WEBVTT

1
00:00.000 --> 00:03.440
So here is the hands-on lab tasks and with them in mind,

2
00:03.440 --> 00:04.940
I've reset the lab environment.

3
00:04.940 --> 00:06.800
Let's do the walkthrough together.

4
00:06.800 --> 00:08.080
So here's the lab environment.

5
00:08.080 --> 00:09.920
I did a reset, I restarted the lab.

6
00:09.920 --> 00:12.200
Let's take a look at our topology diagram.

7
00:12.200 --> 00:14.960
It's always a good idea to have that available and ready.

8
00:14.960 --> 00:16.600
Fantastic. There it is.

9
00:16.600 --> 00:19.760
We are going to do our work based on lab tasks on

10
00:19.760 --> 00:21.880
our six and our triple A servers down here,

11
00:21.880 --> 00:25.000
server one nug at 192.1.1.100.

12
00:25.000 --> 00:28.640
So we'll double click here on server one nug to bring it up,

13
00:28.640 --> 00:32.080
and that'll give us console access to all of our routers,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.640 --> 00:32.080
and that'll give us console access to all of our routers,

14
00:32.080 --> 00:34.000
including router six. All right.

15
00:34.000 --> 00:35.440
So here is server one.

16
00:35.440 --> 00:38.960
Here is multi-tab putty and we are looking at router six.

17
00:38.960 --> 00:41.360
And as you do the lab, feel free to do the debug,

18
00:41.360 --> 00:42.560
turn them on, turn them off.

19
00:42.560 --> 00:45.520
Just to validate what you think is happening is happening.

20
00:45.520 --> 00:47.600
Some of the debug examples include debug,

21
00:47.600 --> 00:50.080
triple A authentication like that,

22
00:50.080 --> 00:54.720
and debug, triple A authorization, and debug, TAC-X.

23
00:54.720 --> 00:56.880
So that's a lot of outputs of you.

24
00:56.880 --> 00:58.960
Want to hold off on those till near the end.

25
00:58.960 --> 01:00.640
You can or you can just leave them on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.960 --> 01:00.640
You can or you can just leave them on.

26
01:00.640 --> 01:03.040
For the demo, I'm going to go ahead and leave those debug

27
01:03.040 --> 01:05.760
running. Let's do a show debug and that looks fine.

28
01:05.760 --> 01:08.560
So I'm also going to leverage this text document right here

29
01:08.560 --> 01:09.920
for a little bit of help.

30
01:09.920 --> 01:12.800
So first of all, I'm going to go ahead and create the local user

31
01:12.800 --> 01:16.400
admin one with privilege of 15 with a password of Cisco

32
01:16.400 --> 01:17.920
exclamation mark two three.

33
01:17.920 --> 01:20.000
And I'm also going to enable triple A new model.

34
01:20.000 --> 01:23.680
So I'll go ahead and do those first and right click on our six

35
01:23.680 --> 01:25.280
and that part is done.

36
01:25.280 --> 01:28.400
Next, we're going to go ahead and specify our TAC-X server

37
01:28.400 --> 01:31.840
with the command TAC-X space server space and the name of our TAC-X
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.400 --> 01:31.840
with the command TAC-X space server space and the name of our TAC-X

38
01:31.840 --> 01:35.280
server and then the information I had to reach it and what the key is.

39
01:35.280 --> 01:38.240
So we'll copy that exactly like we did in the demo up to this point,

40
01:38.240 --> 01:40.960
paste it in, and good to go.

41
01:40.960 --> 01:44.240
All right, for our next task, and let me bring up the tasks real quick.

42
01:44.240 --> 01:45.280
So here they are.

43
01:45.280 --> 01:46.480
We create the local user.

44
01:46.480 --> 01:51.040
We define the triple A server, configure the VTY lines for login authentication

45
01:51.040 --> 01:52.560
via TAC-X plus.

46
01:52.560 --> 01:55.040
So that's going to involve creating a method list

47
01:55.040 --> 01:57.920
and associating that method list with the VTY lines.

48
01:57.920 --> 02:02.640
So to do that, we'll go ahead and actually let's also test our triple A
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:57.920 --> 02:02.640
So to do that, we'll go ahead and actually let's also test our triple A

49
02:02.640 --> 02:03.840
just to make sure it's working.

50
02:03.840 --> 02:08.640
So we'll grab that test command, copy it, paste that in, and sure enough,

51
02:08.640 --> 02:10.800
the user was successfully authenticated.

52
02:10.800 --> 02:15.430
There's the debug messages for authentication and there's some debug messages

53
02:15.430 --> 02:16.240
for TAC-X.

