It's always fun to see somebody gets a router
or a device for the first time.
And they're brand new to Cisco.
It's like, how do I-- how do I get access?
Well, in this video, I'd like to have a chat with you
and I about the various forms of access
and the options for control we have regarding authentication.
So let's start off with this chalkboard drawing.
And let's take R1.
Now, if R1's fairly new, and it doesn't have a configuration,
we'd want to go to the console port,
because we have no IP addresses.
And that means we can't remotely connect to it over its VTY
lines. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
lines.
So if we're connecting to it via the VTY lines,
we could connect and use Telnet.
Or if it's been set up for SSH, which
is preferred because it's secure,
we can connect via SSH over the existing VTY lines.
Or if we connect with the console port,
it's going to line console 0.
And so when we connect initially, by default,
most devices do not have any authentication whatsoever
on the console port, which is great.
And that way we can get in.
But we don't want to leave our devices with no authentication
requirements on the console. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
requirements on the console.
So here are some options that we can
have for the console access.
We can specify that we want to do a Login.
Now, if we just have login by itself,
that means we're requiring a password.
So if we specify Login at the console,
this also applies the VTY lines.
If we specified Login, we'd also have
to specify a password so that we can supply the password when
it asks for it.
Also converse to that, if we say no Login,
that means there's no login required.
It doesn't mean you can't log in.
It just means you can just have access
to it just by connecting. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to it just by connecting.
So Login with a password, that's one option.
We can also do Login local.
Login local says, use the local database, the running config
on this device.
And so you Login local, we connect.
And then, on that line, it's going
to ask us for our User name, like Bob,
and then whatever password we specified for Bob.
And it's important that we use a Type 5 or a Level
5 secret with Bob so that somebody can't just
see the hash, or worse yet, a password in plaintext and just
go back and just have access to that password. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go back and just have access to that password.
So we specify in the local config, a user name like Bob,
a password, we could also specify the privilege level.
So we're on the backup PRIV level.
So one of the first things we might want to do
is create a local user with privilege level 15 access
and then a pretty good password.
And that way, we can get back in if we
force Login for our user name at the console
or at the VTY lines.
OK, so those are a couple options.
The other options include AAA, the Authentication, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The other options include AAA, the Authentication,
Authorization, Accounting.
And we do New model.
Then that does change a few rules by default.
And also, it gives us the opportunity
to create method lists.
We can create method lists, like Method 1.
And for our Method 1, we want to use a group of TACACS servers.
And if there's no TACACS servers,
either defined or reachable, then we
can use a group of RADIUS servers.
And then, if we can't reach a RADIUS server group, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then, if we can't reach a RADIUS server group,
then we can use a local database, like that.
And so what that's doing for us is, once we have the setup--
ideally, if we're telling a method list
that you use a group of TACACS servers,
we should have defined that group of TACACS servers
and tested it to make sure it's reachable and responding
and the keys are all right, and not just say, use TACACS.
Good luck finding one.
We needed to find those, as well, and test them.
So the Method list, [INAUDIBLE] Method 1, Method 2, Method 3.
And that Local right there, that's a good thing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that Local right there, that's a good thing
to come back to in case we don't have reachability to TACACS
server or RADIUS server, or we didn't define them
accidentally, we can still log in.
So this is a good backup right there.
OK, and then we can also specify a method list as a default.
And that way, our VTY lines can use those by default.
Or if we specify, we go to line VTY 0 through 15 or 0
through 4, whatever device we're on,
we could say Login authentication
and then specify a method list.
So it's important to be familiar--
and these topics were addressed back in the CCNA content. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and these topics were addressed back in the CCNA content.
But it's important to be familiar what our options are
for securing it.
And then, even with everything dialed in,
we still may have some options.
I mean, our user right here, let's say
this is Bob the user, who is trying to remotely connect,
maybe on the VTY lines, there's an access control list that's
specifying who can connect.
Or maybe, somewhere between Bob and this device,
there is an ACL filtering ACL, thus denying TCP Port
22 if we're trying to use SSH, which uses TCP Port 22. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
22 if we're trying to use SSH, which uses TCP Port 22.
So we want to be aware of all the moving pieces.
And then, in troubleshooting it, we just
want to find out what works.
One good recommendation is instead
of trying to troubleshoot it remotely,
if you can start at the box itself and Telnet to itself,
and see if it works or not--
or SSH to itself and see if it works or not,
solve the problem there first.
Maybe have some out-of-band-management suit
to get at this device.
So if you can [INAUDIBLE] limiting
the failures or the possibilities, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the failures or the possibilities,
then you can resolve why it's not working locally.
And then you can reach out further to a remote device
and test it from there as well.
So this has been an overview of several of the options
that we can use for authentication, including
the local user database, just a password,
and also using AAA Method lists.
And in the next video, I'd like to take a look
at troubleshooting access to this device
via the console port.
And that includes a lot of factors
like, do we have the right cable,
is our terminal emulation program--
are we pointing to the right local comport, and so forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are we pointing to the right local comport, and so forth.
So I'll see you in that next video
as we tackle troubleshooting console port access.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.