1. Configuring AAA Kamyar Miremadi Laila Sherif Summer 2005

2. AAA Authentication Authentication Authorization Authorization Accounting Accounting

3. AAA Components AAA server AAA server Authenticates users accessing a device or network Authenticates users accessing a device or network Authorizes user to perform specific activities Authorizes user to perform specific activities Performs accounting of device or user activities Performs accounting of device or user activities We used clearbox tacacs+ server running on windows XP. We used clearbox tacacs+ server running on windows XP. Network Access Server (NAS) or Access Device Network Access Server (NAS) or Access Device A router, switch, or other network device that can perform AAA functions on users or devices connecting to it. A router, switch, or other network device that can perform AAA functions on users or devices connecting to it. We used both router Cisco 2500 and switch 2900 Catalyst as Network Access Server. We used both router Cisco 2500 and switch 2900 Catalyst as Network Access Server. RADIUS( Remote Authentication Dial-In User Service) RADIUS( Remote Authentication Dial-In User Service) TACACS+ (Terminal Access Controller Access Control System Plus) TACACS+ (Terminal Access Controller Access Control System Plus) Protocols that can be used by an access device to communicate with the AAA Protocols that can be used by an access device to communicate with the AAA We used TACACS+ We used TACACS+

4. TACACS+ TACACS+ is a security application that provides centralized validation of users attempting to gain access to a router or network access server. TACACS+ is a security application that provides centralized validation of users attempting to gain access to a router or network access server.

5. How it works

6. Configuration steps

7. Configuring Clearbox Tacacs+ server

8. Authentication Setting in ClearBox

9. Authorization Setting in ClearBox

10. Accounting Setting in ClearBox

11. Configuring the Router/Switch Configuring the Tacacs-server host Configuring the Tacacs-server host tacacs-server host 130.182.159.102 tacacs-server host 130.182.159.102 tacacs-server key key tacacs-server key key tacacs-server retransmit retries tacacs-server retransmit retries tacacs-server timeout seconds tacacs-server timeout seconds tacacs-server attempts count tacacs-server attempts count exit exit Show tacacs Show tacacs

12. Configuring the router/switch Authentication Authentication aaa new-model aaa new-model aaa authentication login default tacacs+ enable aaa authentication login default tacacs+ enable line con 0 line con 0 login authentication default login authentication default exit exit

13. Configuring the switch/router Authorization Authorization aaa authorization commands 0 tacacs+ aaa authorization commands 0 tacacs+ exit exit

14. Configuring the switch/router Accounting Accounting aaa accounting exec start-stop tacacs+ aaa accounting exec start-stop tacacs+ aaa accounting network start-stop tacacs+ aaa accounting network start-stop tacacs+ exit exit

15. Running configuration of switch

16. Running configuration of switch (Cont.)

17. Authentication

18. Authentication

19. Accounting

20. Authorization

21. Ethereal