Lab - Securing Administrative Access Using AAA and RADIUS
© 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 20
Additional control over the login process can be achieved using authentication, authorization, and accounting
(AAA). For basic authentication, AAA can be configured to access the local database for user logins, and
fallback procedures can also be defined. However, this approach is not very scalable because it must be
configured on every router. To take full advantage of AAA and achieve maximum scalability, AAA is used in
conjunction with an external TACACS+ or RADIUS server database. When a user attempts to log in, the
router references the external server database to verify that the user is logging in with a valid username and
In this lab, you build a multi-router network and configure the routers and hosts. You will then use CLI
commands to configure routers with basic local authentication by means of AAA. You will install RADIUS
software on an external computer and use AAA to authenticate users with the RADIUS server.
Note: The router commands and output in this lab are from a Cisco 1941 router with Cisco IOS Release
15.4(3)M2 (with a Security Technology Package license). Other routers and Cisco IOS versions can be used.
See the Router Interface Summary Table at the end of the lab to determine which interface identifiers to use
based on the equipment in the lab. Depending on the router model and Cisco IOS version, the commands
available and output produced might vary from what is shown in this lab.
Note: Before beginning, ensure that the routers and switches have been erased and have no startup
3 Routers (Cisco 1941 with Cisco IOS Release 15.4(3)M2 image with a Security Technology Package
2 Switches (Cisco 2960 or comparable) (Not Required)
2 PCs (Windows 7 or Windows 8.1, SSH Client, and WinRadius)
Serial and Ethernet cables, as shown in the topology
Console cables to configure Cisco networking devices
Part 1: Configure Basic Device Settings
In Part 1 of this lab, you set up the network topology and configure basic settings, such as the interface IP
addresses, static routing, device access, and passwords.
All steps should be performed on routers R1 and R3. Only steps 1, 2, 3 and 6 need to be performed on R2.
The procedure for R1 is shown here as an example.
Step 1: Cable the network as shown in the topology.
Attach the devices as shown in the topology diagram, and then cable as necessary.
Step 2: Configure basic settings for each router.
a. Configure host names as shown in the topology.
b. Configure the interface IP addresses as shown in the IP addressing table.
c. Configure a clock rate for the routers with a DCE serial cable attached to their serial interfaces.
R1(config)# interface S0/0/0
R1(config-if)# clock rate 64000
d. To prevent the router from attempting to translate incorrectly entered commands as though they were
host names, disable DNS lookup.
R1(config)# no ip domain-lookup