54
02:16.240 --> 02:21.520
So for login authentication, we want to make a login authentication method list

55
02:21.520 --> 02:21.520
.

56
02:21.520 --> 02:22.720
So it's right here.

57
02:22.720 --> 02:26.320
So the method list is going to be called TAC-Login.

58
02:26.320 --> 02:29.360
It's going to call upon our TAC-X servers and if none is reachable,

59
02:29.360 --> 02:31.200
it'll fall back to the local database.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:29.360 --> 02:31.200
it'll fall back to the local database.

60
02:31.200 --> 02:35.200
It then applies that method list for login authentication called TAC-Login

61
02:35.200 --> 02:36.880
to our 16 VTY lines.

62
02:36.880 --> 02:39.840
So I'll copy that, paste it in, and then we'll test it.

63
02:39.840 --> 02:43.520
So let's tell that to 6.6.6.6.

64
02:43.520 --> 02:48.240
We'll go ahead and login as admin one and specify the password of Cisco,

65
02:48.240 --> 02:51.920
X-Maj2.3, and that looks good.

66
02:51.920 --> 02:54.960
We can also exit out and we can also login as user one.

67
02:54.960 --> 02:57.280
So I'll tell that to 6.6.6.6 again.

68
02:57.280 --> 03:00.560
We'll login as user one this time, also over on the TAC-X server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:57.280 --> 03:00.560
We'll login as user one this time, also over on the TAC-X server,

69
03:00.560 --> 03:04.880
specify the password, same password, a center, and that's working as well.

70
03:04.880 --> 03:05.520
Fantastic.

71
03:05.520 --> 03:08.850
And the debug helps reinforce that we're really talking to that triple A server

72
03:08.850 --> 03:09.040
.

73
03:09.040 --> 03:09.360
All right.

74
03:09.360 --> 03:12.160
So we specified the method list for login authentication.

75
03:12.160 --> 03:13.920
We applied them to the VTY lines.

76
03:13.920 --> 03:18.880
Next, they want us to do authorization for exec and for commands at level 01

77
03:18.880 --> 03:20.400
and 15 using TAC-X.

78
03:20.400 --> 03:25.150
So let's go ahead and include method lists for exec authorization, level 0

79
03:25.150 --> 03:26.000
authorization,

80
03:26.000 --> 03:29.630
commands at level 1 authorization, commands at 15 authorization, and then to

81
03:29.630 --> 03:30.400
apply those
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:29.630 --> 03:30.400
apply those

82
03:30.400 --> 03:32.800
for method lists to our VTY lines.

83
03:32.800 --> 03:34.000
So let's do that next.

84
03:34.000 --> 03:37.360
So in our text document, let's go down to where we're going to create our

85
03:37.360 --> 03:38.160
method lists.

86
03:38.160 --> 03:41.840
So our first method list here for authorization of commands at level 0 is

87
03:41.840 --> 03:43.600
called TAC-0,

88
03:43.600 --> 03:45.440
and it's going to call upon TAC-X.

89
03:45.440 --> 03:48.720
Next one is very similar except looking for authorization for commands at level

90
03:48.720 --> 03:49.440
1,

91
03:49.440 --> 03:50.960
and it's called TAC-1.

92
03:50.960 --> 03:55.280
And the third one looking for commands at level 15, and it's called TAC-15.

93
03:55.280 --> 04:01.160
And then we get a line VTY-0, 315, and we apply all three of those method lists
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:55.280 --> 04:01.160
And then we get a line VTY-0, 315, and we apply all three of those method lists

94
04:01.160 --> 04:01.440
.

95
04:01.440 --> 04:02.320
So we'll do that next.

96
04:02.320 --> 04:06.720
We'll do that by highlighting that text, copying it to my buffer, going to R6,

97
04:06.720 --> 04:07.760
and pasting it in.

98
04:07.760 --> 04:11.040
So if we do a show, run, triple A, and press center.

99
04:11.040 --> 04:13.600
I'll add it to two As, but I didn't know what it meant.

100
04:13.600 --> 04:16.400
There are three method lists for command authorization.

101
04:16.400 --> 04:20.320
And if we do a show, run, pipe, section, line, we can verify those are applied

102
04:20.320 --> 04:21.840
to our VTY lines,

103
04:21.840 --> 04:23.200
as shown right here.

104
04:23.200 --> 04:29.440
In addition, it also wants to include authorization of configuration commands.

105
04:29.440 --> 04:33.440
There's one additional global config command we need to make that happen as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
04:29.440 --> 04:33.440
There's one additional global config command we need to make that happen as

106
04:33.440 --> 04:33.760
well.

107
04:33.760 --> 04:37.200
And if we look at our notepad document, it is this one right here.

108
04:37.200 --> 04:42.340
Triple A authorization config dash commands includes any commands in

109
04:42.340 --> 04:43.440
configuration mode,

110
04:43.440 --> 04:46.400
also requiring authorization by the Triple A server.

111
04:46.400 --> 04:51.330
And just as it heads up again, this Triple A server for admin one, and also for

112
04:51.330 --> 04:52.240
user one,

113
04:52.240 --> 04:53.200
is wide open.

114
04:53.200 --> 04:54.240
There's no restrictions.

115
04:54.240 --> 04:57.920
So the Triple A server via TAC-X is just going to say, "Yes, yes, yes."

116
04:57.920 --> 05:00.560
Anytime the router says, "Can they issue this command?"
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:57.920 --> 05:00.560
Anytime the router says, "Can they issue this command?"

117
05:00.560 --> 05:04.320
And that command, the TAC-X servers configure just to say yes to everything.

118
05:04.320 --> 05:07.360
So I'll go ahead and right click on that, copy it to my buffer,

119
05:07.360 --> 05:10.000
go to R6, paste it in, and let's test it out.

120
05:10.000 --> 05:13.120
So we'll tell that lower to 6.6.6.6.

121
05:13.120 --> 05:17.360
And we'll go ahead and log in as let's log in as user one, put in the password,

122
05:17.360 --> 05:18.080
and that's great.

123
05:18.080 --> 05:20.960
Then we'll type in enable to play the password there.

124
05:20.960 --> 05:22.240
And then we're in privilege mode.

125
05:22.240 --> 05:23.600
We'll go to configuration mode.

126
05:23.600 --> 05:24.640
That's being checked.

127
05:24.640 --> 05:28.070
And then we'll go ahead and in configuration mode, let's create interface loop

128
05:28.070 --> 05:28.320
back.

129
05:28.320 --> 05:30.960
How about 4.4.4 press center?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
05:28.320 --> 05:30.960
How about 4.4.4 press center?

130
05:30.960 --> 05:31.840
That's being checked.

131
05:31.840 --> 05:35.600
And as a result of the Triple A server saying yes to everything,

132
05:35.600 --> 05:36.720
it allowed it to happen.

133
05:36.720 --> 05:41.520
So I'm going to exit out, do a no interface loopback 4.4.4.

134
05:41.520 --> 05:42.960
And it verified that as well.

135
05:42.960 --> 05:43.840
And we typed in end.

136
05:43.840 --> 05:46.320
It also verified that that was allowed as well.

137
05:46.320 --> 05:49.200
So if we scroll up a little bit, when I typed in end,

138
05:49.200 --> 05:50.640
check out what level it exists at.

139
05:50.640 --> 05:56.320
It called upon tack zero, which implies that end, that command is a level zero

140
05:56.320 --> 05:56.960
command,

141
05:56.960 --> 05:58.160
which is kind of interesting.

142
05:58.160 --> 06:02.000
And even though our focus in this set of videos in this lab has been primarily
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:58.160 --> 06:02.000
And even though our focus in this set of videos in this lab has been primarily

143
06:02.000 --> 06:02.320
on

144
06:02.320 --> 06:06.560
using triple A services like TAC-X for authentication and authorization,

145
06:06.560 --> 06:10.000
there's also a whole other component regarding accounting.

146
06:10.000 --> 06:10.720
But guess what?

147
06:10.720 --> 06:11.920
It's the same logic.

148
06:11.920 --> 06:16.160
We want to create accounting method lists, and then we apply those method lists

149
06:16.160 --> 06:17.040
to the lines or

150
06:17.040 --> 06:19.120
the ports where we want that method list to be used.

151
06:19.120 --> 06:22.690
And then as these are our issuing commands, not only are they being checked,

152
06:22.690 --> 06:23.040
for example,

153
06:23.040 --> 06:26.870
for authorization, but they're also being recorded over at the centralized

154
06:26.870 --> 06:27.440
server,

155
06:27.440 --> 06:28.800
in this case, the Triple A server.

156
06:28.800 --> 06:32.000
So thanks for joining me into this dive into the world of authentication and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:28.800 --> 06:32.000
So thanks for joining me into this dive into the world of authentication and

157
06:32.000 --> 06:32.720
authorization

158
06:32.720 --> 06:36.320
using Triple A and also leveraging some local authentication when needed.

159
06:36.320 --> 06:40.210
And I look forward to seeing you, my friend, in another set of videos very,

160
06:40.210 --> 06:40.960
very soon.

161
06:40.960 --> 06:45.320
Until then, I hope this has been informative, and I'd like to thank you for

162
06:45.320 --> 06:45.600
viewing. www.technet24.ir