Packet Tracer - Configure AAA Authentication on Cisco Routers
Topology
Addressing Table
Device Interface IP Address Subnet Mask Default Gateway Switch Port
Fa0/0 192.168.1.1 255.255.255.0 N/A S1 Fa0/1
R1
S0/0/0 (DCE) 10.1.1.2 255.255.255.252 N/A N/A
Fa0/0 192.168.2.1 255.255.255.0 N/A S2 Fa0/2
R2 S0/0/0 10.1.1.1 255.255.255.252 N/A N/A
S0/0/1 (DCE) 10.2.2.1 255.255.255.252 N/A N/A
Fa0/1 192.168.3.1 255.255.255.0 N/A S3 Fa0/5
R3
S0/0/1 10.2.2.2 255.255.255.252 N/A N/A
TACACS+ Server NIC 192.168.2.2 255.255.255.0 192.168.2.1 S2 Fa0/6
RADIUS Server NIC 192.168.3.2 255.255.255.0 192.168.3.1 S3 Fa0/1
PC-A NIC 192.168.1.3 255.255.255.0 192.168.1.1 S1 Fa0/2
PC-B NIC 192.168.2.3 255.255.255.0 192.168.2.1 S2 Fa0/1
PC-C NIC 192.168.3.3 255.255.255.0 192.168.3.1 S3 Fa0/18
Objectives
Configure a local user account on R1 and authenticate on the console and VTY lines using local AAA.
Verify local AAA authentication from the R1 console and the PC-A client.
Configure a server-based AAA authentication using TACACS+.
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 6
Packet Tracer - Configure AAA Authentication on Cisco Routers
Verify server-based AAA authentication from PC-B client.
Configure a server-based AAA authentication using RADIUS.
Verify server-based AAA authentication from PC-C client.
Las contraseas de acceso a los routers son:
Enable password: ciscoenpa55
Password for vty lines: ciscovtypa55
Background / Scenario
The network topology shows routers R1, R2 and R3. Currently all administrative security is based on
knowledge of the enable secret password. Your task is to configure and test local and server-based AAA
solutions.
You will create a local user account and configure local AAA on router R1 to test the console and VTY logins.
o User account: Admin1 and password admin1pa55
You will then configure router R2 to support server-based authentication using the TACACS+ protocol. The
TACACS+ server has been pre-configured with the following:
o Client: R2 using the keyword tacacspa55
o User account: Admin2 and password admin2pa55
Finally, you will configure router R3 to support server-based authentication using the RADIUS protocol. The
RADIUS server has been pre-configured with the following:
o Client: R3 using the keyword radiuspa55
o User account: Admin3 and password admin3pa55
The routers have also been pre-configured with the following:
o Enable secret password: ciscoenpa55
o RIP version 2
Note: The console and VTY lines have not been pre-configured.
Part 1: Configure Local AAA Authentication for Console Access on R1
Step 1: Test connectivity.
Ping from PC-A to PC-B.
Ping from PC-A to PC-C.
Ping from PC-B to PC-C.
Step 2: Configure a local username on R1.
Configure a username of Admin1 and secret password of admin1pa55.
R1(config)# username Admin1 secret admin1pa55
Step 3: Configure local AAA authentication for console access on R1.
Enable AAA on R1 and configure AAA authentication for console login to use the local database.
R1(config)# aaa new-model
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 6
Packet Tracer - Configure AAA Authentication on Cisco Routers
R1(config)# aaa authentication login default local
Step 4: Configure the line console to use the defined AAA authentication method.
Enable AAA on R1 and configure AAA authentication for console login to use the default method list.
R1(config)# line console 0
R1(config-line)# login authentication default
Step 5: Verify the AAA authentication method.
Verify the user EXEC login using the local database.
R1(config-line)# end
%SYS-5-CONFIG_I: Configured from console by console
R1# exit
R1 con0 is now available
Press RETURN to get started.
************ AUTHORIZED ACCESS ONLY *************
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
User Access Verification
Username: Admin1
Password: admin1pa55
R1>
Part 2: Configure Local AAA Authentication for VTY Lines on R1
Step 1: Configure a named list AAA authentication method for VTY lines on R1.
