topic Configuring AAA authentication in Network Access Control

Configuring AAA authentication

joytaylor — Sun, 10 Mar 2019 14:17:51 GMT

We have ACS 3.1 server to AAA authentication for all routers and switches. I want each person to log on the router using his own id, password and enable password. If the ACS server is unavailable, I want to have different id, password and enable password for console and telnet access. What's the proper way to do this? I also want to track all commands entered on the router.

This is what I have:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication login no_tacacs enable

aaa authentication enable default group tacacs+ line

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

username admin password 7 xxxxxxxxxxxxxxxx

line con 0

line aux 0

line vty 0 4

password 7 xxxxxxxxxxxxxxxxxxxxxxxx

Re: Configuring AAA authentication

sghosh — Mon, 12 May 2003 23:42:59 GMT

Hi,

Your config looks good for what you want to do, only issue you have is that you cannot have different enable password for different users when they are using local database. When you are using the local database you will use only one enable password.

Thanks

Sujit

Re: Configuring AAA authentication

mhoda — Mon, 12 May 2003 23:51:59 GMT

Hi,

This is how its working now as per the config:

-Your console port is authenticated using enable password

-For your telnet sessions:

You are getting authenticated via tacacs+ server, if its unvailable then it falls back to local database. But your enable authentication falls back to the line password.

Now if you want to authenticate/authorize and want to get accounting records using tacacs server and then if its unavailable fall back to local database for login and for enable authen, fall back to enable password, then this is what you might want to do:

aaa new-model

aaa authentication login default group tacacs+ local

no aaa authentication login no_tacacs enable <--Remove this

no aaa authentication enable default group tacacs+ line<--Remove this

aaa authentication enable default group tacacs+ enable <---Add this

aaa authorization exec default group tacacs+ local

aaa authorization commands 0 default group tacacs+ local <--Add this to cover level 0 commands

aaa authorization commands 1 default group tacacs+ local <--Add this to cover level 1 commands

aaa authorization commands 15 default group tacacs+ local

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+ <-For level 0 accounting

aaa accounting commands 1 default start-stop group tacacs+ <--For level 1 acocunting

aaa accounting commands 15 default start-stop group tacacs+

aaa authorization console --> This is required if you want to authorize console port.

also, please don't forget to remove the following line from console port:

line con 0

no login authentication no_tacacs

NOTE: Please don't forget to create atleast one admin account with priv level 15 before you apply the above commands:

username admin privilege 15 password cisco

I hope this help ! Thanks,

Mynul

Re: Configuring AAA authentication

joytaylor — Tue, 13 May 2003 15:32:12 GMT

Hi Mynul,

Thank you for the config. Now if I use this config, then for the console port I need to authenticate with Tacacs server, if the server fails am I using the admin account that I create with priv level 15?

This also holds true for telnet access also?

Thanks..Joy

Re: Configuring AAA authentication

mhoda — Tue, 13 May 2003 17:59:39 GMT

Yes, thats right Joy. Thanks, Mynul

Re: Configuring AAA authentication

joytaylor — Wed, 14 May 2003 18:16:38 GMT

Thank you for your help.

Re: Configuring AAA authentication

kirankumar — Fri, 01 Aug 2003 21:00:07 GMT

Hi,

I want to know one more thing,

can we give all writes equal to Administrator.

means all log details a copy to one more user.

Regards

Kiran Kumar