Tacacs

This scenario shows how to set up TACACS+ authentication and per-command authorization. A TACACS+ server configured to deny the show date command and allow everything else is added to a TACACS+ group which is added to an AAA list. This list is used to perform user authentication and authorization of CLI commands.

Local Login And Custom Authorization 

Description 

In this scenario, login is performed through a serial interface. The user is authenticated in the remote TACACS+ server. Commands are also sent to this remote server in order to be authorized/unauthorized.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa group tacacs tacgroup1 server serv1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19A9ormWfkp/Kiv/ZeC7Cbmi37N9mHQtEU=
set system cli aaa authorization author_list
set system login aaa authentication authen_list
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Run the command service cnm restart on DUT0 and expect the following output:

Step 4: Run the command show running on DUT0 and expect the following output:

Step 5: Run the command show date on DUT0 and expect the following output:

Step 6: Run the command service cnm restart on DUT0 and expect the following output:

Step 7: Run the command show running on DUT0 and expect the following output:

Step 8: Run the command show date on DUT0 and expect the following output:

Telnet Login And Custom Authorization 

Description 

In this scenario, login is performed through a Telnet session. The user is authenticated in the remote TACACS+ server. Commands are also sent to this remote server in order to be authorized/unauthorized.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18ulPxxURQcmHicAg1wdXkVGO3x8Kto4ik=
set system cli aaa authorization author_list
set system login aaa authentication authen_list
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output:

SSH Login And Custom Authorization 

Description 

In this scenario, login is performed through a SSH session. The user is authenticated in the remote TACACS+ server. Commands are also sent to this remote server in order to be authorized/unauthorized.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication authen_list
set system aaa group tacacs tacgroup1 server serv1
set system aaa list authen_list method 1 group tacacs tacgroup1
set system aaa list authen_list method 2 local
set system aaa list author_list method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19mofsbPftrOQm0B11ZhRCoWz/rnFfsN+E=
set system cli aaa authorization author_list
set system login aaa authentication authen_list
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testmonitor:

admin@DUT0$ ssh testmonitor@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output: