Sadly no, at least not the whole thing (it's 980 lines long anyway), but here is the passwords, DOT1X, line and TACACS portion (with real passwords, non-relevant commands and IPs sanitized obviously).
Here is enough to show that with a blank switch (as in erase startup, blank) that you cannot set "key config-key password-encrypt PASSWORD" with a script. (you can tell it didn't work because it doesn't create type 6 passwords only type 7).
So run the script, then look up the password types, then run it again if you want, it will never work to create type 6 types (even though the "password aes" command will show up int the running config).
However, type "key config-key password-encrypt PASSWORD" manually into the CLI and run the script again, you'll see that all the type 7s are now type 6.
!
! ---- PASSWORDS ----
!
service password-encryption
key config-key password-encrypt MYCOREPASSWORD
password encryption aes
enable algorithm-type sha256 secret MYENABLEPASSWORD
username LOCALUSER privilege 15 algorithm-type sha256 secret
ip domain name MYDOMAIN
crypto key generate rsa general modulus 2048
!
! ---- GLOBAL DOT1X WIRED ----
!
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
authentication mac-move permit
dot1x system-auth-control
radius-server dead-criteria time 30 tries 14
radius-server retry method reorder
ip radius source-interface loop 0
!
no radius server MYRADIUSSERVER1
radius server MYRADIUSSERVER1
address ipv4 192.168.0.11 auth-port 1812 acct-port 1813
key 0 MYRADIUSPASSWORD
!
no radius server MYRADIUSSERVER2
radius server MYRADIUSSERVER2
address ipv4 192.168.1.11 auth-port 1812 acct-port 1813
key 0 MYRADIUSPASSWORD
!
! ---- TACACS SETUP ----
!
aaa group server tacacs+ MYTACACSGROUP
no server name MYTACACSSERVER1
server name MYTACACSSERVER1
server-private 192.168.0.12 key 0 MYTACACSPASSWORD
!
no server name MYTACACSSERVER2
server name MYTACACSSERVER2
server-private 192.168.1.12 key 0 MYTACACSPASSWORD
!
aaa authentication login VTYMETHOD group MYTACACSGROUP local enable
aaa authentication login CONMETHOD group MYTACACSGROUP local enable
aaa authentication enable default enable none
aaa authentication username-prompt Username:
aaa authentication password-prompt Password:
aaa authorization console
aaa authorization config-commands
aaa authorization exec CONMETHOD group MYTACACSGROUP local if-authenticated
aaa authorization exec VTYMETHOD group MYTACACSGROUP local
aaa accounting exec default start-stop group MYTACACSGROUP
aaa accounting network default start-stop group MYTACACSGROUP
aaa accounting connection default start-stop group MYTACACSGROUP
aaa accounting system default start-stop group MYTACACSGROUP
tacacs-server timeout 5
ip tacacs source-interface loop 0
!
no tacacs server MYTACACSSERVER1
tacacs server MYTACACSSERVER1
address ipv4 192.168.0.12
key 0 MYTACACSPASSWORD
port 49
!
no tacacs server MYTACACSSERVER2
tacacs server MYTACACSSERVER2
address ipv4 192.168.1.12
key 0 MYTACACSPASSWORD
port 49
!
! ----LINE IN SETTINGS ----
!
line vty 0 4
authorization exec VTYMETHOD
login authentication VTYMETHOD
!
line con 0
authorization exec CONMETHOD
login authentication CONMETHOD
end
Here is the relevant portion of the end user interface configuration (the part that pertains to DOT1X).
!
! ---- LOCAL INTERFACES ----
!
int ran gi 1/0/1 - 48
switchport access vlan 123
switchport mode access
switchport voice vlan 456
authentication event fail action next-method
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
!
end
Remember for anyone trying to use type 6 RADIUS passwords on 16.9.5 with FIPS enabled (as of March 11,2020), that those don't seem to work at all.
