Chapter 3 Lab A - Securing Administrative Access Using AAA - RPI CS

CCNA Security Chapter 3 Lab A, Securing Administrative Access Using AAA and RADIUS
Instructor Version
Topology [pic] IP Addressing Table
|Device| |IP Address|Subnet Mask |Default | |
| |Interface | | |Gateway |Switch Port |
|R1 |FA0/1 |192.168.1.|255.255.255.0|N/A |S1 FA0/5 |
| | |1 | | | |
| |S0/0/0 |10.1.1.1 |255.255.255.2|N/A |N/A |
| |(DCE) | |52 | | |
|R2 |S0/0/0 |10.1.1.2 |255.255.255.2|N/A |N/A |
| | | |52 | | |
| |S0/0/1 |10.2.2.2 |255.255.255.2|N/A |N/A |
| |(DCE) | |52 | | |
|R3 |FA0/1 |192.168.3.|255.255.255.0|N/A |S3 FA0/5 |
| | |1 | | | |
| |S0/0/1 |10.2.2.1 |255.255.255.2|N/A |N/A |
| | | |52 | | |
|PC-A |NIC |192.168.1.|255.255.255.0|192.168.1.1 |S1 FA0/6 |
| | |3 | | | |
|PC-C |NIC |192.168.3.|255.255.255.0|192.168.3.1 |S3 FA0/18 |
| | |3 | | | |
Objectives
Part 1: Basic Network Device Configuration . Configure basic settings such as host name, interface IP addresses, and
access passwords.
. Configure static routing. Part 2: Configure Local Authentication . Configure a local database user and local access for the console, vty,
and aux lines.
. Test the configuration. Part 3: Configure Local Authentication Using AAA . Configure the local user database using Cisco IOS.
. Configure AAA local authentication using Cisco IOS.
. Configure AAA local authentication using SDM.
. Test the configuration. Part 4: Configure Centralized Authentication Using AAA and RADIUS . Install a RADIUS server on a computer.
. Configure users on the RADIUS server.
. Configure AAA services on a router to access the RADIUS server for
authentication using Cisco IOS.
. Configure AAA services on a router to access the RADIUS server for
authentication using SDM.
. Test the AAA RADIUS configuration. Background
The most basic form of router access security is to create passwords for
the console, vty, and aux lines. A user is prompted for only a password
when accessing the router. Configuring a privileged EXEC mode enable
secret password further improves security, but still only a basic
password is required for each mode of access.
In addition to basic passwords, specific usernames or accounts with
varying privilege levels can be defined in the local router database that
can apply to the router as a whole. When the console, vty, or aux lines
are configured to refer to this local database, the user is prompted for
a username and a password when using any of these lines to access the
router.
Additional control over the login process can be achieved using
Authentication, Authorization, and Accounting (AAA). For basic
authentication, AAA can be configured to access the local database for
user logins, and fallback procedures can also be defined. However, this
approach is not very scalable because it must be configured on every
router. To take full advantage of AAA and achieve maximum scalability, it
is used in conjunction with an external TACACS+ or RADIUS server
database. When a user attempts to login, the router references the
external server database to verify that the user is logging in with a
valid username and password.
In this lab, you build a multi-router network and configure the routers
and hosts. You use various CLI commands and SDM tools to configure
routers with basic local authentication and local authentication using
AAA. You install RADIUS software on an external computer and use AAA to
authenticate users with the RADIUS server.
Note: The router commands and output in this lab are from a Cisco 1841
with Cisco IOS Release 12.4(20)T (Advance IP image). Other routers and
Cisco IOS versions can be used. See the Router Interface Summary table at
the end of the lab to determine which interface identifiers to use based
on the equipment in the lab. Depending on the router model and Cisco IOS
version, the commands available and output produced might vary from what
is shown in this lab.
Note: Make sure that the routers and switches have been erased and have
no startup configurations.
Instructor Note: Instructions for erasing both the switch and router are
provided in the Lab Manual, located on Academy Connection in the Tools
section.
