TACACS+ configuration using Huawei's (VRP) OS. This is about configuring authentication using the TACACS+ protocol. Authorization and Accounting are easy to set up once Authentication is working, but are not part of this netlab.

This is a configuration from scratch. VRP usage for the first time, no experience at all. TACACS+ VRP authentication.

IP addressing

The IP addressing used in this netlab. 3 appliances:

Testing authentication is done from the node-10 to the router R102 using telnet protocol.

TACACS+

This netlab is using the TAC_PLUS-NG server project from Event-driven servers.

Version of TACACS+NG used in this netlab:

TACACS+ server IP settings:

Preconfigured tac_plus-ng.cfg settings for user authentication:

The basic TACACS+NG configuration used in this netlab, has been explained in previous netlabs, read:

• 01 - TAC PLUS-NG-Configuring basic authentication
• 02 - TACACS+NG PAP-CHAP authentication for AOS-CX
• 03 - Configuring TACACS+NG authentication for EXOS

TACACS+NG configuration

Pre-configured tac_plus-ng.cfg file for this netlab. AAA server configuration ready to use:

#!/usr/sbin/tac_plus-ng
id = spawnd {
    listen = { address = 0.0.0.0 port = 4949 }
}

id = tac_plus-ng {

        host IPv4only {
            address = 0.0.0.0/0
            welcome banner = "\n Welcome to TACACS+NG\n\n"
            key = 123-my_tacacs_key
    }

    profile netadmin {
            script {
                    if (service == shell) {
                            if (cmd == "") {
                                    set priv-lvl = 15
                                    permit
                            }
                    }
            }
    }

    group admin

    user cisco {
    password {
        login = crypt $2a$10$34.ioPXaLJDD.PdEk.4Mle3g0cQw8e16thH1g0nQEC1.jW.sEHi1S
        pap   = crypt $2y$10$NtwT2Cp/fjezs109gGsVdeyU4Am4q2j1IJ219/mMy.k29xNd9XXU2
        chap  = clear auth-chap

    }
        member = admin
    }

    ruleset {
                rule {
                        script {
                            if (member == admin) { profile = netadmin permit }
                        }
                }
        }
}

This is still the same tac_plus-ng configuration used in previous netlabs.

VRP configuration

IP addressing

• Hostname R102
• Address 10.100.100.102/24
• Gateway 10.100.100.1

Configuration lines for the VRP router:

system-view
sysname R102
interface Ethernet1/0/1
 undo shutdown
 ip address 10.100.100.102 255.255.255.0
exit
ip route-static 0.0.0.0 0.0.0.0 10.100.100.1

local account

Add a new local user named huawei, set password to 123@admin This is optional if you want to fiddle around with SSH additionally on top:

system-view
aaa
 local-user huawei password cipher 123@admin
 local-user huawei level 3
 local-user huawei service-type telnet
 user-interface vty 0 4
  authentication-mode aaa
quit

local used configuration finished.

Verify local authentication

Using the TACACS+ client, telnet to the router, and authenticate using the previously configured credentials:

Verfiy the current user settings:

Notice, current user is the local-user huawei, the authentication method Local authentication. Everything works.

Verify IP connectivity with the TACACS+ server, from the router:

The TACACS+ server is reachable via IP.

VRP TACACS+ configuration

The VRP TACACS+ configuration, using here the Protocol name, not the vendor specific hwtacacs. The configuration:

VRP authentication only configuration consist of following parts:

• local user config (optional)
• hwtacacs server template AAA-1
• aaa authentication scheme default
• aaa domain default and default_admin
• user-interface vty

This results in following configuration for the authenticating users:

system-view
#
hwtacacs enable
#
hwtacacs-server template AAA-1
 hwtacacs-server authentication 192.0.2.1 4949
 hwtacacs-server shared-key cipher 123-my_tacacs_key
 quit
#
aaa
 authentication-scheme default
 authentication-mode hwtacacs local
 quit
#
domain default_admin
 authentication-scheme default
 hwtacacs-server AAA-1
 quit
#
domain default
 authentication-scheme default
 hwtacacs-server AAA-1
 quit
#
user-interface vty 0 4
 authentication-mode aaa
 quit
#
commit

This is the most basic authentication configuration for VRP. This should work everywhere.

