TACACS+ configuration using ExtremeXOS (EXOS). This is about configuring authentication using the TACACS+ protocol. Authorization and Accounting are easy to set up once Authentication is working, but are not part of this netlab.

This is a configuration from scratch. EXOS usage for the first time, no experience at all. TACACS+ EXOS authentication.

The official EXOS appliance is available here, or can be simply installed using the GNS3 marketplace or the GNS-gui import appliance function.

IP addressing

The IP addressing used in this netlab. 3 appliances:

Connections in the netlab from node-10 to R103 using telnet and SSH protocol.

TACACS+

This netlab is using the TAC_PLUS-NG server project from Event-driven servers.

Version of TACACS+NG:

TACACS server IP settings:

Preconfigured tac_plus-ng.cfg settings for user authentication:

There is no option to use PAP authentication in EXOS in TACACS+. PAP authentication works using RADIUS only. CHAP authentication for RADIUS is not implemented yet in EXOS.

The basic TACACS+NG configuration used in this netlab, has been set up in

• 01 - TAC PLUS-NG-Configuring basic authentication
• 02 - TACACS+NG PAP-CHAP authentication for AOS-CX

TACACS+NG configuration

Preconfigured tac_plus-ng.cfg file. Ready to use:

#!/usr/sbin/tac_plus-ng
id = spawnd {
    listen = { address = 0.0.0.0 port = 4949 }
}

id = tac_plus-ng {

        host IPv4only {
            address = 0.0.0.0/0
            welcome banner = "\n Welcome to TACACS+NG\n\n"
            key = 123-my_tacacs_key
    }

    profile netadmin {
            script {
                    if (service == shell) {
                            if (cmd == "") {
                                    set priv-lvl = 15
                                    permit
                            }
                    }
            }
    }

    group admin

    user cisco {
    password {
        login = crypt $2a$10$34.ioPXaLJDD.PdEk.4Mle3g0cQw8e16thH1g0nQEC1.jW.sEHi1S
        pap   = crypt $2y$10$NtwT2Cp/fjezs109gGsVdeyU4Am4q2j1IJ219/mMy.k29xNd9XXU2
        chap  = clear auth-chap

    }
        member = admin
    }

    ruleset {
                rule {
                        script {
                            if (member == admin) { profile = netadmin permit }
                        }
                }
        }
}

EXOS configuration

• Download Vitrual-EXOS from the official Extremenetworks github repository, and install and configure the .gns3a appliance manually or using GNS3-client.

local account

Set local admin password to ExtremeXOS

configure account admin

Configure banner to display local EXOS password. Since we all are forgetful, and this is only a netlab, setting this commands to not forget the local credentials:

configure banner
user: admin
pass: ExtremeXOS
[ENTER]

IP addressing

• Hostname R103
• Address 10.100.100.102/24
• Gateway 10.100.100.1

Configuration lines for the EXOS router:

configure snmp sysname R103
configure vlan default ipaddress 10.100.100.103/24
configure iproute add default 10.100.100.1
configure timezone name CEST 60 autodst name CEST begins every last sunday march at 2 0 ends every last sunday october at 3 0

These optional EXOS configuration commands. The resulting CLI output is more fluent and usable for automation. Disable paging and cli refresh:

disable cli paging
disable cli refresh

Equivalent cisco IOS command to disable paging term lenth 0, for the current running session.

Verify configuration

Show the ip configuration of the router using the show ipconfig default. Default refers to the Defaultrouting table:

Show the IP routing table of the router using the show iproute command:

Verify IP connectivity with the TACACS+ server, from the router:

Everything is set up and verified.

EXOS TACACS+ configuration

This results in following configuration for the EXOS router:

configure tacacs primary server 192.0.2.1 4949 client-ip 10.100.100.103 vr VR-Default
configure tacacs primary shared-secret 123-my_tacacs_key
configure tacacs fallback local
enable tacacs

The user admin is the local fallback account in case TACACS+ authentication with the AAA server fails. The router will fall back to using the locally configured users.

Show the AAA configuration. This shown command works almost the same using cisco's IOS:

Verify

Using the TACACS+ client, telnet to the router, and authenticate using the previously configured credentials:

After successful authentication, verify the TACACS statistics using the show tacacs command:

TACACS+NG debug

Authentication debug output from AAA server while the user authenticates on the NAS. EXOS uses the ASCII method:

The ASCII method is the default method for cisco routers.

Now that is all folks! Now you can and configure authorisation and accounting to have all the A's configured and working.

The authentication succeeds and is easy to setup. During testing using this particular EXOS version following issues have been spotted:

EXOS bug 1

After successful authentication, notice the CLI greeting you:

Compare the authentication greeting, especially the the successful with the output of show tacacs, and here the Passed and Failed:

This issue is annoying and dangerous. If this happens using real gear, then you should contact your networking vendor and open a bug report.

EXOS bug 2 - TACACS+

Now, if the TACACS+ client on EXOS would have been fully implemented, then the TACACS+ welcome banner would show up. I did not show up at all. Tested both telnet and SSH.

Summary

I like that Extreme provides free images for netlabs and testing for usage in GNS3, EVE-NG or whatever network simulator is in use. And hopefully this helps someone in the future looking for Cisco-ISE or ClearPass appliance replacement, setting up first test and netlabs for tiny AAA appliance replacement, compared to the commercial products.

TACACS+NG is amazingly flexible and very much like configuring a router from CLI in that regard.

... and while you still wait for your AAA commerical GNS3 appliance to finally start the boot sequence, I already finished running my CLI automation, and reconfigured all running TACACS+NG netlab nodes, thrice... ...

References

• Event-driven servers - TAC_PLUS-NG server project
• Download official Vitrual-EXOS
• EXOS 32.1 Command Refernce Guide Version 32.1.
• GTAC Knowledge Home, just like Cisco Learning Network.
• How To: Identify TACACS Issues
• Connecting to an Extreme switch
• Gajanan Parwar - Understanding extreme command line interface

Related TACACS+NG posts:

• 01 - TAC PLUS-NG-Configuring basic authentication
• 02 - TACACS+NG PAP-CHAP authentication for AOS-CX