In this first video regarding setting up the authentication,
I'd like to focus on local.
Now, what exactly does that mean?
Local means the local configuration on the router.
For example, if we're going to log in as a user,
we're going to go ahead and make sure that user exists,
and the configuration on this router
prior to reaching out using a AAA server.
For the demonstration, I'd like to walk you through,
it looks like, on a fairly new router,
to go ahead and try to connect to it.
Now, good test, by the way,
is to log on to the router via the console port,
and then tell that to yourself or to itself. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then tell that to yourself or to itself.
In this case, the loopback is 666, 666.
We could use any working IP address on any interface,
but 666 is the loopback.
So I'd like to walk you through logging in,
or attempting to log in to the router initially,
and then we'll start setting up with local authentication
to force a login prompt when this router is logged into.
Now, this would apply also to telnet and SH on the VTY lines,
and for the demo, I'm just going to use telnet,
because it's already set up to accept incoming telnet requests.
So here in the lab, let me go ahead and double click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in the lab, let me go ahead and double click
on the topology, and here it is.
We're going to be working on R6.
So let's go ahead and double click on server1 nug,
and it'll give us console access to all our routers.
All right, and here comes server1.
Fantastic, and there is our six, we'll select that tab,
and let's just do a quick show, run, type, section, line.
That's one thing, look at the line configurations for a moment.
So currently on these VTY lines have zero through 15,
I currently have an exact timeout logging synchronous, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I currently have an exact timeout logging synchronous,
no login, no login means no login required.
I also have an enable secret set up on this router.
So we do a show, run, pipe, include secret,
and press center, there is the enable secret,
and I just want to tell you what that is right now.
So the secret is Cisco, exclamation mark two, three,
for the capital C at the very beginning.
So that's the enable secret that's configured
currently on this router.
So let's verify it's IP addresses,
let's just show IP interface brief.
Please exclude any lines that have the word unassigned in them,
and there is our loopback zero of 666. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and there is our loopback zero of 666.
So if we, in this current state, if we did a telnet
to 6.6.6.6 and press center, boom, or N.
So it didn't require any type of login,
and that's because the no login means no login
effectively required, that's how I like to think of it.
And if you type in who here, the name of the show users,
so the last one indicates how we're connected,
on this case, VTY line zero,
and because there's no login required,
we don't have a username associated with this.
So let's go ahead and type in exit,
and let's go to configuration mode. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's go to configuration mode.
And before we require a login at the VTY lines,
let's create a user account so we can login.
So we'll create username admin one,
we'll specify the privilege level is gonna be 15,
and that way it's King Kong writes if we need it,
and then we'll go ahead and specify the secret.
And I'm gonna use that same password,
capital C, ISCO, exclamation mark two, three.
So even though that happens to be the enable secret,
I'm gonna use that same secret or password for this admin one,
and we'll press center.
And that way I have less passwords in my head to remember. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way I have less passwords in my head to remember.
Fantastic.
So now let's go back into configuration mode,
I didn't mean to leave actually.
And let's go to line VTY zero through 15,
that'll cover all of our existing VTY lines,
and we'll say login local, just like that.
And then we'll type in end,
and let's do a telnet to 666 to ourselves,
and now it's requiring a login username.
So we'll type in admin one, press center,
supplier password, which is capital C, ISCO,
exclamation mark two, three, press center,
and we are in.
So now we do a show users, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now we do a show users,
or we do who, which is the same output.
It shows us where logged in as admin one,
and once again we came in on VTY line zero.
So we have an exit and exit again,
and I'll go back in.
Now we're back at the console,
and currently the console is not requiring a login.
So if we do a show run pipe section line,
you notice here at the console,
it's not requiring a login.
So we also, if we wanted to online console zero,
we could say login local,
and we forced the login there as well.
Now, I would strongly encourage you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, I would strongly encourage you,
as you're working, I'm gonna put you on the lab
at the telnet of these videos,
I would encourage you to not mess with the authentication
for line console zero.
That is your lifeline to get into the router.
So you can do the configuration changes
for the authentication,
including TAC-X regarding logging in via the VTY lines,
and test those, and at the same time,
not lock yourself out.
Now in the event you do lock yourself out,
you can use the reset button,
and then I'll reset the lab back to its initial state,
and you can go for it again.
But to save you some time,
I would recommend when you get to the lab, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I would recommend when you get to the lab,
just focus on authentication and authorization
with AAA, just focused on the VTY lines.
So in this video, we've just taken a look
at some options for local authentication,
regarding the local configuration on the local router,
all by itself.
In the next video, we're gonna kick it up a notch
and take a look at using AAA new model,
and after we do that,
we can start adding on additional features
like using centralized authentication servers,
such as a TAC-X server.
So we'll continue this journey in the next video,
and I'll see you there in just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'll see you there in just a moment.