最简单的AAA认证授权审计配置.doc

防火墙技术实验报告时间：2012-03-13实验名称：简单的AAA配置班 级计算机网络技术100#姓名#实验内容1、拓扑图：2、实验设备：1).用一台PC机桥接到VMware内win server2003服务器；2).用两台Router c3600，一台做NAS、一台做Client；3、实验步骤：NAS：NAS(config)#int f1/0NAS(config-if)#ip add 192.168.139.254 255.255.255.0NAS(config-if)#no shutNAS(config)#int f0/0NAS(config-if)#ip add 192.168.2.254 255.255.255.0NAS(config-if)#no shutNAS(config)#username cisco privilege 15 password ciscoNAS(config)#enable secret cisco -配置enable密码-NAS(config)#aaa new-model -开启AAA功能-NAS(config)#aaa authen login cisco group tacacs+ localNAS(config)#aaa authen login lhy noneNAS(config)#line vty 0 15NAS(config-line)#login authen ciscoNAS(config-line)#exiNAS(config)#line con 0NAS(config-line)#login authentication lhyNAS(config-line)#exiNAS(config)#tacacs-server host 192.168.139.4 key cisco -配置共享key-Client:Client(config)#int f0/0Client(config-if)#ip add 192.168.2.2 255.255.255.0Client(config-if)#no shutClient(config)#no ip routing Client(config)#ip default-gateway 192.168.2.254Client#ping 192.168.139.254Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.139.254, timeout is 2 seconds:!在VMware中配置：NAS:NAS#test aaa group tacacs+ cisco cisco new-code Trying to authenticate with Servergroup tacacs+Sending passwordUser successfully authenticated -认证成功-NAS#NAS(config)#aaa authentication enable default group tacacs+ -将enable加入AAA认证中-NAS(config)#aaa authorization exec default group tacacs+ NAS(config)#aaa accounting exec default start-stop group tacacs+ -默认审计方式-NAS(config)#aaa accounting commands 15 default start-stop group tacacs+ -命令审计方式-Client:将enable加入AAA认证里的验证结果：lient#telnet 192.168.139.254Trying 192.168.139.254 . OpenUser Access VerificationUsername: ciscoPassword: NASenPassword: NAS#conf tNAS(config-if)#endNAS#exi -验证成功-Connection to 192.168.139.254 closed by foreign hostClient#授权（authorization）验证结果：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS# -直接进入特权模式-NAS#conf tNAS(config)#exiNAS#exiConnection to 192.168.139.254 closed by foreign hostClient# -授权成功-审计（accounting）用default验证：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#endNAS#sh running-config NAS#sh version NAS#exiConnection to 192.168.139.254 closed by foreign hostClient#审计（accounting）用commands验证：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#exiNAS#sh running-config NAS#sh version NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#int lo 0NAS(config-if)#ip add 2.2.2.2 255.255.255.0NAS(config-if)#exiNAS(config)#exiNAS#exiConnection to 192.168.139.254 closed by foreign hostClient#