WEBVTT 00:00:01.000 --> 00:00:07.000 So now we are going to dive into discussion on AAA configuration and verification. 00:00:07.000 --> 00:00:10.000 And this goes hand-in-hand with the discussion we've just had. 00:00:10.000 --> 00:00:14.000 And you're going to be expected on the exam to be able to apply what we're talking about here 00:00:14.000 --> 00:00:17.000 and incorporate to what we talked about in the last discussion 00:00:17.000 --> 00:00:22.000 and potentially look at an entire massive, really crazy config and scenario 00:00:22.000 --> 00:00:24.000 and answer some questions on it. 00:00:24.000 --> 00:00:30.000 Meaning, if you want to log in right now, what password are you going to use? 00:00:30.000 --> 00:00:34.000 Or based on the configuration, what does it mean? Based on that, what does it mean? 00:00:34.000 --> 00:00:39.000 Or based on what you currently see, what modifications could you make to accomplish what we want you to accomplish? 00:00:39.000 --> 00:00:43.000 All little things like that. 00:00:43.000 --> 00:00:48.000 And remember, the exam section security is 20% of your exam and this falls under that section. 00:00:48.000 --> 00:00:53.000 So expect quite a few questions on what we talked about in the last session or last video 00:00:53.000 --> 00:00:55.000 as well as what we're talking about here now. 00:00:55.000 --> 00:00:58.000 So AAA. First of all, what does that stand for? 00:00:58.000 --> 00:01:02.000 Well, AAA stands for Authentication Authorization and Counting. 00:01:02.000 --> 00:01:06.000 What is AAA? AAA is actually a framework, folks. 00:01:06.000 --> 00:01:08.000 A framework. And what is a framework again? 00:01:08.000 --> 00:01:16.000 Well, when we talked about IPsec, we said that a framework was something that can give you guidelines, 00:01:16.000 --> 00:01:19.000 best practices, help. 00:01:19.000 --> 00:01:22.000 So that way there, you can accomplish whatever objective you're trying to accomplish. 00:01:22.000 --> 00:01:31.000 So with the IPsec framework, we saw the framework in action and how as long as I follow that framework 00:01:31.000 --> 00:01:37.000 and I choose the right things that would be best suited for me, I can accomplish the objective we're trying to accomplish. 00:01:37.000 --> 00:01:39.000 So same thing here with AAA. 00:01:39.000 --> 00:01:47.000 We have this AAA framework that outlines things like authentication, outlines authorization, and outlines accounting. 00:01:47.000 --> 00:01:51.000 Now, does the AAA framework tell you what you should use for authentication or authorization? 00:01:51.000 --> 00:01:52.000 No, of course it doesn't. 00:01:52.000 --> 00:02:00.000 But what it does is say that for authentication, you need to ensure that you have a way to prove that everyone is who they say they are. 00:02:00.000 --> 00:02:04.000 So before authentication, you have what is called identification. 00:02:04.000 --> 00:02:07.000 And what is identification? 00:02:07.000 --> 00:02:09.000 It's how a user identifies themselves. 00:02:09.000 --> 00:02:12.000 So a user can identify themselves like, for example, using their own password. 00:02:12.000 --> 00:02:16.000 A user can identify themselves with a fingerprint scan. 00:02:16.000 --> 00:02:19.000 A user can identify themselves in many different ways. 00:02:19.000 --> 00:02:25.000 And authentication is the process of using whatever they have used to identify themselves 00:02:25.000 --> 00:02:31.000 and then determining if they are actually authenticated based on that identifying information. 00:02:31.000 --> 00:02:41.000 So authentication is the act of proving that they are who exactly they say they are by comparing what they provide to something that is stored in a database. 00:02:41.000 --> 00:02:48.000 So they identify themselves with, let's say, using a password, and I authenticate them using that information against what we have stored in our database. 00:02:48.000 --> 00:02:50.000 And authorization would be what? 00:02:50.000 --> 00:02:52.000 Would be about identifying what they are allowed to access. 00:02:52.000 --> 00:02:55.000 So just because you're authenticated doesn't mean that you're allowed to access anything. 00:02:55.000 --> 00:03:04.000 For example, like AWS, I can create a user account for you in AWS, and I can authenticate you into AWS, but you might not be authorized to do anything. 00:03:04.000 --> 00:03:07.000 So you're authenticated to log in, but then you can't do anything. 00:03:08.000 --> 00:03:14.000 Everything you try to click on, everything you try to do, everything you try to do, it says denied, denied, denied, denied, denied, denied, right? 00:03:14.000 --> 00:03:16.000 That is the difference between authentication and authorization. 00:03:16.000 --> 00:03:20.000 You could totally be authenticated but not be authorized to do anything. 00:03:20.000 --> 00:03:26.000 Now, that's kind of silly in a way because it doesn't make sense to have somebody authenticated and then not give them anything. 00:03:26.000 --> 00:03:33.000 Everybody needs at least one thing that they're authorized to do, or it doesn't even make sense to have an account for them that can be authenticated. 00:03:33.000 --> 00:03:38.000 But that's just a prime example how authentication and authorization are really two separate things. 00:03:38.000 --> 00:03:46.000 And in the realm of security, if you're not aware that these are two really separate things, then you are leaving yourself vulnerable to attack. 00:03:46.000 --> 00:03:59.000 So authenticating and then authorizing, specifying in a very granular way what that authenticated user is allowed and not allowed to do is really important. 00:03:59.000 --> 00:04:00.000 And then let's keep track of everything. 00:04:00.000 --> 00:04:02.000 That is what accounting is for. 00:04:02.000 --> 00:04:04.000 So how are you going to keep track of it? 00:04:04.000 --> 00:04:06.000 One of the easiest ways is to log everything. 00:04:06.000 --> 00:04:08.000 Log all user access. 00:04:08.000 --> 00:04:09.000 Log all user activity. 00:04:09.000 --> 00:04:17.000 Log everything you possibly can so you can keep track of the who, where, what, whys, whens, hows, and so on and so forth from an accounting standpoint. 00:04:17.000 --> 00:04:23.000 So AAA is not enabled on our devices by default. 00:04:23.000 --> 00:04:25.000 It's not. 00:04:26.000 --> 00:04:43.000 What we've done so far to this point in time on our Cisco iOS devices is we've used the line passwords with the login keyword, and we used our local username and password database with the login local keyword. 00:04:43.000 --> 00:04:46.000 We have not used AAA yet. 00:04:47.000 --> 00:05:00.000 If we go to our device, for example, R1, and we type in AAA authentication, you'll see that there is no AAA command that starts with that. 00:05:00.000 --> 00:05:01.000 Let's back up. 00:05:01.000 --> 00:05:10.000 AAA, there's one command and one command only on our device right now, and that is AAA new model. 00:05:10.000 --> 00:05:11.000 Look what it says. 00:05:11.000 --> 00:05:14.000 Enabled new access control commands and functions. 00:05:14.000 --> 00:05:16.000 Disables old commands. 00:05:16.000 --> 00:05:31.000 So somebody, whoever came up with this name, wasn't thinking years and years and years and years down the road because AAA is not a new model anymore, right? 00:05:31.000 --> 00:05:35.000 But that's how we turn it on. 00:05:35.000 --> 00:05:38.000 That is the command to turn it on. 00:05:38.000 --> 00:05:40.000 I'm going to do that right now. 00:05:40.000 --> 00:05:41.000 All right. 00:05:41.000 --> 00:05:48.000 So when it says enable new access control commands and functions, disabling old commands, they were not lying. 00:05:48.000 --> 00:05:50.000 They were not lying by saying that. 00:05:50.000 --> 00:05:54.000 That is legit. 00:05:54.000 --> 00:05:56.000 Let me show you why that is. 00:05:56.000 --> 00:06:00.000 So if you were with me in the last discussion we had, what did we do? 00:06:01.000 --> 00:06:09.000 We set up console port to use the local username and password database. 00:06:09.000 --> 00:06:12.000 Well, let's exit out of here. 00:06:12.000 --> 00:06:22.000 Let's hit return to get started. 00:06:22.000 --> 00:06:23.000 Okay. 00:06:23.000 --> 00:06:25.000 So all that's gone. 00:06:26.000 --> 00:06:30.000 Let's type in enable. 