CCNP ENARSI lab 25 of 35
Device access with AAA: TACACS+, RADIUS and the local database
Move two routers' administrator logins from shared passwords to a real TACACS+ and RADIUS server: authenticate, authorise exec sessions and individual commands, account for what people did, and keep a local fallback that works when the server is down.
Run this lab
It needs Lite: its 3 nodes are set to 3 vCPU and 2,048 MB in total. That fits the free demo too.
In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 25 - Device access with AAA - TACACS plus RADIUS and the local database
- Level
- Advanced
- Time
- About 85 minutes
- Nodes need
- 3 vCPU, 2,048 MB
- Smallest plan
- Lite
The scenario
At Stonechat Insurance every engineer logs in to the routers with one shared VTY password, so nobody knows who changed what, and when someone leaves the password has to change everywhere. Security has installed an AAA server (SRV) that speaks both TACACS+ and RADIUS. You'll put the branch router R1 on TACACS+ (which can authorise individual commands) and the core router R2 on RADIUS (which the company also uses for VPN users), keep a local fallback account on both, and prove that the server records who did what.
| Device | Interface | Address | Notes |
|---|---|---|---|
| R1 | Gi0/0 / Gi0/1 | 10.0.12.1/24 / 10.25.100.1/24 | branch router, TACACS+ client |
| R2 | Gi0/0 | 10.0.12.2/24 | core router, RADIUS client |
| SRV | eth0 | 10.25.100.100/24 | AAA server (TACACS+ TCP 49, RADIUS UDP 1812/1813) |
| On the server | Password | Privilege it returns | What it may do |
|---|---|---|---|
| alice | Alice-Pass1 | 15 | everything |
| bob | Bob-Pass1 | 1 | only show, ping, traceroute, terminal, exit (TACACS+ command authorisation) |
TACACS+ key Tac-Key-2026; RADIUS key Rad-Key-2026. Both routers already have the local account localadmin / Local-Pass1 (privilege 15) and the enable secret Enable-Pass1.
What you’ll practise
- Enable AAA with named method lists and apply them to VTY and console lines
- Configure TACACS+ and RADIUS servers and server groups
- Authorise exec sessions and per-command privilege with TACACS+, and exec privilege with RADIUS attributes
- Account for exec sessions and commands, and read the server's records
- Prove the local fallback works, and troubleshoot with test aaa and show commands
The tasks
- See the problem
- Turn on AAA safely on R1
- Define the TACACS+ server and lists on R1
- Log in as alice and bob
- RADIUS on R2
- Prove the fallback
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- R2
Gi0/0to R1Gi0/0 - R1
Gi0/1to SRVeth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| R1 | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| R2 | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| SRV | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
CCNP ENARSI 300-410 guided labs.Open
25 - Device access with AAA - TACACS plus RADIUS and the local databaseand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More CCNP ENARSI labs
Related labs in other courses
CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.