Setp 1.路由器基本配置

r1(config)#show ip int b

InterfaceIP-Address      OK? Method Status                Protocol

FastEthernet0/0192.168.1.254   YES manual up                    up

FastEthernet1/0192.168.10.254 YES manual up                    up

r1(config)#exit

r1#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 20/53/76 ms

r1#ping 192.168.10.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 40/67/96 ms

r2#show ip int b

InterfaceIP-Address      OK? Method Status                Protocol

FastEthernet0/0192.168.1.253   YES manual up                    up

FastEthernet1/0192.168.10.253 YES manual up                    up

r2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 28/47/72 ms

r2#ping 192.168.10.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 36/42/48 ms

Setp 2.ACS基本配置

1.安装AD-benet.com

2.安装ACS(必需安装java)

3.调整IE安全级别

4.在AD中创建相应的OU、组、用户。其中hw用于raduis 、cisco用于tacacs+

5.勾选network device groups显示相应界面

6．定义tacacs+ 及raduis 客户端及服务器信息

7．AD组及ACS组关联

．8. 重新启动服务

Setp 3.测试PC基本配置

Setp 4.R1做为tacacs+客户端配置及测试

r1(config)#aaa new-model

r1(config)#tacacs-server host 192.168.10.1 key cisco

r1(config)#aaa authentication login cisco group tacacs+ local

r1(config)#line vty 0 4

r1(config-line)#login authentication cisco

r1(config-line)#exit

r1(config)#exit

r1#test aaa group tacacs+ cisco 1 new-code

Trying to authenticate with Servergroup tacacs+

Sending password

User successfully authenticated

Setp 5.R2做为raduis客户端配置及测试

r2(config)#aaa new-model

r2(config)#radius-server host 192.168.10.1 key cisco

r2(config)#aaa authentication login cisco group radius local

r2(config)#line vty 0 4

r2(config-line)#login authentication cisco

r2(config-line)#exit

r2(config)#exit

r2#test aaa group radius hw 1 new-code

Trying to authenticate with Servergroup radius

User successfully authenticated

Setp 6 ACS 用户验证及ebable密码

1．路由器启用enabe密码认证

r1(config)#aaa authentication enable default group tacacs+ enable

2．在ACS上新建用户A设置login及enable密码

3．PC登入R1测试

setp 7 级别授权

1．路由器启用级别授权及测试失败结果图

r1(config)#aaa authorization exec default group tacacs+ local

2．ACS进行级别授权

3．登入R1测试成功

Setp 8 15级别命令授权

1．R1上启用命令授权

r1(config)#aaa authorization commands 15 default group tacacs+ local

2．ACS上面没做配置之前测试结果图

3．ACS配置命令授权

4．登入测试，只能使用指定命令

Setp 10 审计

1．R1路由器审计所有级别配置

r1(config)#no aaa authorization commands 15 default group tacacs+ local

r1(config)#aaa accounting commands 15 default start-stop group tacacs+

r1(config)#aaa accounting commands 1 default start-stop group tacacs+

r1(config)#aaa accounting commands 0 default start-stop group tacacs+

r1(config)#aaa accounting commands 2 default start-stop group tacacs+

2．telnet R1测试输入部分命令

3．ACS查看审计结果图

实验总结:

R1采用ACS -tacacs+认证授权审计.

1.认证调用AD-ciscogroup组里Cisco用户进行login认证.AD-Cisco用户enable密码实验没有做成功(在ACS上新建用户a来做enable认证),没有找出原因.

2.在Tacacs+上对AD用户cisco进行级别和命令授权.

3.在Tacacs+上对级别0\1\2\15级别命令进行审计

R2采用ACS-raduis认证

1.认证周用AD-hwgroup组里hw进行login认证