So now we are going to dive into discussion on AAA configuration and verification.
And this goes hand-in-hand with the discussion we've just had.
And you're going to be expected on the exam to be able to apply what we're talking about here
and incorporate to what we talked about in the last discussion
and potentially look at an entire massive, really crazy config and scenario
and answer some questions on it.
Meaning, if you want to log in right now, what password are you going to use?
Or based on the configuration, what does it mean? Based on that, what does it mean?
Or based on what you currently see, what modifications could you make to accomplish what we want you to accomplish?
All little things like that.
And remember, the exam section security is 20% of your exam and this falls under that section.
So expect quite a few questions on what we talked about in the last session or last video
as well as what we're talking about here now.
So AAA. First of all, what does that stand for?
Well, AAA stands for Authentication Authorization and Counting.
What is AAA? AAA is actually a framework, folks.
A framework. And what is a framework again?
Well, when we talked about IPsec, we said that a framework was something that can give you guidelines,
best practices, help.
So that way there, you can accomplish whatever objective you're trying to accomplish.
So with the IPsec framework, we saw the framework in action and how as long as I follow that framework
and I choose the right things that would be best suited for me, I can accomplish the objective we're trying to accomplish.
So same thing here with AAA.
We have this AAA framework that outlines things like authentication, outlines authorization, and outlines accounting.
Now, does the AAA framework tell you what you should use for authentication or authorization?
No, of course it doesn't.
But what it does is say that for authentication, you need to ensure that you have a way to prove that everyone is who they say they are.
So before authentication, you have what is called identification.
And what is identification?
It's how a user identifies themselves.
So a user can identify themselves like, for example, using their own password.
A user can identify themselves with a fingerprint scan.
A user can identify themselves in many different ways.
And authentication is the process of using whatever they have used to identify themselves
and then determining if they are actually authenticated based on that identifying information.
So authentication is the act of proving that they are who exactly they say they are by comparing what they provide to something that is stored in a database.
So they identify themselves with, let's say, using a password, and I authenticate them using that information against what we have stored in our database.
And authorization would be what?
Would be about identifying what they are allowed to access.
So just because you're authenticated doesn't mean that you're allowed to access anything.
For example, like AWS, I can create a user account for you in AWS, and I can authenticate you into AWS, but you might not be authorized to do anything.
So you're authenticated to log in, but then you can't do anything.
Everything you try to click on, everything you try to do, everything you try to do, it says denied, denied, denied, denied, denied, denied, right?
That is the difference between authentication and authorization.
You could totally be authenticated but not be authorized to do anything.
Now, that's kind of silly in a way because it doesn't make sense to have somebody authenticated and then not give them anything.
Everybody needs at least one thing that they're authorized to do, or it doesn't even make sense to have an account for them that can be authenticated.
But that's just a prime example how authentication and authorization are really two separate things.
And in the realm of security, if you're not aware that these are two really separate things, then you are leaving yourself vulnerable to attack.
So authenticating and then authorizing, specifying in a very granular way what that authenticated user is allowed and not allowed to do is really important.
And then let's keep track of everything.
That is what accounting is for.
So how are you going to keep track of it?
One of the easiest ways is to log everything.
Log all user access.
Log all user activity.
Log everything you possibly can so you can keep track of the who, where, what, whys, whens, hows, and so on and so forth from an accounting standpoint.
So AAA is not enabled on our devices by default.
It's not.
What we've done so far to this point in time on our Cisco iOS devices is we've used the line passwords with the login keyword, and we used our local username and password database with the login local keyword.
We have not used AAA yet.
If we go to our device, for example, R1, and we type in AAA authentication, you'll see that there is no AAA command that starts with that.
Let's back up.
AAA, there's one command and one command only on our device right now, and that is AAA new model.
Look what it says.
Enabled new access control commands and functions.
Disables old commands.
So somebody, whoever came up with this name, wasn't thinking years and years and years and years down the road because AAA is not a new model anymore, right?
But that's how we turn it on.
That is the command to turn it on.
I'm going to do that right now.
All right.
