typical mitigation. Table 28- 1 summarizes the families; the subsections expand on the important ones.

Table 28-1 Common attack types and typical mitigations

• Attack What happens Typical mitigation
• Denial of service
• (DoS)
• A single source exhausts a target's resources
• (bandwidth, CPU, memory, session tables), e.g. a
• TCP SYN flood that fills a server's half-open

connection table.

does nothing.

victim.

• Ingress filtering (uRPF,
• ACLs), close open
• resolvers
• Spoofing Forging an identity field: source IP, source MAC,

ARP replies, DHCP server offers.

rogue DHCP server handing out its own gateway.

• Encryption (TLS, IPsec,
• SSH), DAI, DHCP
• snooping
• Reconnaissance Information gathering before an attack: ping
• sweeps, port scans, DNS and WHOIS queries,

CDP/LLDP sniffing.

• Filter ICMP and unused
• ports, disable CDP on
• edge ports, IPS
• Malware Malicious software: viruses, worms, trojans,

ransomware, spyware (see 28.2.3).

• Endpoint protection,
• patching, least privilege,
• backups

Social engineering Manipulating people rather than technology:

phishing, spear phishing, whaling, vishing,

smishing, pretexting, tailgating.

• User awareness training,
• verification procedures,
• physical controls

Password attacks Guessing, dictionary, brute force, credential stuffing, or capturing password hashes and

cracking them offline.

• Strong policies, login
• block-for , MFA, type 8/9
• hashes
• 28.2.1 DoS, DDoS, reflection and amplification

Denial-of-service attacks target availability. In a TCP SYN flood the attacker sends SYNs from spoofed sources; the server answers each with a SYN-ACK and waits for an ACK that never comes until its half-open connection table is full. A DDoS uses a botnet, so the traffic arrives from thousands of genuine-looking sources at once. A reflection attack sends requests to innocent third-party servers with the victim's address as the spoofed source, so all replies hit the victim; when the replies are much larger than the requests (open DNS resolvers and NTP servers are classic examples) it is also an amplification attack.

Figure 28-3 Reflection and amplification: spoofed small requests produce large replies aimed at the victim.

28.2.2 Spoofing and man-in-the-middle

Spoofing fakes an identity value (IP address, MAC address, ARP reply, DHCP offer) and is usually a means to another attack. A man-in-the-middle (MITM) or on-path attack places the attacker between two parties. On a LAN the classic method is ARP poisoning: gratuitous ARP replies claim that the gateway's IP maps to the attacker's MAC, so hosts send their off-subnet traffic to the attacker, who reads or alters it and forwards it on. A rogue DHCP server that hands out its own address as the gateway does the same. Chapter 31 covers DHCP snooping and Dynamic ARP Inspection, which stop both.

Figure 28-4 ARP poisoning places the attacker on the path between a host and its default gateway.

28.2.3 Malware

Malware is malicious software. The exam distinguishes the types by how they spread and what they need:

Table 28-2 Malware types

Type Defining characteristic

Virus Attaches itself to a legitimate file or program; spreads only when a user runs or shares the infected file.

Worm Self-replicating standalone program that spreads across the network by exploiting vulnerabilities, with no user action.

Trojan horse Disguised as legitimate software the user wants; carries a hidden payload such as a backdoor. Does not self-replicate.

Ransomware Encrypts the victim's files and demands payment for the key; increasingly also steals data and threatens to publish it.

Spyware /

keylogger

Secretly collects information such as keystrokes, passwords and browsing activity. Rootkit Hides itself and other malware deep in the operating system, often granting persistent privileged access.

28.2.4 Social engineering

Social engineering attacks the human layer. Phishing sends mass emails luring recipients to a fake login page or infected attachment; spear phishing tailors the lure to a specific person or group; whaling is spear phishing aimed at senior executives. Vishing uses voice calls and smishing uses SMS. Pretexting invents a believable story (“I'm from the help desk and need your password”), and tailgating means following an authorized person through a secured door.

28.2.5 Password attacks

Passwords remain the most common authentication method, so they are a favourite target. A dictionary attack automates guessing with word lists of common passwords ( cisco , Summer2026! ). A brute-force attack tries every possible combination, which is only practical against short passwords or against a stolen hash that can be attacked offline at billions of guesses per second. Credential stuffing replays username/password pairs leaked from another breach, betting that people reuse passwords. Defences include long and complex passwords, slow modern hash algorithms (type 8 and 9 on IOS, covered in Chapter 29), login rate limiting and, above all, multifactor authentication.

