AAA Server Configuration

There are two methods for the AAA Server; one is the RADIUS server, and the other is the Terminal Access Controller Access Control System TACACS +

1. radius Configuration

AAA New-model startup

AAA authentication login default radius local use the default method list to set the authentication method for login (if you cannot connect to the radius, use the local authentication method)

AAA authentication PPP default local group radius (use the default method list to enable PPP authentication, first based on local database authentication, and then by RADIUS Authentication)

AAA authentication network default group radius (use AAA to authorize the connection to the network)

AAA accounting network default start-stop group radius (enable start and end statistics for network connections)

2. TACACS Configuration

1. Authentication Configuration
Router1 # configure Terminal
Router1 (config) # AAA New-Model
Router1 (config) # AAA authentication login default group TACACS + local


Add local to indicate that after TACACS + server becomes invalid, use local authentication.
2. Configure authorization
Router1 (config) # AAA authorization exec default group TACACS + local
Router1 (config) # AAA authorization commands 15 default group TACACS +


3. Configure tacacs-Server
Router1 (config) # tacacs-server host 10.253.100.100
Router1 (config) # tacacs-server key Cisco


4. record user behavior Audit
Record the configuration commands and time entered by the user
Router1 (config) # AAA accounting commands 15 default start-stop group TACACS +
Router1 (config) # AAA accounting exec default start-stop group TACACS +
Router1 (config) # AAA accounting connection default start-stop group TACACS +


2. Configure the logon Interface
1. implement authentication and authorization in Telnet
Router1 (config) # Line vty 0 4


Router1 (config-line) # login authentication default
& Shy; logon authentication


Router1 (config-line) # authorization exec default
Authorization
Note (if you do not need commands restrictions and do not need to implement authorization commands during logon, you may be confused by this small command)


2. Implement audits in Telnet
Router1 (config-line) # accounting connection default
Router1 (config-line) # accounting commands 15 default
Router1 (config-line) # accounting exec default