So when it says enable new access control commands and functions, disabling old commands, they were not lying.
They were not lying by saying that.
That is legit.
Let me show you why that is.
So if you were with me in the last discussion we had, what did we do?
We set up console port to use the local username and password database.
Well, let's exit out of here.
Let's hit return to get started.
Okay.
So all that's gone.
Let's type in enable.
Okay.
So that's still there.
Thank goodness.
All right.
So first things first for the exam, make sure you know that when you enable AAA on your device, any other parameters you had before, like line authentication or local username and password database authentication, log in local, that doesn't exist anymore.
So type in show, run, pipe to section line.
The enable password is still there.
You'll see here that everything is gone under the line.
You see that?
It's gone.
It does not say log in anymore.
It does not say password.
Oh, it does say password though, right?
It does say password.
But log in is gone.
Log in local is gone.
But the password is still there.
So what does that mean?
It means you have to recognize that if I type in show, run, pipe to section AAA, if you see this command and I ask you right now what password is going to be used, there's not enough information for you to answer the question right now.
And why is that?
Because we need to know if there's a method list applied and other things like that.
Now, technically speaking, you do actually have enough information now that I think about it.
Because I typed in show, run, pipe to section AAA, which would show every single AAA command.
And what we're not seeing here is a AAA command that specifies the method of the line password.
If there was a method that said use the line password, then your answer would be use the line password.
So right now, yeah, you know what?
There is enough information.
But if you really think about this and get a little deeper, if I showed you exactly this and said, what are you going to use to log into the line?
It is no password.
Because there's nothing telling you that you have to use this password right now.
There's nothing telling you that you have to use the local exam password database.
All right, so that's where the console port.
However, let's look at our VTY lines.
Let's try and access the VTY lines.
You ready?
So the VTY lines, by default, are using the local username and password database.
So if we go back to R1, and you'll look at this output, and you have just enabled AAA, and there's no other commands.
Then what are you using?
You're using the local username and password database.
So there has to be at least one username and password in that database.
If there's not, then you won't be able to log in on the VTY lines.
And then what about this one here?
The console port, no username and password required.
Nothing's required by default.
There's a difference now.
So as soon as you enable AAA, no credentials required to authenticate.
Local username and password database credentials required to authenticate, regardless of whatever else it says.
That's the default.
Know that.
Question, Conrad said, are the usernames and secrets still there?
Yes, they are.
So show, do show run, or no, show run pipe to section line.
No, username.
And there you go.
They're all still there.
All right.
So let's just talk about now how we could enforce, for example, certain methods for authentication.
So what we're going to do is we're going to go to configuration mode, and I'm going to type in the command AAA.
You'll see now that we have a whole bunch of AAA commands because we enabled AAA new model.
I'm going to type in authentication.
Now, when you see this list here after authentication, this list is how you define what you're applying AAA to.
So in this case, AAA authentication.
Am I applying it to 802.1X port-based authentication?
Am I applying it to the enable command?
So that way there, when somebody types in the enable command, we use actually AAA for it, as opposed to the enable secret.
We have PPP.
So if you're using point-to-point protocol, instead of using the built-in authentication of PPP, you could actually use AAA authentication for PPP.
But the one we want to focus on here is this one, login.
Login is referring to your lines.
That's what it's for.
So your console port, your aux port, your VTY lines, that is what login is for.
So that is the one we're focusing on for this discussion, device access and authentication for management purposes.
So login.
Now it asks you to provide a name.
So you either create a user-defined name, a name you create yourself, or you use just the name default.
So default is a name.
Now, what I want you to realize here is that what we're creating is what is called a method list.
A method list.
That's what we're doing right now.
So AAA authentication login, and then I give my method list a name.
So I'm just going to go ahead and use the default name right now.
That's all I'm going to do.
That's all that means.
It's the name of it.
Then you specify your first method of authentication.
Your first method of authentication.
For right now, let me just give you an example of typing in local.
So if I type in local, that means the local username and password database.
That would be method number one.
Since it's a method list, I can provide another method.
So by a question mark, what's the next method?
Let's say it's line.
So if local username and password database doesn't work, then you can use the line password.
So what I want to point out to you, though, is that I have used very specific words there.
If the local username and password database doesn't work, then you use the line password.
I did not say if the user fails authentication.
So if the user fails authentication against the local username and password database, you don't get to use the line.
So how in the world does your local username and password database fail?
Well, since it's local, the only way it would fail is if there's no usernames and passwords in the database.
So if your username and password database is blank, then you could use the line password.
Other than that, you'd never use the line password.
If there's at least one username and password in the local username and password database.
So in my scenario here, it doesn't really make sense to do something like this.
Why?
Because my local username and password database is always going to be there with at least one username and password.
So in this case, it doesn't make sense to have multiple methods.
I'll show you when it makes sense to have multiple methods.
But it doesn't stop Cisco on the exam from doing something like this and saying, hey, what does this mean?
It means if the local username and password database is unavailable, it's not working,
then we can go ahead and use the line password for authentication.
So let me just show you here.
Let's just do line as an example.
And let's now apply it to the console port.
So let's go to line console zero.
And what are we going to type in?
We're going to type in now login.
But notice I cannot hit enter.
And I have two different options here.
We're just going to focus on the authentication option today.
So login authentication and then the name.
So it's either going to be the default name like we used up here.
We use the name default.
Or whatever custom name you created.
So let's just put in default.
Do show run pipe to section line.
And what you're going to see here is that nothing is showing up.
Let's see if it even worked.
It did.
It's not even showing up my command.
This is what frustrates me about all of this.
Because right now I have AAA applied to the console port.
But it's not showing that I have it applied.
Why?
I'll tell you why.
It's because I used the default method list.
That's why.
In this scenario.
Okay.
What about?
Remember we said the VTY lines by default use what?
They use the local username and password database by default, correct?
Remember we saw that.
Let's do it one more time to show you.
It's working, right?
We good?
Okay.
So it's using the local username and password database.
But let's try Telnet.
Oh, wait a second.
Right?
It's only using the local username and password database.
Why?
Because I'm using SSH.
But now it's using what?
Line.
It's using the line password.
Why is it using a line password?
Because I explicitly said the default method list is going to now use line.
I mean, this is crazy stuff.
When you think about it, it's like a whole bunch of if then statements in a code.
And it makes it really tough to prepare for a certification exam with all these different options that come flying at you.
So because I said default line, that automatically applies to this regardless of what I do.
For Telnet, but not for SSH.
Whereas for this, it's not applied to it unless I type in what?
Login, authentication, default, which we did, but it doesn't show up.
It doesn't show up.
So what is a better option typically?
A better option typically is to set yourself your authentication.
Login, for example.
Give it a name.
Let's say for the console port.
So let's call it console.
And let's now type in that we're going to use login instead.
Not login.
Pardon me.
Local.
Local username and password database.
So now let's go back to line console zero and type in login, authentication, console.
Do show run pipe to section line.
You're going to see that it's applied in this case.
There you go.
That's helpful, isn't it?
And so now if we try to log in.
We're going to use the username and password database.
And this one here is still using what?
It's still using default.
So in this case, if we try to telnet in, you'll see it's just asking for a password.
Why?
Because it's still using default, which is what?
Default applies to, by default, local username and password database.
But then we change default to line.
So that's why when we're telnetting in it, it's using the line password.
So let's go ahead and modify this.
Or create another one, let's say, as an example.
Triple A authentication.
And we'll say for login purposes, we'll call this one VTY just for fun.
And we'll say login as well.
Oh, let's try login case.
Okay, what does login case mean?
Just so you know.
Sorry, local case.
Local case means the username is also case sensitive.
So if you don't type in the username in the proper case for the local username
and password database, then it won't be, then you'd be denied.
So now let's go to line VTY 0 through 4.
And let's type in login authentication.
And we'll type in VTY because that was the name of that.
Do, show, run, pipe, section, line, and triple A.
All right, so there you go.
So now we've got all three of these, as you can see.
But now if I asked you, how are we going to authenticate to the console ports?
So when you look at the console port, you'll see login authentication con.
So there's con.
And con says local username and password database, not case sensitive.
But if you look at the VTY lines, the VTY lines say what?
Login authentication VTY.
So VTY is local case, which means login is using a local username
and password database, but it's case sensitive.
So this one's not even being used right now anymore on the console port
or the VTY lines.
So if we go to DSW1 as an example, and we try to tell that in now,
it's asking for a username and password.
So let's type in capital Raymond, Raymond, and then Cisco.
And I should be denied because it's not capital R, it's lowercase r.
There you go.
Oops.
All right, so lowercase r.
So that's what local case means.
Remember that for the exam in case it shows up.
All right.
So this is using our local username and password database.
What is the problem with using the local username and password database?
The problem with it is it's not a scalable solution.
Yeah, Conrad, exactly.
It's not a scalable solution.
Why?
Because what it means is that for every single device you have,
you're going to have to maintain a local database of usernames and passwords.
And so if you have, for example, like we have 1, 2, 3, 4, 5 users,
and let's say we had 300 devices, I'm going to have to maintain this on 300 devices.
And so if all of a sudden Casey gets promoted, finds a job somewhere else,
making a lot more money, then I'm going to have to go to all 300 devices
and remove Casey.
What if I forget just one?
Well, that leaves us vulnerable to Casey attacking us later on from the new job
opportunity that Casey has.
So we don't want to end up in that type of situation ever.
We want to be able to centrally manage all of our usernames and passwords.
And so this is where AAA comes into play,
where we're going to use a AAA server as an example,
a database on a centralized external server.
And so one of the two types of protocols we can utilize when our devices,
like Cisco switches or Cisco routers or any other type of Cisco product,
needs to communicate with a AAA server.
We have RADIUS and we have TACACS+.
RADIUS is an open standard that uses UDP.
TACACS+, a Cisco proprietary, uses TCP.
And so now what does this mean?
It means that when you are SSHing or telnetting to your Cisco router,
your Cisco switch or Cisco device that you want to manage, monitor,
maintain via the what?
Via the VTY lines, we are not using the line passwords potentially.
We are not using the local username and password database.
Instead, what are we using?
We're using a AAA server here to do the authentication for us instead of the
local network device.
So RADIUS and TACACS++ are used where?
From here to here.
That's where it's used.
And then from here back to here.
That's where RADIUS and TACACS are used.
They're protocols for communicating with that AAA server.
Now, we have a tendency to call it a RADIUS server or a TACACS++ server,
but in reality, what is it?
It's a server with a centralized database that has the ability to communicate
using RADIUS to our network devices.
Or it's a server that has the ability, sorry,
a server with a database that has the ability to communicate to my network
device using TACACS+.
That's what we have.
And a Cisco example is the Cisco Identity Services Engine, Cisco ICE.
If you want to learn more about ICE, folks,
we have a course here that prepares you for the SISI exam.
That's right.
Securing Identity Services Engine.
We call it the SISI exam.
So does everybody else.
But take a look at that if you're ever interested in using Cisco's
Identity Services Engine.
And then from there,
whether we're using RADIUS or TACACS++ to talk to Identity Services
Engine, we are talking using SSH here or Telnet.
So in the end, right, I try to connect to you.
You ask for my username.
You ask for my password.
You then reach out to the server to find out if my username
and password is correct using RADIUS or TACACS+.
The server responds back yes or no, and then I'm allowed or not.
And then in addition to that, we have the ability to do authorization.
We have the ability to do accounting on that AAA server as well.
So we can configure that network device to also ask the server, hey,
what are they authorized to do?
So now every time I try to do something, right, I've got to be authenticated,
but then am I actually authorized to do what I want to do?
Yes or no.
The server can tell my network device that.
And then we record everything and we send it to that AAA server to make
sure that it can store it in all of its logs.
So RADIUS for the exam, make sure you know the things you see here,
using UDP ports 1812, 1813.
By default, our Cisco devices use 1645 and 1646.
So this would be for authentication and authorization,
and this would be for accounting.
So 1812 or 1645 are auth authorization,
and 1646 and 1813 are accounting.
So originally before RADIUS was widely developed,
deployed, and everything else, we were using 1645, 1646 back in the day.
And Cisco IOS defaults to using 1645, 1646,
but most of us implement RADIUS servers or the software we install in our
systems use 1812, 1813 nowadays.
So what that means is you either got to change the server to use 1645,
1646 with your Cisco devices,
or you got to change your Cisco devices to use 1812, 1813.
So just keep that in mind for the exam.
If they mention the port numbers you have to use,
then they are basically telling you, we want to know,
do you know how to configure those port numbers on your Cisco device?
And I'll show you that when we get to our RADIUS configuration.
TACACS plus is TCP port 49.
RADIUS combines authentication and authorization together.
All that means is this, when my network device reaches out to the server,
it's going to authenticate and authorize the user at the exact same time.
I can't do one without the other.
So I can't just do authentication with RADIUS.
I can't just do authorization with RADIUS.
I have to do both authentication and authorization at the same time.
And I can do accounting separately though.
I can do it separately.
Whereas with TACACS plus, I can do all three separately.
So I can just do authentication.
I can just do authorization.
I can just do accounting if I want to.
RADIUS is a one-way unidirectional with a single challenge response.
Actually, you don't have to know that.
Whereas TACACS plus is a two-way bidirectional with multiple challenges.
Again, you don't have to worry about that.
But down at the bottom, I want you to know that.
Encrypts only password and packet.
Now, when we talk about password, right, we're talking about what?
We're talking about our credentials.
We're talking about different things like that.
But everything else is not.
Whereas TACACS plus encrypts everything.
Know this potentially for the exam.
And this, and this, and this, and this.
And you don't have to worry about that.
I might take that out of my slide.
It's that unimportant for the exam.
So, let's talk about a configuration here.
So, what do we need to do?
So, I don't have a RADIUS server set up right now.
I don't have a TACACS plus server set up.
And that's perfectly fine.
I'm still going to be able to give you a demonstration here.
Although it won't be a successful login using RADIUS or TACACS plus.
Let's start off with TACACS plus, though.
So, always remember this.
When you enable AAA, we saw that by default your console port allows you to
connect without a username and password or any password.
Whereas the VTY lines, you still needed a username and password.
So, it's always advisable that you have at least one username and password on
your device when you're using AAA.
Always.
Why?
What if your servers are not available?
What if they are down?
What if they exploded on you?
What if they were hacked so bad that you can't use them?
What if they were ransomware and it's going to take you five days to recover
them, but you need to get into this router right now?
Well, you need a backup plan.
And that backup plan is your local username and password database.
So, have at least one username and password in your local username
and password database.
So, I encourage you to have that.
We know how to enable AAA, so it's already enabled.
I don't have to do that, but AAA new model was the command to enable it.
Now, when you're setting up a TACACS Plus server scenario, situation,
what are the things we need?
What's important to us?
Well, I need information about that TACACS Plus server because this router is
going to have to talk to that TACACS Plus server.
So, what I have to do is I have to teach this particular device about that
TACACS Plus server.
So, let's say we have a TACACS Plus server out there,
and I'm going to, in my configuration here, call it TAC server one.
You can call it anything you want.
So, you might want to find out what is the name of that server
and maybe put it in there.
It's up to you.
But that is just a locally significant value for this configuration right now.
That's all it is.
Then we have to specify the actual IP address, IV4 or V6 address of that server.
So, I'm going to put an IPV4 here.
And then what is either the host name or the IP address of that server?
So, I'm going to type in 10.0.3.8, which is a bogus address here.
It's not going to work.
And then I can go ahead and hit enter.
Now, let's specify the port number.
So, by default, it is TCP port 49.
But if you're ever told to change the port number, you just do it this way.
And then lastly, we also need a key at a minimum.
What is the key?
So, this key is going to be the password that is used between your router
and the AAA server.
So, they can authenticate with each other.
So, my AAA server needs to be using this IP address, this port number,
and this key we're going to specify right here.
Now, I'm just going to type in.
It's a TACACS plus server shared secret key.
So, that means the exact same key needs to be configured over there on the server.
TACACS server shared secret key is the actual key that I created here.
So, at a minimum, you need those three parameters.
So, now this device knows how to talk to that AAA server.
Now, let's say you had multiple AAA servers.
For example, let's say you had another one, a backup, a failover,
a secondary for redundancy sakes or high availability sakes
or load balancing sakes.
Then all you would do is create another one of these for that particular server.
So, let's call it TACACS server 2.
Let's put in its IP address.
Let's say that's its IP.
Let's say that, again, port number is 49.
And let's say we're using the exact same secret key.
So, now we have that configuration.
We have the two configs of our two different servers.
So, do, show, run, pipe to section.
All right, so that's all I've done.
I've just specified the parameters that are needed to talk to
and communicate between my router and that particular server.
So, now what I want to do is I want to create a configuration here called a
AAA group.
The AAA group allows me to specify which particular servers are going to be
grouped together.
So, I'm going to call this my TAC group for TACACS group.
And what I'm going to do is I'm now going to embed my servers that we've
created.
So, let's embed this server and let's now embed this server.
That's all I've done here.
I've just created a group and I've embedded my servers inside that
particular group.
So, these two servers are now in that group.
Why?
Because now I'm going to use that group in a method list.
That's what I'm going to do.
So, I'm going to type in AAA authentication.
And now we are going to type in, this is going to be for login.
And, again, I could use default or I could use anyone I want to call.
Let's call it AAA example for us today.
That's the name of it.
And then what is my method list?
Now, this makes sense to use multiple methods.
So, method number one is going to be a group.
And who is that group?
It's going to be my server group I created a while ago.
Now, if you didn't create a group, then you could specify TACACS plus.
And if you specify TACACS plus, it will use whatever servers you created.
So, if I just typed in TACACS plus here, it would use these two servers.
But I can say group and then put in my group name,
and then it uses the servers from that group.
So, you might be saying, well, then why did you use the group?
Because think about it, you might have more TACACS servers.
And if you want certain TACACS servers to be used for this
and other TACACS servers to be used for that in massive enterprises environments,
then it's better to create groups for the different purposes
and then call upon the groups in your method list.
Also, before we were allowed to create groups like this,
we could only specify TACACS plus.
It would be whatever servers we specify.
So, this is like a newer type of config,
where the TACACS plus was like an older type of config.
So, now this is method number one.
So, if I apply this, then that means the only way to authenticate is how?
With my TACACS plus servers.
If the TACACS plus servers are down, if the TACACS plus servers are unavailable,
then what does that mean?
Then we don't authenticate.
You don't get in.
So, it's always advisable to have a second option, a second method at a minimum,
like local as an example.
Local means what?
Local username and password database.
But maybe you would prefer to use your enable password.
You could do that as well.
You could use an enable password.
What else could you do?
You could maybe use the line password if you wanted to.
So, as you can see, there's a multitude of different options that you have.
Could you say TACACS group, I want to use the local username and password database.
If that doesn't work, I want to use a line password.
If that doesn't work, I want to use the enable password.
And if that doesn't work, I want to go ahead and use no authentication whatsoever.
Sure.
So, to read this, you say method one is the TACACS plus servers.
If they are unavailable, use the local username and password database.
If it's unavailable, use the line password.
If it's unavailable, use the enable password.
If it's unavailable, use no password, nothing, and you are automatically authenticated.
So, basically, you would only get to none in this case if there were no servers available,
if there was no username and password in the database, there was no line password,
there was no enable password, you are automatically in.
Well, and in that case, you'd be automatically in no matter what, right?
It wouldn't matter.
But that's how you read it.
I'm just trying to give you an example of how to read this.
Even though it may not make sense for the real world when you read this,
because it's like, well, nobody would do that.
I know.
But think about it from an exam standpoint.
It doesn't matter if it would really work or not in the real world.
They're testing you on whether you can read that or not.
What does none mean?
It means you get in without providing credentials.
So, if I gave you this then,
how do you authenticate if the TACACS Plus servers are unavailable?
