CCNA 200-125 Exam: AAA demo: TACACS+ with GNS3

on the Cisco ACS server we need to go to network configuration and add a triple-a client in other words we need to add the Cisco router we need to specify the hostname of the router so I'm going to call this router 1 and then we need to specify the IP address of the router 10.1.1.1 the key that we used was Cisco shown over here so we need to specify Cisco as the key and we are going to authenticate in this example using tacacs Cisco IOS there are other options such as Radiesse but we'll use tech X in this example and I'm going to click Submit and apply to apply that configuration once again under users we only have a user called admin so now let's test whether we can log back in to write a one as David so I'll enter David and the password notice authentication has failed on the tacacs server going to reports and activity we can look at failed attempts and we can see here that we've got a failed attempt for David external database user invalid or bad password our login is Mary username Mary password Cisco I'll refresh the logged in failures and notice mary has failed but if we log in as admin Cisco the authentication passes and we are able to access the Radha show run pipe include user shows us that we have a user David and a user Mary with the relevant passwords but to the local user name and password database is only used if the tacacs server is not available so as an example if I stop the tac-x service on the tac-x server and exit out of the router and then login as David I can access the router so I can only use the local user name and password database if the tax server is down if however the tac-x server is up so I'll start to the service again if I try and log back in as David notice authentication has failed and once again on the tax server we can see that David failed the authentication I can however log back in as admin now what's really nice about this is that you can create centralized user accounts so I could create a user called user one set to their password and click Submit so when I look at the available users and now have a user called user 1 and without making any configuration changes on the router we can login as user 1 so that user doesn't exist in the local router configuration but it exists on the tacacs server if I want to I can disable the user account so user 1 is now disabled back on the rudder if we try and log in as user 1 authentication has failed and once again looking at the reports on the ACS server we can see failed attempts user 1 account is disabled so when they try to access this device TTY 0 in other words the console their login has failed if they try to access that router remotely so they try to tell NIT to the rotor and login as user 1 authentication has failed and refreshing the information the tac-x server we can see that user 1 has failed the authentication account is disabled and they try to access tty 98 in other words one of the vty lines on this router we're getting a lot of central information from the ACS server what we can also do is enable some debugging so login as admin and then we can use command such as debug tax and I'll just enable all of it and debug triple-a and in this case we'll enable authentication so when the user tries to access the router we can see quite a bit of information so trouble a authentication login the users trying to login we're using the default method load on the vty lines no authentication methods have been set its inheriting the default method so default is being used authentication start packet created we trying to get a response from the user in this case the user took too long so let's try that again I'll put in the username of user one so we can see now it's asking for a password and notice the response failed the server 10111 has rejected that username so let's put some spaces there and login with the admin user logon succeeded so in this case we received a response of pass that then occations succeeded so go through the full process again telnet to the router default list is being used we asking for the user account so that's admin asking for the password authentication succeeded so we can see what's taking place in the background here trouble a authentication is being used the rod is told by the trouble a server to ask the user for the username and then to ask them for their password and then to tell the user that they succeeded the authentication and can log-in so that's an example of basic trouble a authentication on router one now there are two ways to set this up we're using the older method at the moment because these routers don't support the newer method where we create a group so I'll show you that in a moment but before I do that I'll copy this configuration to Radha T to show you that we can create a central authentication server now at the moment we haven't configured rotted - on the ACS server so we can still log in as David so under network configuration we need to create an entry for right at - so right at - 10.1 to 202 is the IP address of our writer show IP interface brief so there's the IP address key used is going to be Cisco and I'm going to click a submit and apply so that rod has now been configured so try and log in as David authentication has failed try and log in as admin that allocation passes we've now configured two routers with centralized authentication under the reports failed attempts we can see that David failed the authentication attempt on the second router so we think information for both router 2 and Rotter 1 let's configure router 3 I'll take this configuration and paste it into router 3 on router 3 we can log in as David so that works but we can't login as admin because we still need to configure the ACS server so back on ACS will add rather three IP addresses 10.1.1.1 furred or Kia Cisco click Submit the rod is now configured so previously we couldn't login as admin but now hopefully we should be able to let's try again David failed there so admin so admin Cisco works david cisco doesn't work because the rod is not communicating with ACS but admin cisco does so we've now got three routers configured to communicate with an ACS server these routers are using an older version of iOS they're using version 12.4 and that version doesn't support tacacs server groups which is the new way of doing things and is what you need to know for the exam you