Tacacs

This scenario shows how to set up TACACS+ authentication and per-command authorization. A TACACS+ server configured to deny the show date command and allow everything else is added to a TACACS+ group which is added to an AAA list. This list is used to perform user authentication and authorization of CLI commands.

Local Login And Custom Authorization 

Description 

In this scenario, login is performed through a serial interface. The user is authenticated in the remote TACACS+ server. Commands are also sent to this remote server in order to be authorized/unauthorized.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 key 1234
set system aaa group tacacs tacgroup1 server serv1
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set system login aaa authentication authen_list
set system cli aaa authorization author_list

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Run command service cnm restart at DUT0 and expect this output:

Step 4: Run command show running at DUT0 and expect this output:

Step 5: Run command show date at DUT0 and expect this output:

Step 6: Run command service cnm restart at DUT0 and expect this output:

Step 7: Run command show running at DUT0 and expect this output:

Step 8: Run command show date at DUT0 and expect this output:

Telnet Login And Custom Authorization 

Description 

In this scenario, login is performed through a Telnet session. The user is authenticated in the remote TACACS+ server. Commands are also sent to this remote server in order to be authorized/unauthorized.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 key 1234
set system aaa group tacacs tacgroup1 server serv1
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set service telnet
set system login aaa authentication authen_list
set system cli aaa authorization author_list

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 key 1234
set system aaa group tacacs tacgroup1 server serv1
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set service ssh aaa authentication authen_list
set system login aaa authentication authen_list
set system cli aaa authorization author_list

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testmonitor:

admin@DUT0$ ssh testmonitor@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output: