On the Cisco ACS server, we need to go to network configuration and add a triple A client.
In other words, we need to add the Cisco router.
We need to specify the hostname of the router, so I'm gonna call this router 1 and then we need to specify
the IP address of the router
10.1.1.201. The key that we used
was Cisco, shown over here.
So we need to specify Siska as the key and we are going to authenticate in this example using Tacacs
Cisco iOS, there are other options such as Radius
but we'll use Tacacs in this example and I'm going to click, submit and apply to apply that configuration.
Once again, under users, we only have a user called Admin.
So now let's test whether we can log back in to Router 1 as David, so well enter David and the password
notice authentication has failed on the Tacacs server going to reports and activity.
We can look at failed attempts
and we can see here that we've got a failed attempt for David, external database user invalid or bad
password.
I'll login as Mary, username Mary, password Cisco.
I'll refresh the logged in failures and notice Mary
has failed.
But if we log in is Admin Cisco, the authentication passes and we are able to access the router show
run pipe include user.
Shows us that we have a user, David, and a user, Mary, with the relevant passwords, but to the
local username and password database
is only used if the Tacacs server is not available. So as an example, if I stop the Tacacs service on
the Tacacs server
and exit out of the router and then log in as David, I can access the broader so I can only use the
local username and password database if the Tacacs server is down.
If, however, the Tacacs server is up, so I'll start the service again.
If I try and log back in as David notice authentication has failed and once again on the server, we
can see that David failed the authentication.
I can, however, log back in as admin.
Now, what's really nice about this is that you can create a centralized user accounts so I could create
a user called user one set to their password
and click submit, so when I look at the available users, I now have a user called User One, and without
making any configuration changes on the router, we can log in as user one so that user doesn't exist
in the local router configuration but exists on the Tacacs server.
If I want to I can disable the user account.
So user 1 is now disabled back on the router.
If we try and log in as user 1
authentication has failed, and once again, looking at the reports on the ACS server.
We can see failed attempts, user 1 account is disabled, so when they try to access this device,
TTY 0,
in other words, the console.
Their login has failed.
If they try to access that router remotely, so they try to Telnet the router and login as user 1,
authentication has failed and refreshing the information on the tacacs server, we can see that user
1 has failed, the authentication account is disabled and they try to access TTY 98.
In other words, one of the VTY lines on the router, we're getting a lot of central information
from the ACS server.
What we can also do is enable some debugging.
So login as admin and then we can use command such as Debug Tacacs
and I'll just enable all of it and debug triple A
and in this case we'll enable authentication.
So when the user tries to access the router, we can see quite a bit of information.
So AAA authentication log in, the users trying to log in, we using the default method note on the
VTY lines.
No authentication methods have been set.
It's inheriting the default method, so default is being used.
authentication start packet created.
We're trying to get a response from the user in this case, the user took too long, so let's try that
again.
I'll put in the username of user 1.
So we can see now it's asking for a password
and notice the response failed.
The server 10.111 has rejected that username, so let's put some spaces there and login with
the
admin user.
Login succeeded.
So in this case, we received a response of pass authentication succeeded.
So go through the full process again.
Telnet to the router.
Default list is being used, we are asking for the user account, so that's admin asking for the password.
Authentication succeeded.
So we can see what's taking place in the background here.
AAA authentication is being used.
The router is told by the AAA server to ask the user for the username and then to ask them for their
password and then to tell the user that they succeeded the authentication and can login.
So that's an example of basic authentication on router 1.
Now, there are two ways to set this up, we're using the older method at the moment because these routers
don't support the newer method where we create a group.
So I'll show you that in a moment.
But before I do that, I'll copy this configuration to router 2, to show you that we can create
a central authentication server.
At the moment, we haven't configured router 2 on the ACS server, so we can still log in as David.
So under network configuration, we need to create an entry for router 2, so router 2 10.1.2
02 is the IP address of the router, show IP Interface brief.
So there's the IP address.
Key used is going to be Cisco and I'm going to click, submit and apply so that router is now being configured.
So try and log in
as David.
Authentication has failed, try and login as admin authentication passes, we've now configured two routers
with centralized authentication.
Under the reports, failed attempts.
We can see that David failed the authentication attempt on the second router, so we seek information
for both router 2 and router 1, let's configure router 3.
I'll take this configuration and paste it into router 3.
On router 3, we can log in as David, so that works, but we can't log in as admin because we still
need to configure the ACS server.
So back on ACS, we'll add router 3 IP address is 10.1.1.203 password or keys, Cisco click
submit the routers now configured.
So previously, we couldn't log in as Admin but now hopefully we should be able to.
Let's try again.
David failed there.
So Admin.
So Admin Cisco works.
David Cisco doesn't work.
Because the router is now communicating with ACS, but Admin Cisco does, so we've now got three routers
configured to communicate with an ACS server.
These routers are using an older version of iOS.
They're using version 12.4, and that version doesn't support Tacacs server groups, which is the
new way of doing things and is what you need to know for the exam.