OK, so let's see if we can complete this lab, were told to configure the Tacacs and Radius server as
follows.
So on the AAA server, we need to enable the AAA service and then we need to specify our clients. First
client is router 1 that's going to use this IP address.
We'll configure the router in a moment.
The secret password that we'll use here is Cisco, the protocol used is Tacacs.
I'm going to click add, to add that client. Next client is router 2 IP address is 10.1.1.203.
The password used is Cisco, and in this case, it needs to be Radius, switch 1 client IP address is
10.1.1.252, secret will be Cisco.
This device is going to use Tacacs.
We then need to add a user, the username is David.
The password is Cisco.
So that's the server configured, server has an IP address once again of 10.1.1.250.
The first device we need to configure is router 1, here's router 1.
It's just booted up.
It's asking us whether we want to enter the initial configuration dialogue, we don't want to do that.
So I'm going to say no, I'll configure the router with a hostname of R1.
So were told to configure AA for login and enable using Tacacs with server 10.1.1.250.
Now, before we can do that, we need to make sure we have IP connectivity.
So I'm going to configure the router with an IP address on gigabit 000 and I'm going to
no shut the interface.
That's per our network topology, and we've been given the IP address of the Tacacs client.
So we know this router needs to be configured with this IP address.
So can the router ping the Tacacs server 10.1.1.250?
Yes, it can.
So before we configure AAA., we need to ensure that we have IP connectivity on our devices.
I'll do something similar while I'm here with router 2, so hostname isrouter 2 interface gigabit
000 no shut IP address 10.1.1.253/24 mask.
Can we ping
the AAA server? We'll have to wait for spanning tree to converge while we are waiting for that.
Let's have a look at our switch.
Switch has no configuration either.
So hostname will be switch 1 interface VLAN 1, no shut IP address of the switch will be 10.
1.1.252.
So all I've done is change the switch name
and configure an IP address on the switch, so can the switch ping
the AAA server? Yes, it can.
What about router 2?
Can it ping the server?
Yes, it can.
So we've got IP connectivity between the devices and the AAA server.
Now, let's configure AAA on router 1.
So in global configuration mode, we need to type AAA new model.
I'm going to create the backup username
called backup, password is going to be Cisco, you don't have to use that username if you don't want
to, in the real world, you'd use something better and you could use any name, in the lab in the exam
follow the instructions given.
Next thing we need to do is enable authentication.
So AAA authentication.
We're going to do it for login.
We're going to do this for all lines, so console, VTY, Auxillary port, TTYs, VTYs any line that
connects to the router.
And we're going to use a group.
Which is a Tacacs group, and then we're going to use local as the backup, we first are going to use
Tacacs as our authentication protocol and then as a backup, we'll use local authentication.
We need to do something similar for
enable.
So for the enable password.
We can use a group,
Tacacs group, and then we're going to use local authentication, so at the moment we have
configured three AAA commands.
The last step is to configure the tech server.
The host is going to be 10 one one to 50, the key will be Sasko.
So, again, this is our triple-A configuration, here's our tech server configuration.
Not properly, and techniques are security protocols and are therefore used to enhance the security
of your network devices.
So you need to be careful.
Now, if you log out of your router and you've made a mistake, you may not be able to log back in to
your router.
So what I'm going to do is I'm going to simply telnet to the border to check if things are working right.
So I'm gonna login as David, Password is Cisco
and notice I'm now able to login to the router, even though I didn't configure
the VTY lines, so type exit on back on the console of the router.
Notice only the console is in use, show run
go down all the way, notice line VTY 024 isn't configured by default we are using
AAA for all lines.
As soon as you type this command, we are no longer using the local username and password database.
Everything is going to use Tacacs first and will only use the local username and password database
if the Tacacs server is not available.
So if you're unsure, I suggest you don't save your routers configuration, so if you make a mistake,
you can simply reboot your devices.
But router 1 is working
the next step is to configure router 2 with AAA, but we're using radius in this example.