00:06:30.000 --> 00:06:31.000 Okay. 00:06:31.000 --> 00:06:32.000 So that's still there. 00:06:32.000 --> 00:06:33.000 Thank goodness. 00:06:33.000 --> 00:06:34.000 All right. 00:06:34.000 --> 00:06:50.000 So first things first for the exam, make sure you know that when you enable AAA on your device, any other parameters you had before, like line authentication or local username and password database authentication, log in local, that doesn't exist anymore. 00:06:50.000 --> 00:06:54.000 So type in show, run, pipe to section line. 00:06:54.000 --> 00:06:56.000 The enable password is still there. 00:06:56.000 --> 00:07:01.000 You'll see here that everything is gone under the line. 00:07:01.000 --> 00:07:02.000 You see that? 00:07:02.000 --> 00:07:04.000 It's gone. 00:07:04.000 --> 00:07:06.000 It does not say log in anymore. 00:07:06.000 --> 00:07:08.000 It does not say password. 00:07:08.000 --> 00:07:10.000 Oh, it does say password though, right? 00:07:10.000 --> 00:07:11.000 It does say password. 00:07:11.000 --> 00:07:13.000 But log in is gone. 00:07:13.000 --> 00:07:15.000 Log in local is gone. 00:07:15.000 --> 00:07:18.000 But the password is still there. 00:07:18.000 --> 00:07:20.000 So what does that mean? 00:07:21.000 --> 00:07:47.000 It means you have to recognize that if I type in show, run, pipe to section AAA, if you see this command and I ask you right now what password is going to be used, there's not enough information for you to answer the question right now. 00:07:48.000 --> 00:07:50.000 And why is that? 00:07:58.000 --> 00:08:03.000 Because we need to know if there's a method list applied and other things like that. 00:08:03.000 --> 00:08:09.000 Now, technically speaking, you do actually have enough information now that I think about it. 00:08:09.000 --> 00:08:14.000 Because I typed in show, run, pipe to section AAA, which would show every single AAA command. 00:08:15.000 --> 00:08:20.000 And what we're not seeing here is a AAA command that specifies the method of the line password. 00:08:26.000 --> 00:08:31.000 If there was a method that said use the line password, then your answer would be use the line password. 00:08:35.000 --> 00:08:37.000 So right now, yeah, you know what? 00:08:37.000 --> 00:08:39.000 There is enough information. 00:08:39.000 --> 00:08:45.000 But if you really think about this and get a little deeper, if I showed you exactly this and said, what are you going to use to log into the line? 00:08:45.000 --> 00:08:47.000 It is no password. 00:08:47.000 --> 00:08:52.000 Because there's nothing telling you that you have to use this password right now. 00:08:52.000 --> 00:08:56.000 There's nothing telling you that you have to use the local exam password database. 00:08:56.000 --> 00:08:58.000 All right, so that's where the console port. 00:08:58.000 --> 00:09:01.000 However, let's look at our VTY lines. 00:09:03.000 --> 00:09:05.000 Let's try and access the VTY lines. 00:09:05.000 --> 00:09:07.000 You ready? 00:09:09.000 --> 00:09:24.000 So the VTY lines, by default, are using the local username and password database. 00:09:29.000 --> 00:09:38.000 So if we go back to R1, and you'll look at this output, and you have just enabled AAA, and there's no other commands. 00:09:39.000 --> 00:09:41.000 Then what are you using? 00:09:41.000 --> 00:09:45.000 You're using the local username and password database. 00:09:46.000 --> 00:09:51.000 So there has to be at least one username and password in that database. 00:09:52.000 --> 00:09:56.000 If there's not, then you won't be able to log in on the VTY lines. 00:09:56.000 --> 00:09:59.000 And then what about this one here? 00:09:59.000 --> 00:10:04.000 The console port, no username and password required. 00:10:04.000 --> 00:10:06.000 Nothing's required by default. 00:10:06.000 --> 00:10:08.000 There's a difference now. 00:10:08.000 --> 00:10:14.000 So as soon as you enable AAA, no credentials required to authenticate. 00:10:16.000 --> 00:10:21.000 Local username and password database credentials required to authenticate, regardless of whatever else it says. 00:10:21.000 --> 00:10:23.000 That's the default. 00:10:23.000 --> 00:10:25.000 Know that. 00:10:26.000 --> 00:10:28.000 Question, Conrad said, are the usernames and secrets still there? 00:10:28.000 --> 00:10:29.000 Yes, they are. 00:10:29.000 --> 00:10:33.000 So show, do show run, or no, show run pipe to section line. 00:10:33.000 --> 00:10:35.000 No, username. 00:10:36.000 --> 00:10:37.000 And there you go. 00:10:37.000 --> 00:10:39.000 They're all still there. 00:10:46.000 --> 00:10:47.000 All right. 00:10:47.000 --> 00:10:59.000 So let's just talk about now how we could enforce, for example, certain methods for authentication. 00:10:59.000 --> 00:11:03.000 So what we're going to do is we're going to go to configuration mode, and I'm going to type in the command AAA. 00:11:06.000 --> 00:11:10.000 You'll see now that we have a whole bunch of AAA commands because we enabled AAA new model. 00:11:10.000 --> 00:11:12.000 I'm going to type in authentication. 00:11:17.000 --> 00:11:29.000 Now, when you see this list here after authentication, this list is how you define what you're applying AAA to. 00:11:29.000 --> 00:11:31.000 So in this case, AAA authentication. 00:11:31.000 --> 00:11:37.000 Am I applying it to 802.1X port-based authentication? 00:11:39.000 --> 00:11:43.000 Am I applying it to the enable command? 00:11:43.000 --> 00:11:52.000 So that way there, when somebody types in the enable command, we use actually AAA for it, as opposed to the enable secret. 00:11:53.000 --> 00:11:55.000 We have PPP. 00:11:55.000 --> 00:12:03.000 So if you're using point-to-point protocol, instead of using the built-in authentication of PPP, you could actually use AAA authentication for PPP. 00:12:03.000 --> 00:12:09.000 But the one we want to focus on here is this one, login. 00:12:09.000 --> 00:12:14.000 Login is referring to your lines. 00:12:14.000 --> 00:12:16.000 That's what it's for. 00:12:16.000 --> 00:12:24.000 So your console port, your aux port, your VTY lines, that is what login is for. 00:12:24.000 --> 00:12:32.000 So that is the one we're focusing on for this discussion, device access and authentication for management purposes. 00:12:32.000 --> 00:12:34.000 So login. 00:12:34.000 --> 00:12:37.000 Now it asks you to provide a name. 00:12:38.000 --> 00:12:47.000 So you either create a user-defined name, a name you create yourself, or you use just the name default. 00:12:47.000 --> 00:12:50.000 So default is a name. 00:12:50.000 --> 00:12:58.000 Now, what I want you to realize here is that what we're creating is what is called a method list. 00:12:58.000 --> 00:13:00.000 A method list. 00:13:00.000 --> 00:13:02.000 That's what we're doing right now. 00:13:02.000 --> 00:13:10.000 So AAA authentication login, and then I give my method list a name. 00:13:10.000 --> 00:13:13.000 So I'm just going to go ahead and use the default name right now. 00:13:13.000 --> 00:13:15.000 That's all I'm going to do. 00:13:15.000 --> 00:13:16.000 That's all that means. 00:13:16.000 --> 00:13:19.000 It's the name of it. 00:13:19.000 --> 00:13:26.000 Then you specify your first method of authentication. 00:13:26.000 --> 00:13:30.000 Your first method of authentication. 00:13:30.000 --> 00:13:35.000 For right now, let me just give you an example of typing in local. 00:13:35.000 --> 00:13:41.000 So if I type in local, that means the local username and password database. 00:13:41.000 --> 00:13:44.000 That would be method number one. 00:13:44.000 --> 00:13:47.000 Since it's a method list, I can provide another method. 00:13:47.000 --> 00:13:50.000 So by a question mark, what's the next method? 00:13:50.000 --> 00:13:53.000 Let's say it's line. 00:13:53.000 --> 00:14:01.000 So if local username and password database doesn't work, then you can use the line password. 00:14:01.000 --> 00:14:08.000 So what I want to point out to you, though, is that I have used very specific words there. 00:14:08.000 --> 00:14:14.000 If the local username and password database doesn't work, then you use the line password. 00:14:14.000 --> 00:14:19.000 I did not say if the user fails authentication. 