Configuring AAA Kamyar Miremadi Laila Sherif Summer 2005

AAA Authentication Authentication Authorization Authorization Accounting Accounting

AAA Components AAA server AAA server Authenticates users accessing a device or network Authenticates users accessing a device or network Authorizes user to perform specific activities Authorizes user to perform specific activities Performs accounting of device or user activities Performs accounting of device or user activities We used clearbox tacacs+ server running on windows XP. We used clearbox tacacs+ server running on windows XP. Network Access Server (NAS) or Access Device Network Access Server (NAS) or Access Device A router, switch, or other network device that can perform AAA functions on users or devices connecting to it. A router, switch, or other network device that can perform AAA functions on users or devices connecting to it. We used both router Cisco 2500 and switch 2900 Catalyst as Network Access Server. We used both router Cisco 2500 and switch 2900 Catalyst as Network Access Server. RADIUS( Remote Authentication Dial-In User Service) RADIUS( Remote Authentication Dial-In User Service) TACACS+ (Terminal Access Controller Access Control System Plus) TACACS+ (Terminal Access Controller Access Control System Plus) Protocols that can be used by an access device to communicate with the AAA Protocols that can be used by an access device to communicate with the AAA We used TACACS+ We used TACACS+

TACACS+ TACACS+ is a security application that provides centralized validation of users attempting to gain access to a router or network access server. TACACS+ is a security application that provides centralized validation of users attempting to gain access to a router or network access server.

How it works

Configuration steps

Configuring Clearbox Tacacs+ server

Authentication Setting in ClearBox

Authorization Setting in ClearBox

Accounting Setting in ClearBox

Configuring the Router/Switch Configuring the Tacacs-server host Configuring the Tacacs-server host tacacs-server host tacacs-server host tacacs-server key key tacacs-server key key tacacs-server retransmit retries tacacs-server retransmit retries tacacs-server timeout seconds tacacs-server timeout seconds tacacs-server attempts count tacacs-server attempts count exit exit Show tacacs Show tacacs

Configuring the router/switch Authentication Authentication aaa new-model aaa new-model aaa authentication login default tacacs+ enable aaa authentication login default tacacs+ enable line con 0 line con 0 login authentication default login authentication default exit exit

Configuring the switch/router Authorization Authorization aaa authorization commands 0 tacacs+ aaa authorization commands 0 tacacs+ exit exit

Configuring the switch/router Accounting Accounting aaa accounting exec start-stop tacacs+ aaa accounting exec start-stop tacacs+ aaa accounting network start-stop tacacs+ aaa accounting network start-stop tacacs+ exit exit

Running configuration of switch

Running configuration of switch (Cont.)

Authentication

Authentication

Accounting

Authorization

Ethereal