31/08/2021 CCNA Security: Configuring AAA – CertificationKits.

com

    Home About Us Contact Us Blog Shop

CertificationKits is your one-stop source for Cisco certification lab hardware &
training.

CCNA
Lab Security:
Certification Kits Configuring AAA
Lab Suggestions Cisco Certification SHOP 

Search ... 

Configuring Exec Access using Radius then Local 

Router(config)#aaa authentication login default group radius local

All users are authenticated using the Radius server (the first method). 
If the Radius server doesn’t respond, then the router’s local database
is used (the second method).

For local authentication, define the username name and password:

Router(config)#username xxx password yyy

Because we are using the list default in the aaa authentication

login command, login authentication is automatically applied for all Cisco CCNA 200-301
login connections (such as tty, vty, console and aux). Standard Kit
$469.99
Using the example above, if we do not include the local keyword, we
have:

Router(config)#aaa authentication login default group radius

If the AAA server does not reply to the authentication request, the
authentication will fail (since the router does not have an alternate
method to try).

The group keyword provides a way to group existing server hosts. The

feature allows the user to select a subset of the configured server
hosts and use them for a particular service.

Cisco CCNA 200-301

G2 Titanium Kit
Configuring Console Access Using Line Password  $1179.99

https://www.certificationkits.com/cisco-certification/ccna-security-certification-topics/ccna-security-aaa-on-cisco-routers/ccna-security-configuring-aaa/ 1/5
31/08/2021 CCNA Security: Configuring AAA – CertificationKits.com

Let’s expand the configuration example above so that console login is

only authenticated by the password set on line con 0.

The named list is CONSOLE.  There is only one authentication method

(line).

Router(config)#aaa authentication login CONSOLE line

Once a named list (in this example, CONSOLE) is created, it must be

applied to a line or interface for it to come into effect.  This is done
using the login authentication list_name command:

Router(config)#line con 0

Router(config-line)#exec-timeout 0 0

Router(config-line)#password cisco

Router(config-line)#login authentication CONSOLE

The CONSOLE list overrides the default method list default on line con
0. You need to enter the password “cisco” (configured on line con 0) to
get console access. The default list is still used on tty, vty and aux.

To have console access authenticated by a local username and

password, use the following:

Router(config)#aaa authentication login CONSOLE local

In this case, a username and password have to be configured in the

local database of the router.  The list must also be applied to the line
or interface.

To have no authentication, use the following:

Router(config)#aaa authentication login CONSOLE none

In this case, there is no authentication to get to the console access.

The list must also be applied to the line or interface.

Configuring Enable Mode Access Using External AAA Server 

You can also easily configure authentication for enable mode (privilege
15) logins.

Router(config)#aaa authentication enable default group radius

enable

Only the password will be requested, the username is $enab15$.

 Hence the username $enab15$ must be defined on the AAA server.

https://www.certificationkits.com/cisco-certification/ccna-security-certification-topics/ccna-security-aaa-on-cisco-routers/ccna-security-configuring-aaa/ 2/5
31/08/2021 CCNA Security: Configuring AAA – CertificationKits.com

Configure AAA Authorization

Authorization is the process by which you can control what a user can
and cannot do.  First define a named list of authorization methods.
 Then apply that list to one or more interfaces (except for the default
method list).  The first listed method is used. If it fails to respond, the
second one is used, and so on.

Exec Authorization 

The aaa authorization exec command determines if the user is allowed

to run an EXEC shell.  This facility might return user profile information
such as autocommand information, idle timeout, session timeout,
access-list and privilege and other per-user factors. Exec authorization
is only carried out over vty and tty lines.

The following example uses Radius Authentication for all users.

Router(config)#aaa authentication login default group radius local

All users who want to log in to the access server have to be authorized
using Radius (first method) or local database (second method).

The following example uses Radius Authentication for Exec access.

Router(config)#aaa authorization exec default group radius local

On the AAA server, Service-Type=1 (login) must be selected.

With this example, if the local keyword is not included and the AAA

server does not respond, then authorization will never be possible and
the connection will fail.

If the Radius server doesn’t reply, the enable password configured

locally on the router will have to be configured for the user to gain
access.

Configure AAA Accounting

The aaa authorization network command runs authorization for all

network-related service requests such as PPP, SLIP and ARAP.  This
section focuses on PPP, which is most commonly used.

The AAA server checks if a PPP session by the client is allowed.

 Moreover, PPP options can be requested by the client: callback,
compression, IP address, and so on.  These options have to be
configured on the user profile on the AAA server.  Moreover, for a
specific client, the AAA profile can contain idle-timeout, access-list and
other per-user attributes which will be downloaded by the Cisco IOS
software and applied for this client.

https://www.certificationkits.com/cisco-certification/ccna-security-certification-topics/ccna-security-aaa-on-cisco-routers/ccna-security-configuring-aaa/ 3/5
31/08/2021 CCNA Security: Configuring AAA – CertificationKits.com

Configuring Radius Authorization

In this scenario, the access server is used to accept PPP dialin

connections. So first we must configure Radius authentication. 

Router(config)#aaa authentication ppp default group radius local

Then we need to configure the Authorization.

Router(config)#aaa authorization network default group radius

local

For every dial-in PPP session, accounting information is sent to the

AAA server once the client is authenticated and after the disconnect
using the keyword start-stop.  So let’s configure the start and stop of
the Accounting records.

Router(config)#aaa accounting network default start-stop group

radius local

Let’s say we only want accounting information to be sent and recorded

after a client’s disconnects.  We then use the keyword stop and
configure the following line.

Router(config)#aaa accounting network default stop group radius

local

Until this point, AAA accounting provides start and stop record
support for calls that have passed user authentication.  But what
happens if authentication or PPP negotiation fails?  There is no record
of authentication. The solution is to use AAA resource failure stop
accounting command.

Router(config)#aaa accounting send stop-record authentication

failure

Then a stop record is sent to the AAA server.  But what if we want to
enable full resource accounting, which generates both a start record at
call setup and a stop record at call termination?  We would then
configure the following.

Router(config)#aaa accounting resource start-stop

With this command, a call setup and call disconnect start-stop

accounting record tracks the progress of the resource connection to
the device. A separate user authentication start-stop accounting
record tracks the user management progress. These two sets of
accounting records are interlinked using a unique session ID for the
call.

https://www.certificationkits.com/cisco-certification/ccna-security-certification-topics/ccna-security-aaa-on-cisco-routers/ccna-security-configuring-aaa/ 4/5
31/08/2021 CCNA Security: Configuring AAA – CertificationKits.com

 Shop  Extended CertificationKits is not CONNECT

CertificationKits Warranties affiliated or endorsed
in any way by Cisco    
 Why  Trade-up Program Systems Inc. Cisco,
CertificationKits? CCNA, CCENT, CCNP,
 Returns & CCSP, CCVP, CCIE are
 Cisco Resources Exchanges trademarks of Cisco
Systems Inc.

 Wall of Fame  Shipping Visit Cisco Systems Inc.

Information at: www.cisco.com.
 Blog
 Terms & Conditions

 Privacy & Security

Copyright 2017 CertificationKits.com | All Rights Reserved    

https://www.certificationkits.com/cisco-certification/ccna-security-certification-topics/ccna-security-aaa-on-cisco-routers/ccna-security-configuring-aaa/ 5/5