Radius

Telnet Default Authorization 

Description 

A RADIUS server is added to a RADIUS group which is added to an AAA list. This list is assigned to the login system’s authentication. In this scenario, the default authorization mapping is used, which maps the standard level to monitor and the privileged level to admin. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19bH4m4hPfsrbPEruz4OF+V8zS3/h/1Bt+ZF/O4nlE8NJmx68P272x0OdbJZLjzItejGK92awl2cA==
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

Telnet Privilege Map 

Description 

A RADIUS server is added to a RADIUS group which is added to an AAA list. This list is assigned to login system’s authentication. Finally, the RADIUS privilege levels are mapped to locally defined roles. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa authorization privilege-map radius privileged role monitor
set system aaa authorization privilege-map radius standard role admin
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/cD5uaMrPT0kwLgs1y+s7gEFL9spOD/tW5F2rXkbokU+HqFL6xloHM0YOGV0UGlXAfmWWoEE7K8A==
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

SSH Default Authorization 

Description 

A RADIUS server is added to a RADIUS group which is added to an AAA list. This list is assigned to the SSH service’s authentication. In this scenario, the default authorization mapping is used, which maps the standard level to monitor and the privileged level to admin. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+C9dvfzmfV5MlU37ltKjUor/BVN1g5LfYiBAA0R1nPV0BamsSbvxCqvewyFy4Ds3uE8moo85fZfw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

SSH Privilege Map 

Description 

A RADIUS server is added to a RADIUS group which is added to an AAA list. This list is assigned to SSH service’s authentication. Finally, the RADIUS privilege levels are mapped to locally defined roles. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa authorization privilege-map radius privileged role monitor
set system aaa authorization privilege-map radius standard role admin
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/ZChVHZpYF4YzOvlr5xkjCzG8ZysNtzxQqEapJvXp8wQF/gVpZPfAbTfVtTLB/qAa77720o2QjoQ==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output: