51CTO下载-在Cisco路由器上配置AAA本地认证.doc

实验过程：第一步 R1、R2预配置R1(config)#int lo0R1(config-if)#ip add 1.1.1.1 255.255.255.0R1(config-if)#int f0/0R1(config-if)#ip add 192.168.0.1 255.255.255.0R1(config-if)#no shR1(config-if)#exitR2(config)#int lo0R2(config-if)#ip add 2.2.2.2 255.255.255.0R2(config-if)#int f0/0R2(config-if)#ip add 192.168.0.2 255.255.255.0R2(config-if)#no shR2(config-if)#exit第二步 在R1上配置AAA认证R1(config)#aaa new-model/ 启动AAAR1(config)#aaa authentication login default local/ 配置任何登陆采用Local本地用户数据库R1(config)#username norvel password norvel/ 配置一个本地用户名和密码R1(config)#end第三步 在R1上进行Console登陆的测试R1#debug aaa authenticationAAA Authentication debugging is onR1#exit R1 con0 is now available Press RETURN to get started. User Access VerificationUsername:*Jun 26 05:52:53.951: AAA/BIND(00000003): Bind i/f *Jun 26 05:52:53.955: AAA/AUTHEN/LOGIN (00000003): Pick method list defaultUsername: norvel/ 在提示输入用户名的地方输入刚才配置的本地用户名Password:R1enR1#*Jun 26 05:53:58.767: AAA: parse name=tty0 idb type=-1 tty=-1*Jun 26 05:53:58.767: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0*Jun 26 05:53:58.767: AAA/MEMORY: create_user (0x664EE3D4) user=norvel ruser=NULL ds0=0 port=tty0 rem_addr=async authen_type=ASCII service=ENABLE priv=15 initial_task_id=0, vrf= (id=0)*Jun 26 05:53:58.771: AAA/AUTHEN/START (1425944051): port=tty0 list= action=LOGIN service=ENABLE*Jun 26 05:53:58.771: AAA/AUTHEN/START (1425944051): console enable - default to enable password (if any)*Jun 26 05:53:58.771: AAA/AUTHEN/START (1425944051): Method=ENABLER1#*Jun 26 05:53:58.771: AAA/AUTHEN(1425944051): cant find any passwords*Jun 26 05:53:58.771: AAA/AUTHEN(1425944051): Status=ERROR*Jun 26 05:53:58.775: AAA/AUTHEN/START (1425944051): Method=NONE*Jun 26 05:53:58.775: AAA/AUTHEN(1425944051): Status=PASS*Jun 26 05:53:58.775: AAA/MEMORY: free_user (0x664EE3D4) user=norvel ruser=NULL port=tty0 rem_addr=async authen_type=ASCII service=ENABLE priv=15 vrf= (id=0)第四步 从R2上登陆R1进行测试R2#telnet 192.168.0.1Trying 192.168.0.1 . OpenUser Access VerificationUsername: norvel/ 输入R1上的本地用户名与密码Password:R1enPassword:R1#/ 登陆成功！第五步 查看R1的debug信息R1#*Jun 26 06:16:51.123: AAA: parse name=tty2 idb type=-1 tty=-1*Jun 26 06:16:51.127: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=2 channel=0*Jun 26 06:16:51.127: AAA/MEMORY: create_user (0x66541148) user=norvel ruser=NULL ds0=0 port=tty2 rem_addr=192.168.0.2 authen_type=ASCII service=ENABLE priv=15 initial_task_id=0, vrf= (id=0)*Jun 26 06:16:51.127: AAA/AUTHEN/START (2142463753): port=tty2 list= action=LOGIN service=ENABLE*Jun 26 06:16:51.131: AAA/AUTHEN/START (2142463753): non-console enable - default to enable password*Jun 26 06:16:51.131: AAA/AUTHEN/START (2142463753): Method=ENABLER1#*Jun 26 06:16:51.131: AAA/AUTHEN(2142463753): Status=GETPASSR1#*Jun 26 06:16:52.843: AAA/AUTHEN/CONT (2142463753): continue_login (user=(undef)*Jun 26 06:16:52.843: AAA/AUTHEN(2142463753): Status=GETPASS*Jun 26 06:16:52.847: AAA/AUTHEN/CONT (2142463753): Method=ENABLE*Jun 26 06:16:52.847: AAA/AUTHEN(2142463753): Status=PASS*Jun 26 06:16:52.847: AAA/MEMORY: free_user (0x66541148) user=NULL ruser=NULL port=tty2 rem_addr=192.168.0.2 authen_type=ASCII service=ENABLE priv=15 vrf= (id=0)R1#第六步 重新配置R1上的认证R1(config)#no aaa authentication login defaultR1(config)#aaa authentication login CONSOLE localR1(config)#aaa authentication login VTY enableR1(config)#lin con 0R1(config-line)#login authentication CONSOLER1(config-line)#exitR1(config)#lin vty 0 4R1(config-line)#login authentication VTYR1(config-line)#exit第七步 在R2上重新Telnet R1R2#telnet 192.168.0.1Trying 192.168.0.1 . OpenUser Access VerificationPassword:R1enPassword:R1#第八步 查看R1桑的debug信息R1(config)#*Jun 26 06:21:39.971: AAA/BIND(00000015): Bind i/f *Jun 26 06:21:39.975: AAA/AUTHEN/LOGIN (00000015): Pick method list VTY*Jun 26 06:21:39.987: AAA/AUTHEN/ENABLE(00000015): Processing request action LOGIN*Jun 26 06:21:39.991: AAA/AUTHEN/ENABLE(00000015): Done status GET_PASSWORDR1(config)#*Jun 26 06:21:41.679: AAA/AUTHEN/ENABLE(00000015): Processing request action LOGIN*Jun 26 06:21:41.679: AAA/AUTHEN/ENABLE(00000015): Done status PASSR1(config)#*Jun 26 06:21:43.475: AAA: parse name=tty2 idb type=-1 tty=-1*Jun 26 06:21:43.475: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=2 channel=0*Jun 26 06:21:43.475: AAA/MEMORY: create_user (0x66CB414C) user=NULL ruser=NULL ds0=0 port=tty2 rem_addr=192.168.0.2 authen_type=ASCII service=ENABLE priv=15 initial_task_id=0, vrf= (id=0)*Jun 26 06:21:43.479: AAA/AUTHEN/START (1985530519): port=tty2 list= action=LOGIN service=ENABLE*Jun 26 06:21:43.479: AAA/AUTHEN/START (1985530519): non-console enable - default to enable password*Jun 26 06:21:43.479: AAA/AUTHEN/START (1985530519): Method=ENABLER1(config)#*Jun 26 06:21:43.483: AAA/AUTHEN(1985530519): Status=GETPASSR1(config)#*Jun 26 06:21:45.059: AAA/AUTHEN/CONT (1985530519): continue_login (user=(undef)*Jun 26 06:21:45.059: AAA/AUTHEN(1985530519): Status=GETPASS*Jun 26 06:21:45.059: A