防火墻技術實驗報告時間：2012-03-13實驗名稱：簡單的AAA配置班 級計算機網絡技術100#姓名#實驗內容1、拓撲圖：2、實驗設備：1).用一臺PC機橋接到VMware內win server2003服務器；2).用兩臺Router c3600，一臺做NAS、一臺做Client；3、實驗步驟：NAS：NAS(config)#int f1/0NAS(config-if)#ip add 192.168.139.254 255.255.255.0NAS(config-if)#no shutNAS(config)#int f0/0NAS(config-if)#ip add 192.168.2.254 255.255.255.0NAS(config-if)#no shutNAS(config)#username cisco privilege 15 password ciscoNAS(config)#enable secret cisco -配置enable密碼-NAS(config)#aaa new-model -開啟AAA功能-NAS(config)#aaa authen login cisco group tacacs+ localNAS(config)#aaa authen login lhy noneNAS(config)#line vty 0 15NAS(config-line)#login authen ciscoNAS(config-line)#exiNAS(config)#line con 0NAS(config-line)#login authentication lhyNAS(config-line)#exiNAS(config)#tacacs-server host 192.168.139.4 key cisco -配置共享key-Client:Client(config)#int f0/0Client(config-if)#ip add 192.168.2.2 255.255.255.0Client(config-if)#no shutClient(config)#no ip routing Client(config)#ip default-gateway 192.168.2.254Client#ping 192.168.139.254Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.139.254, timeout is 2 seconds:!在VMware中配置：NAS:NAS#test aaa group tacacs+ cisco cisco new-code Trying to authenticate with Servergroup tacacs+Sending passwordUser successfully authenticated -認證成功-NAS#NAS(config)#aaa authentication enable default group tacacs+ -將enable加入AAA認證中-NAS(config)#aaa authorization exec default group tacacs+ NAS(config)#aaa accounting exec default start-stop group tacacs+ -默認審計方式-NAS(config)#aaa accounting commands 15 default start-stop group tacacs+ -命令審計方式-Client:將enable加入AAA認證里的驗證結果：lient#telnet 192.168.139.254Trying 192.168.139.254 . OpenUser Access VerificationUsername: ciscoPassword: NASenPassword: NAS#conf tNAS(config-if)#endNAS#exi -驗證成功-Connection to 192.168.139.254 closed by foreign hostClient#授權（authorization）驗證結果：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS# -直接進入特權模式-NAS#conf tNAS(config)#exiNAS#exiConnection to 192.168.139.254 closed by foreign hostClient# -授權成功-審計（accounting）用default驗證：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#endNAS#sh running-config NAS#sh version NAS#exiConnection to 192.168.139.254 closed by foreign hostClient#審計（accounting）用commands驗證：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword: NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#exiNAS#sh running-config NAS#sh version NAS#conf tEnter configuration commands, one per line. End with CNTL/Z.NAS(config)#int lo 0NAS(config-if)#ip add 2.2.2.2 255.255.255.0NAS(config-if)#exiNAS(config)#exiNAS#exiConnection to 192.168.139.254 closed by foreign hostClient#