CloudLabBox
Try the free demo

CCNA lab 32 of 46

AAA: RADIUS and TACACS+ clients with local fallback

Move device logins to a central RADIUS server that also decides each user's privilege level, keep a local account for when the server is down, record sessions with accounting, and configure a TACACS+ client to see the fallback in action.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 32 - AAA - RADIUS and TACACS plus clients with local fallback

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 55 minutes
Nodes need
4 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

Wexford Veterinary Group is growing from two routers to twenty, and local accounts on every device are becoming unmanageable: leavers keep their access and nobody can say who changed what. The new AAA server (RADIUS, 10.32.0.100) will authenticate administrators centrally and tell each router what privilege level a user gets. A TACACS+ server is planned at 10.32.0.101 but isn't installed yet, which is a perfect chance to test the local fallback.

DeviceAddressRole
R110.32.0.1/24RADIUS client
R210.32.0.2/24TACACS+ client (server not yet available); SSH/Telnet client for tests
AAA10.32.0.100/24RADIUS server, UDP 1812/1813, secret RadSecret1

RADIUS users: alice / AlicePass1 (privilege 15), bob / BobPass1 (privilege 1). Local fallback user on both routers: admin / Cl@ssLab1 (privilege 15).

What you’ll practise

  • Compare authentication, authorisation and accounting, and RADIUS with TACACS+
  • Enable AAA safely with a local fallback account
  • Configure a RADIUS server group and method lists for VTY logins and exec authorisation
  • Test AAA with test aaa and real logins, and read the server's log
  • Configure a TACACS+ client and observe the fallback to local when the server doesn't answer

The tasks

  1. Know the three As and the two protocols
  2. Turn on AAA without locking yourself out
  3. Point R1 at the RADIUS server
  4. Use RADIUS for remote logins
  5. Record sessions with accounting
  6. Configure TACACS+ and watch the fallback

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of AAA - RADIUS and TACACS plus clients with local fallback4 nodes, 3 links. Every link is listed as text below the diagram.R1R2S1AAAeth0Gi0/2Gi0/0Gi0/0Gi0/0Gi0/1
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to S1 Gi0/0
  • R2 Gi0/0 to S1 Gi0/1
  • AAA eth0 to S1 Gi0/2
Nodes in AAA: RADIUS and TACACS+ clients with local fallback, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
S1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
AAAEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 32 - AAA - RADIUS and TACACS plus clients with local fallback and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.