On the Cisco atheists serve we need to go to network configuration and add a triple a client.
In other words we need to add the Cisco router we need to specify the host name of the Rodda.
Call throttle one.
And then we need to specify the IP address of the Rodda tend to add 1 to 1 to 1.
The key that we used
was Cisco shown over here.
So we need to specify Siska is the key and we are going to theni Kate in the example using Takacs Siska
us.
There are other options such as radius but will use techniques in this example and I'm going to click
submit and apply to apply that configuration
once again under uses.
We only have a use of called admen.
So now let's test whether we can log back in to one as David.
All into David and the password.
Notice that vindication has failed on the Tech X server going to reports and activity.
We can look at failed attempts and we can see here that we've got a failed attempt for David external
database use invalid or bad password a look in his memory use and a memory Posawatz Siska I'll refresh
the logged in failures and notice Mary has failed.
But if we log in as admin Cisco the offene cation passes and we are able to access the Rodda show run
pipe.
Include user shows us that we have a user davit and a user Mary with the relevant passwords but the
local username and password database is only used if the tech X server is not available.
So as an example if I stop the Tech X service on the Tech X server and exit out of the router and then
log in as David I can access the broader so I can only use the local username and password database
if the tactics server is down.
If however the Tech X server is up I'll start the service again.
If I try and log back in as David notice authentication has failed and once again on the Tech X server
we can see that David failed the authentication.
I can however log back in as admin.
Now what's really nice about this is that you can create centralized user accounts so I could try to
use a call use of one set to password
and click submit.
So when I look at the available users I now have a user called use a one and without making any configuration
changes on the router.
We can log in as use of one so that to use it doesn't exist in the local rodder configuration but exists
on the X server.
If I want to I can disable the user account so use one is now disabled.
Back on the road if we try and log in as use one indication has failed and once again looking at the
reports on the server we can see failed attempts to use a one account is disabled.
So when they try to access this device TTB Why 0.
In other words the console they logon has failed if they try to access that router remotely so they
try to tell it to the Rhondda and logon as use a one education has failed and refreshing the information
the tech X-server we can see that use of one has failed the authentication account is disabled and they
try to access TDY 98.
In other words one of the V-twin one lines on the router we're getting a lot of central information
from the Esaias server.
What we can also do is enable some debugging
So logon as admin and then we can use command such as debug Takacs.
And I'll just enable all of that and debug Triple-A.
And in this case will enable the indication.
So when the user tries to access the router we can see quite a bit of information so Triple-A authentication
log in the users trying to log in we using the default method.
Note on the V-twin lines
no authentication methods have been set.
It's inheriting the default method.
So default is being used to authentication start Pech it create it.
We try to get a response from the user.
In this case the user took too long so let's try that again.
I'll put in the User name of use a one so we can see now it's asking for a password.
And notice the response failed the server 10 1 1 1 has rejected that user name.
So let's put some spaces then log in with the admin user logon succeeded.
So in this case we received a response of pass authentication succeeded so go through the full process
again
telnet to the Rodda default list is being used.
We are asking for the user account so that admin asking for the password
authentication succeeded.
So we can see what's taking place in the background here.
Triple-A syndication is being used
the Rada is told by the police of it to ask the use of a user name and then to ask them for their password
and then to tell the user that they succeeded the authentication and can logon.
So that's an example of basic Triple-A if any nation on Rotto one.
Now there are two ways to set this up.
We are using the older method at the moment because these routers don't support the new method where
we create a group so I'll show you that in a moment.
But before I do that I'll copy this configuration to rockety to show you that we can create a central
authentication server
at the moment we haven't configured router to on the server so we can still log in as David so under
network configuration we need to create an entry for rodded too.
So I wrote it to tend at 1 to 2 or.
Is the IP address of Arata show IP interface brief.
So there's the IP address key used is going to be Cisco and I'm going to click submit and apply so that
road is now being configured
so try and log in as David authentication has filed try and logon as admin authentication ponces.
We've now configured to routers with centralized authentication under the reports failed attempts.
We can see that David failed the syndication attempt on the second router.
So we are seeing information for both router 2 and Rato one that's configurator sorry I'll take the
configuration and paste it into router 3
on broader three.
We can log in as davit.
So that works but we can log in as admin because we still need to configure the server
so Beck couldn't ACX at Rodda 3 IP addresses tendered wandered 1 to 2 3 password keys Cisco click submit.
The router is not configured So previously we couldn't log in as admin but now hopefully we should be
able to let's try again.
David failed there.
Addleman so Edman Cisco works
David Cisco doesn't work.
Because the rod is not communicating with a yes but admin Cisco does.
So we've now got three routers configured to communicate with an AC s server.
These routers are using an older version of iOS they're using version 12 to 4.
And that version doesn't support tech X server groups which is the new way of doing things and is what
you need to know for the exam.