At the moment in this GNS3 topology, we can log in to Router 1 with the username David and Password
Cisco.
The ACS server, however, only has a username of admin.
So once we integrate R1 with the ACS server, David will no longer be able to log in.
So let's configure R1 to talk to the authentication server. At the moment
please note that on the console, when we use the command login, we have the option login, enter or
carriage return, which means that the password on the line is used for authentication
or we can specify that a local username and password database is used for authentication, one of the
first commands we going to use with triple A is triple A new model.
This will enable new access control commands and functions
and disable old commands, so we've entered a new model now when we go onto the console and type log
in notice, the options have changed.
Previously we had login local or log and enter, but if we type login enter, that doesn't work
or login local.
That also doesn't work, so the authentication commands have changed and now we have the options of
login authentication and we can specify a word or the default option, I'm not going to enter that now.
By default, the authentication used is default
and I'll show you where that's configured in a moment. So all we've done thus far is specify
a new model.
We need a local username and password as backup, but that was configured previously, so we've got
two usernames and passwords here, David and Mary.
So what we'll do now is specify Tacacs, you could use Radius, but in this example, I'm going to specify
a Tacacs host of 10.1.1.1.
That is this ACS server.
ACS server has an IP address of 10.1.1.1.
So as an example, ping 10.1.1.1
the router can ping the ACS server, we need to specify a password that's going to be used for encryption.
So we use the command tech server key and then specify a password for the encryption or key for the
encryption.
I'll use Cisco here
and now we need to specify triple A options.
We have authentication, authorization and accounting.
I'm going to specify authentication.
What are we going to authenticate in our example?
We're going to authenticate login attempts to the Router.
So triple A. authentication login, you could also use triple A for PPP sessions, in other words, Chappe
or Pappe, or when someone uses the enabled command to go to the enable mode, but you will simply do
it for login.
We can use a word or default, and that's where that default option comes in.
Default means that this authentication method is going to be applied to all lines on the router.
That means the console, the auxiliary port VTY lines and TTY lines.
We didn't apply authentication on the auxiliary port in this router, but by using AAA, it's a lot
easier to apply an authentication on every line on the device and not miss some of the lines.
So it's a lot better than doing things locally.
We can then specify what's going to be used for authentication in our example, we want to specify a
group which is going to be Tacacs because we're using the Tacacs protocol and then as a backup authentication
method, we can use local.
What that means is that if the router is unable to connect to the Tacacs server because the network
is down or the server is down, a local username and password database will be used as an alternate
method for authenticating the user.
Now please note authentication failures to the Tacacs server doesn't mean that the local database will be used.
The local database is only used if the server is unavailable.
So that was the configuration, show run will allow us to see that, so we specified AAA new model, we specified
our authentication default method is going to be using Tacacs and then a local database.
These were configured previously, but you would need to configure a local username and password as
a backup.
Here's our Tacacs server information
and notice on the lines, we no longer see a log in local, the console is using the default, which
is to use Tacacs and if that fails, to use a local database.
So when we try and log back into the router with a username of David and password of Cisco, it works
at the moment because the router isn't connected to the Tacacs server, we still have to configure the Tacacs
server to allow the router to communicate with the server.
At the moment, we have some other devices here, but the GNS3 router isn't configured.