WEBVTT

1
00:00.000 --> 00:03.200
In this first video regarding setting up the authentication,

2
00:03.200 --> 00:05.200
I'd like to focus on local.

3
00:05.200 --> 00:06.720
Now, what exactly does that mean?

4
00:06.720 --> 00:10.560
Local means the local configuration on the router.

5
00:10.560 --> 00:13.000
For example, if we're going to log in as a user,

6
00:13.000 --> 00:14.960
we're going to go ahead and make sure that user exists,

7
00:14.960 --> 00:16.760
and the configuration on this router

8
00:16.760 --> 00:19.800
prior to reaching out using a AAA server.

9
00:19.800 --> 00:21.720
For the demonstration, I'd like to walk you through,

10
00:21.720 --> 00:24.120
it looks like, on a fairly new router,

11
00:24.120 --> 00:25.440
to go ahead and try to connect to it.

12
00:25.440 --> 00:26.800
Now, good test, by the way,

13
00:26.800 --> 00:29.640
is to log on to the router via the console port,

14
00:29.640 --> 00:31.720
and then tell that to yourself or to itself.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.640 --> 00:31.720
and then tell that to yourself or to itself.

15
00:31.720 --> 00:33.680
In this case, the loopback is 666, 666.

16
00:33.680 --> 00:36.400
We could use any working IP address on any interface,

17
00:36.400 --> 00:38.360
but 666 is the loopback.

18
00:38.360 --> 00:40.280
So I'd like to walk you through logging in,

19
00:40.280 --> 00:42.920
or attempting to log in to the router initially,

20
00:42.920 --> 00:45.800
and then we'll start setting up with local authentication

21
00:45.800 --> 00:49.120
to force a login prompt when this router is logged into.

22
00:49.120 --> 00:53.400
Now, this would apply also to telnet and SH on the VTY lines,

23
00:53.400 --> 00:55.320
and for the demo, I'm just going to use telnet,

24
00:55.320 --> 00:58.320
because it's already set up to accept incoming telnet requests.

25
00:58.320 --> 01:00.960
So here in the lab, let me go ahead and double click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.320 --> 01:00.960
So here in the lab, let me go ahead and double click

26
01:00.960 --> 01:02.760
on the topology, and here it is.

27
01:02.760 --> 01:04.880
We're going to be working on R6.

28
01:04.880 --> 01:07.960
So let's go ahead and double click on server1 nug,

29
01:07.960 --> 01:11.080
and it'll give us console access to all our routers.

30
01:11.080 --> 01:12.920
All right, and here comes server1.

31
01:12.920 --> 01:16.360
Fantastic, and there is our six, we'll select that tab,

32
01:16.360 --> 01:21.360
and let's just do a quick show, run, type, section, line.

33
01:21.360 --> 01:23.560
That's one thing, look at the line configurations for a moment.

34
01:23.560 --> 01:27.040
So currently on these VTY lines have zero through 15,

35
01:27.040 --> 01:30.360
I currently have an exact timeout logging synchronous,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:27.040 --> 01:30.360
I currently have an exact timeout logging synchronous,

36
01:30.360 --> 01:34.520
no login, no login means no login required.

37
01:34.520 --> 01:37.640
I also have an enable secret set up on this router.

38
01:37.640 --> 01:40.900
So we do a show, run, pipe, include secret,

39
01:40.900 --> 01:43.000
and press center, there is the enable secret,

40
01:43.000 --> 01:44.800
and I just want to tell you what that is right now.

41
01:44.800 --> 01:47.960
So the secret is Cisco, exclamation mark two, three,

42
01:47.960 --> 01:49.320
for the capital C at the very beginning.

43
01:49.320 --> 01:51.560
So that's the enable secret that's configured

44
01:51.560 --> 01:52.560
currently on this router.

45
01:52.560 --> 01:54.440
So let's verify it's IP addresses,

46
01:54.440 --> 01:56.040
let's just show IP interface brief.

47
01:56.040 --> 01:59.200
Please exclude any lines that have the word unassigned in them,

48
01:59.200 --> 02:02.600
and there is our loopback zero of 666.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.200 --> 02:02.600
and there is our loopback zero of 666.

49
02:02.600 --> 02:05.320
So if we, in this current state, if we did a telnet

50
02:05.320 --> 02:09.320
to 6.6.6.6 and press center, boom, or N.

51
02:09.320 --> 02:12.120
So it didn't require any type of login,

52
02:12.120 --> 02:14.800
and that's because the no login means no login

53
02:14.800 --> 02:17.280
effectively required, that's how I like to think of it.

54
02:17.280 --> 02:20.000
And if you type in who here, the name of the show users,

55
02:20.000 --> 02:22.000
so the last one indicates how we're connected,

56
02:22.000 --> 02:24.080
on this case, VTY line zero,

57
02:24.080 --> 02:25.840
and because there's no login required,

58
02:25.840 --> 02:27.840
we don't have a username associated with this.

59
02:27.840 --> 02:29.160
So let's go ahead and type in exit,

60
02:29.160 --> 02:31.040
and let's go to configuration mode.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.160 --> 02:31.040
and let's go to configuration mode.

61
02:31.040 --> 02:34.280
And before we require a login at the VTY lines,

62
02:34.280 --> 02:36.720
let's create a user account so we can login.