00:14:19.000 --> 00:14:26.000 So if the user fails authentication against the local username and password database, you don't get to use the line. 00:14:26.000 --> 00:14:30.000 So how in the world does your local username and password database fail? 00:14:30.000 --> 00:14:37.000 Well, since it's local, the only way it would fail is if there's no usernames and passwords in the database. 00:14:37.000 --> 00:14:42.000 So if your username and password database is blank, then you could use the line password. 00:14:42.000 --> 00:14:45.000 Other than that, you'd never use the line password. 00:14:46.000 --> 00:14:50.000 If there's at least one username and password in the local username and password database. 00:14:50.000 --> 00:14:54.000 So in my scenario here, it doesn't really make sense to do something like this. 00:14:54.000 --> 00:14:55.000 Why? 00:14:55.000 --> 00:15:02.000 Because my local username and password database is always going to be there with at least one username and password. 00:15:02.000 --> 00:15:05.000 So in this case, it doesn't make sense to have multiple methods. 00:15:05.000 --> 00:15:08.000 I'll show you when it makes sense to have multiple methods. 00:15:08.000 --> 00:15:12.000 But it doesn't stop Cisco on the exam from doing something like this and saying, hey, what does this mean? 00:15:12.000 --> 00:15:17.000 It means if the local username and password database is unavailable, it's not working, 00:15:17.000 --> 00:15:21.000 then we can go ahead and use the line password for authentication. 00:15:21.000 --> 00:15:22.000 So let me just show you here. 00:15:22.000 --> 00:15:25.000 Let's just do line as an example. 00:15:25.000 --> 00:15:28.000 And let's now apply it to the console port. 00:15:28.000 --> 00:15:31.000 So let's go to line console zero. 00:15:31.000 --> 00:15:33.000 And what are we going to type in? 00:15:33.000 --> 00:15:35.000 We're going to type in now login. 00:15:35.000 --> 00:15:38.000 But notice I cannot hit enter. 00:15:38.000 --> 00:15:40.000 And I have two different options here. 00:15:40.000 --> 00:15:43.000 We're just going to focus on the authentication option today. 00:15:43.000 --> 00:15:47.000 So login authentication and then the name. 00:15:47.000 --> 00:15:51.000 So it's either going to be the default name like we used up here. 00:15:51.000 --> 00:15:54.000 We use the name default. 00:15:54.000 --> 00:15:57.000 Or whatever custom name you created. 00:15:57.000 --> 00:16:00.000 So let's just put in default. 00:16:00.000 --> 00:16:08.000 Do show run pipe to section line. 00:16:08.000 --> 00:16:15.000 And what you're going to see here is that nothing is showing up. 00:16:15.000 --> 00:16:23.000 Let's see if it even worked. 00:16:23.000 --> 00:16:27.000 It did. 00:16:27.000 --> 00:16:36.000 It did. 00:16:36.000 --> 00:16:38.000 It's not even showing up my command. 00:16:38.000 --> 00:16:43.000 This is what frustrates me about all of this. 00:16:43.000 --> 00:16:50.000 Because right now I have AAA applied to the console port. 00:16:50.000 --> 00:16:52.000 But it's not showing that I have it applied. 00:16:52.000 --> 00:16:53.000 Why? 00:16:53.000 --> 00:16:55.000 I'll tell you why. 00:16:55.000 --> 00:17:00.000 It's because I used the default method list. 00:17:00.000 --> 00:17:03.000 That's why. 00:17:03.000 --> 00:17:06.000 In this scenario. 00:17:06.000 --> 00:17:07.000 Okay. 00:17:07.000 --> 00:17:08.000 What about? 00:17:08.000 --> 00:17:13.000 Remember we said the VTY lines by default use what? 00:17:13.000 --> 00:17:17.000 They use the local username and password database by default, correct? 00:17:17.000 --> 00:17:19.000 Remember we saw that. 00:17:19.000 --> 00:17:27.000 Let's do it one more time to show you. 00:17:27.000 --> 00:17:28.000 It's working, right? 00:17:28.000 --> 00:17:29.000 We good? 00:17:29.000 --> 00:17:30.000 Okay. 00:17:30.000 --> 00:17:33.000 So it's using the local username and password database. 00:17:33.000 --> 00:17:39.000 But let's try Telnet. 00:17:39.000 --> 00:17:41.000 Oh, wait a second. 00:17:41.000 --> 00:17:42.000 Right? 00:17:42.000 --> 00:17:43.000 It's only using the local username and password database. 00:17:43.000 --> 00:17:44.000 Why? 00:17:44.000 --> 00:17:45.000 Because I'm using SSH. 00:17:45.000 --> 00:17:46.000 But now it's using what? 00:17:46.000 --> 00:17:47.000 Line. 00:17:47.000 --> 00:17:49.000 It's using the line password. 00:17:49.000 --> 00:17:51.000 Why is it using a line password? 00:17:51.000 --> 00:17:59.000 Because I explicitly said the default method list is going to now use line. 00:17:59.000 --> 00:18:01.000 I mean, this is crazy stuff. 00:18:01.000 --> 00:18:07.000 When you think about it, it's like a whole bunch of if then statements in a code. 00:18:07.000 --> 00:18:13.000 And it makes it really tough to prepare for a certification exam with all these different options that come flying at you. 00:18:13.000 --> 00:18:25.000 So because I said default line, that automatically applies to this regardless of what I do. 00:18:25.000 --> 00:18:28.000 For Telnet, but not for SSH. 00:18:28.000 --> 00:18:35.000 Whereas for this, it's not applied to it unless I type in what? 00:18:35.000 --> 00:18:41.000 Login, authentication, default, which we did, but it doesn't show up. 00:18:41.000 --> 00:18:42.000 It doesn't show up. 00:18:42.000 --> 00:18:44.000 So what is a better option typically? 00:18:44.000 --> 00:18:49.000 A better option typically is to set yourself your authentication. 00:18:49.000 --> 00:18:50.000 Login, for example. 00:18:50.000 --> 00:18:51.000 Give it a name. 00:18:51.000 --> 00:18:53.000 Let's say for the console port. 00:18:53.000 --> 00:18:55.000 So let's call it console. 00:18:55.000 --> 00:18:58.000 And let's now type in that we're going to use login instead. 00:18:58.000 --> 00:18:59.000 Not login. 00:18:59.000 --> 00:19:00.000 Pardon me. 00:19:00.000 --> 00:19:01.000 Local. 00:19:01.000 --> 00:19:04.000 Local username and password database. 00:19:04.000 --> 00:19:12.000 So now let's go back to line console zero and type in login, authentication, console. 00:19:12.000 --> 00:19:15.000 Do show run pipe to section line. 00:19:15.000 --> 00:19:17.000 You're going to see that it's applied in this case. 00:19:17.000 --> 00:19:18.000 There you go. 00:19:18.000 --> 00:19:20.000 That's helpful, isn't it? 00:19:21.000 --> 00:19:26.000 And so now if we try to log in. 00:19:26.000 --> 00:19:51.000 We're going to use the username and password database. 00:19:51.000 --> 00:19:55.000 And this one here is still using what? 00:19:55.000 --> 00:19:58.000 It's still using default. 00:19:58.000 --> 00:20:05.000 So in this case, if we try to telnet in, you'll see it's just asking for a password. 00:20:05.000 --> 00:20:06.000 Why? 00:20:06.000 --> 00:20:08.000 Because it's still using default, which is what? 00:20:08.000 --> 00:20:16.000 Default applies to, by default, local username and password database. 00:20:16.000 --> 00:20:19.000 But then we change default to line. 00:20:19.000 --> 00:20:24.000 So that's why when we're telnetting in it, it's using the line password. 00:20:24.000 --> 00:20:27.000 So let's go ahead and modify this. 00:20:27.000 --> 00:20:29.000 Or create another one, let's say, as an example. 00:20:29.000 --> 00:20:34.000 Triple A authentication. 00:20:34.000 --> 00:20:38.000 And we'll say for login purposes, we'll call this one VTY just for fun. 00:20:38.000 --> 00:20:40.000 And we'll say login as well. 00:20:40.000 --> 00:20:43.000 Oh, let's try login case. 00:20:43.000 --> 00:20:46.000 Okay, what does login case mean? 00:20:46.000 --> 00:20:47.000 Just so you know. 00:20:47.000 --> 00:20:48.000 Sorry, local case. 00:20:48.000 --> 00:20:53.000 Local case means the username is also case sensitive. 00:20:53.000 --> 00:20:57.000 So if you don't type in the username in the proper case for the local username 00:20:57.000 --> 00:21:04.000 and password database, then it won't be, then you'd be denied. 00:21:04.000 --> 00:21:08.000 So now let's go to line VTY 0 through 4. 00:21:08.000 --> 00:21:12.000 And let's type in login authentication. 00:21:12.000 --> 00:21:17.000 And we'll type in VTY because that was the name of that. 00:21:17.000 --> 00:21:24.000 Do, show, run, pipe, section, line, and triple A. 00:21:24.000 --> 00:21:25.000 All right, so there you go. 00:21:25.000 --> 00:21:28.000 So now we've got all three of these, as you can see. 00:21:28.000 --> 00:21:34.000 But now if I asked you, how are we going to authenticate to the console ports? 