7.2.6 Packet Tracer - Configure Local AAA for Console and VTY Access Answers

R1(config)# username Admin1 secret admin1pa55

R1(config)# aaa new-model

R1(config)# aaa authentication login default local

R1(config)# line console 0

R1(config-line)# login authentication default

R1(config-line)# end

%SYS-5-CONFIG_I: Configured from console by console

R1# exit

R1 con0 is now available

Press RETURN to get started.

************ AUTHORIZED ACCESS ONLY *************

UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.

User Access Verification

Username: Admin1

Password: admin1pa55

R1>

R1(config)# ip domain-name netsec.com

R1(config)# crypto key generate rsa general-keys modulus 1024

The name for the keys will be: R1.netsec.com

% The key modulus size is 1024 bits

% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

*Mar 1 0:2:12.822: %SSH-5-ENABLED: SSH 1.99 has been enabled

R1(config)# aaa authentication login SSH-LOGIN local

R1(config)# line vty 0 4

R1(config-line)# login authentication SSH-LOGIN

R1(config-line)# transport input ssh

R1(config-line)# end

PC> ssh –l Admin1 192.168.1.1
Open
Password: admin1pa55

! ==============================================================
!--- 7.2.6 Packet Tracer - Configure Local AAA for Console and VTY Access
!--- ANSWER SCRIPT FOR ROUTER R1
!--- Usage: copy this whole file and paste it into the R1 terminal (start at the R1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1: Configure Local AAA Authentication for Console Access.
! --------------------------------------------------------------

!--- Configure a local username with a strong encrypted secret, for the local AAA database to authenticate against.
username Admin1 secret admin1pa55

!--- Enable AAA on R1.
aaa new-model

!--- Configure the default AAA login method list to use the local database.
aaa authentication login default local

!--- Apply the default AAA method list to the console line.
line console 0
 login authentication default
 exit

! --------------------------------------------------------------
!--- Part 2: Configure Local AAA Authentication for VTY Lines (SSH).
! --------------------------------------------------------------

!--- Set the domain name; required before RSA keys can be generated.
ip domain-name netsec.com

!--- Generate 1024-bit RSA keys for SSH (hostname/domain-name are already set above, so the key name R1.netsec.com resolves correctly).
crypto key generate rsa general-keys modulus 1024

!--- Configure a named AAA method list, SSH-LOGIN, to authenticate against the local database.
aaa authentication login SSH-LOGIN local

!--- Apply the SSH-LOGIN method list to the VTY lines and restrict remote access to SSH only.
line vty 0 4
 login authentication SSH-LOGIN
 transport input ssh
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show run | section line con      -> confirms "login authentication default" under line console 0
!---   show run | section line vty      -> confirms "login authentication SSH-LOGIN" and "transport input ssh"
!---   show crypto key mypubkey rsa     -> confirms a 1024-bit RSA key pair named R1.netsec.com exists
!---   (console) exit then reconnect    -> confirms the console now prompts "Username:" / "Password:" using Admin1 / admin1pa55
!---   ssh -l Admin1 192.168.1.1 (from PC-A) -> confirms SSH login works end-to-end using the same local AAA database
!--- Note: R2 and R3 are pre-configured for this activity (enable secret ciscoenpa55, OSPF MD5 auth) —
!--- only R1 needs AAA configured. Both console and VTY now authenticate through the local user database,
!--- so losing the Admin1 credentials would lock out console access too; keep the enable secret as a fallback.
! ==============================================================