WEBVTT

1
00:00.000 --> 00:02.660
In the previous video, we enabled AAA NewModel

2
00:02.660 --> 00:05.660
and identified that now the access to the VTY lines

3
00:05.660 --> 00:10.460
is controlled and enforced by requiring a user name and password

4
00:10.460 --> 00:12.560
from the local database on the router.

5
00:12.560 --> 00:15.160
So now that we have AAA NewModel enabled on this router,

6
00:15.160 --> 00:18.200
we can now start specifying a AAA server,

7
00:18.200 --> 00:20.500
attack, axe, or radius, etc.,

8
00:20.500 --> 00:22.100
that we want to be able to leverage.

9
00:22.100 --> 00:24.260
So in this video, I'd like to walk you through how we train

10
00:24.260 --> 00:28.700
our six to know about a AAA server over here on Server One.

11
00:28.700 --> 00:32.700
Now the AAA server as we're running here are attack, axe, plus.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.700 --> 00:32.700
Now the AAA server as we're running here are attack, axe, plus.

12
00:32.700 --> 00:34.700
And if you just want to say attack, axe, that's cool too,

13
00:34.700 --> 00:36.700
because that's normally just what we'll call it.

14
00:36.700 --> 00:39.300
And on this attack, axe server, it's at this IP address, 192,

15
00:39.300 --> 00:40.700
once you see it, 1.100.

16
00:40.700 --> 00:44.700
And the key that we're going to use, I think of it like a password

17
00:44.700 --> 00:47.700
that our six needs to know as it communicates back and forth

18
00:47.700 --> 00:52.700
with ServerNug, the key on that server is Cisco exclamation mark 23.

19
00:52.700 --> 00:56.700
Now that password does not have to be the same as user accounts

20
00:56.700 --> 00:59.700
or anything else, but I'm using that similar password again,

21
00:59.700 --> 01:03.700
just so that I, as I do the lab, have one less different password
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.700 --> 01:03.700
just so that I, as I do the lab, have one less different password

22
01:03.700 --> 01:06.700
to memorize, so that'll be the key that this router will need

23
01:06.700 --> 01:10.700
to communicate with this AAA server using the protocol called attack axe.

24
01:10.700 --> 01:13.700
So let's head over to our six and let's set it up.

25
01:13.700 --> 01:17.700
So back in the lab, let's do a quick who to verify who are connected.

26
01:17.700 --> 01:20.700
That's who are currently logged on directly at the console.

27
01:20.700 --> 01:24.700
And the console once again, by default, has no authentication requirements

28
01:24.700 --> 01:26.700
and no authorization requirements.

29
01:26.700 --> 01:27.700
And that's the way we're going to leave it.

30
01:27.700 --> 01:29.700
We'll do all of our testing on the VTY lines.

31
01:29.700 --> 01:31.700
That way we don't lose access.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:29.700 --> 01:31.700
That way we don't lose access.

32
01:31.700 --> 01:34.700
So the first thing I'd like to do is before we start configuring

33
01:34.700 --> 01:39.700
R6 to use this server Server1 nug as a AAA server,

34
01:39.700 --> 01:44.700
I'd like to verify we have basic connectivity from R6 down to that server.

35
01:44.700 --> 01:49.700
So at R6, let's do a ping to 192.168.1.100.

36
01:49.700 --> 01:50.700
And that looks good.

37
01:50.700 --> 01:53.700
Let's also do a trace just to make sure our topology looks

38
01:53.700 --> 01:55.700
consistent with what the drawing is.

39
01:55.700 --> 01:58.700
And that is the trace to 192.168.1.100.

40
01:58.700 --> 02:01.700
That looks pretty good.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:58.700 --> 02:01.700
That looks pretty good.

41
02:01.700 --> 02:03.700
So the next hop was R8.

42
02:03.700 --> 02:06.700
And then the final destination was the server at that 100.

43
02:06.700 --> 02:09.700
If you look at our topology, that looks good.

44
02:09.700 --> 02:11.700
So traffic went down to R8.

45
02:11.700 --> 02:15.700
And then it got routed over to the server at 192.168.1.100.

46
02:15.700 --> 02:16.700
Perfect.

47
02:16.700 --> 02:20.700
So next, let's go ahead and tell R6 about this AAA server.

48
02:20.700 --> 02:22.700
So the syntax to that from configuration mode is attack axe.

49
02:22.700 --> 02:25.700
Now there's some older commands as well.

50
02:25.700 --> 02:29.700
We can use attack axe-server, space host and specify the IP address.

