Authentication

This scenario shows how to set up AAA authentication for login/Telnet using different AAA methods.

An AAA list with the local AAA method is created and assigned to the SSH service’s authentication. The device then starts an SSH session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0:

set system aaa list list1 method 1 local
set service ssh aaa authentication list1

Step 2: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user admin:

admin@DUT0$ ssh admin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Radius Method 

Description 

A RADIUS server is added to a RADIUS group which is added to an AAA list. This list is assigned to the SSH service’s authentication. The device then starts an SSH session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set service ssh aaa authentication list1

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Tacacs Method 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. The device then starts an SSH session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 key 1234
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set service ssh aaa authentication list1

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null