- [Narrator] Here. We want to take a look
at troubleshooting Cisco iOS, AAA.
AAA is the framework that provides authentication,
authorization and accounting for our devices.
In order to protect the management plane,
we'll start out by examining
how we can troubleshoot a local database on a Cisco router.
I already have AAA configured here on this router.
And in order to enable AAA services globally,
you first have to run the command AAA new-model.
So if you're going through this on your own,
and you're not able to configure some of these options,
most likely AAA is globally disabled,
which is the default state of AAA in iOS.
Let's take a look at the configuration here
by performing a show run.
And if you notice this show run command that I'm using,
it's using a pipe to command
and it's calling out section username,
AAA line radius, and tacacs.
Now you could do just a normal show run command,
and see all of this.
But I like to use this pipe to command in order to show very
specific sections of the running configuration.
So, that's just going to make it easier when we're looking
through our output.
So I'm going to run that command, and if we're starting to
troubleshoot a local database,
the first thing we want to do is verify that we do have AAA
enabled.
And as I said,
that global command is AAA new-model.
And we do see that is the case here.
And if this were disabled,
it would say no AAA new hyphen model.
So that part of our local database is good.
Next We want to verify usernames and passwords.
If we look about halfway down our output,
we can see that we have the username,
Charles password zero Cisco,
and this is stored in the local username and password
database.
Now I made the password zero,
just so you could see exactly what the password was set to.
And obviously that's not a secure password for real world
purposes. You'd want to be much more secure than that,
but obviously with a local database,
if the combination you're trying to use,
if the username and password combination,
you're trying to log in with,
if that's not listed in the local database,
then that's not going to work.
These local credentials are also used as a backup
authentication method
when you're using tacacs plus or radius,
which we'll examine in just a bit.
By default, when we enabled AAA,
the local database is going to be referenced.
So you need at least one user configured here.
And it's also a good idea to do that,
even if you're using an external AAA server so that you have
a fail, safe method of access.
The next thing we want to check is our method lists.
A method list defines the authentication methods
that we're going to use,
be that a local database or an external server.
And, they specify the order that they will be used in.
So in this configuration output,
we can see a couple of different method lists.
We see first a method list called VTY line,
and we see another one called console line.
Notice that at the end of these method lists,
we have an order that we want to use for authentication.
With the VTY lines,
we're calling out the group tacacs group.
And so we only have the tacacs server group listed
as our method.
We don't have the local option.
If you look underneath that, the console lines,
we have both the radius group, and additionally, at the end,
we see the keyword local,
meaning that if the radius server can't be contacted,
we will fall back to the local authentication.
So if we tried to use a local username from our local
database on the VTY line group on this method list,
that's going to fail because we only have the tacacs server
group in there.
So, this is something you want to look for when you're
troubleshooting as well.
If you don't have a tacacs server in place,
as I don't here because I'm working in a lab environment,
or if your server goes offline,
then local authentication would fail in this case with the
VTY lines.
because we don't have the local option at the end of that.
If we tried to log in with the local database user to those
VTY lines, we would not be able to do that.
And the local database authentication would fail.
So that's another thing to keep an eye on.
As for local database troubleshooting,
that's really just about it.
We just want to make sure that first we have a local user
created on the router and second,
that whatever we're trying to access the VTY lines,
the console lines, whatever we're trying to access,
we want to make sure that there is a command, allowing for
local database login.
In this case,
we would want to update this particular line for our
VTY lines, we would want to add in the local key word.
And actually, let's go ahead and do that.
I'm going to go ahead and copy this.
And I'm going to go under global configuration mode.
I'll paste that in.
And I would just simply add the keyword local.
I'll append the local to the end of that.
And now that's going to allow for local authentication from
this local user database,
if we're just using the default method list,
which it's pretty common to do,
we just want to make sure that under our lines that we see
here, our console line, our VTY lines.
We want to make sure that we have the local option in there
as well, and that will allow local database access.
So that's a look at how to troubleshoot AAA with a
local database.
Next we'll look at troubleshooting tacacs plus
and radius.