Exam alert

A worm needs no user action; a virus does. Spear phishing targets a specific person or group; whaling targets executives. In a reflection attack the source IP of the attacker's packets is the victim's address. Expect short scenario questions that describe one of these and ask you to name it.

28.3 Security Program Elements

Technology alone cannot secure an organization. Blueprint topic 5.2 names three people-and-facility elements of a security program.

28.3.1 User awareness

User awareness programs keep every employee conscious of threats through continual, lightweight activity: reminder emails, posters, login banners and especially simulated phishing campaigns that track who clicks and teach them on the spot.

28.3.2 User training

Training is formal and often role-specific: annual mandatory courses for all staff, secure coding for developers, incident-response drills for operations. Training teaches how to apply policy; awareness keeps it front of mind.

28.3.3 Physical access control

An attacker who can touch a device can usually own it (password recovery from the console, a stolen switch revealing its configuration). Physical access control uses locked wiring closets and data centres, badge readers with access logs, biometric scanners, mantraps (two-door vestibules that defeat tailgating), guards and video surveillance.

Figure 28-5 Defence in depth: an attacker must defeat several independent layers to reach the data.

Figure 28-5 shows the principle that ties the program together: defence in depth. No single

control is perfect, so you layer independent ones; a phishing email that beats the mail filter may still be stopped by a trained user, endpoint protection or internal segmentation. A related principle is least privilege: give every user and system only the access it needs.

28.4 Firewalls and Intrusion Prevention: A Recap

A firewall enforces policy between security zones: inside, outside and a DMZ for public servers. Modern firewalls are stateful: they track connections started from the inside and automatically allow the return traffic, while unsolicited outside traffic is denied unless a rule permits it. A router ACL, by contrast, is stateless. A next-generation firewall (NGFW) adds application awareness, URL filtering and integrated IPS. An IPS sits inline, matches traffic against attack signatures and can drop it; an IDS analyzes a copy of the traffic, so it can alert but not block.

INSIDE (trusted) OUTSIDE (Internet)

Dmz

web server

Ngfw + ips

outbound + replies OK unsolicited denied

except HTTPS to DMZ

Figure 28-6 A stateful firewall with inside, outside and DMZ zones.

28.5 AAA: Authentication, Authorization and Accounting

Configuring local usernames on hundreds of devices does not scale and leaves no central record of who changed what. AAA moves identity decisions to a central server. Blueprint topic 5.8 asks you to tell its three functions apart.

Authentication answers who are you? The user proves identity with something they know (password), have (token, certificate, phone) or are (biometric).

Authorization answers what are you allowed to do? After login, the server decides the privilege level, which commands the user may run, which VLAN a device lands in, or which ACL applies.

Accounting answers what did you do? The device sends records of session start and stop times, commands entered and data used to the server for auditing and billing.

28.5.1 RADIUS and TACACS+

The network device acting as the AAA client talks to an AAA server, such as Cisco Identity Services Engine (ISE), using one of two protocols. Table 28-3 compares them; know every row.

Table 28-3 RADIUS versus TACACS+

Feature RADIUS TACACS+

Standard Open standard (RFC 2865/2866) Developed by Cisco (later published as RFC 8907)

Transport UDP 1812 (authentication), 1813

(accounting); legacy 1645/1646

Tcp 49

Encryption Encrypts only the password field Encrypts the entire packet body AAA functions Combines authentication and

Exam alert

Classic pairings: TACACS+ = TCP 49, whole-body encryption, separate A/A/A, per-command authorization, best for device administration. RADIUS = UDP 1812/1813, password-only encryption, combined authentication and authorization, best for network access (802.1X). Admin R1 (AAA client) TACACS+ server

• 1. SSH login: user / password
• 2. Authentication REQUEST

3. pass

• 4. R1# prompt
• 5. types: reload
• 6. Authorization: may run "reload"?
• 7. FAIL (denied)
• 8. Accounting record

Figure 28-7 TACACS+ separates authentication, per-command authorization and accounting.

28.5.2 802.1X: AAA for network access

IEEE 802.1X is port-based network access control: a switch port or WLAN admits only authentication traffic until the device proves its identity. Know its three roles by name: Supplicant: the client device (software on the PC, phone or printer) that requests access. Authenticator: the switch or wireless LAN controller/AP that controls the port. It relays messages but does not decide.

Authentication server: the RADIUS server (for example ISE) that checks the credentials and tells the authenticator to permit or deny.

Between supplicant and authenticator, messages use EAP over LAN (EAPoL), carried directly in Ethernet frames because the client has no IP address yet. Between authenticator and server, the same EAP messages are encapsulated in RADIUS. Chapter 32 revisits 802.1X for wireless and the EAP methods it carries.

• Supplicant Authenticator Authentication server
• client PC switch / WLC RADIUS (ISE)
• EAPoL (Layer 2) EAP in RADIUS

Port stays unauthorized (only EAPoL allowed) until the server returns Access-Accept

Figure 28-8 The three 802.1X roles and the protocols used on each segment.

28.6 Virtual Private Networks

A virtual private network (VPN) creates a private, protected connection across an untrusted network, usually the Internet. Blueprint topic 5.5 divides VPNs into site-to-site and remote access.

28.6.1 IPsec security services

IPsec is a framework of open standards for protecting IP packets at Layer 3. It provides four services:

Table 28-4 IPsec security services

Service What it means Typical algorithms

Confidentiality Payload is encrypted so eavesdroppers cannot

read it.

• AES (128/256), AES-GCM;
• legacy DES/3DES
• Integrity Receiver detects any change to the packet in

transit.

Hmac-sha-256/384/512;

legacy MD5, SHA-1

Authentication Each peer proves it is who it claims to be. Pre-shared keys, RSA digital certificates

Anti-replay Captured packets cannot be re-sent later; each

packet has a sequence number checked

against a window.

ESP/AH sequence numbers

Before protecting data, two IPsec peers must agree on algorithms and generate shared keys. They do this with Internet Key Exchange (IKE), version 1 or the preferred version 2, running over UDP port 500 (UDP 4500 when NAT is detected). IKE uses Diffie-Hellman to derive shared keys without ever sending them; the agreed parameters form security associations (SAs).

28.6.2 ESP and AH

IPsec defines two protocols for protecting packets:

Encapsulating Security Payload (ESP), IP protocol 50, provides confidentiality (encryption), integrity, origin authentication and anti-replay. It is what almost every real VPN uses.

Authentication Header (AH), IP protocol 51, provides integrity, authentication and anti-replay but no encryption. Because AH also protects the outer IP header, it breaks when NAT changes addresses, and it is rarely used today.

Either can run in tunnel mode, which protects the entire original packet and adds a new outer IP header (site-to-site VPNs), or transport mode, which protects only the payload (used when the endpoints are themselves the peers, as with GRE over IPsec).

• Original packet IP hdr TCP Data
• ESP tunnel mode
• New IP ESP hdr IP hdr TCP Data trailer ICV
• encrypted

authenticated (integrity check value covers ESP header to trailer)

proto 50

Figure 28-9 ESP in tunnel mode encrypts the whole original packet and adds a new IP header.

28.6.3 Site-to-site VPNs

A site-to-site VPN permanently connects two networks. The gateways at each site build the tunnel; hosts behind them send ordinary packets and are unaware of the VPN. When R1 receives a packet from 10.1.1.0/24 to 10.2.2.0/24, it encrypts it with ESP, adds a new IP header from its public address to R2's, and sends it across the Internet; R2 verifies, decrypts and forwards the original packet.

Figure 28-10 Site-to-site IPsec VPN: only the gateways know the tunnel exists.

The encrypt and decrypt counters increasing on both peers prove that traffic is flowing through the SA.

R1 — console

R1# show crypto ipsec sa
interface: GigabitEthernet0/1

Crypto map tag: VPN-MAP, local addr 198.51.100.1

local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)

• current_peer 203.0.113.2 port 500
• PERMIT, flags={origin_is_acl,}
• #pkts encaps: 1482, #pkts encrypt: 1482, #pkts digest: 1482
• #pkts decaps: 1475, #pkts decrypt: 1475, #pkts verify: 1475
• #send errors 0, #recv errors 0
• inbound esp sas:
• spi: 0x8F3A21C4(2403999172)
• transform: esp-aes 256 esp-sha256-hmac ,
• in use settings ={Tunnel, }
• replay detection support: Y
• Status: ACTIVE(ACTIVE)

Figure 28-11 An active IPsec SA using AES-256 and SHA-256 in tunnel mode. (CLI output in this chapter is illustrative of IOS 15 / IOS XE.)

