Security: AAA, Layer 2 Defense, VPNs, and Segmentation
AAA and identity
Authentication proves who you are, authorization decides what you may do, and accounting records what you did. TACACS+ runs over TCP 49, encrypts the entire payload, and separates the three functions. RADIUS runs over UDP 1812 and 1813, encrypts only the password, and combines authentication with authorization. 802.1X uses EAPOL between supplicant and authenticator, with the switch relaying to the AAA server. MAB falls back to the MAC address as identity when no supplicant exists, and web authentication redirects users to a portal.
Layer 2 hardening
Port security violation modes are protect (drop), restrict (drop and log), and shutdown (err-disable). DHCP snooping builds a binding table from trusted ports, and Dynamic ARP Inspection depends on that table, so DAI cannot work without DHCP snooping. IP Source Guard uses the same bindings to filter spoofed source addresses. Storm control limits broadcast, multicast, or unknown unicast.
Segmentation and VPNs
Cisco TrustSec assigns security group tags and enforces SGACLs without redesigning subnets. IPsec uses IKEv1 or IKEv2 for key exchange, ESP for confidentiality, and AH for integrity only. DMVPN combines mGRE, NHRP, and IPsec; FlexVPN builds on IKEv2. CoPP and control-plane protection shield the route processor.
Traps
RADIUS does not encrypt the full packet. DAI without DHCP snooping fails. DHCP snooping trusted ports must face the legitimate server, not access ports. Wireless questions may swap WPA2-PSK for WPA3-SAE or ask about Protected Management Frames.
Rule of thumb
If the question mentions per-command authorization, full payload encryption, or TCP 49, the answer is TACACS+; anything about UDP 1812 or combined authentication and authorization points to RADIUS.