Authentication

This scenario shows how to set up AAA authentication for login/Telnet using different AAA methods.

An AAA list with the local AAA method is created and assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set service telnet
set system aaa list list1 method 1 local
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Radius Method 

Description 

A RADIUS server is added to a RADIUS group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+C2uLAISWn82mTkgABsohtapdF2M9wgS6q2+j45K07h2hSaBQWvICU1VAiiJa41GltkWTS/JtzjA==
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Tacacs Method 

Description 

A TACACS+ server is added to a TACACS+ group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+L6pAwsOMCzpwQDJ2d1nEQZqKPFEjobpY=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Tacacs Method With Wrong Secret 

Description 

A TACACS+ server is added to a TACACS+ group, but said server is configured with a wrong secret key. The TACACS+ group is added to an AAA list, with local method as fallback. After assigning this list to the login system’s authentication, the device starts a Telnet session with itself to check that access is granted using the local method.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa list list1 method 2 local
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+ddOpoZdK9pkX/XvncM6+tMkmO5eomGu8=
set system cli aaa authorization list1
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user localuser authentication encrypted-password '$6$yeCPW/duiE2lZQjj$IUdtfTtCWlI81TE6xlG1d8aNm3eGHkZ3svsdxrjdzJcc1LQXtNwsCvFgOQlCh5JdDKr.FQlFRMhhO0SJVaeOu/'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 which is going to fail:

admin@DUT0$ telnet 127.0.0.1

Step 4: Modify the following configuration lines in DUT0 :

set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+ddOpoZdK9pgnH1uX3L9haZu3VrZVd+kg=

Step 5: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 6: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 7: Run command show version at DUT0 and expect this output: