WEBVTT

1
00:00.000 --> 00:03.600
For the hands-on lab, there's a link just below this video to launch that lab.

2
00:03.600 --> 00:05.760
If you want to launch it right now and give it a moment to initialize, that'd

3
00:05.760 --> 00:06.320
be great.

4
00:06.320 --> 00:09.280
And here's what I like to do. We're getting this AAA authentication and

5
00:09.280 --> 00:10.080
authorization lab.

6
00:10.080 --> 00:13.440
I'd like you to configure R6. That's the same router we've dealt with in the

7
00:13.440 --> 00:14.000
demonstrations

8
00:14.000 --> 00:18.440
up at this point. And on R6, I'd like you to configure it to be able to use a T

9
00:18.440 --> 00:19.360
ACAC server

10
00:19.360 --> 00:25.040
at 192.168.1.100. And the key is going to be Cisco 123 with the capital C. That

11
00:25.040 --> 00:25.840
is pre-configured

12
00:25.840 --> 00:30.360
already over on the triple A server. Then I'd like you to create a local user
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:25.840 --> 00:30.360
already over on the triple A server. Then I'd like you to create a local user

13
00:30.360 --> 00:31.280
on R6 called

14
00:31.280 --> 00:37.440
admin1 with a privilege level of 15 and a password of Cisco exclamation mark 23

15
00:37.440 --> 00:37.440
.

16
00:37.440 --> 00:42.300
And just be aware that the same user account admin1 is also sitting over at the

17
00:42.300 --> 00:43.120
triple A server.

18
00:43.120 --> 00:46.330
So you'll have a local user account called admin1 with that password. And there

19
00:46.330 --> 00:46.640
's also

20
00:46.640 --> 00:50.070
that same user sitting over on the triple A server. Then once you have that

21
00:50.070 --> 00:50.720
done, I'd like you to

22
00:50.720 --> 00:56.090
configure the VTY lines for login authentication, which would involve creating

23
00:56.090 --> 00:56.800
a method list for

24
00:56.800 --> 01:00.700
login authentication. And in that method list, specify you want to use the TAC
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:56.800 --> 01:00.700
login authentication. And in that method list, specify you want to use the TAC

25
01:00.700 --> 01:01.360
AC server you

26
01:01.360 --> 01:05.700
defined earlier, and then apply that method list to the VTY lines. And then

27
01:05.700 --> 01:06.320
secondly,

28
01:06.320 --> 01:09.550
once you've done the login authentication, I'd also like you to get on top of

29
01:09.550 --> 01:10.080
that the

30
01:10.080 --> 01:13.860
authorization of what that user is allowed to do. I'd like you to the

31
01:13.860 --> 01:15.440
authorization for exec

32
01:15.440 --> 01:21.920
and also for commands at level 0, 1, and 15. And all of those should use TACAC.

33
01:21.920 --> 01:25.480
Now one thing that's going to happen here that's a little bit different is that

34
01:25.480 --> 01:26.400
if we're authenticating

35
01:26.400 --> 01:31.030
our admin1 user over from the TACAC server, it's going to go ahead and come up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:26.400 --> 01:31.030
our admin1 user over from the TACAC server, it's going to go ahead and come up

36
01:31.030 --> 01:32.080
in user mode.

37
01:32.080 --> 01:36.230
So once you're in user mode, you can type in enable. And the enable password is

38
01:36.230 --> 01:36.720
upper case

39
01:36.720 --> 01:41.920
C, I, S, C, O, exclamation mark 23. Or if you want to kick it up a notch and

40
01:41.920 --> 01:42.560
you want to do the

41
01:42.560 --> 01:46.550
authorization of the exec shell from the local database where the user is

42
01:46.550 --> 01:48.000
identified as privilege

43
01:48.000 --> 01:51.580
15, thus we did the demos up to this point, you can do that as well. Either way

44
01:51.580 --> 01:52.080
is great,

45
01:52.080 --> 01:56.030
but that's why I make you aware of the privilege mode password is Cisco ex

46
01:56.030 --> 01:57.520
clamation mark 23.

47
01:57.520 --> 02:00.650
And then on top of all that, I'd also like to make sure that not only is the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.520 --> 02:00.650
And then on top of all that, I'd also like to make sure that not only is the

48
02:00.650 --> 02:02.080
authorization done

49
02:02.080 --> 02:06.360
for commands at level 0, 1, and 15, but also I'd like to do the authorization

50
02:06.360 --> 02:06.960
for any commands

51
02:06.960 --> 02:11.390
they issue while in configuration mode, which we demonstrated in the videos as

52
02:11.390 --> 02:12.960
well. Now on server

53
02:12.960 --> 02:17.370
one, there is that little notepad document called triple A, and it is on the

54
02:17.370 --> 02:18.400
desktop. If you want to

55
02:18.400 --> 02:22.160
use that for reference, please feel free to so have some fun with this hands on

56
02:22.160 --> 02:23.040
lab. And when

57
02:23.040 --> 02:26.720
you are ready, join me in the next video and we'll do a walkthrough together.