00:21:34.000 --> 00:21:39.000 So when you look at the console port, you'll see login authentication con. 00:21:39.000 --> 00:21:41.000 So there's con. 00:21:41.000 --> 00:21:46.000 And con says local username and password database, not case sensitive. 00:21:46.000 --> 00:21:49.000 But if you look at the VTY lines, the VTY lines say what? 00:21:49.000 --> 00:21:51.000 Login authentication VTY. 00:21:51.000 --> 00:21:57.000 So VTY is local case, which means login is using a local username 00:21:57.000 --> 00:22:00.000 and password database, but it's case sensitive. 00:22:00.000 --> 00:22:03.000 So this one's not even being used right now anymore on the console port 00:22:03.000 --> 00:22:05.000 or the VTY lines. 00:22:05.000 --> 00:22:10.000 So if we go to DSW1 as an example, and we try to tell that in now, 00:22:10.000 --> 00:22:12.000 it's asking for a username and password. 00:22:12.000 --> 00:22:18.000 So let's type in capital Raymond, Raymond, and then Cisco. 00:22:18.000 --> 00:22:23.000 And I should be denied because it's not capital R, it's lowercase r. 00:22:23.000 --> 00:22:27.000 There you go. 00:22:27.000 --> 00:22:32.000 Oops. 00:22:32.000 --> 00:22:34.000 All right, so lowercase r. 00:22:34.000 --> 00:22:35.000 So that's what local case means. 00:22:35.000 --> 00:22:37.000 Remember that for the exam in case it shows up. 00:23:05.000 --> 00:23:21.000 All right. 00:23:21.000 --> 00:23:28.000 So this is using our local username and password database. 00:23:28.000 --> 00:23:42.000 What is the problem with using the local username and password database? 00:23:42.000 --> 00:23:49.000 The problem with it is it's not a scalable solution. 00:23:49.000 --> 00:23:51.000 Yeah, Conrad, exactly. 00:23:51.000 --> 00:23:52.000 It's not a scalable solution. 00:23:52.000 --> 00:23:53.000 Why? 00:23:53.000 --> 00:24:03.000 Because what it means is that for every single device you have, 00:24:03.000 --> 00:24:11.000 you're going to have to maintain a local database of usernames and passwords. 00:24:11.000 --> 00:24:23.000 And so if you have, for example, like we have 1, 2, 3, 4, 5 users, 00:24:23.000 --> 00:24:29.000 and let's say we had 300 devices, I'm going to have to maintain this on 300 devices. 00:24:29.000 --> 00:24:34.000 And so if all of a sudden Casey gets promoted, finds a job somewhere else, 00:24:34.000 --> 00:24:38.000 making a lot more money, then I'm going to have to go to all 300 devices 00:24:38.000 --> 00:24:40.000 and remove Casey. 00:24:40.000 --> 00:24:42.000 What if I forget just one? 00:24:42.000 --> 00:24:46.000 Well, that leaves us vulnerable to Casey attacking us later on from the new job 00:24:46.000 --> 00:24:49.000 opportunity that Casey has. 00:24:49.000 --> 00:24:52.000 So we don't want to end up in that type of situation ever. 00:24:52.000 --> 00:24:56.000 We want to be able to centrally manage all of our usernames and passwords. 00:24:56.000 --> 00:24:59.000 And so this is where AAA comes into play, 00:24:59.000 --> 00:25:03.000 where we're going to use a AAA server as an example, 00:25:03.000 --> 00:25:08.000 a database on a centralized external server. 00:25:09.000 --> 00:25:15.000 And so one of the two types of protocols we can utilize when our devices, 00:25:15.000 --> 00:25:22.000 like Cisco switches or Cisco routers or any other type of Cisco product, 00:25:22.000 --> 00:25:26.000 needs to communicate with a AAA server. 00:25:26.000 --> 00:25:31.000 We have RADIUS and we have TACACS+. 00:25:31.000 --> 00:25:34.000 RADIUS is an open standard that uses UDP. 00:25:34.000 --> 00:25:39.000 TACACS+, a Cisco proprietary, uses TCP. 00:25:39.000 --> 00:25:44.000 And so now what does this mean? 00:25:44.000 --> 00:25:53.000 It means that when you are SSHing or telnetting to your Cisco router, 00:25:53.000 --> 00:25:57.000 your Cisco switch or Cisco device that you want to manage, monitor, 00:25:58.000 --> 00:25:59.000 maintain via the what? 00:25:59.000 --> 00:26:07.000 Via the VTY lines, we are not using the line passwords potentially. 00:26:07.000 --> 00:26:11.000 We are not using the local username and password database. 00:26:11.000 --> 00:26:14.000 Instead, what are we using? 00:26:14.000 --> 00:26:20.000 We're using a AAA server here to do the authentication for us instead of the 00:26:20.000 --> 00:26:22.000 local network device. 00:26:22.000 --> 00:26:26.000 So RADIUS and TACACS++ are used where? 00:26:26.000 --> 00:26:28.000 From here to here. 00:26:28.000 --> 00:26:31.000 That's where it's used. 00:26:31.000 --> 00:26:35.000 And then from here back to here. 00:26:35.000 --> 00:26:37.000 That's where RADIUS and TACACS are used. 00:26:37.000 --> 00:26:41.000 They're protocols for communicating with that AAA server. 00:26:41.000 --> 00:26:46.000 Now, we have a tendency to call it a RADIUS server or a TACACS++ server, 00:26:46.000 --> 00:26:48.000 but in reality, what is it? 00:26:48.000 --> 00:26:54.000 It's a server with a centralized database that has the ability to communicate 00:26:54.000 --> 00:26:57.000 using RADIUS to our network devices. 00:26:57.000 --> 00:27:01.000 Or it's a server that has the ability, sorry, 00:27:01.000 --> 00:27:04.000 a server with a database that has the ability to communicate to my network 00:27:04.000 --> 00:27:06.000 device using TACACS+. 00:27:06.000 --> 00:27:08.000 That's what we have. 00:27:08.000 --> 00:27:17.000 And a Cisco example is the Cisco Identity Services Engine, Cisco ICE. 00:27:17.000 --> 00:27:20.000 If you want to learn more about ICE, folks, 00:27:20.000 --> 00:27:25.000 we have a course here that prepares you for the SISI exam. 00:27:25.000 --> 00:27:26.000 That's right. 00:27:26.000 --> 00:27:28.000 Securing Identity Services Engine. 00:27:28.000 --> 00:27:31.000 We call it the SISI exam. 00:27:31.000 --> 00:27:33.000 So does everybody else. 00:27:33.000 --> 00:27:36.000 But take a look at that if you're ever interested in using Cisco's 00:27:36.000 --> 00:27:40.000 Identity Services Engine. 00:27:40.000 --> 00:27:42.000 And then from there, 00:27:42.000 --> 00:27:45.000 whether we're using RADIUS or TACACS++ to talk to Identity Services 00:27:45.000 --> 00:27:51.000 Engine, we are talking using SSH here or Telnet. 00:27:51.000 --> 00:27:54.000 So in the end, right, I try to connect to you. 00:27:54.000 --> 00:27:55.000 You ask for my username. 00:27:55.000 --> 00:27:57.000 You ask for my password. 00:27:57.000 --> 00:28:01.000 You then reach out to the server to find out if my username 00:28:01.000 --> 00:28:05.000 and password is correct using RADIUS or TACACS+. 00:28:05.000 --> 00:28:09.000 The server responds back yes or no, and then I'm allowed or not. 00:28:09.000 --> 00:28:13.000 And then in addition to that, we have the ability to do authorization. 00:28:13.000 --> 00:28:16.000 We have the ability to do accounting on that AAA server as well. 00:28:16.000 --> 00:28:19.000 So we can configure that network device to also ask the server, hey, 00:28:19.000 --> 00:28:21.000 what are they authorized to do? 00:28:21.000 --> 00:28:25.000 So now every time I try to do something, right, I've got to be authenticated, 00:28:25.000 --> 00:28:28.000 but then am I actually authorized to do what I want to do? 00:28:28.000 --> 00:28:29.000 Yes or no. 00:28:29.000 --> 00:28:31.000 The server can tell my network device that. 00:28:31.000 --> 00:28:36.000 And then we record everything and we send it to that AAA server to make 00:28:36.000 --> 00:28:39.000 sure that it can store it in all of its logs. 00:28:40.000 --> 00:28:44.000 So RADIUS for the exam, make sure you know the things you see here, 00:28:44.000 --> 00:28:47.000 using UDP ports 1812, 1813. 00:28:47.000 --> 00:28:54.000 By default, our Cisco devices use 1645 and 1646. 00:28:54.000 --> 00:28:58.000 So this would be for authentication and authorization, 00:28:58.000 --> 00:29:00.000 and this would be for accounting. 00:29:00.000 --> 00:29:05.000 So 1812 or 1645 are auth authorization, 00:29:06.000 --> 00:29:09.000 and 1646 and 1813 are accounting. 00:29:09.000 --> 00:29:14.000 So originally before RADIUS was widely developed, 00:29:14.000 --> 00:29:18.000 deployed, and everything else, we were using 1645, 1646 back in the day. 00:29:18.000 --> 00:29:22.000 And Cisco IOS defaults to using 1645, 1646, 00:29:22.000 --> 00:29:26.000 but most of us implement RADIUS servers or the software we install in our 00:29:26.000 --> 00:29:29.000 systems use 1812, 1813 nowadays. 