51
02:29.700 --> 02:31.700
That's a legacy way of doing it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:29.700 --> 02:31.700
That's a legacy way of doing it.

52
02:31.700 --> 02:35.700
The current way is doing attack axe space and the question mark server space.

53
02:35.700 --> 02:36.700
And then we'll give it a name.

54
02:36.700 --> 02:39.700
And let's call this our attack axe and press enter.

55
02:39.700 --> 02:42.700
And that puts us into the configuration mode for that attack axe server.

56
02:42.700 --> 02:46.700
So we'll specify that the attack axe server is at the address.

57
02:46.700 --> 02:48.700
And we are using IPv4.

58
02:48.700 --> 02:51.700
So we'll specify the keyword IPv4 and the IP address of our server.

59
02:51.700 --> 02:55.700
Which is 192.168.1.100.

60
02:55.700 --> 02:56.700
And press enter.

61
02:56.700 --> 03:00.700
And then we're also going to specify the pass where the key to use as it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:56.700 --> 03:00.700
And then we're also going to specify the pass where the key to use as it

62
03:00.700 --> 03:01.700
encrypts the messages back and forth.

63
03:01.700 --> 03:06.050
Because unlike radius and attack axe, the entire session is going to be

64
03:06.050 --> 03:06.700
encrypted.

65
03:06.700 --> 03:10.200
So we'll type in key, space, a question mark, and then the key is going to be

66
03:10.200 --> 03:11.700
Cisco, exclamation mark 2, 3.

67
03:11.700 --> 03:15.700
And that's the key I have configured on the software providing the attack axe

68
03:15.700 --> 03:19.700
services over on server 1 nug at 192.168.1.100.

69
03:19.700 --> 03:21.700
So press enter and they'll type n.

70
03:21.700 --> 03:23.700
Now, a couple of things here.

71
03:23.700 --> 03:26.700
One is over on the attack axe server, I have a few user accounts.

72
03:26.700 --> 03:30.700
I've got a user over here called user 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:26.700 --> 03:30.700
I've got a user over here called user 1.

73
03:30.700 --> 03:32.700
You'll never guess what the password is.

74
03:32.700 --> 03:35.700
It's capital C-I-S-E-O exclamation mark 2, 3.

75
03:35.700 --> 03:36.700
I'll write that here as well.

76
03:36.700 --> 03:40.590
And I also have a user account over here called admin 1 with that same password

77
03:40.590 --> 03:40.700
.

78
03:40.700 --> 03:42.700
Now we created a local user called admin 1.

79
03:42.700 --> 03:46.700
And I wanted to have it in both places because we can mix them atch.

80
03:46.700 --> 03:51.080
And we can do authentication off the local config on the router and then

81
03:51.080 --> 03:53.700
authorization on a triple A server.

82
03:53.700 --> 03:56.700
Or we can do the authentication of the triple A server and local authorization.

83
03:56.700 --> 04:00.530
So I just want you to be aware that I have these two user accounts both sitting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:56.700 --> 04:00.530
So I just want you to be aware that I have these two user accounts both sitting

84
04:00.530 --> 04:02.700
over here at the attack axe server.

85
04:02.700 --> 04:06.470
And one great thing to do right now is to verify before we start doing

86
04:06.470 --> 04:13.070
additional configs, let's verify that this router, router 6, can test whether

87
04:13.070 --> 04:15.700
or not attack axe and the centralized server can validate our user names and

88
04:15.700 --> 04:15.700
pass them.

89
04:15.700 --> 04:21.010
Now one way of doing that is to go ahead and use the command test, which is

90
04:21.010 --> 04:21.700
fantastic.

91
04:21.700 --> 04:24.700
It does exactly what one would think it's going to do.

92
04:24.700 --> 04:28.510
It's going to let us test our connectivity as well as the authentication of a

93
04:28.510 --> 04:29.700
user or attack axe.

94
04:29.700 --> 04:33.700
So before we do that, let's also do a triple A authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:29.700 --> 04:33.700
So before we do that, let's also do a triple A authentication.

95
04:33.700 --> 04:35.700
And furthermore, let's also do a debug of attack axe.

96
04:35.700 --> 04:38.700
So there's going to be quite a bit of content coming at the screen.

97
04:38.700 --> 04:40.700
Let's do a quick show of debug.

98
04:40.700 --> 04:42.700
And we have those two debug running.

99
04:42.700 --> 04:46.340
Also in the background, what I'd like to do for you is I'm going to capture the

100
04:46.340 --> 04:50.700
traffic right off of the link, the 10 to 68 network.

101
04:50.700 --> 04:53.700
It's going between our six and our eight.

102
04:53.700 --> 04:56.920
And that way we can look at the packet captures as well and just verify that

103
04:56.920 --> 05:01.140
sure enough, it's attack axe going back and forth between our six and the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:56.920 --> 05:01.140
sure enough, it's attack axe going back and forth between our six and the

104
05:01.140 --> 05:03.700
triple A server that's supporting and using tech axe.

105
05:03.700 --> 05:06.850
All right, so in the background, I have that capture running and let's go ahead

106
05:06.850 --> 05:07.700
and do our test.

107
05:07.700 --> 05:12.020
So here at our six, we use the test commands, let's say been test space, triple

108
05:12.020 --> 05:13.700
A space and a question mark.

109
05:13.700 --> 05:16.700
And then we use the keyword group, which represents a group of servers.

110
05:16.700 --> 05:19.700
Now, if we only have one server, it's not going to be too hard to decide.

111
05:19.700 --> 05:22.990
But if we have five or six triple A servers and we split like group, it could

112
05:22.990 --> 05:26.230
go ahead and pick, for example, one of our servers from the group of attack axe

113
05:26.230 --> 05:26.700
servers.

114
05:26.700 --> 05:30.090
If that server was available, you go to the next one, the next one to complete
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
05:26.700 --> 05:30.090
If that server was available, you go to the next one, the next one to complete

115
05:30.090 --> 05:30.700
the list.

116
05:30.700 --> 05:34.810
So currently we have one tack x server identified, so we're going to type in

117
05:34.810 --> 05:38.700
test triple A group, the keyword tack x plus space question mark.

118
05:38.700 --> 05:42.760
And then we're going to specify username. So over on that centralized server, I

119
05:42.760 --> 05:46.770
have a user called user one, so I'll type in user one space and a question mark

120
05:46.770 --> 05:48.700
and then the password for user one.

121
05:48.700 --> 05:53.860
And we'll press center and so let's keep that needle more so the tail end of

122
05:53.860 --> 05:58.700
that would be do we want to use the legacy or new code for the test.

123
05:58.700 --> 06:02.750
And they'll both work. So let's go ahead and use legacy press center and that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:58.700 --> 06:02.750
And they'll both work. So let's go ahead and use legacy press center and that

124
06:02.750 --> 06:03.700
is successful.

125
06:03.700 --> 06:07.210
And we have our debug messages coming back. And if we did again, use the option

126
06:07.210 --> 06:09.700
of new code press center, that is also going to work.

127
06:09.700 --> 06:13.330
And then we have the debug that we have in place running. So let's do an undi

128
06:13.330 --> 06:14.700
bug all and let's look at the output.

129
06:14.700 --> 06:19.800
So if we scroll up, we can see right here that is sending out a request via TCP

130
06:19.800 --> 06:26.700
to 192.168.100 port 49, which is the destination server port used for tack x

131
06:26.700 --> 06:26.700
plus.

132
06:26.700 --> 06:30.520
So we supplied the username, we supplied the password that was all processed by
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:26.700 --> 06:30.520
So we supplied the username, we supplied the password that was all processed by

133
06:30.520 --> 06:31.700
the triple A server.

134
06:31.700 --> 06:36.060
And it sent back an authentication status of pass. And as for that reason, the

135
06:36.060 --> 06:38.700
Cisco router said, yep, you passed authentication, you can log in.

136
06:38.700 --> 06:41.940
And we did that without having to use the local database on the router. So if

137
06:41.940 --> 06:46.700
we did a test again, for example, and we did it with the user admin one,

138
06:46.700 --> 06:50.740
even though we had a local admin one, this admin one, because we're doing a

139
06:50.740 --> 06:54.450
test against the triple A server that can validate whether or not that user

140
06:54.450 --> 06:55.700
account is authenticated as well.

141
06:55.700 --> 07:00.140
And that comes back as user successfully authenticated. Or if we did the legacy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
06:55.700 --> 07:00.140
And that comes back as user successfully authenticated. Or if we did the legacy

142
07:00.140 --> 07:04.440
with the legacy keyword here, that should also work because we have that user

143
07:04.440 --> 07:05.700
as well over here on the tack x server.

144
07:05.700 --> 07:09.800
Now also behind the scenes, if you want to look at those packets went back and

145
07:09.800 --> 07:13.700
forth between our six and the triple A server, we can do that as well.

146
07:13.700 --> 07:17.360
Let's take a look at that right now. So here in the protocol analyzer, we go

147
07:17.360 --> 07:18.700
ahead and stop the capture.

