交换路由CCIE之路――AAA实验

1、实验 AAA技术一实验拓扑ACS服务器二实验要求公司希望对公司所有设备执行集中化的用户认证，根据不同级别的管理员，授予不同的资源访问。Ø 1.属于admin组的成员拥有最高执行权力Ø 2.属于guest组的成员只能使用show 进行简单查看三实验内容客服端为R6，用户用R5。配置r5(config#int s0r5(config-if#clock rate 64000r5(config-if#no shur6interface Serial0Type escape sequence to abort.!Success rate is 100 percent (5/5, ro

2、und-trip min/avg/max = 32/32/32 msR6为开启AAAR6>R6>en% No password set发现只能进入用户模式，这时做如下配置R6(config#lin vty 0 4R6(config-line#privilege level 15再次登录R6#发现可以直接进特权模式了。R6开启AAA,并在服务器建立2个用户名user1， user2密码均为cisco,不做任何其他设置。R6配置如下：R6(config#aaa new-model /开启AAAR6(config#aaa authentication login bluefox grou

3、p tacacs+ local /登录时采用tacacs+,若失效则采用本地数据库R6(config#username user1 password cisco /建立本地数据库R6(config#lin vty 0 4R6(config-line# login authentication bluefox /在远程登录时运用认证R5再次远程登录Username: user1Password: R6# Username: user2Password: R6#说明只要有正确的用户名正确的密码就能登录现在为了实现实验要求，我建立2个组，user1 ，user2 为admin组，user3 user

4、4为guest组，在admin组我不做任何设置，在guest组设置命名只有show的内容允许。R6做如下配置R6(config#aaa authorization commands 0 bluefox group tacacs+ R6(config#aaa authorization commands 1 bluefox group tacacs+ R6(config#aaa authorization commands 2 bluefox group tacacs+ R6(config#aaa authorization commands 3 bluefox group tacacs+ R6

5、(config#aaa authorization commands 4 bluefox group tacacs+ R6(config#aaa authorization commands 5 bluefox group tacacs+ R6(config#aaa authorization commands 6 bluefox group tacacs+ R6(config#aaa authorization commands 7 bluefox group tacacs+ R6(config#aaa authorization commands 8 bluefox group tacac

6、s+ R6(config#aaa authorization commands 9 bluefox group tacacs+ R6(config#aaa authorization commands 10 bluefox group tacacs+ R6(config#aaa authorization commands 11 bluefox group tacacs+ R6(config#aaa authorization commands 12 bluefox group tacacs+ R6(config#aaa authorization commands 13 bluefox gr

7、oup tacacs+ R6(config#aaa authorization commands 14 bluefox group tacacs+ R6(config#aaa authorization commands 15 bluefox group tacacs+R6(config-line#authorization commands 0 bluefox R6(config-line#authorization commands 1 bluefox R6(config-line#authorization commands 2 bluefox R6(config-line#author

8、ization commands 3 bluefox R6(config-line#authorization commands 4 bluefox R6(config-line#authorization commands 5 bluefox R6(config-line#authorization commands 6 bluefox R6(config-line#authorization commands 7 bluefox R6(config-line#authorization commands 8 bluefox R6(config-line#authorization comm

9、ands 9 bluefox R6(config-line#authorization commands 10 bluefox R6(config-line#authorization commands 11 bluefox R6(config-line#authorization commands 12 bluefox R6(config-line#authorization commands 13 bluefox R6(config-line#authorization commands 14 bluefox R6(config-line#authorization commands 15

10、 bluefox现在再次登录Username: user1Password: R6#R6#show runCommand authorization failed.发现用没做任何设置的用户组成员，什么都不能干，不满足要求。查看原因，因为R6启用了命令授权，但组admin默认授权命令是全部拒绝，所以要改为全允许才行，这时候再试一次User Access VerificationUsername: user1Password: R6#show runBuilding configuration.用guest组成员登录User Access VerificationUsername: user3Password: R6#show privilege Current privilege level is 15R6#show runBuilding config