What is the role of the router or switch in the AAA architecture?
- authentication server
- supplicant
- NAS
- RADIUS entry point
Explanation: In the AAA (Authentication, Authorization, and Accounting) architectural framework, the router or switch functions as the Network Access Server (NAS), also known as the client or RADIUS client. According to the sources, the role of the NAS includes:
- Point of Contact: It is the device that users or machines contact first to gain access to a protected resource, such as the network or the device CLI.
- Intermediary/Proxy: The NAS acts as a proxy between the supplicant (the endpoint requesting access) and the authentication server (the central server, like Cisco ISE, that validates credentials).
- Protocol Translator: It communicates with the endpoint using 802.1X/EAP and then encapsulates that information into RADIUS or TACACS+ messages to communicate with the AAA server.
- Policy Enforcement: After the authentication server validates the user's identity and notifies the NAS of the authorization status, the NAS allows or denies the user access to the network based on that response.
While the supplicant is the software service on the endpoint and the authentication server is the central authority, the router or switch serves as the essential NAS that enforces security at the access edge.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
