So in Router 2, CONFT AAA new model username, backup password, Cisco, you want that in
case you have a problem with communication to your AAA server, if there's a problem communicating with
your AAA server and you haven't configured a local authentication method.
You won't be able to log in to your router, so we want to have a backup here of local that's only
used if the server is not available.
So going back to router 1, as an example if I try and telnet
to the router and login with the username backup password Cisco, that's denied because the AAA server is
available, but if the AAA server is not available, we'd be able to log in using that backup method
and I'll demonstrate that in a moment.
So thus far, we've configured AAA new model and a log in a default using radius, so AAA authentication.
Enable default group is going to be radius local backup, the radius server is host
and again, just use question mark if you're not sure, 10.1.1.250, the key is going
to be Cisco.
Obviously in the real world, you're going to use better keys than that.
So show run include AAA,
there's our AAA configuration
here's our radius configuration.
So let's telnet to ourselves
and see if we can log in. Now, have had problems with Packet Tracer
up to the moment, it's taking a long time.
But eventually I've been able to log in, so that looks good, Packet Tracer should display the username
here but it doesn't
it's just a problem in
Packet Tracer. I'll exit the telnet session packet tracer is a simulator once again.
So it's not perfect, but it does a great job in this lab allowing us to learn and practice AAA authentication
I'll save the router's configuration, last device to configure is switch1 it's going to be using
Radius authentication.
So on switch 1 new model username, backup password Cisco,
AAA Authentication login, default group Tacacs, in this example, local backup AAA
authentication,
enable default group
Tacacs,
backup is going to be local.
Tacacs server is going to be 10.1.1.250.
The key is going to be Cisco.
So again show run type include AAA, there's our AAA configuration, here's our Tacacs
configuration. Let's telnet to ourselves
make sure that we can log in before I savethe configuration.
So that looks good.
Save the switches configuration.
So now we've got AAA configured on these three devices.
These devices don't have a username configured of David in the local username and password database,
but notice I should be able to log in via the console using the username David and the password Cisco
and there you go.
I can login to Router1,
Router 1 is an example
should be able to telnet to Router 3 and also log in using the same username and password, even
though that user is not configured on the devices.
Try that again, username is David, Password is Cisco, so I can log into router 1, router 2
and switch 1 using username David, we then need to create another user and test that that works as
well.
So on the AAA server,
I'm going to create a user called Peter Pan and Click ad, so all I've done is create another user on
the AAA server.
But that means that when router 1 telnet to router 2, we should be able to log in with the user, Peter
Pan, which we can.
This is the advantage of AAA.
Rather than having to create users on every device, we can simply create new users
on the AAA server
and as soon as I've done that
I'll be able to
log in to the device using that username and password.