28.6.4 GRE over IPsec

Plain IPsec tunnels carry only unicast IP, so multicast routing protocols such as OSPF cannot run across them. Generic Routing Encapsulation (GRE), IP protocol 47, creates a virtual point-to-point tunnel interface that carries multicast and non-IP traffic, but it has no encryption. GRE over IPsec combines them: the router encapsulates the packet in GRE, then IPsec encrypts the GRE packet.

Public IP ESP hdr GRE Private IP OSPF hello / data ESP trl/ICV encrypted by IPsec (GRE adds multicast and routing-protocol support)

Figure 28-12 GRE over IPsec: GRE carries the routing protocol, IPsec encrypts the GRE packet.

28.6.5 dmvpn

With many branches, a full mesh of static tunnels becomes unmanageable: 50 sites would need 1,225 tunnels. Dynamic Multipoint VPN (DMVPN) is a Cisco solution that builds a hub-and-spoke design with simple configuration (each spoke is configured only with the hub), using multipoint GRE (mGRE) tunnels, the Next Hop Resolution Protocol (NHRP) and IPsec. When two spokes need to talk, they use NHRP to learn each other's public address from the hub and build a dynamic spoke-to-spoke tunnel on demand.

28.6.6 Remote-access VPNs

A remote-access VPN connects one user's device to the corporate network on demand. The device is aware of the VPN: it runs client software (such as Cisco Secure Client, formerly AnyConnect) or uses a browser. The headend, typically a firewall, authenticates the user (often via RADIUS with MFA), assigns an inside address and pushes policy. Most remote-access VPNs use TLS on TCP 443 (plus DTLS on UDP 443), which passes through almost any hotel firewall and can even be clientless through a browser portal; the alternative is an IPsec IKEv2 client tunnel.

• Home worker
• Secure Client
• Hotel user
• Internet

Tls/dtls vpn, tcp/udp 443

Figure 28-13 Remote-access VPNs: each user's device builds its own tunnel to the headend.

Table 28-5 Site-to-site versus remote-access VPNs

Characteristic Site-to-site Remote access

Connects Whole networks (site to site) One user device to a network Duration Permanent, always on On demand, while the user needs it End hosts aware of

Vpn?

No: gateways do all the work Yes: client software or browser

Typical technology IPsec, GRE over IPsec, DMVPN TLS/DTLS (most common) or IPsec IKEv2 If a question mentions “the users are unaware of the VPN” or “connects branch offices,” think site-to-site. If it mentions client software, a browser, or traveling employees, think remote access, most often TLS-based. ESP encrypts; AH does not.

LAB Centralize device login with TACACS+ and a local fallback

Goal: make R1 authenticate SSH and console logins against a TACACS+ server at 10.10.10.5, authorize EXEC sessions and level-15 commands, record accounting, and fall back to a local account if the server is unreachable.

Admin 10.20.0.50 R1

G0/1 10.10.10.1

Ise 10.10.10.5

Ssh

Tcp 49

Figure 28-14 AAA lab topology.

Background: AAA is turned on with aaa new-model . From that moment the line-level login and password commands no longer control access; method lists do. A method list names the sources to try in order. The next method (here local ) is used only when the server does not respond; a “reject” answer is final.

Steps: create the fallback user first (once AAA is on, VTY logins use the local database by default, so with no local user you can lock yourself out), then enable AAA, define the server and group, and add the method lists:

R1(config)# username backup privilege 15 secret Fallb@ck-2026 ! local fallback account
R1(config)# aaa new-model
R1(config)# tacacs server ISE1
R1(config-server-tacacs)# address ipv4 10.10.10.5
R1(config-server-tacacs)# key T@cKey!
R1(config-server-tacacs)# exit
R1(config)# aaa group server tacacs+ ADMINS
R1(config-sg-tacacs+)# server name ISE1
R1(config-sg-tacacs+)# exit
R1(config)# aaa authentication login default group ADMINS local
R1(config)# aaa authorization exec default group ADMINS local
R1(config)# aaa authorization commands 15 default group ADMINS local
R1(config)# aaa accounting commands 15 default start-stop group ADMINS
R1(config)# ip tacacs source-interface GigabitEthernet0/1

Verify: test the server with test aaa (and show tacacs for counters), then log in through SSH from the admin PC.

