In Packet Tracer I want to configure Cisco ISR4331 router to use RADIUS authentication for vty lines and console..
Maybe it is limitations of Packet Tracer or limitations of my understanding AAA topic, but can it be configured completely without any local credentials.., I mean no local users, no local or enable secrets/passwords?
And additionally I would want to configure it the way that, You don't have to type username and password twice - I mean on login, and on `enable` command.
So far I tried:
Building configuration...
Current configuration : 1661 bytes
!
version 16.6.4
service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R4
!
no logging console
!
!
!
!
!
!
aaa new-model
!
aaa authentication login default group radius
aaa authentication enable default group radius
!
!
aaa authorization exec default group radius
aaa authorization network default group radius
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
no ip domain-lookup
ip domain-name network.co.il
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 ciscoOSPF
duplex auto
speed auto
!
interface GigabitEthernet0/0/1
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/1/0
ip address 10.100.4.1 255.255.255.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 ciscoOSPF
!
interface Serial0/1/1
ip address 10.100.1.2 255.255.255.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 ciscoOSPF
!
interface Vlan1
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
passive-interface GigabitEthernet0/0/0
network 10.100.1.0 0.0.0.255 area 0
network 10.100.4.0 0.0.0.255 area 0
!
ip classless
!
ip flow-export version 9
!
!
!
!
radius server RADIUS-SRV
address ipv4 172.18.1.1 auth-port 1645
key radsecret
radius server 172.18.1.1
address ipv4 172.18.1.1 auth-port 1645
key radsecret
!
!
!
logging 172.18.1.1
line con 0
!
line aux 0
!
line vty 0 4
login authentication default
transport input ssh
!
!
!
end
It works fine:
- I can connect via ssh with username:password
- It requires username:password on console line
- No local usernames and password configured
[!] However it does require to type twice username and password - once for login
and second time for entering privileged EXEC mode.
How can I disable this double typing? Thanks in advance!