148
07:18.700 --> 07:23.000
Let me turn off the colors. Let me make it a little bit bigger. So it's easier

149
07:23.000 --> 07:26.100
to read. And I'm also going to go ahead and filter out some of the output here

150
07:26.100 --> 07:27.700
so we don't have to look at the actual bytes.

151
07:27.700 --> 07:32.090
So click on view and turn off packet bytes. And that looks better. I'm also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
07:27.700 --> 07:32.090
So click on view and turn off packet bytes. And that looks better. I'm also

152
07:32.090 --> 07:35.250
going to go ahead and take off the timestamps to make it a little bit easier to

153
07:35.250 --> 07:35.700
read.

154
07:35.700 --> 07:39.820
So I'll go ahead and right click here on the columns. And I'll take off the tim

155
07:39.820 --> 07:43.390
estamps and I'll space these out a little bit to make it a little easier to read

156
07:43.390 --> 07:43.700
.

157
07:43.700 --> 07:46.880
So to make it easier to find our content, I'm going to go ahead and put a

158
07:46.880 --> 07:50.030
display filter up here in the left. I'm going to go ahead and put a display

159
07:50.030 --> 07:53.700
filter saying, please only show me tack x protocol related packets.

160
07:53.700 --> 07:59.980
So we'll type in TAC ACS press enter and that gives us nothing. So let's go

161
07:59.980 --> 08:03.460
ahead and scroll down. We could also use a display filter, I suppose, but we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
07:59.980 --> 08:03.460
ahead and scroll down. We could also use a display filter, I suppose, but we

162
08:03.460 --> 08:04.700
didn't capture all that many packets.

163
08:04.700 --> 08:08.920
So let's go ahead and there we go. So here is one of our requests coming from

164
08:08.920 --> 08:14.700
10 to 68.6. And if we take a look at our six, we do a show IP interface brief

165
08:14.700 --> 08:16.700
that indeed is one of its interfaces.

166
08:16.700 --> 08:20.180
That's the interface closest to the target of the server based on the routing

167
08:20.180 --> 08:25.700
table. So we did a show IP route for 192.168.1.100.

168
08:25.700 --> 08:29.960
The server is showing us is using the egress route band interface of FA4/0. And

169
08:29.960 --> 08:35.730
that's exactly what that IP address is 10.2.68.6. Fantastic. So if you go back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
08:29.960 --> 08:35.730
that's exactly what that IP address is 10.2.68.6. Fantastic. So if you go back

170
08:35.730 --> 08:39.700
to our packet capture and we go ahead and open this up a little bit.

171
08:39.700 --> 08:43.830
So it's running TCP. The destination port is 49. So here is our TCP header

172
08:43.830 --> 08:48.760
information. And if we scroll down here is tack x plus. And if we scroll down

173
08:48.760 --> 08:52.700
further, we have our encrypted request effectively saying, hey, I've got this

174
08:52.700 --> 08:54.700
user and is this user.

175
08:54.700 --> 08:59.150
Okay, the login meaning are they authenticated and the next packet we have the

176
08:59.150 --> 09:03.060
response from the triple A server coming back to the R6 router. So if we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:59.150 --> 09:03.060
response from the triple A server coming back to the R6 router. So if we

177
09:03.060 --> 09:07.180
collapse all the columns for a moment, we have the source port coming from the

178
09:07.180 --> 09:07.700
server.

179
09:07.700 --> 09:12.320
It's TCP port 49 going to the port that our six sourced it from. And here is

180
09:12.320 --> 09:15.880
our tack x payload. And it's the encrypted reply that basically indicates. Yeah

181
09:15.880 --> 09:17.700
, the user is good. Let them log in.

182
09:17.700 --> 09:21.480
So let's do a quick spot check. We have enabled triple A new model. We've told

183
09:21.480 --> 09:24.810
our six where the triple A server is that it can use in conjunction with tack x

184
09:24.810 --> 09:28.700
for doing the authentication as well as the authorization that's coming up.

185
09:28.700 --> 09:32.630
So how exactly do we tell router six now to start using the triple A server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
09:28.700 --> 09:32.630
So how exactly do we tell router six now to start using the triple A server

186
09:32.630 --> 09:37.280
that knows about for authentication authorization. Well, one of the first steps

187
09:37.280 --> 09:41.690
is to create named method lists to specify how we want to do the authentication

188
09:41.690 --> 09:42.700
authorization.

189
09:42.700 --> 09:46.900
And we'll start that process in the very next video. So I'll see you there in

190
09:46.900 --> 09:47.700
just a moment.