00:29:29.000 --> 00:29:33.000 So what that means is you either got to change the server to use 1645, 00:29:33.000 --> 00:29:35.000 1646 with your Cisco devices, 00:29:35.000 --> 00:29:39.000 or you got to change your Cisco devices to use 1812, 1813. 00:29:39.000 --> 00:29:41.000 So just keep that in mind for the exam. 00:29:41.000 --> 00:29:44.000 If they mention the port numbers you have to use, 00:29:44.000 --> 00:29:47.000 then they are basically telling you, we want to know, 00:29:47.000 --> 00:29:50.000 do you know how to configure those port numbers on your Cisco device? 00:29:50.000 --> 00:29:53.000 And I'll show you that when we get to our RADIUS configuration. 00:29:53.000 --> 00:29:56.000 TACACS plus is TCP port 49. 00:29:56.000 --> 00:30:00.000 RADIUS combines authentication and authorization together. 00:30:00.000 --> 00:30:04.000 All that means is this, when my network device reaches out to the server, 00:30:04.000 --> 00:30:09.000 it's going to authenticate and authorize the user at the exact same time. 00:30:09.000 --> 00:30:11.000 I can't do one without the other. 00:30:11.000 --> 00:30:13.000 So I can't just do authentication with RADIUS. 00:30:13.000 --> 00:30:16.000 I can't just do authorization with RADIUS. 00:30:16.000 --> 00:30:20.000 I have to do both authentication and authorization at the same time. 00:30:20.000 --> 00:30:23.000 And I can do accounting separately though. 00:30:23.000 --> 00:30:24.000 I can do it separately. 00:30:24.000 --> 00:30:27.000 Whereas with TACACS plus, I can do all three separately. 00:30:28.000 --> 00:30:30.000 So I can just do authentication. 00:30:30.000 --> 00:30:32.000 I can just do authorization. 00:30:32.000 --> 00:30:35.000 I can just do accounting if I want to. 00:30:35.000 --> 00:30:38.000 RADIUS is a one-way unidirectional with a single challenge response. 00:30:38.000 --> 00:30:40.000 Actually, you don't have to know that. 00:30:40.000 --> 00:30:43.000 Whereas TACACS plus is a two-way bidirectional with multiple challenges. 00:30:43.000 --> 00:30:45.000 Again, you don't have to worry about that. 00:30:45.000 --> 00:30:47.000 But down at the bottom, I want you to know that. 00:30:47.000 --> 00:30:50.000 Encrypts only password and packet. 00:30:50.000 --> 00:30:53.000 Now, when we talk about password, right, we're talking about what? 00:30:53.000 --> 00:30:55.000 We're talking about our credentials. 00:30:55.000 --> 00:30:56.000 We're talking about different things like that. 00:30:56.000 --> 00:30:58.000 But everything else is not. 00:30:58.000 --> 00:31:00.000 Whereas TACACS plus encrypts everything. 00:31:10.000 --> 00:31:12.000 Know this potentially for the exam. 00:31:12.000 --> 00:31:15.000 And this, and this, and this, and this. 00:31:15.000 --> 00:31:18.000 And you don't have to worry about that. 00:31:18.000 --> 00:31:19.000 I might take that out of my slide. 00:31:19.000 --> 00:31:24.000 It's that unimportant for the exam. 00:31:24.000 --> 00:31:27.000 So, let's talk about a configuration here. 00:31:27.000 --> 00:31:29.000 So, what do we need to do? 00:31:33.000 --> 00:31:35.000 So, I don't have a RADIUS server set up right now. 00:31:35.000 --> 00:31:36.000 I don't have a TACACS plus server set up. 00:31:36.000 --> 00:31:38.000 And that's perfectly fine. 00:31:38.000 --> 00:31:42.000 I'm still going to be able to give you a demonstration here. 00:31:42.000 --> 00:31:46.000 Although it won't be a successful login using RADIUS or TACACS plus. 00:31:46.000 --> 00:31:49.000 Let's start off with TACACS plus, though. 00:31:49.000 --> 00:31:51.000 So, always remember this. 00:31:51.000 --> 00:32:00.000 When you enable AAA, we saw that by default your console port allows you to 00:32:00.000 --> 00:32:04.000 connect without a username and password or any password. 00:32:04.000 --> 00:32:08.000 Whereas the VTY lines, you still needed a username and password. 00:32:08.000 --> 00:32:12.000 So, it's always advisable that you have at least one username and password on 00:32:12.000 --> 00:32:16.000 your device when you're using AAA. 00:32:16.000 --> 00:32:17.000 Always. 00:32:17.000 --> 00:32:18.000 Why? 00:32:18.000 --> 00:32:21.000 What if your servers are not available? 00:32:21.000 --> 00:32:23.000 What if they are down? 00:32:23.000 --> 00:32:25.000 What if they exploded on you? 00:32:25.000 --> 00:32:31.000 What if they were hacked so bad that you can't use them? 00:32:31.000 --> 00:32:35.000 What if they were ransomware and it's going to take you five days to recover 00:32:35.000 --> 00:32:39.000 them, but you need to get into this router right now? 00:32:39.000 --> 00:32:42.000 Well, you need a backup plan. 00:32:42.000 --> 00:32:45.000 And that backup plan is your local username and password database. 00:32:45.000 --> 00:32:49.000 So, have at least one username and password in your local username 00:32:49.000 --> 00:33:00.000 and password database. 00:33:00.000 --> 00:33:03.000 So, I encourage you to have that. 00:33:03.000 --> 00:33:06.000 We know how to enable AAA, so it's already enabled. 00:33:06.000 --> 00:33:12.000 I don't have to do that, but AAA new model was the command to enable it. 00:33:12.000 --> 00:33:21.000 Now, when you're setting up a TACACS Plus server scenario, situation, 00:33:21.000 --> 00:33:23.000 what are the things we need? 00:33:23.000 --> 00:33:25.000 What's important to us? 00:33:25.000 --> 00:33:31.000 Well, I need information about that TACACS Plus server because this router is 00:33:31.000 --> 00:33:35.000 going to have to talk to that TACACS Plus server. 00:33:35.000 --> 00:33:41.000 So, what I have to do is I have to teach this particular device about that 00:33:41.000 --> 00:33:42.000 TACACS Plus server. 00:33:42.000 --> 00:33:46.000 So, let's say we have a TACACS Plus server out there, 00:33:46.000 --> 00:33:52.000 and I'm going to, in my configuration here, call it TAC server one. 00:33:52.000 --> 00:33:54.000 You can call it anything you want. 00:33:54.000 --> 00:33:59.000 So, you might want to find out what is the name of that server 00:33:59.000 --> 00:34:01.000 and maybe put it in there. 00:34:01.000 --> 00:34:02.000 It's up to you. 00:34:02.000 --> 00:34:06.000 But that is just a locally significant value for this configuration right now. 00:34:06.000 --> 00:34:08.000 That's all it is. 00:34:08.000 --> 00:34:14.000 Then we have to specify the actual IP address, IV4 or V6 address of that server. 00:34:14.000 --> 00:34:17.000 So, I'm going to put an IPV4 here. 00:34:17.000 --> 00:34:21.000 And then what is either the host name or the IP address of that server? 00:34:21.000 --> 00:34:25.000 So, I'm going to type in 10.0.3.8, which is a bogus address here. 00:34:25.000 --> 00:34:27.000 It's not going to work. 00:34:27.000 --> 00:34:30.000 And then I can go ahead and hit enter. 00:34:30.000 --> 00:34:31.000 Now, let's specify the port number. 00:34:31.000 --> 00:34:34.000 So, by default, it is TCP port 49. 00:34:34.000 --> 00:34:39.000 But if you're ever told to change the port number, you just do it this way. 00:34:39.000 --> 00:34:41.000 And then lastly, we also need a key at a minimum. 00:34:41.000 --> 00:34:43.000 What is the key? 00:34:43.000 --> 00:34:49.000 So, this key is going to be the password that is used between your router 00:34:49.000 --> 00:34:51.000 and the AAA server. 00:34:51.000 --> 00:34:54.000 So, they can authenticate with each other. 00:34:54.000 --> 00:34:59.000 So, my AAA server needs to be using this IP address, this port number, 00:34:59.000 --> 00:35:10.000 and this key we're going to specify right here. 00:35:10.000 --> 00:35:11.000 Now, I'm just going to type in. 00:35:11.000 --> 00:35:18.000 It's a TACACS plus server shared secret key. 00:35:18.000 --> 00:35:22.000 So, that means the exact same key needs to be configured over there on the server. 00:35:22.000 --> 00:35:27.000 TACACS server shared secret key is the actual key that I created here. 00:35:27.000 --> 00:35:30.000 So, at a minimum, you need those three parameters. 00:35:30.000 --> 00:35:34.000 So, now this device knows how to talk to that AAA server. 00:35:34.000 --> 00:35:37.000 Now, let's say you had multiple AAA servers. 