Required Resources . 3 routers with SDM 2.5 installed (Cisco 1841 with Cisco IOS Release
12.4(20)T1 or comparable)
. 2 switches (Cisco 2960 or comparable)
. PC-A: Windows XP, Vista, or Windows Server with RADIUS server
software available
. PC-C: Windows XP or Vista
. Serial and Ethernet cables as shown in the topology
. Rollover cables to configure the routers via the console
Instructor Note:
This lab is divided into five parts. Each part can be administered
individually or in combination with others as time permits. The main goal
is to configure various types of user access authentication, from basic
local access validation to the use of AAA and then AAA with an external
RADIUS server. Both Cisco IOS and SDM methods of configuring the router are
covered. R1 and R3 are on separate networks and communicate through R2,
which simulates an ISP type situation. Students can work in teams of two
for router authentication configuration, one person configuring R1 and the
other R3. Although switches are shown in the topology, students can omit the switches
and use crossover cables between the PCs and routers R1 and R3. The basic running configs for all three routers are captured after Part 1
and Part 2 of the lab are completed. The running config commands that are
added to R1 and R3 in Parts 3 and 4 are captured and listed separately. All
configs are found at the end of the lab. Part 1: Basic Network Device Configuration
In Part 1 of this lab, you set up the network topology and configure
basic settings, such as the interface IP addresses, static routing,
device access, and passwords.
All steps should be performed on routers R1 and R3. Only steps 1, 2, 3
and 6 need to be performed on R2. The procedure for R1 is shown here as
an example.
Step 1: Cable the network as shown in the topology.
Attach the devices shown in the topology diagram, and cable as necessary.
Step 2: Configure basic settings for each router.
a. Configure host names as shown in the topology.
b. Configure the interface IP addresses as shown in the IP addressing
table.
c. Configure a clock rate for the routers with a DCE serial cable attached
to their serial interface. R1(config)#interface S0/0/0
R1(config-if)#clock rate 64000 d. To prevent the router from attempting to translate incorrectly entered
commands as though they were host names, disable DNS lookup. R1(config)#no ip domain-lookup Step 3: Configure static routing on the routers.
a. Configure a static default route from R1 to R2 and from R3 to R2.
e. Configure a static route from R2 to the R1 LAN and from R2 to the R3
LAN.
Step 4: Configure PC host IP settings.
Configure a static IP address, subnet mask, and default gateway for PC-
A and PC-C, as shown in the IP addressing table.
Step 5: Verify connectivity between PC-A and R3.
a. Ping from R1 to R3.
Were the ping results successful? Yes
If the pings are not successful, troubleshoot the basic device
configurations before continuing.
a. Ping from PC-A on the R1 LAN to PC-C on the R3 LAN.
Were the ping results successful? Yes
If the pings are not successful, troubleshoot the basic device
configurations before continuing.
Note: If you can ping from PC-A to PC-C, you have demonstrated that
static routing is configured and functioning correctly. If you cannot
ping but the device interfaces are up and IP addresses are correct,
use the show run and show ip route commands to help identify routing
protocol-related problems.
Step 6: Save the basic running configuration for each router.
Use the Transfer > Capture text option in HyperTerminal or some other
method to capture the running configs for each router. Save the three
files so that they can be used to restore configs later in the lab.
Step 7: Configure and encrypt passwords on R1 and R3. Note: Passwords in this task are set to a minimum of 10 characters but
are relatively simple for the benefit of performing the lab. More
complex passwords are recommended in a production network. For this step, configure the same settings for R1 and R3. Router R1 is
shown here as an example.
a. Configure a minimum password length.
Use the security passwords command to set a minimum password length
of 10 characters. R1(config)#security passwords min-length 10 b. Configure the enable secret password on both routers. R1(config)#enable secret cisco12345 c. Configure the basic console, auxiliary port, and vty lines.
d. Configure a console password and enable login for router R1. For
additional security, the exec-timeout command causes the line to log out
after 5 minutes of inactivity. The logging synchronous command prevents
console messages from interrupting command entry.