Authentication
This scenario shows how to set up AAA authentication for login/Telnet using different AAA methods.
Local Method
Description
An AAA list with the local AAA method is created and assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.
Scenario
Step 1: Set the following configuration in DUT0 :
set service telnet set system aaa list list1 method 1 local set system login aaa authentication list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 6.12.74 (osdx) (pts/1) osdx login: Password: Welcome to Teldat OSDx v4.2.9.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Tue May 5 01:45:42 UTC 2026 on ttyS0 admin@osdx$
Radius Method
Description
A RADIUS server is added to a RADIUS group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set service telnet set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19cIzFsyrmZW0hCO6SILUESUwAutIT17XHH5F7k81GNySD0Vql5zuaABt/gYMuXn6XYVwkxZYg/vQ== set system login aaa authentication list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.225 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.225/0.225/0.225/0.000 ms
Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 6.12.74 (osdx) (pts/1) osdx login: Password: Welcome to Teldat OSDx v4.2.9.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Tue May 5 01:39:28 UTC 2026 from 127.0.0.1 on pts/1 testing@osdx$
Tacacs Method
Description
A TACACS+ server is added to a TACACS+ group, which is added to an AAA list. This list is assigned to the login system’s authentication. The device then starts a Telnet session with itself to check that access is granted when the correct username and password are used.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set service telnet set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19QKpzb9mFuTCdHw+oCOqUFFvfMGBqvdLE= set system login aaa authentication list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.202 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.202/0.202/0.202/0.000 ms
Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 6.12.74 (osdx) (pts/1) osdx login: Password: Welcome to Teldat OSDx v4.2.9.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Tue May 5 01:45:40 UTC 2026 on ttyS0 testing@osdx$
Tacacs Method With Wrong Secret
Description
A TACACS+ server is added to a TACACS+ group, but said server is configured with a wrong secret key. The TACACS+ group is added to an AAA list, with local method as fallback. After assigning this list to the login system’s authentication, the device starts a Telnet session with itself to check that access is granted using the local method.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set service telnet set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa list list1 method 2 local set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18BLKDYlb/S14/6HsTBhzXhgFlu/Jqzji8= set system cli aaa authorization list1 set system login aaa authentication list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system login user localuser authentication encrypted-password '$6$zFUlnvhHUzxAKJVh$WYZUE4sIZrewSMTDNbHsjKBBZdZpPJBOSFB6CI1cm1uX3LstYeZ/jppr9H9JeeGUovXfTajzLU4ViWJoUkiNE/'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.342 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.342/0.342/0.342/0.000 ms
Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 which is going to fail:
admin@DUT0$ telnet 127.0.0.1Show output
' Login incorrect' contains 'Login incorrect'
Step 4: Modify the following configuration lines in DUT0 :
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX194LA7O/7IBVCO/x7fVuR2/mBWaB388zsM=
Step 5: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.186 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.186/0.186/0.186/0.000 ms
Step 6: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 6.12.74 (osdx) (pts/1) osdx login: Password: Welcome to Teldat OSDx v4.2.9.3 This system includes free software. Contact Teldat for licenses information and source code. localuser@osdx$
Step 7: Run command show version at DUT0 and expect this output:
Show output
OS vendor: Teldat OS name: OSDx OS version: v4.2.9.3 OS Linux kernel: 6.12.74 OS built by: jenkins@diana OS build date: Mon May 4 07:22:04 UTC 2026 OS installation: physical OS boot mode: user License: VM_BASE Firewall eth-Rate-Permit-Full Hardware vendor: QEMU Hardware model: VM Hardware OEM model: Standard PC (i440FX + PIIX, 1996) Hardware version: pc-i440fx-7.2 Hardware UUID: 2d377ee9-e07c-52e8-820a-5f99c944420e Hardware architecture: amd64 Hardware fwid: iso Hardware base MAC: de:ad:be:ef:6c:00 Hardware cpu: 1 x QEMU Virtual CPU version 2.5+ (4 cores) Last reboot reason: Panic Date: Tue 05 May 2026 01:47:07 +00:00 Uptime: 4:29:12 CPU load (1m, 5m, 15m): 0.15 0.18 0.19 CPU usage % (1m): 2.98 Storage usage (kB): 420440/8144384 Memory usage (kB): 446536/1572692 Users logged in: 1 Mode (current/next boot): user/user Hostname: osdx