00:35:37.000 --> 00:35:41.000 For example, let's say you had another one, a backup, a failover, 00:35:41.000 --> 00:35:45.000 a secondary for redundancy sakes or high availability sakes 00:35:45.000 --> 00:35:46.000 or load balancing sakes. 00:35:46.000 --> 00:35:50.000 Then all you would do is create another one of these for that particular server. 00:35:50.000 --> 00:35:52.000 So, let's call it TACACS server 2. 00:35:52.000 --> 00:35:54.000 Let's put in its IP address. 00:35:54.000 --> 00:35:56.000 Let's say that's its IP. 00:35:56.000 --> 00:35:59.000 Let's say that, again, port number is 49. 00:35:59.000 --> 00:36:03.000 And let's say we're using the exact same secret key. 00:36:03.000 --> 00:36:05.000 So, now we have that configuration. 00:36:05.000 --> 00:36:08.000 We have the two configs of our two different servers. 00:36:08.000 --> 00:36:16.000 So, do, show, run, pipe to section. 00:36:16.000 --> 00:36:17.000 All right, so that's all I've done. 00:36:17.000 --> 00:36:21.000 I've just specified the parameters that are needed to talk to 00:36:21.000 --> 00:36:26.000 and communicate between my router and that particular server. 00:36:26.000 --> 00:36:31.000 So, now what I want to do is I want to create a configuration here called a 00:36:31.000 --> 00:36:32.000 AAA group. 00:36:32.000 --> 00:36:39.000 The AAA group allows me to specify which particular servers are going to be 00:36:39.000 --> 00:36:40.000 grouped together. 00:36:40.000 --> 00:36:44.000 So, I'm going to call this my TAC group for TACACS group. 00:36:44.000 --> 00:36:48.000 And what I'm going to do is I'm now going to embed my servers that we've 00:36:48.000 --> 00:36:52.000 created. 00:36:52.000 --> 00:36:58.000 So, let's embed this server and let's now embed this server. 00:36:58.000 --> 00:37:00.000 That's all I've done here. 00:37:00.000 --> 00:37:04.000 I've just created a group and I've embedded my servers inside that 00:37:04.000 --> 00:37:08.000 particular group. 00:37:08.000 --> 00:37:10.000 So, these two servers are now in that group. 00:37:10.000 --> 00:37:11.000 Why? 00:37:11.000 --> 00:37:15.000 Because now I'm going to use that group in a method list. 00:37:15.000 --> 00:37:17.000 That's what I'm going to do. 00:37:18.000 --> 00:37:23.000 So, I'm going to type in AAA authentication. 00:37:23.000 --> 00:37:30.000 And now we are going to type in, this is going to be for login. 00:37:30.000 --> 00:37:34.000 And, again, I could use default or I could use anyone I want to call. 00:37:34.000 --> 00:37:39.000 Let's call it AAA example for us today. 00:37:39.000 --> 00:37:41.000 That's the name of it. 00:37:41.000 --> 00:37:44.000 And then what is my method list? 00:37:44.000 --> 00:37:48.000 Now, this makes sense to use multiple methods. 00:37:48.000 --> 00:37:53.000 So, method number one is going to be a group. 00:37:53.000 --> 00:37:55.000 And who is that group? 00:37:55.000 --> 00:38:01.000 It's going to be my server group I created a while ago. 00:38:01.000 --> 00:38:07.000 Now, if you didn't create a group, then you could specify TACACS plus. 00:38:07.000 --> 00:38:15.000 And if you specify TACACS plus, it will use whatever servers you created. 00:38:15.000 --> 00:38:21.000 So, if I just typed in TACACS plus here, it would use these two servers. 00:38:21.000 --> 00:38:26.000 But I can say group and then put in my group name, 00:38:26.000 --> 00:38:30.000 and then it uses the servers from that group. 00:38:30.000 --> 00:38:32.000 So, you might be saying, well, then why did you use the group? 00:38:32.000 --> 00:38:36.000 Because think about it, you might have more TACACS servers. 00:38:36.000 --> 00:38:39.000 And if you want certain TACACS servers to be used for this 00:38:39.000 --> 00:38:43.000 and other TACACS servers to be used for that in massive enterprises environments, 00:38:43.000 --> 00:38:46.000 then it's better to create groups for the different purposes 00:38:46.000 --> 00:38:55.000 and then call upon the groups in your method list. 00:38:55.000 --> 00:38:58.000 Also, before we were allowed to create groups like this, 00:38:58.000 --> 00:39:00.000 we could only specify TACACS plus. 00:39:00.000 --> 00:39:04.000 It would be whatever servers we specify. 00:39:04.000 --> 00:39:06.000 So, this is like a newer type of config, 00:39:06.000 --> 00:39:11.000 where the TACACS plus was like an older type of config. 00:39:11.000 --> 00:39:14.000 So, now this is method number one. 00:39:14.000 --> 00:39:23.000 So, if I apply this, then that means the only way to authenticate is how? 00:39:23.000 --> 00:39:27.000 With my TACACS plus servers. 00:39:27.000 --> 00:39:35.000 If the TACACS plus servers are down, if the TACACS plus servers are unavailable, 00:39:35.000 --> 00:39:40.000 then what does that mean? 00:39:40.000 --> 00:39:44.000 Then we don't authenticate. 00:39:44.000 --> 00:39:46.000 You don't get in. 00:39:46.000 --> 00:39:51.000 So, it's always advisable to have a second option, a second method at a minimum, 00:39:51.000 --> 00:39:53.000 like local as an example. 00:39:53.000 --> 00:39:54.000 Local means what? 00:39:54.000 --> 00:39:58.000 Local username and password database. 00:39:58.000 --> 00:40:01.000 But maybe you would prefer to use your enable password. 00:40:01.000 --> 00:40:03.000 You could do that as well. 00:40:03.000 --> 00:40:05.000 You could use an enable password. 00:40:05.000 --> 00:40:07.000 What else could you do? 00:40:07.000 --> 00:40:10.000 You could maybe use the line password if you wanted to. 00:40:10.000 --> 00:40:14.000 So, as you can see, there's a multitude of different options that you have. 00:40:14.000 --> 00:40:20.000 Could you say TACACS group, I want to use the local username and password database. 00:40:20.000 --> 00:40:22.000 If that doesn't work, I want to use a line password. 00:40:22.000 --> 00:40:25.000 If that doesn't work, I want to use the enable password. 00:40:25.000 --> 00:40:32.000 And if that doesn't work, I want to go ahead and use no authentication whatsoever. 00:40:32.000 --> 00:40:33.000 Sure. 00:40:33.000 --> 00:40:40.000 So, to read this, you say method one is the TACACS plus servers. 00:40:40.000 --> 00:40:44.000 If they are unavailable, use the local username and password database. 00:40:44.000 --> 00:40:47.000 If it's unavailable, use the line password. 00:40:47.000 --> 00:40:50.000 If it's unavailable, use the enable password. 00:40:50.000 --> 00:40:58.000 If it's unavailable, use no password, nothing, and you are automatically authenticated. 00:40:58.000 --> 00:41:02.000 So, basically, you would only get to none in this case if there were no servers available, 00:41:02.000 --> 00:41:05.000 if there was no username and password in the database, there was no line password, 00:41:05.000 --> 00:41:09.000 there was no enable password, you are automatically in. 00:41:09.000 --> 00:41:12.000 Well, and in that case, you'd be automatically in no matter what, right? 00:41:12.000 --> 00:41:17.000 It wouldn't matter. 00:41:17.000 --> 00:41:18.000 But that's how you read it. 00:41:18.000 --> 00:41:21.000 I'm just trying to give you an example of how to read this. 00:41:21.000 --> 00:41:24.000 Even though it may not make sense for the real world when you read this, 00:41:24.000 --> 00:41:25.000 because it's like, well, nobody would do that. 00:41:25.000 --> 00:41:26.000 I know. 00:41:26.000 --> 00:41:28.000 But think about it from an exam standpoint. 00:41:28.000 --> 00:41:30.000 It doesn't matter if it would really work or not in the real world. 00:41:30.000 --> 00:41:32.000 They're testing you on whether you can read that or not. 00:41:32.000 --> 00:41:34.000 What does none mean? 00:41:34.000 --> 00:41:38.000 It means you get in without providing credentials. 00:41:38.000 --> 00:41:44.000 So, if I gave you this then, 00:41:44.000 --> 00:41:49.000 how do you authenticate if the TACACS Plus servers are unavailable? 00:41:49.000 --> 00:41:50.000 No authentication. 00:41:50.000 --> 00:41:51.000 You're in. 00:41:51.000 --> 00:41:54.000 Nothing required. 00:41:54.000 --> 00:41:59.000 How do you authenticate if the local username and password database is unavailable 00:41:59.000 --> 00:42:01.000 and the TACACS Plus servers are unavailable? 00:42:01.000 --> 00:42:03.000 Again, you don't have to authenticate. 