In the previous video, we set up local authentication here on our six for tel
net access.
We also created a local administrator account here admin one so that when we do
connect to the VTY lines,
we have a username and password that we can use to log into the router.
So in this video, we're going to kick it up a notch by using the command AAA
space new dash model.
Now a few things are going to change by default when we do that.
First of all, the VTY lines, if we didn't even have log in local there, the
default behavior,
once we do triple A new model, is to require login authentication at the VTY WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
once we do triple A new model, is to require login authentication at the VTY
lines.
So right out of the gate, let's demonstrate that and then we'll continue.
So back to our six week go and currently we have log in local here.
So I'm going to take that off of the VTY lines by going to line VTY 0 through
15 and say no login.
And that actually will do it will do do show run pipe section line just to
confirm.
And on our VTY lines, no login effectively.
So no login required. So we did it tell that the six six six six to ourselves
and press center. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But a Bing but a boom, no login required.
So we type in who we are now connected once again on VTY line zero, but we didn
't have to supply a username or password.
So let's exit and do a who again just to confirm we're now back at line
consoles here.
Fantastic. Let's go into configuration mode and let's type in triple A space
new dash model.
Now that's the only change I just made.
However, the default behavior on the VTY lines is going to require a login now.
So we do a show run pipe section line and press center. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we do a show run pipe section line and press center.
It knows that even though on the VTY lines, it doesn't say log in local because
we have triple A new model enabled effectively is requiring a login now on the
VTY lines.
So to test that we can do a tell that to six six six six press center.
Now it's asking for username we have one admin one and we'll supply the
password capital C. I. S. E. O. exclamation mark two three press center and we
're in.
Now notice that we are logged in but still put us in user mode.
So if we do a show privilege and press center where our privilege level once we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we do a show privilege and press center where our privilege level once we
type in enable press center by default that's going to be enabled 15 will
supply the enabled password.
Which is capital C. I. S. E. O. exclamation mark two three and now we're in so
triple A new model is one step in the right direction.
Requiring logins at the VTY lines. Now it doesn't affect the console line. So
if we didn't exit.
So we're back to the console will do a who and then we take an exit again.
Then we'll type an exit again. I'll press center to go back and there's still
no login required at the console.
So we do a show run type section line and press center for the console. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we do a show run type section line and press center for the console.
It doesn't say log in local but at the same time triple A new model didn't
automatically enforce it online console zero although it did enforce a local
login on the VTY line.
Again that's because we have this in place show run pipe include triple A.
We have triple A new dash model implemented and that's what's causing the login
requirement on the VTY lines.
Now one other cool thing I'd like to share with you about triple A new model is
to who verify who we are.
Great work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Sitting at the console still.
Let's do a debug of triple A authentication just like that.
So now if we did a tell that to our six six six six loop I could dress and
press center.
Here we have our debug message saying it picked a method list and it picked it
one called permanent local and that's a default with triple A new model.
So local is referring to the local database the local configuration on this
router and that's why we can log in like a user like admin that we created
earlier.
We can supply the password for that user which is capital C I SEO excellent WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can supply the password for that user which is capital C I SEO excellent
smart 23 press center and we are now logged in.
However it still just logged this in in user mode and we'll correct that as
well as we get into working with a tack X server and adding some authorization
commands as well as login authentication commands to this router.
So for now let me type in exit that brings us back to the console.
I'll turn off the debugging within on debug all.
So now that we have triple A new model implemented on this router.
We now have the opportunity to identify which tack X servers or radius servers WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We now have the opportunity to identify which tack X servers or radius servers
or LDAP servers etc that this router can use if called upon for additional
features like authentication and authorization and accounting using that
centralized server.
So in the next video I'll walk you through the configuration on the router to
point to and use a centralized triple A server and in the example we're going
to use we're going to use tack X.
So I'll see you there in that next video in just a moment.