AAA with local users, TACACS+, and RADIUS

Before central testing, have the instructor show ISE1's enabled services, R1 /32 definition, netop policy, privilege result, explicit reject rule and accounting views through its trusted private GUI. Do not infer these from an IP address or successful ping. If any prerequisite is missing, select the local/paper alternative.

What you should see

The server-dependent path is available only after the instructor confirms the complete fixture; no success is invented.

Why this step matters

Server provisioning is outside this CCNA client exercise but its exact required behavior cannot be left implicit.

In GNS3, right-click R1 and choose Console before typing. Start at > or # on the fresh autonomous router. Check the VTY inventory gate before proceeding. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

enable
show line
configure terminal
hostname R1
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
end

What you should see

R1 should own .1 and the line inventory must match the setup profile.

Why this step matters

The server recognizes the client's source address, so this address is part of the AAA contract.

In GNS3, right-click Admin1 and choose Console before typing. At its Linux shell, configure the private interface only. Use the desktop browser later for the trusted ISE GUI. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
ping -c 3 192.0.2.1
ping -c 3 192.0.2.20

What you should see

Both paths should be reachable; service and policy checks remain separate.

Why this step matters

A ping result cannot prove that a server recognizes R1 or accepts a user.

In GNS3, right-click R1 and choose Console before typing. Start at #. Replace BREAKGLASS_SECRET privately, and retain this Console throughout. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
username breakglass privilege 15 algorithm-type scrypt secret BREAKGLASS_SECRET
ip domain name lab.test
crypto key generate rsa modulus 3072
ip ssh version 2
aaa new-model
aaa authentication login CONSOLE_LOCAL local
line console 0
login authentication CONSOLE_LOCAL
end

What you should see

The local recovery identity and named Console authentication should be configured.

Why this step matters

Central method changes later do not replace the Console's deliberate local-only path.

In GNS3, right-click R1 and choose Console before typing. Start at #. This is the known baseline used again during rollback. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
aaa authentication login LOCAL_LOGIN local
aaa authorization exec LOCAL_EXEC local
line vty 0 4
login authentication LOCAL_LOGIN
authorization exec LOCAL_EXEC
transport input ssh
exec-timeout 5 0
line vty 5 15
transport input none
end

What you should see

The declared remote range should use local authentication and authorization.

Why this step matters

Defining a method list is not enough; the line needs the intended binding.

In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, verify R1's host identity and enter the local secret only at the prompt. The next two commands run inside IOS. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

ssh breakglass@192.0.2.1
show privilege
exit

What you should see

The local account should work before any central lists are applied.

Why this step matters

Do not proceed to central testing with an unverified recovery credential.

In GNS3, right-click R1 and choose Console before typing. Start at # in the Console. Replace TAC_KEY with the same private value configured for R1 on ISE1. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
tacacs server TAC1
address ipv4 192.0.2.20
key TAC_KEY
exit
aaa group server tacacs+ TAC_GRP
server name TAC1
exit
ip tacacs source-interface GigabitEthernet1
end

What you should see

The server object, group and source interface should agree with the server contract.

Why this step matters

A key or source mismatch is a protocol relationship failure, not necessarily a bad netop password.

In GNS3, right-click R1 and choose Console before typing. Start at #. Replace RAD_KEY privately; this is separate from TAC_KEY. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
radius server RAD1
address ipv4 192.0.2.20 auth-port 1812 acct-port 1813
key RAD_KEY
exit
aaa group server radius RAD_GRP
server name RAD1
exit
ip radius source-interface GigabitEthernet1
end

What you should see

RADIUS has its own named server and group even though ISE1 is the same appliance.

Why this step matters

A working TACACS+ service does not validate RADIUS ports, secret or attributes.

In GNS3, right-click R1 and choose Console before typing. Start at #. These named lists do not affect the local Console and are not active on VTYs until explicitly attached. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
aaa authentication login TAC_LOGIN group TAC_GRP local
aaa authorization exec TAC_EXEC group TAC_GRP local
aaa accounting exec TAC_ACCT start-stop group TAC_GRP
aaa authentication login RAD_LOGIN group RAD_GRP local
aaa authorization exec RAD_EXEC group RAD_GRP local
aaa accounting exec RAD_ACCT start-stop group RAD_GRP
end

What you should see

Six named policies should exist with distinct login, authorization and accounting roles.

Why this step matters

Authentication fallback alone does not guarantee that shell authorization and accounting behave as intended.

In GNS3, right-click R1 and choose Console before typing. At # apply the first six lines. Then right-click Admin1 > Console and run the remaining lines from its shell; show commands and exit run inside the successful IOS session. Use netop's central secret. The final breakglass attempt must be rejected; allow one password prompt only. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
line vty 0 4
login authentication TAC_LOGIN
authorization exec TAC_EXEC
accounting exec TAC_ACCT
end
ssh netop@192.0.2.1
show privilege
show clock
exit
ssh -o NumberOfPasswordPrompts=1 breakglass@192.0.2.1

What you should see

Require netop success at privilege 1, breakglass rejection and corresponding ISE1 TACACS authentication/authorization and start/stop records.

Why this step matters

A missing or wrong server result is a failed test to investigate, not permission to weaken the policy.

In GNS3, right-click R1 and choose Console before typing. At # apply the first six lines, then open Admin1's Console for the remaining commands exactly as in the TACACS+ test. Use the central netop secret and only one breakglass attempt. Inspect the RADIUS access and accounting records, not the previous TACACS results. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
line vty 0 4
login authentication RAD_LOGIN
authorization exec RAD_EXEC
accounting exec RAD_ACCT
end
ssh netop@192.0.2.1
show privilege
show clock
exit
ssh -o NumberOfPasswordPrompts=1 breakglass@192.0.2.1

What you should see

Require a RADIUS accept with the intended privilege, an explicit reject and actual session accounting evidence.

Why this step matters

The same username and appliance address do not make the two protocol configurations interchangeable.

In GNS3, right-click Admin1 and choose Console before typing. Close remote sessions. In GNS3 right-click only the ISE1 GigabitEthernet0--Switch1 Ethernet2 link and select Suspend; leave both VMs and R1's Console running. At Admin1's Console run these commands and wait for the actual AAA timeout without repeated attempts. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

ssh breakglass@192.0.2.1
show privilege
exit

What you should see

After the server method times out, local authentication and EXEC authorization should allow breakglass. Record actual delay and failure if it does not; remote accounting may be missing.

Why this step matters

This is server unavailability, unlike the earlier definitive reject. No password or policy is changed to manufacture the difference.

In GNS3, right-click Admin1 and choose Console before typing. In GNS3 resume the same suspended ISE1 link. Open Admin1's Console and wait for actual service reachability. Run the listed tests, then inspect ISE1's new RADIUS results and accounting using its trusted private GUI. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

ssh netop@192.0.2.1
show privilege
exit
ssh -o NumberOfPasswordPrompts=1 breakglass@192.0.2.1

What you should see

Central netop access should recover and breakglass should again be rejected remotely; do not assume outage accounting was recovered.

Why this step matters

Restoration must reestablish the normal policy decision, not leave the device on unintended local-only behavior.

In GNS3, right-click R1 and choose Console before typing. At # in the retained Console, restore the original VTY lists. Then close GUI sessions, stop the isolated project using normal appliance shutdown procedures and revert disposable snapshots; do not hard-power off a retained ISE database. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.

configure terminal
line vty 0 4
login authentication LOCAL_LOGIN
authorization exec LOCAL_EXEC
no accounting exec RAD_ACCT
end
show running-config | section line vty

What you should see

The Console remains local-only and VTYs return to the known local baseline before the disposable credentials are retired.

Why this step matters

A rollback names the actual prior policy; it does not disable AAA globally or bypass authentication.