00:42:03.000 --> 00:42:06.000 You're automatically in. 00:42:06.000 --> 00:42:08.000 How do you read all of this? 00:42:08.000 --> 00:42:12.000 That's important for you to be able to do. 00:42:12.000 --> 00:42:25.000 All right, let's hit enter there. 00:42:25.000 --> 00:42:34.000 So, there's our new method list. 00:42:34.000 --> 00:42:40.000 Let's go ahead and apply this. 00:42:40.000 --> 00:42:42.000 Where should I apply this to? 00:42:42.000 --> 00:42:50.000 I just don't want to lock myself up. 00:42:50.000 --> 00:42:52.000 Let's apply it to the VTY lines. 00:42:52.000 --> 00:42:55.000 That way I can still get into the console port if I have to. 00:42:55.000 --> 00:42:56.000 That's the best thing. 00:42:56.000 --> 00:43:03.000 Okay, let's go to line VTY zero through four. 00:43:03.000 --> 00:43:04.000 Log in. 00:43:04.000 --> 00:43:06.000 Authentication. 00:43:06.000 --> 00:43:08.000 And what is it? 00:43:08.000 --> 00:43:12.000 It's AAA example. 00:43:12.000 --> 00:43:15.000 So, we said, first and foremost, it's a TACACS Plus server. 00:43:15.000 --> 00:43:32.000 So, let's say on our TACACS Plus server, we are going to have, okay, there you go. 00:43:32.000 --> 00:43:34.000 So, what has happened here? 00:43:34.000 --> 00:43:37.000 I can't get to the TACACS Plus server. 00:43:37.000 --> 00:43:39.000 I can't get to the TACACS Plus server. 00:43:39.000 --> 00:43:41.000 It's unavailable. 00:43:41.000 --> 00:43:44.000 So, it's asking me for a username, right? 00:43:44.000 --> 00:43:49.000 So, if I provide the username and password that's stored on the TACACS Plus server, 00:43:49.000 --> 00:43:57.000 let's say my username is Raymond and my password on the TACACS Plus server is let me in. 00:43:57.000 --> 00:44:03.000 You're going to see that it's not going to work. 00:44:03.000 --> 00:44:04.000 Why is it not going to work? 00:44:04.000 --> 00:44:10.000 Well, obviously, we know it's not going to work because the server is what? 00:44:10.000 --> 00:44:13.000 The server is unavailable. 00:44:13.000 --> 00:44:21.000 So, if the server is unavailable, what's the next item in our method list, folks? 00:44:21.000 --> 00:44:22.000 Local username and password database. 00:44:22.000 --> 00:44:24.000 So, it's actually trying that. 00:44:24.000 --> 00:44:27.000 That's what it's trying to use right now. 00:44:27.000 --> 00:44:32.000 So, let's type in Raymond and let's type in Raymond's password in the local username 00:44:32.000 --> 00:44:38.000 and password database and it works. 00:44:38.000 --> 00:44:40.000 So, there's a prime example. 00:44:40.000 --> 00:44:45.000 If the TACACS Plus server is not available, then you have to know that 00:44:45.000 --> 00:44:55.000 and you have to apply the credentials for the local username and password database. 00:44:55.000 --> 00:44:57.000 So, let's go back to R1 right now. 00:44:57.000 --> 00:44:59.000 So, it's not going to tell you, oh, it's down. 00:44:59.000 --> 00:45:01.000 Like, if logging was down, you would not know that. 00:45:01.000 --> 00:45:06.000 You would have to find out some other way, hey, why or, oh, we're down. 00:45:06.000 --> 00:45:07.000 The TACACS Plus servers are down. 00:45:07.000 --> 00:45:09.000 So, that means I'm going to have to apply my local username 00:45:09.000 --> 00:45:13.000 and password database credentials. 00:45:13.000 --> 00:45:19.000 Let's change this, though. 00:45:19.000 --> 00:45:24.000 I want to change it to TACAC group and then none. 00:45:24.000 --> 00:45:25.000 Let's do none. 00:45:25.000 --> 00:45:34.000 Let's do none just to show you that if it's none, watch what happens. 00:45:34.000 --> 00:45:43.000 So, it will recognize the TACACS Plus server is down and then it should just let me in. 00:45:43.000 --> 00:45:44.000 Yeah, there you go. 00:45:44.000 --> 00:45:47.000 I'm in. 00:45:47.000 --> 00:45:50.000 So, that is how none works. 00:45:50.000 --> 00:45:51.000 None means just let them in. 00:45:51.000 --> 00:45:52.000 Keep that in mind. 00:45:52.000 --> 00:45:53.000 It doesn't mean no authentication. 00:45:53.000 --> 00:45:57.000 It means let them in. 00:45:57.000 --> 00:45:59.000 All right. 00:45:59.000 --> 00:46:04.000 Let me just double check my notes now that I've been able to give you this demonstration 00:46:04.000 --> 00:46:08.000 and make sure that we got everything covered. 00:46:08.000 --> 00:46:09.000 All right. 00:46:09.000 --> 00:46:10.000 So, yeah, definitely make sure you can read. 00:46:10.000 --> 00:46:18.000 So, make sure you know every single one of these in that list, what they mean. 00:46:18.000 --> 00:46:19.000 Not all of them, but enable. 00:46:19.000 --> 00:46:20.000 What does that mean? 00:46:20.000 --> 00:46:22.000 Use the enable password for authentication. 00:46:22.000 --> 00:46:23.000 Group. 00:46:23.000 --> 00:46:25.000 So, group radius or group TACACS. 00:46:25.000 --> 00:46:26.000 Kerberos. 00:46:26.000 --> 00:46:27.000 You can do Kerberos if you want. 00:46:27.000 --> 00:46:28.000 Probably not going to show up on the exam, though. 00:46:28.000 --> 00:46:31.000 Line, local, local case, none. 00:46:31.000 --> 00:46:32.000 That's what we've talked about. 00:46:32.000 --> 00:46:33.000 Those are the ones I want you to remember. 00:46:51.000 --> 00:46:57.000 All right. 00:46:57.000 --> 00:47:13.000 So, one thing I want to point out to you is that right now Raymond has privilege level 00:47:13.000 --> 00:47:14.000 15, right? 00:47:15.000 --> 00:47:27.000 It's not working anymore. 00:47:27.000 --> 00:47:28.000 You notice that? 00:47:28.000 --> 00:47:37.000 Once you enable AAA, that doesn't work unless you enable it with a AAA authorization command. 00:47:37.000 --> 00:47:38.000 Oops. 00:47:38.000 --> 00:47:40.000 I didn't want to type that. 00:47:40.000 --> 00:47:41.000 All right. 00:47:42.000 --> 00:47:45.000 So, let me show you how you can do that in case it shows up. 00:47:50.000 --> 00:47:53.000 So, show run pipe to section line. 00:47:53.000 --> 00:47:55.000 All right. 00:47:55.000 --> 00:47:57.000 We have log in authentication con. 00:47:57.000 --> 00:48:02.000 Let's go ahead and type in configure terminal AAA authorization now. 00:48:02.000 --> 00:48:03.000 So, AAA authorization. 00:48:03.000 --> 00:48:06.000 And we're going to authorize exec now. 00:48:06.000 --> 00:48:08.000 That's what we're going to do. 00:48:12.000 --> 00:48:14.000 And then we can create a method. 00:48:14.000 --> 00:48:16.000 We give it a name or we can use default. 00:48:16.000 --> 00:48:17.000 So, default or give it a name. 00:48:17.000 --> 00:48:19.000 So, let's type in a name. 00:48:19.000 --> 00:48:20.000 What can we give it a name here as? 00:48:20.000 --> 00:48:24.000 Oh, let's just call it auth or ization. 00:48:29.000 --> 00:48:30.000 All right. 00:48:30.000 --> 00:48:32.000 And then let's just go ahead and say local. 00:48:32.000 --> 00:48:35.000 Local username and password database. 00:48:38.000 --> 00:48:39.000 All right. 00:48:39.000 --> 00:48:43.000 So, now I've been able to trigger that privilege level command that we have in there. 00:48:45.000 --> 00:48:47.000 And so, that should work here. 00:48:51.000 --> 00:48:52.000 Let me just double check something here. 00:48:52.000 --> 00:48:54.000 Line console zero. 00:49:04.000 --> 00:49:07.000 That would be for that exec automatically. 00:49:08.000 --> 00:49:09.000 Let's just give this a try. 00:49:21.000 --> 00:49:22.000 Trying to remember how to apply it. 00:49:26.000 --> 00:49:27.000 Drawing a blank on it. 00:49:27.000 --> 00:49:28.000 It's not in my notes. 00:49:30.000 --> 00:49:32.000 Ah, the joys of doing the demo on the fly. 00:49:37.000 --> 00:49:44.000 How do I get that on my VTY line right now? 00:49:50.000 --> 00:49:53.000 Might have to come back and do that after so we don't waste too much time here. 00:49:53.000 --> 00:49:55.000 Let's configure terminal. 00:50:08.000 --> 00:50:11.000 Now, I'm going to – I'm drawing a blank on the command right now, folks. 00:50:11.000 --> 00:50:15.000 Instead of wasting everybody's time, I'm going to jump back. 00:50:15.000 --> 00:50:17.000 I'll continue my adventure and I'll come back. 00:50:17.000 --> 00:50:21.000 And during break, I'll check it out and I'll tell everybody right after break. 00:50:21.000 --> 00:50:22.000 Yep. 00:50:22.000 --> 00:50:23.000 All right. 