Juniper交换机AAA认证.docx

《Juniper交换机AAA认证.docx》由会员分享，可在线阅读，更多相关《Juniper交换机AAA认证.docx（4页珍藏版）》请在第一文库网上搜索。

1、Juniper交换机AAA登录认证配置1.登录Cisco ACS,添加交换机信息，使用RADIUS (Juniper)认证创建junipejtest组，并添加了 E401#test主机，输入需要验证的主机IP及验证秘钥然后勾选juniper的radius模板PostureValidationReportsandActivityExternal UserDataNetworkConfigurationNeM*ork AccesProfilesSystemConfigurationAdministrationControlInterfaceConfigurationShared ProfileCo

2、mporUEdrtAAA Client HostnameAAA Client IP AddressShared SecretNetwork Device GroupAdd AAA ClientRADIUS Key WrapKey Encryption KeyMessage Authenticator Code KeyKey Input FormatC ASCII HexadecimalAuthenticate Using Single Connect TACACS+ AAA Client (Record stop in accounting on failure) Log Update/Wat

3、chdog Packets from this AAA Client Log RADIUS Tunneling Packets from this AAA Client Replace RADIUS Port info with Username from this AAA Client Match Framed-IP-Address with user IP address for accounting packets from this AAA Clientjunipe喉板I Submit I Submit + AddIv I Cancel I2.在ACS的接口下导入模板，然后点击用户组将

4、需要3A认证的用户加入juniper上相应权限的用户组在组里面里面添加Juniper交换机里面配置的超级管理员帐号，这样的目的是把Juniper交换机上具有超级管理员权限的gainet这个用户的权限关联到Group。这个组中，那么这个组中的用户(关联的域用户以及本地添加进去的本地用户)都具有超管的权限。如果希望某个组($0 Group 2)具有只读的权限,那么进入这个组的Edit Settings,在Juniper-Local-User-Name里面添加Juniper里面的只读用户read即可HHCISCOGroup SetupJump ToUserSetup厂090 Tunnel-Clien

5、t-Auth-IDCroupSetupShared ProfileComponents 091 Tunnel-Server-Auth-IDRADIUS (Juniper)Access RestrictionsEnable OptionsPassword AgingIP Address AssignmentDownloadable ACLsTACACS+RADIUS (IETF)Network函m I ConfigurationRADIUS(Juniper)System ConfigurationTag 1Tag(2zJ Value |T Value If=L I InterfaceI b Co

6、nfigurationc% I Administration唳 Control而4 I External UseryJ I Databaseso Postureao Validation, Network匠2636001 Juniper-Local-User-NamegainetJuniper RADIUS Attributes3 Juniper AAA Radius 配置：set system authentication-order radiusset system radius-server 203.171.224.86 secret set system radius-server 2

7、03.171.224.86 timeout 5set system authentication-order password这条命令如果不删除，在AAA服务器正常通信情况下也能使用本地帐号登录;如果删除，在AAA服务器不能通信的情况下才能使用本地帐号登录。4 .登录验证TXCVV_Juniper_EX4550 login： bjpPassword： JUNOS 12.3R5.7 built 2013-12-18 01:32:43 UTCbjp(?TXCVV_Juniper_EX4550 show system usersf pc0：2：01PMUSERrootup 53 days- 20:1

8、3 j1 3 users j load auerages ： 0.14j, 0.14jb 0.13TTV110FROMLOGIN020Decl3IDLE WHAT595days -cs rootp0203.171.224.4212：01PM1 clibjpPl203.171.224.422：01PMcli Juniper 交换机 TACACS+配:ll1 Juniper交换机上tacacs+配置如下:set groups global system authentication-order tacplusset groups global system tacplus-server secre

9、t uset groups global system tacplus-server 203.171.224.86 timeout 5set groups global system tacplus-server 203.171.224.86 source-addressset groups global system login user remote uid 2002set groups global system login user remote class super-userset apply-groups global不需要set system authentication-or

10、der这条命令，因为set groups global已经指定了认证类型如果在AAA服务器不能通信的情况下才能使用本地帐号登录则添加如下命令：set groups global system authentication-order password或者set system authentication-order password2 .ACS设置按照平时开机柜配置即可UserSetupAAA Client Setup forVIP-XShared ProfileComporwntsGroupSetup= I ltfrfCJP Configuration避、 Administration0 C

11、ontrol172.31.4.1 I Etrn1 UsrG I DatabasesPostureVlidtioNetwork AccessProfiles* I ReportsandI Activity3.验证AAA Client IP AddressShared SecretNetwork Device GroupRADIUS Key WrapKey Encryption Key00000000000000000000000000000000Message Authenticator Code Key0000000000000000000000000000000000000000Key In

12、put FormatC ASCII r HexadecimalAuthenticate UsingR Single Connect TACACS+ AAA Client (Record stop in accounting on failure)|core-&-aggJUNOS 12.3R5.7 built 2013-12-18 01:32:43 UTCbjp(?TXCVV_Jun iper_EX4550bjp(?TXCVV_Juniper_EX4550 sou system usersf pc0：2 ：52PM up 53 days， 21:03 3 users load averages

13、： 0.23, 0.23， 0.18USERTTVFROMLOGIN0 IDLE WHATrootu0-20Decl3 595days -csh PJPp0203171224422:52PM- cli rootP2203.171.224.422:34PM一 cli根据日志提示可得知用户有配置等权限PDatsfTmePnortMessage172314.12015-8-814:56NoticeAug 814:337 TXCYY.Jjnpr-X4S50 rngd19134j: DAS.LOGXJT.EVENT: User toj, extrg ccnligraton rrode172.31.4.12015-8-814:55NoticeAug 814:53:32 TXCYY_Junper_p4550 mgdll9134j U.COMMIT User ,bjp requeued ,cwrmr operekx (cofwent none)172.31.4.120158814:54NoticeAug 814:52:56 IXCYY.Junper-EX4S50 ngdl9134t U.DAS.LOGN.EVENI User ,p ertenng cwtigirabon mode172.31.4.12015-8-814:53NoticeAu 814 51:51 TXCYY JUrwe