I'm making a network using ACS in my lab and authentication fails when I telnet from a user(H1) to a router(c3845). Please look at below.
What I did is, configured VPN between c3845 and c3640.I confirmed that VPN is working.
Setup H1 as an user and c3845 as a AAA client on ACS.
Authentication protocol which I'm using is tacacs+.
When I telnet from H1 to c3845, "% Authentication failed" message appears and the session disconnects.
Am I missing something?
Please somebody give me an advice.
topology and ip address.
fa --GE0/1-GE0/0-------fa0/0-fa1/0--fa
| ACS |---|c3845 |--| VPN |--|c3640 |--| H1 |
+---------+-----------+------------------+
| device | interface | ip address |
+---------+-----------+------------------+
| ACS | fa | 192.168.0.15/24 |
+---------+-----------+------------------+
| c3845 | GE0/1 | 192.168.0.220/24 |
+ +-----------+------------------+
| | GE0/1 | 1.1.1.1/8 |
+---------+-----------+------------------+
| c3640 | fa0/0 | 1.1.1.2/8 |
+ +-----------+------------------+
| | fa1/0 | 172.26.0.1/24 |
+---------+-----------+------------------+
| H1(host)| fa | 172.26.0.2/24 |
+---------+-----------+------------------+
configuration of c3845
========================================
c3845#sh running-config
Building configuration...
Current configuration : 3432 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname c3845
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
username xxx privilege 15 secret xxxx
aaa new-model
!
!
aaa authentication login default group tacacs+
aaa session-id common
ip subnet-zero
ip cef
!
!
!
!
ip domain name yourdomain.com
ip ips po max-events 100
no ftp-server write-enable
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
crypto isakmp key 6 ciscovpn address 1.1.1.2
!
!
crypto ipsec transform-set TS-Basic esp-3des esp-sha-hmac
!
crypto map MAP-Basic 10 ipsec-isakmp
set peer 1.1.1.2
set transform-set TS-Basic
match address 150
!
!
!
!
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 1.1.x.x.0.0.0
duplex auto
speed auto
media-type rj45
crypto map MAP-Basic
!
interface GigabitEthernet0/1
ip address 192.168.0.220 255.255.255.0
duplex auto
speed auto
media-type rj45
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 1.1.1.2
ip route 172.26.0.0 255.255.0.0 1.1.1.2
!
!
ip http server
ip http authentication local
ip http secure-server
!
access-list 150 permit ip 192.168.0.0 0.0.255.255 172.26.0.0 0.0.255.255
!
!
!
tacacs-server host 192.168.0.15
tacacs-server directed-request
tacacs-server key xxx
!
control-plane
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line 66
no activation-character
no exec
transport preferred none
transport input all
transport output all
line vty 0 4
privilege level 15
transport input telnet ssh
line vty 5 15
privilege level 15
transport input telnet ssh
!
scheduler allocate 20000 1000
!
end