Configure a named list called TELNET-LOGIN to authenticate logins using local AAA.
R1(config)# aaa authentication login TELNET-LOGIN local
Step 2: Configure the VTY lines to use the defined AAA authentication method.
Configure the VTY lines to use the named AAA method.
R1(config)# line vty 0 4
R1(config-line)# login authentication TELNET-LOGIN
R1(config-line)# end
Step 3: Verify the AAA authentication method.
Verify the Telnet configuration. From the command prompt of PC-A, Telnet to R1.
PC> telnet 192.168.1.1
************ AUTHORIZED ACCESS ONLY *************
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 6
Packet Tracer - Configure AAA Authentication on Cisco Routers
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
User Access Verification
Username: Admin1
Password: admin1pa55
R1>
Part 3: Configure Server-Based AAA Authentication Using TACACS+ on R2
Step 1: Configure a backup local database entry called Admin.
For backup purposes, configure a local username of Admin2 and secret password of admin2pa55.
R2(config)# username Admin2 secret admin2pa55
Step 2: Verify the TACACS+ Server configuration.
Select the TACACS+ Server and from the Services tab, click on AAA. Notice that there is a Network
configuration entry for R2 and a User Setup entry for Admin2.
Step 3: Configure the TACACS+ server specifics on R2.
Configure the AAA TACACS server IP address and secret key on R2.
R2(config)# tacacs-server host 192.168.2.2
R2(config)# tacacs-server key tacacspa55
Step 4: Configure AAA login authentication for console access on R2.
Enable AAA on R2 and configure all logins to authenticate using the AAA TACACS+ server and if not
available, then use the local database.
R2(config)# aaa new-model
R2(config)# aaa authentication login default group tacacs+ local
Step 5: Configure the line console to use the defined AAA authentication method.
Configure AAA authentication for console login to use the default AAA authentication method.
R2(config)# line console 0
R2(config-line)# login authentication default
Step 6: Verify the AAA authentication method.
Verify the user EXEC login using the AAA TACACS+ server.
R2(config-line)# end
%SYS-5-CONFIG_I: Configured from console by console
R2# exit
R2 con0 is now available
Press RETURN to get started.
************ AUTHORIZED ACCESS ONLY *************
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 6
Packet Tracer - Configure AAA Authentication on Cisco Routers
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
User Access Verification
Username: Admin2
Password: admin2pa55
R2>
Part 4: Configure Server-Based AAA Authentication Using RADIUS on R3
Step 1: Configure a backup local database entry called Admin.
For backup purposes, configure a local username of Admin3 and secret password of admin3pa55.
R3(config)# username Admin3 secret admin3pa55
Step 2: Verify the RADIUS Server configuration.
Select the RADIUS Server and from the Services tab, click on AAA. Notice that there is a Network
configuration entry for R3 and a User Setup entry for Admin3.
Step 3: Configure the RADIUS server specifics on R3.
Configure the AAA RADIUS server IP address and secret key on R3.
R3(config)# radius-server host 192.168.3.2
R3(config)# radius-server key radiuspa55
Step 4: Configure AAA login authentication for console access on R3.
Enable AAA on R3 and configure all logins to authenticate using the AAA RADIUS server and if not available,
then use the local database.
R3(config)# aaa new-model
R3(config)# aaa authentication login default group radius local
Step 5: Configure the line console to use the defined AAA authentication method.
Configure AAA authentication for console login to use the default AAA authentication method.
R3(config)# line console 0
R3(config-line)# login authentication default
Step 6: Verify the AAA authentication method.
Verify the user EXEC login using the AAA RADIUS server.
R3(config-line)# end
%SYS-5-CONFIG_I: Configured from console by console
R3# exit
R3 con0 is now available
Press RETURN to get started.
************ AUTHORIZED ACCESS ONLY *************
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 6
Packet Tracer - Configure AAA Authentication on Cisco Routers
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
User Access Verification
Username: Admin3
Password: admin3pa55
R3>
Step 7: Check results.
Your completion percentage should be 100%. Click Check Results to see feedback and verification of which
required components have been completed.
2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 6