00:50:23.000 --> 00:50:26.000 In the interest of time, I'm going to jump back. 00:50:26.000 --> 00:50:30.520 I'll continue my adventure and I'll come back and during break I'll check it out and I'll 00:50:30.520 --> 00:50:33.520 tell everybody right after break. 00:50:33.520 --> 00:50:35.520 Yeah. 00:50:35.520 --> 00:50:38.520 All right. 00:50:38.520 --> 00:50:41.520 Let's try. 00:50:41.520 --> 00:50:53.520 You know what? 00:50:53.520 --> 00:50:55.679 I want to give it the same name as before. 00:50:55.679 --> 00:50:57.760 That's what I'm going to do. 00:50:57.760 --> 00:50:58.760 So show. 00:50:58.760 --> 00:50:59.760 Let's do this. 00:50:59.760 --> 00:51:01.959 Do show run pipe to section line. 00:51:01.959 --> 00:51:03.919 I think this is the reason why. 00:51:03.919 --> 00:51:07.159 Do show run pipe to, no, section AAA. 00:51:07.159 --> 00:51:08.159 Let's do this. 00:51:08.159 --> 00:51:11.919 Now, we have the AAA example. 00:51:11.919 --> 00:51:13.800 That's what we called it, right? 00:51:13.800 --> 00:51:22.879 So let's do authorization with that exact same one. 00:51:22.879 --> 00:51:26.159 So in this case, we're going to do exec. 00:51:26.159 --> 00:51:31.120 We're going to do AAA example. 00:51:31.120 --> 00:51:38.120 And let's do, let's try that. 00:51:39.080 --> 00:51:44.080 Some of that in my notes, not those exact words. 00:51:44.080 --> 00:51:46.080 Nope, didn't apply it either. 00:51:46.080 --> 00:51:47.080 That's okay. 00:51:47.080 --> 00:51:50.080 I'm going to come back to that after. 00:51:50.080 --> 00:51:53.080 All right. 00:51:53.080 --> 00:52:02.360 We'll come back to that one after so we're not wasting everybody's time and we can get 00:52:02.360 --> 00:52:03.360 through what we want. 00:52:03.360 --> 00:52:04.520 I'll take a peek at it after. 00:52:04.520 --> 00:52:10.239 So here is in our documentation, in our slides, just some commands to remember. 00:52:10.239 --> 00:52:13.360 It's the ones we went through just to show you. 00:52:13.360 --> 00:52:17.399 So then you got your AAA authentication login, default group, tag group, local, and things 00:52:17.399 --> 00:52:18.399 like that. 00:52:18.399 --> 00:52:22.760 Make sure you can read these and you know what they are and then applying them to the 00:52:22.760 --> 00:52:33.360 commands that we have. 00:52:33.360 --> 00:52:35.040 And then RADIUS is the same way. 00:52:35.040 --> 00:52:40.919 So when you look at RADIUS here, you'll see that for RADIUS, we're just using a different 00:52:40.919 --> 00:52:41.919 set of commands. 00:52:41.919 --> 00:52:45.919 So RADIUS server, and then the address IP, and this is how you'd specify your port number 00:52:45.919 --> 00:52:46.919 with RADIUS. 00:52:46.919 --> 00:52:47.919 It's right there. 00:52:47.919 --> 00:52:48.919 So it's not a separate command. 00:52:48.919 --> 00:52:49.919 It's part of the address command. 00:52:49.919 --> 00:52:56.239 And then you set up your group and you apply your servers to the group or you embed the 00:52:56.239 --> 00:52:58.679 servers in your group. 00:52:58.679 --> 00:53:10.959 And then down here, again, just applying your method list as we talked about before. 00:53:10.959 --> 00:53:20.399 Now a few other things that I want to just point out to you, let's go back to here, AAA 00:53:20.399 --> 00:53:26.439 common criteria, in case that pops up on the certification exam. 00:53:26.439 --> 00:53:28.080 What is common criteria? 00:53:28.479 --> 00:53:35.719 It's used to create a password policy. 00:53:35.719 --> 00:53:36.719 That's what it's used for. 00:53:36.719 --> 00:53:41.739 It's used to create a password policy. 00:53:41.739 --> 00:53:48.239 So you'll see here that once you enable AAA, you can do a AAA common criteria policy and 00:53:48.239 --> 00:53:49.760 give it a name. 00:53:49.760 --> 00:53:57.159 So this is you creating a password policy for when you are using the AAA and you're 00:53:57.159 --> 00:54:01.399 using the local username and password database for authentication purposes. 00:54:01.399 --> 00:54:09.199 It's going to force you to meet these particular requirements for the passwords in the local 00:54:09.199 --> 00:54:10.399 username and password database. 00:54:10.399 --> 00:54:15.959 So if you're not using AAA, then these would not be available. 00:54:15.959 --> 00:54:19.719 But if you're using AAA, then these would be available for the local username and password 00:54:19.719 --> 00:54:23.040 database. 00:54:23.040 --> 00:54:24.639 So think about it from an exam standpoint. 00:54:24.879 --> 00:54:28.360 If the scenario is about, hey, you're currently using your local username and password database 00:54:28.360 --> 00:54:33.760 for authentication purposes, you want to make sure that you have a password policy set up 00:54:33.760 --> 00:54:34.760 for it. 00:54:34.760 --> 00:54:35.760 How are you going to do that? 00:54:35.760 --> 00:54:38.800 Well, first of all, you're going to have to enable AAA in order to accomplish that. 00:54:38.800 --> 00:54:39.800 That's number one. 00:54:39.800 --> 00:54:43.800 And then number two, once AAA is enabled, you can use AAA common criteria to create 00:54:43.800 --> 00:54:46.159 your password policy. 00:54:46.159 --> 00:54:50.360 So you got number of character changes you can specify, the maximum length of a password, 00:54:50.360 --> 00:54:55.399 the minimum length of a password, the lifetime of your passwords, and so on and so forth. 00:54:55.399 --> 00:54:59.679 And then you apply it, as you can see, to the username accounts. 00:54:59.679 --> 00:55:09.159 So right now we applied it to Raymond, common criteria policy, and the name of that policy. 00:55:09.159 --> 00:55:12.719 So that way there, no matter what, when we are dealing with Raymond, when it comes to 00:55:12.719 --> 00:55:17.040 that password, the password has to meet those password requirements. 00:55:17.040 --> 00:55:21.040 And you'll see that the password array now does not meet the password requirements, does it? 00:55:22.040 --> 00:55:23.040 It doesn't. 00:55:31.040 --> 00:55:35.679 And the reason why is because I created that password before I actually created the policy 00:55:35.679 --> 00:55:38.840 on this device. 00:55:38.840 --> 00:55:45.040 So the next time Raymond changes his password, then Raymond will be forced to use the password 00:55:45.040 --> 00:55:47.040 policy requirements that we have here. 00:55:59.040 --> 00:56:00.040 Okay. 00:56:06.040 --> 00:56:09.040 So it looks like we have everything covered we wanted to cover, folks. 00:56:09.040 --> 00:56:12.040 Let me just go back here, take a peek at this. 00:56:12.040 --> 00:56:14.040 We've covered pretty much here and more. 00:56:14.040 --> 00:56:16.040 I went a lot deeper than that. 00:56:26.040 --> 00:56:27.040 Covered that. 00:56:29.040 --> 00:56:32.040 We've talked about this with the AAA server. 00:56:32.040 --> 00:56:36.040 Radius versus TACACS to get us ready for the exam at a high level. 00:56:36.040 --> 00:56:38.040 Understanding that, that's perfect. 00:56:40.040 --> 00:56:41.040 All right, know this. 00:56:41.040 --> 00:56:42.040 We're good there. 00:56:45.040 --> 00:56:48.040 We've gone through this in a little demo, showed you what happens, how to read it. 00:56:48.040 --> 00:56:50.040 That's the most important part for the exam. 00:56:50.040 --> 00:56:53.040 If you can't read the method list, you are going to struggle. 00:57:15.040 --> 00:57:16.040 That's good. 00:57:17.040 --> 00:57:18.040 All right. 00:57:21.040 --> 00:57:23.040 And then we looked at radius, same thing, and we're good there. 00:57:23.040 --> 00:57:26.040 All right, so we have you covered there for AAA. 00:57:28.040 --> 00:57:35.040 And in the meantime, let's remind you that your goal is to be able to apply everything 00:57:35.040 --> 00:57:40.040 from this discussion and the discussion before, all together. 00:57:40.040 --> 00:57:46.040 So that way there, when you are tested about those on the exam, you are going to have the 00:57:46.040 --> 00:57:50.040 ability to pick one versus the other out of a lineup on the exam based on the information 00:57:50.040 --> 00:57:51.040 they provide you. 00:57:52.040 --> 00:57:58.040 It's not going to be easy, especially if you are weak in regards to how all this works. 00:57:58.040 --> 00:58:03.040 So I encourage you to review, review, review to strengthen your knowledge, and then they 00:58:03.040 --> 00:58:05.040 become easier, the questions.