MicroNugget: AAA, TACACS+, and SSH

In this video, Keith Barker covers how to set up a router to authenticate users and restrict access to the secure shell (SSH). He begins with a router that has no security in place and uses TACACS+ to pair it with an AAA server.

Keith covers a lot of ground in this short video, walking you through locking down an unsecured router using a AAA server and TACACS+. He uses a straightforward checklist with eight simple steps, beginning with enabling secret on the router and then moving on to create a local user just in case a AAA server can’t be reached. The next steps are to set the domain name and create an RSA public/private key pair to establish SSH access. All of this lays the groundwork so you can enable the router to access a triple-A server. You’ll specify which AAA server you want to use, along with the key, then move on to select a default method for authenticating users.

Start learning with CBT Nuggets:

[mr.snuggles]

Wow, that was fast. I learned the "!" for comments and the "Control-plane" option from the video.

[deanvm]

I can see your smiles in your talking. Makes me think your life has been good doing what you love to do. --- From Philippines

[KeithBarker]

I use Camtasia for most of my recordings. I used a live Cisco ACS server for TACACS+, and a 12.4 version of IOS for the router.

Thanks for watching-

Keith Barker

[KeithBarker]

You are very welcome. Thanks for watching, and for your comments.

Keith Barker

[KeithBarker]

Thanks for the post. Glad you enjoyed the "meal".

Best wishes,

Keith Barker

[cbtnuggets]

Sounds good! Let us know how the setup goes and if you have any questions.

[obione]

wow.keith barker now i see y u wrote th 640-554.this is amazing.thanks alot

[danieleberhardt]

as always, amazing video with clear explanation and to the point! THANK YOU CBT NUGGETS!!

[NotAMystery]

No soup or desert. That was all main course!! Awesome!

[gashone]

holly snickers, in 5 min. Thanks Keith

[futurDaFutur]

Keith, you're the boss! Cheers for all the good work !

[swizkniv]

Love all your video tutorials - keep'em coming!..Cheers

[pmanolak]

Hi Keith, I am trying in packet tracer to use Tacacs+ authentication for switch, but I am stuck on which IP address should I use in aaa configuration on server. I am trying to assign an IP address to default vlan, but no luck.

[MrPhobos]

! Tell to the devices that no management protocols except for SSH are allowed
- control-plane host -
- management-interface FastEthernet 2/0 allow ssh -

command control-plane host is missing in my switches; any ideas on another command ?
...btw... GREAT video! I'm using as inspiration for my work!

[Marvin]

I love your videos but you went to fast. Can you please slow and doing by step by step.

[cinqueottavi]

Thank you. And how do you write on the desktop? Do you have a special hardware?

[techcambokh]

How about the configuration on server tac_plus.conf? May you please showing configuration on server!

[cinqueottavi]

which software has been used to do these lessons? Thanks

[dragonbeardable]

Is this how to do your lab "AAA and NTP Tshoot 2020-05-16" ?

[jeffstrehlow]

could you connect multiple ps4's to a AAA server?