topic Re: aaa new-model in Network Security

aaa new-model

BigK — Fri, 03 Apr 2020 18:38:04 GMT

Hello,

what is the suggested method to configure aaa new-model and 802.x on a remote router without locking myself out of the router and if I did lock myself, what is the process to recover and access the device again.

Here is my current config

aaa new-model
!
!
aaa group server tacacs+ TACACS-GROUP
server name SITE1-ISE1
server name SITE2-ISE2
!
aaa authentication password-prompt TACACS.server.failed-Use.enable.password:
aaa authentication login default group TACACS-GROUP local-case enable
aaa authentication enable default group TACACS-GROUP enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group TACACS-GROUP local
aaa authorization commands 15 default group TACACS-GROUP local
aaa accounting exec default start-stop group TACACS-GROUP
aaa accounting commands 15 default start-stop group TACACS-GROUP
aaa accounting network default start-stop group TACACS-GROUP
aaa accounting connection default start-stop group TACACS-GROUP
aaa accounting system default start-stop group TACACS-GROUP

line con 0
password 7 05080F1C9961
logging synchronous
transport output none
stopbits 1

line vty 0 15
password 7 124D4
logging synchronous
transport input ssh
transport output all

Thanks !

Re: aaa new-model

balaji.bandi — Fri, 03 Apr 2020 18:14:34 GMT

As Long as you are not saved the configuration, some one can reboot the device you can still able to Login using Local username and password.

you can have 2 Open Session one you can try with radius and one open already with Local account.

Re: aaa new-model

BigK — Fri, 03 Apr 2020 18:36:06 GMT

Thanks BB.

I am planning on sending the router with aaa config and saved config. any other suggestions?

Re: aaa new-model

Rob Ingram — Fri, 03 Apr 2020 18:49:16 GMT

Hi,
Ideally you should test the configuration on a local device, but...

Before you make the changes use the "reload in X" command, which would reload the device in X minutes if you were to be locked out. Open a new ssh connection (don't close the old session), test the changes work as expected then cancel the reload command using "reload cancel". If you were to have issues and you were locked out you just need to wait until the reload command reboots the router and it reloads - obviously don't save the the configuration until you confirms it works as expected.

HTH

Re: aaa new-model

BigK — Fri, 03 Apr 2020 18:55:25 GMT

I appreciate both suggestions.

Thanks again!

Re: aaa new-model

johnlloyd_13 — Sat, 04 Apr 2020 04:13:00 GMT

hi,

is this a new device or already in production?

don't forget these lines:

tacacs-server host TACACS-1
tacacs-server host TACACS-2
tacacs-server directed-request
tacacs-server key <KEY STRING>

Re: aaa new-model

Cristian Matei — Sat, 04 Apr 2020 09:00:43 GMT

Hi,

I understand that you want to remotely enable AAA, without loosing access to the device, completely. I've done some changes to your config, explained below:

1. Ensure you have your TACACS servers defined as below:

tacacs server SITE1-ISE1

address ipv4 x.x.x.x

key xxx

tacacs server SITE2-ISE2

address ipv4 x.x.x.x

key xxx

aaa group server tacacs+ TACACS-GROUP
ip tacacs source-interface xxx (ensure to hardcode this, otherwise, depending on your routing design, it may happen that the device uses different source IP's to speak with the TACACS server and it's gonna get rejected)

2. If you would use "non-default" AAA lists, you would not loose access at all. With "default" AAA list follow this order of commands:

aaa new-model

tacacs server SITE1-ISE1

address ipv4 1.1.1.1

key xxx

tacacs server SITE2-ISE2

address ipv4 2.2.2.2

key xxx

aaa group server tacacs+ TACACS-GROUP

!
aaa group server tacacs+ TACACS-GROUP
server name SITE1-ISE1
server name SITE2-ISE2

!
At this point stop and use the "test aaa group TACACS-GROUP server 1.1.1.1 xyz xyz legacy" and "test aaa group TACACS-GROUP server 2.2.2.2 xyz xyz legacy". If authentication is not successful, fix the TACACS integration configuration and move on only after having this functional.

!
!

aaa authentication password-prompt TACACS.server.failed-Use.enable.password:
aaa authentication login default group TACACS-GROUP local-case enable
aaa authentication enable default group TACACS-GROUP enable
aaa authorization console
aaa authorization commands 15 default group TACACS-GROUP local
aaa accounting exec default start-stop group TACACS-GROUP
aaa accounting commands 15 default start-stop group TACACS-GROUP
aaa accounting network default start-stop group TACACS-GROUP
aaa accounting connection default start-stop group TACACS-GROUP
aaa accounting system default start-stop group TACACS-GROUP

aaa authorization exec default group TACACS-GROUP local

aaa authorization config-commands

You should not loose access, but you would reconnect in order to authenticate and test now the TACACS functionality.

Regards,

Cristian Matei.