Authentication

This scenario shows how to set up AAA authentication for login/Telnet using different AAA methods.

An AAA list with the local AAA method is created and assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set service telnet
set system aaa list list1 method 1 local
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Radius Method 

Description 

A RADIUS server is added to a RADIUS group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18h9nQu7aSwNjLZ3LzeTkDuNdxm6/3tfh3fkJSD85d6cVk5+EVWrmdDqXUSmAcxtGplVV97PvKXvg==
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Tacacs Method 

Description 

A TACACS+ server is added to a TACACS+ group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18WQYFxAoilDcVjDJbhzhyiuXiBQEomZEo=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Tacacs Method With Wrong Secret 

Description 

A TACACS+ server is added to a TACACS+ group, but said server is configured with a wrong secret key. The TACACS+ group is added to an AAA list, with local method as fallback. After assigning this list to the login system’s authentication, the device starts a Telnet session with itself to check that access is granted using the local method.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa list list1 method 2 local
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1/Q6zQ0Hs4sXgHSDCIByyHaNJOs7hfHenM=
set system cli aaa authorization list1
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user localuser authentication encrypted-password '$6$VylGNdWjYtWhwoaJ$CiAlp9XCJCgKOWewmbK7qX.r.dO/k2U/e7Ai1l7DlZ0hTb4X56I.1q5UObgymxyOh42ly2WiRWQE8h0sVqQFo.'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 which is going to fail:

admin@DUT0$ telnet 127.0.0.1

Step 4: Modify the following configuration lines in DUT0 :

set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1/Q6zQ0Hs4sXgWXM+fTRjodUjLE0XIQNLQ=

Step 5: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 6: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 7: Run command show version at DUT0 and expect this output: