In this lab, you need to configure both Tacacs and Radius authentication on router 1, router
2 and switch 1 in this packet tracer topology
we have a tacacs and radius server, which you need to configure AAA authentication.
So on the AAA server you need to enable the AAA service and you need to configure router 1, router 2
and switch 1 as clients on the AAA server. In this lab router 1 and switch 1 will use the
Tacacs
protocol router 2 will be configured to use radius.
So you need to add the three clients with the details, as well as add a user name for authentication.
Use your own name as the username and password of Cisco, in this solution video
as an example, I'm simply going to use my name David as the username.
Make sure that you configure router 1 for authentication for both login and enable using Tacacs
with the AAA server 10.1.1.250.
This server is configured with this IP address, so that's the IP address you need to configure router
1 with for authentication, both login and enable authentication.
So when you test this, you should be prompted for your username when you log in to the console as well
as when you type enable make sure that you use a local authentication as a backup in case the server
is not available.
Use a backup username of backup and a password of Cisco.
You then need to test or that you can log in using your own name.
So essentially on all three devices, you're going to configure the AAA server and ensure that you can log
in to these three servers using your username and password, which is not configured on these devices,
but is configured on the Tacacs and Radius server.
So make sure that you can log in to router 1, do something similar with router 2 but use radius
as the authentication protocol.
You'll also configure which one using Tacacs
and again, make sure that you can log in with your username and password.
So for verification, you should be able to login too all devices using your own name
as configured
on the server.
Once you've done that, create another user on the AAA server and verify that the user can also log in to
the devices.
So note both your name as well as the new user are not configured on the network devices.
There will be no local database on the devices that have those two usernames.
The usernames are stored on the server.
You need to verify that the local backup user cannot log in while the AAA servers reachable.
In other words, as long as these devices can contact the AAA server, the local backup user should not
be able to log in to the network devices
but test that the local user can log in if IP connectivity is broken between the network devices and
the AAA server.
So to simulate that, disable the support on your switch and then check that the backup user can
log in to the three network devices while IP connectivity is broken and then test what happens when
the port is a re-enable.
So re-enable the port and then verify that the backup user can now no longer log in, but your username
can login.
So in other words, make sure that you understand which user accounts are valid when the AAA server is
available and when it's not available.
And then once you've done to that use simulation mode in packet tracer and verify that when you log
in with your user account that Tacacs and Radius messages are sent between the switch and the server.
So in other words, when you log in to router 1, you should see a text message being sent to the
Tacacs server and a reply going back to your router, on router 2, you should see something similar for
Radius and Tacacs on switch 1.
So can you complete this lab? It's quite a lot to do, but do you understand how to configure both Radius
and Tacacs?
Download the packet tracer file and see if you can complete the lab yourself.
Otherwise, watch the next video where I complete the lab.