Cisco AAA Radius Server Configuration on GNS3



In this tutorial I will explain shortly what is AAA and how to enable AAA on a Cisco router and some basic AAA authentication configuration. Please note that this is only about the router end configuration.
What is AAA?
AAA services are like a security package, which provides a massive security to a device.
AAA stands for Authentication, authorization and accounting.

Authentication: 
Validate who you are, instead of enable secret now u have username and password to login.
Authorization:  
Tells you what you can do. Define different user’s privileges and access levels. 
Accounting:  
Use for monitoring and for keeping history. Tracks what you did on a device.

By using AAA u can control PPP links, aux port, dialup modem, VTY, VPN access anything that required password.
AAA Protocols:
There are two famous protocols use for AAA services that are
ü  Radius
ü  Tacacs
Radius server is open standard where as Tacacs+ server is Cisco proprietary. You can also use the Microsoft Active directory services as AAA server.  

For AAA demonstration I have created the following topology in which R1 is enabled for AAA authentication. In first step I have created an AAA authentication group named “viki-group” in which I define server-group priority and  radius server address which is not present here but due to priority router first look for an Radius server and then authenticate user from their local database . Second step is enable AAA for your required service in my case I enabled it for VTY access.  

R1 config:

R1(config)#int s1/0
R1(config-if)#ip add 1.1.1.1 255.255.255.0
R1(config-if)#no shut
R1(config)#aaa new-model
R1(config)#aaa authentication login viki-login group radius local                 (Server priority)
R1(config)#radius-server host 192.168.1.1 key password                          (Server Address)
R1(config)#username viki password cisco                                               (Local user Database)

R1(config)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login authentication viki-login                       (enable AAA for Telnet access)
R1(config-line)#ex

Radious Configuration:

Radious(config)#int s1/0
Radious(config-if)#ip add
Radious(config-if)#ip address 1.1.1.2 255.255.255.0
Radious(config-if)#no shu
Radious(config-if)#no shutdown

For verification telnet to 1.1.1.1 and now router authenticate you with a user name and password.



UA-23728446-1