Now, the main difference between the old way of doing it and the new way is that we can create groups,
so use the command Tacacs server and you give your server a name.
You specify the IP address and key of the Tacacs server.
Previously, you type those two commands, but now you configure the configuration as follows.
You also create groups which you can use to provide different services.
So you type AAA group server in this case Tacacs, and create a group which then maps back to the server
previously created.
And now when you specify your login, you point to this ACS group here, rather than pointing simply
to Tacacs, this gives you more flexibility than what you had previously.
This router is running iOS V version 15.6 of iOS, so it's a lot newer version
and then the other routers.
Notice 15.6.2, so I'll configure this router using the new method.
Which is the method that you need to know for the CCNA exam CONFT AAA new model, now before I
enter that.
At the moment, please note that there's no authentication to login, but what I'll do now is enable
AAA new model.
Specify a backup username of David.
With a positive Cisco, note once again, that
the console has no authentication configured on it, and neither do the other lines, such as the aux
and VTY lines, Tacacs and the difference now is we have space server and now we can specify a name.
So ACS or whatever name you want.
This gives us different options.
But as an example, we can specify the IPv4
address of the server and the key that's going to be used, so we've specified to the address of the
server and the key for the encryption to the server, type exit and now we can use the command
AAA group.
Server, in our example, it's going to be Tacacs and we'll just give it a name of ACS group.
Various options are available, but now we can specify server and the name of the server, which we
created previously, so this is referring back to the server that we created.
So these commands are subcommands as follows
type exit, and now we can type AAA authentication login.
We're going to use a default list to apply it to all the lines, and now we're going to specify a group
which in our case is going to be ACSgroup, and then we'll use local as a backup mechanism.
Now, the IP address on Gigabit 00 is 10.1.1.204.
So back in ACS, we need to specify router 4 10.1.1.204,
click submit and apply what is now being added, so now on the console of the router.
Notice we are prompted for a username, specify Admin, specify password Cisco.
Try that again, so Admin Cisco,
try the local username and password that works so there's a problem
between the router and the ACS server and we'll just confirm our configuration.
So we've created a group called ACS Group, which is the same over here that's failing at the moment,
and we're getting a local authentication.
The server that we pointing to is ACS.
Which we can see over here, password is Cisco for the communication to this ACS server.
Let's confirm that we did that right on the ACS server.
Notice I forgot to put a key in some specify key of Cisco click, submit and apply
and now we'll try again.
So your username is Admin, password is Cisco, we are straight in, so that works.
If we try, David, in other words, the local username and password that should fail, and it does
because that user is once again not configured in ACS.
So on our reports, failed attempts.
We can see that David's authentication failed
for this router 10.1.1.204.
So let's copy this configuration
and I'll configure this iOSV layer 2 switch with that configuration at the moment, the switch has
no configuration, so I'll create an IP address
10.1.1.205.
On the switch, can it ping
the ACS server?
Yes, it can.
So now we can paste that exact configuration into the switch and there you go.
Back on the ACS server, we need to add our switch, so switch 1, 10.1.1.20
5, password Cisco,
submit that
so there we go.
So now when we exit out of the switch and log back in, we are prompted for our username and password
and admin
cisco succeeds, where as
a user of David and Cisco fails
because that username is not configured on the ACS server.
So once again, Admin Cisco succeeds.
So this is the advantage we've got 1.2.3.4.5 devices using a centralized ACS
server.
If someone else joined the company, we could create another user account such as Peter and click Add.
Specify Peter's password,
click submit.
So we now have Admin Peter and user 1 configured.
On the switch notice, there is no username
called Peter
there's only a user called David.
But if we log in with a new user of Peter, they can log in
and we can do that on any of the devices, so as an example, on router 3 we can log in without
a problem.
We could even telnet to say router 2
and login as Peter
by configuring ACS, we don't have to configure multiple databases of usernames and passwords.
We don't have to configure the VTY, AUX and console ports on every individual device.
The authentication of all those ports will be handled through AAA and will leverage a central database.
In my example, I'm using a Cisco ACS server that's integrated throughGNS3 and is providing
the authentication for all of these devices centrally using a local database.
But ACS could point to an Active Directory database and use the usernames and passwords stored in windows
for authentication to network devices as soon as you have many devices in your network.
It makes sense to use a radius or tacacs server such as Cisco ACS for your centralized authentication,
authorization and accounting, in this example, I was demonstrating Tacacs, but you could also use
radius as the protocol between the router or switch and ACS server.