Scribd Logo
Upload

Welcome to Scribd!

  • 4K views

    Configure AAA Authentication On Cisco Routers

    Uploaded by

    rumors158
    The document describes configuring authentication on three routers (R1, R2, R3) using different authentication methods. It involves: 1) Configuring local authentication on R1 for the console and VTY lines using a local username and password. 2) Configuring R2 for TACACS+ server authentication using a backup local account and configuring the TACACS+ server details. 3) Configuring R3 for RADIUS server authentication using a backup local account and configuring the RADIUS server details.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Configure AAA Authentication On Cisco Routers

    Uploaded by

    rumors158
    4K views4 pages
    The document describes configuring authentication on three routers (R1, R2, R3) using different authentication methods. It involves: 1) Configuring local authentication on R1 for the console and VTY lines using a local username and password. 2) Configuring R2 for TACACS+ server authentication using a backup local account and configuring the TACACS+ server details. 3) Configuring R3 for RADIUS server authentication using a backup local account and configuring the RADIUS server details.

    Original Title

    Configure AAA Authentication on Cisco Routers

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document describes configuring authentication on three routers (R1, R2, R3) using different authentication methods. It involves: 1) Configuring local authentication on R1 for the console and VTY lines using a local username and password. 2) Configuring R2 for TACACS+ server authentication using a backup local account and configuring the TACACS+ server details. 3) Configuring R3 for RADIUS server authentication using a backup local account and configuring the RADIUS server details.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    4K views4 pages

    Configure AAA Authentication On Cisco Routers

    Uploaded by

    rumors158
    The document describes configuring authentication on three routers (R1, R2, R3) using different authentication methods. It involves: 1) Configuring local authentication on R1 for the console and VTY lines using a local username and password. 2) Configuring R2 for TACACS+ server authentication using a backup local account and configuring the TACACS+ server details. 3) Configuring R3 for RADIUS server authentication using a backup local account and configuring the RADIUS server details.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    PT Activity: Configure AAA Authentication on Cisco Routers

    Addressing Table

    Device Interface IP Address Subnet Mask

    Fa0/0 192.168.1.1 255.255.255.0


    R1
    S0/0/0 10.1.1.2 255.255.255.252
    S0/0/0 10.1.1.1 255.255.255.252
    R2 Fa0/0 192.168.2.1 255.255.255.0
    S0/0/1 10.2.2.1 255.255.255.252
    S0/0/1 10.2.2.2 255.255.255.252
    R3
    Fa0/0 192.168.3.1 255.255.255.0
    TACACS+ Server NIC 192.168.2.2 255.255.255.0
    RADIUS Server NIC 192.168.3.2 255.255.255.0
    PC-A NIC 192.168.1.3 255.255.255.0
    PC-B NIC 192.168.2.3 255.255.255.0
    PC-C NIC 192.168.3.3 255.255.255.0

    Learning Objectives
    · Configure a local user account on R1 and authenticate on the console and VTY lines
    using local AAA.
    · Verify local AAA authentication from the R1 console and the PC-A client.
    · Configure a server-based AAA authentication using TACACS+.
    · Verify server-based AAA authentication from PC-B client.
    · Configure a server-based AAA authentication using RADIUS.
    · Verify server-based AAA authentication from PC-C client.

    Introduction
    The network topology shows routers R1, R2 and R3. Currently all administrative security is
    based on knowledge of the enable secret password. Your task is to configure and test local and
    server-based AAA solutions.
    You will create a local user account and configure local AAA on router R1 to test the console and
    VTY logins.
    · User account: Admin1 and password admin1pa55
    You will then configure router R2 to support server-based authentication using the TACACS+
    protocol. The TACACS+ server has been pre-configured with the following:
    · Client: R2 using the keyword tacacspa55
    · User account: Admin2 and password admin2pa55
    Finally, you will configure router R3 to support server-based authentication using the RADIUS
    protocol. The RADIUS server has been pre-configured with the following:
    · Client: R3 using the keyword radiuspa55
    · User account: Admin3 and password admin3pa55
    The routers have also been pre-configured with the following:
    · Enable secret password: ciscoenpa55
    · RIP version 2
    Note: The console and VTY lines have not been pre-configured.

    Task 1: Configure Local AAA Authentication for Console Access on R1

    Step 1. Test connectivity.