No authentication.
You're in.
Nothing required.
How do you authenticate if the local username and password database is unavailable
and the TACACS Plus servers are unavailable?
Again, you don't have to authenticate.
You're automatically in.
How do you read all of this?
That's important for you to be able to do.
All right, let's hit enter there.
So, there's our new method list.
Let's go ahead and apply this.
Where should I apply this to?
I just don't want to lock myself up.
Let's apply it to the VTY lines.
That way I can still get into the console port if I have to.
That's the best thing.
Okay, let's go to line VTY zero through four.
Log in.
Authentication.
And what is it?
It's AAA example.
So, we said, first and foremost, it's a TACACS Plus server.
So, let's say on our TACACS Plus server, we are going to have, okay, there you go.
So, what has happened here?
I can't get to the TACACS Plus server.
It's unavailable.
So, it's asking me for a username, right?
So, if I provide the username and password that's stored on the TACACS Plus server,
let's say my username is Raymond and my password on the TACACS Plus server is let me in.
You're going to see that it's not going to work.
Why is it not going to work?
Well, obviously, we know it's not going to work because the server is what?
The server is unavailable.
So, if the server is unavailable, what's the next item in our method list, folks?
Local username and password database.
So, it's actually trying that.
That's what it's trying to use right now.
So, let's type in Raymond and let's type in Raymond's password in the local username
and password database and it works.
So, there's a prime example.
If the TACACS Plus server is not available, then you have to know that
and you have to apply the credentials for the local username and password database.
So, let's go back to R1 right now.
So, it's not going to tell you, oh, it's down.
Like, if logging was down, you would not know that.
You would have to find out some other way, hey, why or, oh, we're down.
The TACACS Plus servers are down.
So, that means I'm going to have to apply my local username
and password database credentials.
Let's change this, though.
I want to change it to TACAC group and then none.
Let's do none.
Let's do none just to show you that if it's none, watch what happens.
So, it will recognize the TACACS Plus server is down and then it should just let me in.
Yeah, there you go.
I'm in.
So, that is how none works.
None means just let them in.
Keep that in mind.
It doesn't mean no authentication.
It means let them in.
All right.
Let me just double check my notes now that I've been able to give you this demonstration
and make sure that we got everything covered.
All right.
So, yeah, definitely make sure you can read.
So, make sure you know every single one of these in that list, what they mean.
Not all of them, but enable.
What does that mean?
Use the enable password for authentication.
Group.
So, group radius or group TACACS.
Kerberos.
You can do Kerberos if you want.
Probably not going to show up on the exam, though.
Line, local, local case, none.
That's what we've talked about.
Those are the ones I want you to remember.
All right.
So, one thing I want to point out to you is that right now Raymond has privilege level
15, right?
It's not working anymore.
You notice that?
Once you enable AAA, that doesn't work unless you enable it with a AAA authorization command.
Oops.
I didn't want to type that.
All right.
So, let me show you how you can do that in case it shows up.
So, show run pipe to section line.
All right.
We have log in authentication con.
Let's go ahead and type in configure terminal AAA authorization now.
So, AAA authorization.
And we're going to authorize exec now.
That's what we're going to do.
And then we can create a method.
We give it a name or we can use default.
So, default or give it a name.
So, let's type in a name.
What can we give it a name here as?
Oh, let's just call it auth or ization.
All right.
And then let's just go ahead and say local.
Local username and password database.
All right.
So, now I've been able to trigger that privilege level command that we have in there.
And so, that should work here.
Let me just double check something here.
Line console zero.
That would be for that exec automatically.
Let's just give this a try.
Trying to remember how to apply it.
Drawing a blank on it.
It's not in my notes.
Ah, the joys of doing the demo on the fly.
How do I get that on my VTY line right now?
Might have to come back and do that after so we don't waste too much time here.
Let's configure terminal.
Now, I'm going to – I'm drawing a blank on the command right now, folks.
Instead of wasting everybody's time, I'm going to jump back.
I'll continue my adventure and I'll come back.
