AAA using TACACS+ and GNS3 example

PART I: AAA using TACACS+ and GNS3 example

First of all, you have to install Tacacs.net.

Link: http://www.tacacs.net/download.asp

I have installed this program on my computer and it will be linked to GNS3 by using a loopback interface (IP address: 10.0.2.2/30).

During the installation, you must supply a shared secret password to encrypt communications between the TACACS+ server and the network element:

After the installation has finished, go to start menu (if you use Windows XP) and edit the files inside the Configuracion folder:

You have to edit 4 files:

authentication
authorization
tacplus
clients

NOTE As you can see, the clients file is not showed in the image. This is because it is a hidden file, so you have to make changes in your operating system.

I recommend you to make a backup of this folder before editing them.

You can open every file with notepad, delete their text and do a copy-paste from my configuration examples:

.............................................................................................................................................................................................................................................

authentication file

..............................................................................................................................................................................................................................................

<?xml version="1.0" encoding="utf-8"?>

<Name>Privileged</Name>

<Users>

<User>

<Name>juantron</Name>

</User>

</Users>

</UserGroup>

<Name>No_privileges</Name>

<Users>

<User>

<Name>martin</Name>

</User>

</Users>

</UserGroup>

</UserGroups>

</Authentication>

..............................................................................................................................................................................................................................................

authorization file

..............................................................................................................................................................................................................................................

<?xml version="1.0" encoding="utf-8"?>

<UserGroup>Privileged</UserGroup>

</UserGroups>

<ClientGroup>INTERNAL</ClientGroup>

</ClientGroups>

</AutoExec>

<Shell>

</Shell>

</Authorization>

<UserGroup>No_privileges</UserGroup>

</UserGroups>

<ClientGroup>INTERNAL</ClientGroup>

</ClientGroups>

</AutoExec>

<Shell>

<Permit>telnet .*</Permit>

<Permit>enable</Permit>

</Shell>

</Authorization>

</Authorizations>

..............................................................................................................................................................................................................................................

clients file

..............................................................................................................................................................................................................................................

<?xml version="1.0" encoding="UTF-8"?>

<!--This is the configuration file for TACACS+ clients. A TACACS+ client, as defined by the RFC, is the client that is

making a request to the TACACS+ server such as a router, switch, or firewall-->

</Clients>

</ClientGroup>

</ClientGroups>

</Clients>

..............................................................................................................................................................................................................................................

NOTE if the ip address of your loopback interface has a different value from these, please add them to this file.

..............................................................................................................................................................................................................................................

tacplus file

..............................................................................................................................................................................................................................................

<?xml version="1.0" encoding="UTF-8"?>

<!-- This is the global configuration file for the TACACS+ Server

If you have multiple NICs or IP addresses on this system (including virtual adapters like VMWare or VPN), the server will resolve to the first IP address listed in Ipconfig.

If you have multiple physical or virtual NICs, you will need to manually hard code the IP address in <LocalIP>, disconnect any open sessions, and restart the service. You will also need to use the -s switch in TACTest.

The following logging levels are available: Alert, Critical, Error, Warning, Notice, Information, and Debug.

Debug generates the most information, and Alert generates the least amount of logging information.

-->

<DisabledPrompt>This account has been disabled</DisabledPrompt>

<PasswordPrompt>Password: </PasswordPrompt>

<UserNamePrompt>Username: </UserNamePrompt>

<ExpiredPasswordPrompt>The password for this account has expired</ExpiredPasswordPrompt>

<IncorrectPasswordPrompt>Incorrect Password</IncorrectPasswordPrompt>

<IncorrectUserOrPasswordPrompt>Invalid username or incorrect password</IncorrectUserOrPasswordPrompt>

</Server>

..............................................................................................................................................................................................................................................