benje02
asked on
AAA Authentication types and methods - Setting for Admin or general user access
I have a few questions about the authentication options (methods) available on the NAS.
1) Is arap, nasi, and ppp only used for network access, meaning that it has no effect on the user who is using the authentication but only effects whether the user can use that particular protocol to connect to the network?
2) What is the 'enable' option for? Can you give me an example?
3) When the 'default' method is used and is automatically applied to all lines, does this mean all lines or all lines and interfaces on the router? For example, if I have a 2521 with con, aux, vty, serial 0 3 (serial 3 is async for dialin), and isdn, are all these lines/interfaces under the control of the 'default' authentication unless configured otherwise?
4) Would I ever use the AAA NAS without the CSACS or similar server to control authorization for user access? I don't see much in the way of network service control on the NAS username options?
Thanks,
1) Is arap, nasi, and ppp only used for network access, meaning that it has no effect on the user who is using the authentication but only effects whether the user can use that particular protocol to connect to the network?
2) What is the 'enable' option for? Can you give me an example?
3) When the 'default' method is used and is automatically applied to all lines, does this mean all lines or all lines and interfaces on the router? For example, if I have a 2521 with con, aux, vty, serial 0 3 (serial 3 is async for dialin), and isdn, are all these lines/interfaces under the control of the 'default' authentication unless configured otherwise?
4) Would I ever use the AAA NAS without the CSACS or similar server to control authorization for user access? I don't see much in the way of network service control on the NAS username options?
Thanks,
ASKER
So authenticating a user is a two step process? One step is the layer 2 protocol they can use to access the network and the other is how their user ID will be authenticated? Are both commands below needed for a dialup user to access the NAS?
aaa authentication login default local (user ID/password part??)
aaa authentication ppp default local (network access method??)
****
What I meant by the 'enable' is its use in the authentication command, for example;
pita(config)#aaa authen enable default ?
enable Use enable password for authentication.
group Use Server-group
line Use line password for authentication.
none NO authentication.
What does this command do? This seems redundent with the login option. See below;
pita(config)#aaa authen login default ?
enable Use enable password for authentication.
group Use Server-group
krb5 Use Kerberos 5 authentication.
krb5-telnet Allow logins only if already authenticated via Kerberos V
Telnet.
line Use line password for authentication.
local Use local username authentication.
local-case Use case-sensitive local username authentication.
none NO authentication.
****
If each physical interface is associated with a line, then why are some serial interfaces not showing up in the 'show line' command? Only the serial interfaces that I can change the hardware to async show up.
aaa authentication login default local (user ID/password part??)
aaa authentication ppp default local (network access method??)
****
What I meant by the 'enable' is its use in the authentication command, for example;
pita(config)#aaa authen enable default ?
enable Use enable password for authentication.
group Use Server-group
line Use line password for authentication.
none NO authentication.
What does this command do? This seems redundent with the login option. See below;
pita(config)#aaa authen login default ?
enable Use enable password for authentication.
group Use Server-group
krb5 Use Kerberos 5 authentication.
krb5-telnet Allow logins only if already authenticated via Kerberos V
Telnet.
line Use line password for authentication.
local Use local username authentication.
local-case Use case-sensitive local username authentication.
none NO authentication.
****
If each physical interface is associated with a line, then why are some serial interfaces not showing up in the 'show line' command? Only the serial interfaces that I can change the hardware to async show up.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
when you are accessing your server via dial-up or any other means... it certainly depends on the hardware and the flexibility it provides on the particular interfaces ... and obviously your ios ...
most of the time ppp is used as protocol and two authentication procedures are supported ...
these are ...
- ppp authentication pap
and
- ppp authentication chap
or
- aaa authentication arap (if you have support of arap)
chap - challenge handshake authentication protocol is a little more complex than pap (password authentication protocol).
For home users to dial-in we prefer pap.
in cisco ... enable commands enables a certain option on a particular place ...
You need to configure authenticaion on physical interfaces like serials and bri, etc separately ... remember each physical interface is associated with a line ...
HeadOffice#sh line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
0 CTY - - - - - 0 0 0/0 -
39 TTY 115200/115200- inout - - - 0 0 0/0 Se1/6
40 TTY 115200/115200- inout - - - 0 0 0/0 Se1/7
65 AUX 115200/115200- inout - - - 2 0 470/0 -
* 66 VTY - - - - - 76 0 0/0 -
* 67 VTY - - - - - 25 0 0/0 -
* 68 VTY - - - - - 11 0 0/0 -
69 VTY - - - - - 5 0 0/0 -
70 VTY - - - - - 2 0 0/0 -
while on the vty lines you can deploy configuration in a bundle fashion... like ...
!
line vty 0 4
login sheeraz
password sheeraz
!
you can use AAA without TACACS or RADIUS on router or access server and you can define username and respective passwords ... let me show you the sample config ...
username ABC-KHI password 7 xxxxxxxxxx
aaa new-model
!
!
aaa authentication login default local
aaa authentication login NO_AUTHEN none
aaa authentication ppp default local
aaa session-id common
!
radius-server authorization permit missing Service-Type
!
try this ... because i m successfully configured usernames on my router using this ...