So here is the hands-on lab tasks and with them in mind,
I've reset the lab environment.
Let's do the walkthrough together.
So here's the lab environment.
I did a reset, I restarted the lab.
Let's take a look at our topology diagram.
It's always a good idea to have that available and ready.
Fantastic. There it is.
We are going to do our work based on lab tasks on
our six and our triple A servers down here,
server one nug at 192.1.1.100.
So we'll double click here on server one nug to bring it up,
and that'll give us console access to all of our routers, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that'll give us console access to all of our routers,
including router six. All right.
So here is server one.
Here is multi-tab putty and we are looking at router six.
And as you do the lab, feel free to do the debug,
turn them on, turn them off.
Just to validate what you think is happening is happening.
Some of the debug examples include debug,
triple A authentication like that,
and debug, triple A authorization, and debug, TAC-X.
So that's a lot of outputs of you.
Want to hold off on those till near the end.
You can or you can just leave them on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You can or you can just leave them on.
For the demo, I'm going to go ahead and leave those debug
running. Let's do a show debug and that looks fine.
So I'm also going to leverage this text document right here
for a little bit of help.
So first of all, I'm going to go ahead and create the local user
admin one with privilege of 15 with a password of Cisco
exclamation mark two three.
And I'm also going to enable triple A new model.
So I'll go ahead and do those first and right click on our six
and that part is done.
Next, we're going to go ahead and specify our TAC-X server
with the command TAC-X space server space and the name of our TAC-X WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with the command TAC-X space server space and the name of our TAC-X
server and then the information I had to reach it and what the key is.
So we'll copy that exactly like we did in the demo up to this point,
paste it in, and good to go.
All right, for our next task, and let me bring up the tasks real quick.
So here they are.
We create the local user.
We define the triple A server, configure the VTY lines for login authentication
via TAC-X plus.
So that's going to involve creating a method list
and associating that method list with the VTY lines.
So to do that, we'll go ahead and actually let's also test our triple A WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to do that, we'll go ahead and actually let's also test our triple A
just to make sure it's working.
So we'll grab that test command, copy it, paste that in, and sure enough,
the user was successfully authenticated.
There's the debug messages for authentication and there's some debug messages
for TAC-X.
So for login authentication, we want to make a login authentication method list
.
So it's right here.
So the method list is going to be called TAC-Login.
It's going to call upon our TAC-X servers and if none is reachable,
it'll fall back to the local database. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'll fall back to the local database.
It then applies that method list for login authentication called TAC-Login
to our 16 VTY lines.
So I'll copy that, paste it in, and then we'll test it.
So let's tell that to 6.6.6.6.
We'll go ahead and login as admin one and specify the password of Cisco,
X-Maj2.3, and that looks good.
We can also exit out and we can also login as user one.
So I'll tell that to 6.6.6.6 again.
We'll login as user one this time, also over on the TAC-X server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll login as user one this time, also over on the TAC-X server,
specify the password, same password, a center, and that's working as well.
Fantastic.
And the debug helps reinforce that we're really talking to that triple A server
.
All right.
So we specified the method list for login authentication.
We applied them to the VTY lines.
Next, they want us to do authorization for exec and for commands at level 01
and 15 using TAC-X.
So let's go ahead and include method lists for exec authorization, level 0
authorization,
commands at level 1 authorization, commands at 15 authorization, and then to
apply those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
apply those
for method lists to our VTY lines.
So let's do that next.
So in our text document, let's go down to where we're going to create our
method lists.
So our first method list here for authorization of commands at level 0 is
called TAC-0,
and it's going to call upon TAC-X.
Next one is very similar except looking for authorization for commands at level
1,
and it's called TAC-1.
And the third one looking for commands at level 15, and it's called TAC-15.
And then we get a line VTY-0, 315, and we apply all three of those method lists WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we get a line VTY-0, 315, and we apply all three of those method lists
.
So we'll do that next.
We'll do that by highlighting that text, copying it to my buffer, going to R6,
and pasting it in.
So if we do a show, run, triple A, and press center.
I'll add it to two As, but I didn't know what it meant.
There are three method lists for command authorization.
And if we do a show, run, pipe, section, line, we can verify those are applied
to our VTY lines,
as shown right here.
In addition, it also wants to include authorization of configuration commands.
There's one additional global config command we need to make that happen as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's one additional global config command we need to make that happen as
well.
And if we look at our notepad document, it is this one right here.
Triple A authorization config dash commands includes any commands in
configuration mode,
also requiring authorization by the Triple A server.
And just as it heads up again, this Triple A server for admin one, and also for
user one,
is wide open.
There's no restrictions.
So the Triple A server via TAC-X is just going to say, "Yes, yes, yes."
Anytime the router says, "Can they issue this command?" WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Anytime the router says, "Can they issue this command?"
And that command, the TAC-X servers configure just to say yes to everything.
So I'll go ahead and right click on that, copy it to my buffer,
go to R6, paste it in, and let's test it out.
So we'll tell that lower to 6.6.6.6.
And we'll go ahead and log in as let's log in as user one, put in the password,
and that's great.
Then we'll type in enable to play the password there.
And then we're in privilege mode.
We'll go to configuration mode.
That's being checked.
And then we'll go ahead and in configuration mode, let's create interface loop
back.
How about 4.4.4 press center? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
How about 4.4.4 press center?
That's being checked.
And as a result of the Triple A server saying yes to everything,
it allowed it to happen.
So I'm going to exit out, do a no interface loopback 4.4.4.
And it verified that as well.
And we typed in end.
It also verified that that was allowed as well.
So if we scroll up a little bit, when I typed in end,
check out what level it exists at.
It called upon tack zero, which implies that end, that command is a level zero
command,
which is kind of interesting.
And even though our focus in this set of videos in this lab has been primarily WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And even though our focus in this set of videos in this lab has been primarily
on
using triple A services like TAC-X for authentication and authorization,
there's also a whole other component regarding accounting.
But guess what?
It's the same logic.
We want to create accounting method lists, and then we apply those method lists
to the lines or
the ports where we want that method list to be used.
And then as these are our issuing commands, not only are they being checked,
for example,
for authorization, but they're also being recorded over at the centralized
server,
in this case, the Triple A server.
So thanks for joining me into this dive into the world of authentication and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So thanks for joining me into this dive into the world of authentication and
authorization
using Triple A and also leveraging some local authentication when needed.
And I look forward to seeing you, my friend, in another set of videos very,
very soon.
Until then, I hope this has been informative, and I'd like to thank you for
viewing. www.technet24.ir