63
02:36.720 --> 02:38.720
So we'll create username admin one,

64
02:38.720 --> 02:42.000
we'll specify the privilege level is gonna be 15,

65
02:42.000 --> 02:44.000
and that way it's King Kong writes if we need it,

66
02:44.000 --> 02:46.800
and then we'll go ahead and specify the secret.

67
02:46.800 --> 02:48.600
And I'm gonna use that same password,

68
02:48.600 --> 02:51.080
capital C, ISCO, exclamation mark two, three.

69
02:51.080 --> 02:53.520
So even though that happens to be the enable secret,

70
02:53.520 --> 02:56.800
I'm gonna use that same secret or password for this admin one,

71
02:56.800 --> 02:57.640
and we'll press center.

72
02:57.640 --> 03:00.480
And that way I have less passwords in my head to remember.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:57.640 --> 03:00.480
And that way I have less passwords in my head to remember.

73
03:00.480 --> 03:01.320
Fantastic.

74
03:01.320 --> 03:02.640
So now let's go back into configuration mode,

75
03:02.640 --> 03:04.040
I didn't mean to leave actually.

76
03:04.040 --> 03:07.800
And let's go to line VTY zero through 15,

77
03:07.800 --> 03:09.800
that'll cover all of our existing VTY lines,

78
03:09.800 --> 03:12.600
and we'll say login local, just like that.

79
03:12.600 --> 03:13.960
And then we'll type in end,

80
03:13.960 --> 03:17.760
and let's do a telnet to 666 to ourselves,

81
03:17.760 --> 03:20.480
and now it's requiring a login username.

82
03:20.480 --> 03:22.920
So we'll type in admin one, press center,

83
03:22.920 --> 03:25.520
supplier password, which is capital C, ISCO,

84
03:25.520 --> 03:27.760
exclamation mark two, three, press center,

85
03:27.760 --> 03:28.920
and we are in.

86
03:28.920 --> 03:30.440
So now we do a show users,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.920 --> 03:30.440
So now we do a show users,

87
03:30.440 --> 03:33.520
or we do who, which is the same output.

88
03:33.520 --> 03:36.520
It shows us where logged in as admin one,

89
03:36.520 --> 03:39.880
and once again we came in on VTY line zero.

90
03:39.880 --> 03:42.240
So we have an exit and exit again,

91
03:42.240 --> 03:43.160
and I'll go back in.

92
03:43.160 --> 03:44.640
Now we're back at the console,

93
03:44.640 --> 03:47.320
and currently the console is not requiring a login.

94
03:47.320 --> 03:49.320
So if we do a show run pipe section line,

95
03:49.320 --> 03:50.880
you notice here at the console,

96
03:50.880 --> 03:52.320
it's not requiring a login.

97
03:52.320 --> 03:55.240
So we also, if we wanted to online console zero,

98
03:55.240 --> 03:56.720
we could say login local,

99
03:56.720 --> 03:58.120
and we forced the login there as well.

100
03:58.120 --> 04:01.320
Now, I would strongly encourage you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:58.120 --> 04:01.320
Now, I would strongly encourage you,

101
04:01.320 --> 04:02.960
as you're working, I'm gonna put you on the lab

102
04:02.960 --> 04:04.440
at the telnet of these videos,

103
04:04.440 --> 04:07.400
I would encourage you to not mess with the authentication

104
04:07.400 --> 04:08.720
for line console zero.

105
04:08.720 --> 04:12.160
That is your lifeline to get into the router.

106
04:12.160 --> 04:13.920
So you can do the configuration changes

107
04:13.920 --> 04:15.080
for the authentication,

108
04:15.080 --> 04:18.520
including TAC-X regarding logging in via the VTY lines,

109
04:18.520 --> 04:20.600
and test those, and at the same time,

110
04:20.600 --> 04:21.720
not lock yourself out.

111
04:21.720 --> 04:23.840
Now in the event you do lock yourself out,

112
04:23.840 --> 04:25.400
you can use the reset button,

113
04:25.400 --> 04:27.440
and then I'll reset the lab back to its initial state,

114
04:27.440 --> 04:28.560
and you can go for it again.

115
04:28.560 --> 04:29.800
But to save you some time,

116
04:29.800 --> 04:31.480
I would recommend when you get to the lab,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:29.800 --> 04:31.480
I would recommend when you get to the lab,

117
04:31.480 --> 04:34.560
just focus on authentication and authorization

118
04:34.560 --> 04:37.600
with AAA, just focused on the VTY lines.

119
04:37.600 --> 04:38.960
So in this video, we've just taken a look

120
04:38.960 --> 04:41.720
at some options for local authentication,

121
04:41.720 --> 04:44.160
regarding the local configuration on the local router,

122
04:44.160 --> 04:45.000
all by itself.

123
04:45.000 --> 04:47.000
In the next video, we're gonna kick it up a notch

124
04:47.000 --> 04:49.480
and take a look at using AAA new model,

125
04:49.480 --> 04:50.520
and after we do that,

126
04:50.520 --> 04:52.200
we can start adding on additional features

127
04:52.200 --> 04:54.440
like using centralized authentication servers,

128
04:54.440 --> 04:55.920
such as a TAC-X server.

129
04:55.920 --> 04:57.800
So we'll continue this journey in the next video,

130
04:57.800 --> 05:00.360
and I'll see you there in just a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
04:57.800 --> 05:00.360
and I'll see you there in just a moment.