AAA default

Using the shown configuration applied to the router will result in following.

VRP sends the username username@domain.ltd as the default username. This is the AAA server authentication debug:

The NAS, here the VRP router, sends the username as cisco@default_admin. The TACACS+ server can not find this username and this results, in no such user, and failed authentication.

VRP has a hwtacacs server configuration option to adjust the sent NAS sent username. Both configurations explained below, result in identical behaviour, sending username without the default suffix shown in above debug output.

AAA router

Using NE40E:

Set the hwtacacs user-name original option:

system-view
#
hwtacacs enable
#
hwtacacs-server template AAA-1
 hwtacacs-server authentication 192.0.2.1 4949
 hwtacacs-server shared-key cipher 123-my_tacacs_key 
 hwtacacs user-name original
#
return

AAA switch

Virutal VRP appliance tested. Huawei CE12800E:

Use the hwtacacs server user-name domain-excluded option.

Configuration example

system-view
#
hwtacacs server template AAA-1
 hwtacacs-server authentication 192.0.2.1 4949
 hwtacacs-server shared-key cipher 123-my_tacacs_key
 hwtacacs-server user-name domain-excluded
#
return
y

However on the (NAS), here the CE12800 switch shows following:

Resulting in an authentication error.

AAA server debug output:

• AAA server reports, lookup succeeded. Everything go.
• NAS authentication results in an error. Full stop.

The solution to this, partially explained on the mailing list. Looks like there are platform and implementation specific differences. I did not look into this further here for VRP switch platforms.

UPDATE:

The resolution to this is mentioned already above. The switch needs a user in its local user database to authenticate successfully to TACACS+.

local account (mandatory)

Add a new local user named huawei, set password to Admin@123! This is optional if you want to fiddle around with SSH additionally on top:

system-view
aaa
 local-user huawei password cipher Admin@123!
 local-user huawei level 3
 local-user huawei service-type telnet
 user-interface vty 0 4
  authentication-mode aaa
quit

Once a local-user is added everything works using CE12800 switch appliance.

VRP TACACS+NG configuration

VRP configuration for TACACS+NG user authentication. This is specifically for a VRP router platforms. This should work using following GNS3 virtual router appliance NE40E:

system-view
#
hwtacacs enable
#
hwtacacs-server template AAA-1
 hwtacacs-server authentication 192.0.2.1 4949
 hwtacacs-server shared-key cipher 123-my_tacacs_key
 hwtacacs-server user-name original
 quit
#
aaa
 authentication-scheme default
 authentication-mode hwtacacs local
 quit
#
domain default_admin
 authentication-scheme default
 hwtacacs-server AAA-1
 quit
#
domain default
 authentication-scheme default
 hwtacacs-server AAA-1
 quit
#
user-interface vty 0 4
 authentication-mode aaa
 quit
#
quit
#
commit

Verify

Using the TACACS+ client, telnet to the router, and authenticate using the previously configured credentials:

After successful authentication, the only command that worksdisplay access-user self command:

The user has level 0. The authentication type is HWTACACS.

TACACS+NG debug

Authentication debug output from authenticates on the NAS. VRP uses the ASCII method, now correctly shown authenticating user is cisco, without the domain part, resulting in a succeeding authentication:

Now that is all folks! Now you can and configure authorisation and accounting to have all the A's configured and working.

The authentication succeeds, but is not that very easy to setup I must admit if done from scratch. At the end VRP AAA works using TACACS+NG.

Summary

The VRP AAA configuration is serious business. I am glad I could barely manage 1/3-rd of it, the authentication part. From scratch. Never dealt with VRP TACACS+ at that level.

So in case anyone wants a very basic VRP router tac_plus-ng.cfg. Here you go. The VRP switch part behaves differently to the router configuration. Switches need corresponding local users in the VRP configuration, routers need the TACACS+ configuration only, without local-users.

References

• VRP local-user privilege level
• Event-driven servers - TAC_PLUS-NG server project
• Configuring TACACS+ Server With A Simple GUI
• VRP hash - Cipher Decipher

Related TACACS+NG posts:

• 01 - TAC PLUS-NG-Configuring basic authentication
• 02 - TACACS+NG PAP-CHAP authentication for AOS-CX
• 03 - Configuring TACACS+NG authentication for EXOS