And during break, I'll check it out and I'll tell everybody right after break.
Yep.
All right.
In the interest of time, I'm going to jump back.
I'll continue my adventure and I'll come back and during break I'll check it out and I'll
tell everybody right after break.
Yeah.
All right.
Let's try.
You know what?
I want to give it the same name as before.
That's what I'm going to do.
So show.
Let's do this.
Do show run pipe to section line.
I think this is the reason why.
Do show run pipe to, no, section AAA.
Let's do this.
Now, we have the AAA example.
That's what we called it, right?
So let's do authorization with that exact same one.
So in this case, we're going to do exec.
We're going to do AAA example.
And let's do, let's try that.
Some of that in my notes, not those exact words.
Nope, didn't apply it either.
That's okay.
I'm going to come back to that after.
All right.
We'll come back to that one after so we're not wasting everybody's time and we can get
through what we want.
I'll take a peek at it after.
So here is in our documentation, in our slides, just some commands to remember.
It's the ones we went through just to show you.
So then you got your AAA authentication login, default group, tag group, local, and things
like that.
Make sure you can read these and you know what they are and then applying them to the
commands that we have.
And then RADIUS is the same way.
So when you look at RADIUS here, you'll see that for RADIUS, we're just using a different
set of commands.
So RADIUS server, and then the address IP, and this is how you'd specify your port number
with RADIUS.
It's right there.
So it's not a separate command.
It's part of the address command.
And then you set up your group and you apply your servers to the group or you embed the
servers in your group.
And then down here, again, just applying your method list as we talked about before.
Now a few other things that I want to just point out to you, let's go back to here, AAA
common criteria, in case that pops up on the certification exam.
What is common criteria?
It's used to create a password policy.
That's what it's used for.
It's used to create a password policy.
So you'll see here that once you enable AAA, you can do a AAA common criteria policy and
give it a name.
So this is you creating a password policy for when you are using the AAA and you're
using the local username and password database for authentication purposes.
It's going to force you to meet these particular requirements for the passwords in the local
username and password database.
So if you're not using AAA, then these would not be available.
But if you're using AAA, then these would be available for the local username and password
database.
So think about it from an exam standpoint.
If the scenario is about, hey, you're currently using your local username and password database
for authentication purposes, you want to make sure that you have a password policy set up
for it.
How are you going to do that?
Well, first of all, you're going to have to enable AAA in order to accomplish that.
That's number one.
And then number two, once AAA is enabled, you can use AAA common criteria to create
your password policy.
So you got number of character changes you can specify, the maximum length of a password,
the minimum length of a password, the lifetime of your passwords, and so on and so forth.
And then you apply it, as you can see, to the username accounts.
So right now we applied it to Raymond, common criteria policy, and the name of that policy.
So that way there, no matter what, when we are dealing with Raymond, when it comes to
that password, the password has to meet those password requirements.
And you'll see that the password array now does not meet the password requirements, does it?
It doesn't.
And the reason why is because I created that password before I actually created the policy
on this device.
So the next time Raymond changes his password, then Raymond will be forced to use the password
policy requirements that we have here.
Okay.
So it looks like we have everything covered we wanted to cover, folks.
Let me just go back here, take a peek at this.
We've covered pretty much here and more.
I went a lot deeper than that.
Covered that.
We've talked about this with the AAA server.
Radius versus TACACS to get us ready for the exam at a high level.
Understanding that, that's perfect.
All right, know this.
We're good there.
We've gone through this in a little demo, showed you what happens, how to read it.
That's the most important part for the exam.
If you can't read the method list, you are going to struggle.
That's good.
All right.
And then we looked at radius, same thing, and we're good there.
All right, so we have you covered there for AAA.
And in the meantime, let's remind you that your goal is to be able to apply everything
from this discussion and the discussion before, all together.
So that way there, when you are tested about those on the exam, you are going to have the
ability to pick one versus the other out of a lineup on the exam based on the information
they provide you.
It's not going to be easy, especially if you are weak in regards to how all this works.
So I encourage you to review, review, review to strengthen your knowledge, and then they
become easier, the questions.