基础tacacs+及raduis实验
Setp 1.路由器基本配置
r1(config)#show ip int b
Interface
IP-Address OK? Method Status Protocol
FastEthernet0/0
192.168.1.254 YES manual up up
FastEthernet1/0
192.168.10.254 YES manual up up
r1(config)#exit
r1#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/53/76 ms
r1#ping 192.168.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 40/67/96 ms
r2#show ip int b
Interface
IP-Address OK? Method Status Protocol
FastEthernet0/0
192.168.1.253 YES manual up up
FastEthernet1/0
192.168.10.253 YES manual up up
r2#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 28/47/72 ms
r2#ping 192.168.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 36/42/48 ms
Setp 2.ACS基本配置
1.安装AD-benet.com
2.安装ACS(必需安装java)
3.调整IE安全级别
4.在AD中创建相应的OU、组、用户。其中hw用于raduis 、cisco用于tacacs+
5.勾选network device groups显示相应界面
6．定义tacacs+ 及raduis 客户端及服务器信息
7．AD组及ACS组关联
．8. 重新启动服务
Setp 3.测试PC基本配置
Setp 4.R1做为tacacs+客户端配置及测试
r1(config)#aaa new-model
r1(config)#tacacs-server host 192.168.10.1 key cisco
r1(config)#aaa authentication login cisco group tacacs+ local
r1(config)#line vty 0 4
r1(config-line)#login authentication cisco
r1(config-line)#exit
r1(config)#exit
r1#test aaa group tacacs+ cisco 1 new-code
Trying to authenticate with Servergroup tacacs+
Sending password
User successfully authenticated
Setp 5.R2做为raduis客户端配置及测试
r2(config)#aaa new-model
r2(config)#radius-server host 192.168.10.1 key cisco
r2(config)#aaa authentication login cisco group radius local
r2(config)#line vty 0 4
r2(config-line)#login authentication cisco
r2(config-line)#exit
r2(config)#exit
r2#test aaa group radius hw 1 new-code
Trying to authenticate with Servergroup radius
User successfully authenticated
Setp 6 ACS 用户验证及ebable密码
1．路由器启用enabe密码认证
r1(config)#aaa authentication enable default group tacacs+ enable
2．在ACS上新建用户A设置login及enable密码
3．PC登入R1测试
setp 7 级别授权
1．路由器启用级别授权及测试失败结果图
r1(config)#aaa authorization exec default group tacacs+ local
2．ACS进行级别授权
3．登入R1测试成功
Setp 8 15级别命令授权
1．R1上启用命令授权
r1(config)#aaa authorization commands 15 default group tacacs+ local
2．ACS上面没做配置之前测试结果图
3．ACS配置命令授权
4．登入测试，只能使用指定命令
Setp 10 审计
1．R1路由器审计所有级别配置
r1(config)#no aaa authorization commands 15 default group tacacs+ local
r1(config)#aaa accounting commands 15 default start-stop group tacacs+
r1(config)#aaa accounting commands 1 default start-stop group tacacs+
r1(config)#aaa accounting commands 0 default start-stop group tacacs+
r1(config)#aaa accounting commands 2 default start-stop group tacacs+
2．telnet R1测试输入部分命令
3．ACS查看审计结果图
实验总结:
R1采用ACS -tacacs+认证授权审计.
1. 认证调用AD-ciscogroup组里Cisco用户进行login认证.AD-Cisco用户enable密码实验没有做成功(在ACS上新建用户a来做enable认证),没有找出原因.
2. 在Tacacs+上对AD用户cisco进行级别和命令授权.
3. 在Tacacs+上对级别0\1\2\15级别命令进行审计
R2采用ACS-raduis认证
1. 认证周用AD-hwgroup组里hw进行login认证