    · Ping from PC-A to PC-B.
    · Ping from PC-A to PC-C.
    · Ping from PC-B to PC-C.

    Step 2. Configure a local username on R1.


    Configure a username of Admin1 and secret password ofadmin1pa55.
    R1(config)# username Admin1 password admin1pa55

    Step 3. Configure local AAA authentication for console access on R1.


    Enable AAA on R1 and configure AAA authentication for console login to use the local database.
    R1(config)# aaa new-model
    R1(config)# aaa authentication login default local

    Step 4. Configure the line console to use the defined AAA authentication method.
    Enable AAA on R1 and configure AAA authentication for console login to use the default method
    list.
    R1(config)# line console 0
    R1(config-line)# login authentication default

    Step 5. Verify the AAA authentication method.


    Verify the user EXEC login using the local database.

    Task 2: Configure Local AAA Authentication for VTY Lines on R1

    Step 1. Configure a named list AAA authentication method for VTY lines on R1.
    Configure a named list called TELNET-LOGIN to authenticate logins using local AAA.
    R1(config)# aaa authentication login TELNET-LOGIN local

    Step 2. Configure the VTY lines to use the defined AAA authentication method.
    Configure the VTY lines to use the named AAA method.
    R1(config)# line vty 0 4
    R1(config-line)# login authentication TELNET-LOGIN
    R1(config-line)# end

    Step 3. Verify the AAA authentication method.


    Verify the Telnet configuration. From the command prompt of PC-A, Telnet to R1.
    PC> telnet 192.168.1.1
    Task 3: Configure Server-Based AAA Authentication Using TACACS+ on R2

    Step 1. Configure a backup local database entry called Admin.


    For backup purposes, configure a local username of Admin and secret password
    of adminpa55.
    R2(config)# username Admin password adminpa55

    Step 2. Verify the TACACS+ Server configuration.


    Select the TACACS+ Server. From the Config tab, click on AAAand notice that there is a
    Network configuration entry for R2 and a User Setup entry for Admin2.

    Step 3. Configure the TACACS+ server specifics on R2.


    Configure the AAA TACACS server IP address and secret key on R2.
    R2(config)# tacacs-server host 192.168.2.2
    R2(config)# tacacs-server key tacacspa55

    Step 4. Configure AAA login authentication for console access on R2.


    Enable AAA on R2 and configure all logins to authenticate using the AAA TACACS+ server
    and if not available, then use the local database.
    R2(config)# aaa new-model
    R2(config)# aaa authentication login default group tacacs+ local

    Step 5. Configure the line console to use the defined AAA authentication method.
    Configure AAA authentication for console login to use the default AAA authentication
    method.
    R2(config)# line console 0
    R2(config-line)# login authentication default

    Step 6. Verify the AAA authentication method.


    Verify the user EXEC login using the AAA TACACS+ server.

    Task 4: Configure Server-Based AAA Authentication Using RADIUS on R3

    Step 1. Configure a backup local database entry called Admin.


    For backup purposes, configure a local username of Admin and secret password of adminpa55.
    R3(config)# username Admin password adminpa55

    Step 2. Verify the RADIUS Server configuration.


    Select the RADIUS Server. From the Config tab, click on AAA and notice that there is a Network
    configuration entry for R3 and a User Setup entry for Admin3.

    Step 3. Configure the RADIUS server specifics on R3.


    Configure the AAA RADIUS server IP address and secret key on R3.
    R3(config)# radius-server host 192.168.3.2
    R3(config)# radius-server key radiuspa55

    Step 4. Configure AAA login authentication for console access on R3.


    Enable AAA on R3 and configure all logins to authenticate using the AAA RADIUS server and if
    not available, then use the local database.
    R3(config)# aaa new-model
    R3(config)# aaa authentication login default group radius local

    Step 5. Configure the line console to use the defined AAA authentication method.
    Configure AAA authentication for console login to use the default AAA authentication method.
    R3(config)# line console 0
    R3(config-line)# login authentication default

    Step 6. Verify the AAA authentication method.


    Verify the user EXEC login using the AAA TACACS+ server.

    Step 7. Check results.


    Your completion percentage should be 100%. Click Check Resultsto see feedback and
    verification of which required components have been completed.

    You might also like