Fallbacks

This scenario shows how to set up a fallback mechanism for RADIUS/TACACS+ through Telnet/SSH.

Test Authenticaction Fallback

Description

This scenario checks all the different combinations of RADIUS/TACACS+ authentication with/without fallback configuration through SSH and Telnet. The user baduser is configured in the local database, but it is not authorized in the remote server. Therefore, if the server is reachable or if local fallback is not specified, login should fail.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa list LIST method 2 local
set system aaa server tacacs SRV address 10.215.168.1
set system aaa server tacacs SRV encrypted-key U2FsdGVkX1+aDT3ATAA0eYmV04ADnftsfsa4nzW/t50=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.838 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.838/0.838/0.838/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 2

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa server tacacs SRV address 10.215.168.1
set system aaa server tacacs SRV encrypted-key U2FsdGVkX1+aDT3ATAA0eYmV04ADnftsfsa4nzW/t50=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.247 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.247/0.247/0.247/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 3

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP local-vrf test
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa list LIST method 2 local
set system aaa server tacacs SRV address 10.215.168.1
set system aaa server tacacs SRV encrypted-key U2FsdGVkX1+aDT3ATAA0eYmV04ADnftsfsa4nzW/t50=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=9.71 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 9.708/9.708/9.708/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 4

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP local-vrf test
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa server tacacs SRV address 10.215.168.1
set system aaa server tacacs SRV encrypted-key U2FsdGVkX1+aDT3ATAA0eYmV04ADnftsfsa4nzW/t50=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.244 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.244/0.244/0.244/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 5

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa list LIST method 2 local
set system aaa server radius SRV address 10.215.168.1
set system aaa server radius SRV encrypted-key U2FsdGVkX19keaP5VpTo0+Qfk7FBhNkSgAhLWqpi70IWi0GPPGjZdYb9ajRiK5gZ7e7bizBfmenjpHhP3wm/Bw==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.631 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.631/0.631/0.631/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 6

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa server radius SRV address 10.215.168.1
set system aaa server radius SRV encrypted-key U2FsdGVkX19keaP5VpTo0+Qfk7FBhNkSgAhLWqpi70IWi0GPPGjZdYb9ajRiK5gZ7e7bizBfmenjpHhP3wm/Bw==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.207 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.207/0.207/0.207/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 7

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP local-vrf test
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa list LIST method 2 local
set system aaa server radius SRV address 10.215.168.1
set system aaa server radius SRV encrypted-key U2FsdGVkX19keaP5VpTo0+Qfk7FBhNkSgAhLWqpi70IWi0GPPGjZdYb9ajRiK5gZ7e7bizBfmenjpHhP3wm/Bw==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.321 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.321/0.321/0.321/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 8

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP local-vrf test
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa server radius SRV address 10.215.168.1
set system aaa server radius SRV encrypted-key U2FsdGVkX19keaP5VpTo0+Qfk7FBhNkSgAhLWqpi70IWi0GPPGjZdYb9ajRiK5gZ7e7bizBfmenjpHhP3wm/Bw==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=5.82 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 5.823/5.823/5.823/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 9

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa list LIST method 2 local
set system aaa server tacacs SRV address 1.2.3.4
set system aaa server tacacs SRV encrypted-key U2FsdGVkX19GtiOqKSojdrApor5LBFNHw7j5aTm82zY=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.354 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.354/0.354/0.354/0.000 ms

Note

In this case, SSH and Telnet connection will be successful, because the tacacs server, i.e., method 1, is not reachable and; therefore, the next method will be attempted (local method) and it will allow the authentication.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:
Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

baduser@osdx$

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:
Last login: Fri Mar 21 22:29:00 UTC 2025 from 127.0.0.1 on pts/1

Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

baduser@osdx$

Example 10

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa server tacacs SRV address 1.2.3.4
set system aaa server tacacs SRV encrypted-key U2FsdGVkX19GtiOqKSojdrApor5LBFNHw7j5aTm82zY=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.50 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.496/1.496/1.496/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 11

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP local-vrf test
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa list LIST method 2 local
set system aaa server tacacs SRV address 1.2.3.4
set system aaa server tacacs SRV encrypted-key U2FsdGVkX19GtiOqKSojdrApor5LBFNHw7j5aTm82zY=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.345 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.345/0.345/0.345/0.000 ms

Note

In this case, SSH and Telnet connection will be successful, because the tacacs server, i.e., method 1, is not reachable and; therefore, the next method will be attempted (local method) and it will allow the authentication.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:
Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

Last login: Fri Mar 21 22:29:01 2025 from ::ffff:127.0.0.1
baduser@osdx$

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:
Last login: Fri Mar 21 22:29:34 UTC 2025 from 127.0.0.1 on pts/1

Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

baduser@osdx$

Example 12

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group tacacs GROUP local-vrf test
set system aaa group tacacs GROUP server SRV
set system aaa list LIST method 1 group tacacs GROUP
set system aaa server tacacs SRV address 1.2.3.4
set system aaa server tacacs SRV encrypted-key U2FsdGVkX19GtiOqKSojdrApor5LBFNHw7j5aTm82zY=
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.220 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.220/0.220/0.220/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 13

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa list LIST method 2 local
set system aaa server radius SRV address 1.2.3.4
set system aaa server radius SRV encrypted-key U2FsdGVkX1840CABjdfplMMX/DnEJd8KtrLDIXgZCPpmelD2akcsMmw5E9tXY8ad1fUZ1e0GJPlBgFn9w/sY/g==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.324 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.324/0.324/0.324/0.000 ms

Note

In this case, SSH and Telnet connection will be successful, because the radius server, i.e., method 1, is not reachable and; therefore, the next method will be attempted (local method) and it will allow the authentication.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:
Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

Last login: Fri Mar 21 22:29:35 2025 from ::ffff:127.0.0.1
baduser@osdx$

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:
Last login: Fri Mar 21 22:30:07 UTC 2025 from 127.0.0.1 on pts/1

Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

baduser@osdx$

Example 14

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa server radius SRV address 1.2.3.4
set system aaa server radius SRV encrypted-key U2FsdGVkX1840CABjdfplMMX/DnEJd8KtrLDIXgZCPpmelD2akcsMmw5E9tXY8ad1fUZ1e0GJPlBgFn9w/sY/g==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.185 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.185/0.185/0.185/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect

Example 15

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP local-vrf test
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa list LIST method 2 local
set system aaa server radius SRV address 1.2.3.4
set system aaa server radius SRV encrypted-key U2FsdGVkX1840CABjdfplMMX/DnEJd8KtrLDIXgZCPpmelD2akcsMmw5E9tXY8ad1fUZ1e0GJPlBgFn9w/sY/g==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.277 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.277/0.277/0.277/0.000 ms

Note

In this case, SSH and Telnet connection will be successful, because the radius server, i.e., method 1, is not reachable and; therefore, the next method will be attempted (local method) and it will allow the authentication.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:
Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

Last login: Fri Mar 21 22:30:08 2025 from ::ffff:127.0.0.1
baduser@osdx$

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:
Last login: Fri Mar 21 22:30:38 UTC 2025 from 127.0.0.1 on pts/1

Welcome to Teldat OSDx 202503211214.a3e79e6-master-snapshot

This system includes free software.
Contact Teldat for licenses information and source code.

baduser@osdx$

Example 16

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 vrf test
set service ssh aaa authentication LIST
set service telnet
set system aaa group radius GROUP local-vrf test
set system aaa group radius GROUP server SRV
set system aaa list LIST method 1 group radius GROUP
set system aaa server radius SRV address 1.2.3.4
set system aaa server radius SRV encrypted-key U2FsdGVkX1840CABjdfplMMX/DnEJd8KtrLDIXgZCPpmelD2akcsMmw5E9tXY8ad1fUZ1e0GJPlBgFn9w/sY/g==
set system login aaa authentication LIST
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user baduser authentication encrypted-password '$6$toee5R7Dk1fV9RsH$/LbNsbX2f2AQyRceHWo6IZ5uNhqxwz8KvYNXkNlnwF/cK/Xq.hNtcrFdcGIMQgMlhz58AEpEuhpUmv.WIH0XX.'
set system vrf test

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 vrf test count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: test
PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 test: 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.200 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.200/0.200/0.200/0.000 ms

Note

In this case, SSH and Telnet connection will fail.

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user baduser:

admin@DUT0$ ssh baduser@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null
Show output
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
baduser@127.0.0.1's password:

Step 4: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1
Show output
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Linux 6.1.128 (osdx) (pts/1)

osdx login:
Password:

Login incorrect