Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 2.8 — Compare network management access

Management access combines reachability, transport protection, authentication, authorization, accounting, and recovery. A secure protocol solves only the transport portion.

Console access

The console provides local out-of-band-style device access for bootstrap and recovery. It does not depend on IP routing, which makes it invaluable when the management plane is broken. Physical control, terminal-server security, local credentials, and session logging still matter.

Telnet, SSH, HTTP, and HTTPS

Telnet transmits its session without confidentiality and should not be selected for normal remote administration. SSH provides encrypted terminal access and server identity based on configured keys. HTTP is unprotected web transport; HTTPS adds TLS protection and certificate considerations. Prefer SSH or HTTPS, restrict sources, and disable unused legacy services.

Encryption does not make a shared administrator account accountable. Use named identities and least privilege.

TACACS+ and RADIUS

Both protocols support centralized AAA. TACACS+ is commonly associated with granular network-device administration and separates AAA functions. RADIUS is widely used for network access and combines authentication and authorization in its model. Exact platform support and protection differ, so follow the system's documented design.

Plan redundant servers and a controlled local recovery path. A centralized AAA outage should not force an unsafe permanent bypass.

Cloud-managed access

Cloud-managed platforms use a provider-hosted control interface and device-to- cloud connectivity. Secure the administrator identity with MFA and roles, review audit logs, understand organization and tenant boundaries, and document what happens during provider or Internet loss. Cloud management does not eliminate the need for local device recovery.

Worked scenario

An operator needs remote CLI with per-user accountability. SSH protects the session, while TACACS+-backed authentication, command authorization, and accounting provide centralized identity and records. A local emergency account is stored and tested under a break-glass procedure. Telnet with one shared password would fail both confidentiality and accountability requirements.

Verification

Test from an allowed source and a denied source. Confirm protocol version and certificate or host-key expectations, successful named authentication, correct authorization, accounting records, timeout behavior, and break-glass recovery. Do not test emergency access for the first time during an outage.

Common traps

• Calling console access an ordinary in-band IP protocol.
• Saying SSH supplies command authorization automatically.
• Treating HTTPS as proof the administrator is least-privileged.
• Omitting AAA redundancy and recovery.
• Ignoring cloud administrator and tenant security.

Readiness checklist

• I can rank access methods by transport protection.
• I can compare centralized AAA roles.
• I include authorization, accounting, and recovery.
• I can describe cloud-managed trust boundaries.