R1# test aaa group ADMINS netadmin C0mpl3x!Pass legacy

Attempting authentication test to server-group ADMINS using tacacs+ User was successfully authenticated.

Figure 28-15 Verifying TACACS+ authentication with the built-in test command.

Expected results: the test succeeds, SSH logins get the privilege level the server assigns, and the server logs accounting records. With G0/1 shut down, backup can still log in from the console.

Aaa

Radius

Tacacs+

• supplicant
• authenticator
• IPsec

Esp

GRE over IPsec

Review questions

• 1. Which term describes a weakness in a system that could be used to compromise it?

• A. Threat
• B. Exploit
• C. Vulnerability
• D. Mitigation

• 2. An attacker sends DNS queries with a spoofed source address to thousands of open resolvers, which send large replies to the victim. Which two terms describe this attack? (Choose two.)

• A. Reflection
• B. Man-in-the-middle
• C. Amplification
• D. Reconnaissance
• E. Brute force

• 3. Which type of malware spreads across a network on its own by exploiting vulnerabilities, without user interaction?

• A. Virus
• B. Worm
• C. Trojan horse
• D. Spyware

• 4. An email crafted to look like it came from the CEO's bank is sent only to the CEO. What is this?

• A. Vishing
• B. Smishing
• C. Whaling
• D. Pretexting by phone

• 5. Which security program element is a monthly simulated phishing campaign sent to all employees?

• A. Physical access control
• B. User awareness
• C. Accounting
• D. Least privilege

• 6. Which AAA function determines which commands an authenticated administrator may execute?

• A. Authentication
• B. Authorization
• C. Accounting
• D. Auditing

• 7. Which two statements describe TACACS+? (Choose two.)

• A. It uses UDP ports 1812 and 1813.
• B. It encrypts the entire packet body.
• C. It combines authentication and authorization.
• D. It uses TCP port 49.
• E. It is the protocol used between authenticator and server in 802.1X.

• 8. In 802.1X, which device is the authenticator?

• A. The client PC
• B. The RADIUS server
• C. The access switch
• D. The certificate authority

• 9. Which IPsec service prevents an attacker from capturing and re-sending valid packets?

• A. Confidentiality
• B. Integrity
• C. Anti-replay
• D. Origin authentication

• 10. Which IPsec protocol provides encryption?

• A. AH, IP protocol 51
• B. ESP, IP protocol 50
• C. GRE, IP protocol 47
• D. IKE, UDP 500

• 11. Why would an engineer configure GRE over IPsec rather than a plain IPsec tunnel between two sites?

• A. GRE provides stronger encryption than ESP.
• B. GRE allows multicast routing protocols such as OSPF to run over the tunnel.
• C. GRE removes the need for IKE.
• D. GRE works only with AH.

• 12. Which two statements describe a typical remote-access VPN? (Choose two.)

• A. End users are unaware that the VPN exists.
• B. It often uses TLS on TCP port 443.
• C. It is permanently up between two routers.
• D. The user device runs client software or a browser.
• E. It requires DMVPN.

Answers

• 1. C. A vulnerability is a weakness.
• 2. A, C. Spoofed requests bounce off third parties (reflection), and the replies are larger than the requests (amplification).
• 3. B. Worms self-replicate across the network.
• 4. C. Spear phishing aimed at a senior executive is whaling.
• 5. B. Simulated phishing is a classic user awareness activity.
• 6. B. Authorization decides what an authenticated user may do, including per-command authorization with TACACS+.
• 7. B, D. TACACS+ uses TCP 49 and encrypts the full body.
• 8. C. The switch (or WLC/AP) is the authenticator.
• 9. C. Anti-replay uses sequence numbers to reject duplicated or old packets.
• 10. B. ESP provides confidentiality; AH provides integrity and authentication only.
• 11. B. Pure IPsec carries only unicast; GRE carries multicast so routing protocols can run.
• 12. B, D. Remote-access VPNs are on demand, client- or browser-based, and commonly TLS on port 443.