CloudLabBox
Try the free demo

CCNP ENCOR lab 28 of 36

Device access: lines, local users, SSH and AAA with RADIUS

Replace shared passwords on Fernhill's Bristol router with named users, SSH only and login protection, then centralise authentication and authorisation on a RADIUS server with a safe local fallback and accounting.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 28 - Device access - lines local users SSH and AAA with RADIUS

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
3 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

An audit of Fernhill Freight's Bristol router (R1) found everything an auditor hates: one shared Telnet password (cisco) for everybody, an enable password in clear text, no record of who logged in, and no protection against password guessing. The new policy:

  • Named accounts only, stored as strong hashes; SSH version 2 only; idle sessions closed after 10 minutes.
  • Logins are checked by the NOC's RADIUS server; the RADIUS server also decides each user's privilege level and receives accounting records.
  • If the RADIUS server can't be reached, a local emergency account still works. The console must never depend on the network.
  • Repeated failed logins block further attempts for two minutes.

The NOC workstation (NMS, 10.10.50.100) runs a small RADIUS server for the lab (/opt/lab/radius_server.py) with two users: alice / Str0ngPass9 (network admin, privilege 15) and bob / Helpdesk42 (help desk, privilege 1). Shared secret: Fh-Radius-2026. Local emergency account: admin / Fh-Adm1n-Local.

DeviceInterfaceAddress
R1Gi0/0 / Lo010.0.12.1/30 / 10.255.0.1
R2Gi0/0 / Gi0/110.0.12.2/30 / 10.10.50.1/24
NMSeth010.10.50.100/24 (desktop: Applications → System Tools → MATE Terminal)

Topology: R1 — R2 — NMS. OSPF connects the routers; NMS reaches 10.0.0.0/8 through R2.

What you’ll practise

  • Secure the console and VTY lines with local users, scrypt secrets, timeouts and SSH version 2
  • Protect logins with login block-for and a minimum password length
  • Explain AAA method lists and configure authentication, exec authorisation and accounting with RADIUS
  • Keep a local fallback and a safe console method so a server failure can't lock you out
  • Verify with test aaa, show aaa servers, SSH logins and the RADIUS server's log

The tasks

  1. Clean up the local credentials
  2. SSH only, with sensible line settings
  3. Start the RADIUS server
  4. Point R1 at RADIUS and test it
  5. Build the method lists
  6. Log in as each user
  7. Prove the fallback

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Device access - lines local users SSH and AAA with RADIUS3 nodes, 2 links. Every link is listed as text below the diagram.R1R2NMSGi0/0Gi0/0Gi0/1eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R2 Gi0/1 to NMS eth0
Nodes in Device access: lines, local users, SSH and AAA with RADIUS, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
NMSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 28 - Device access - lines local users SSH and AAA with RADIUS and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.