Juniper JUNOSE 11.1.X - BROADBAND ACCESS CONFIGURATION GUIDE 6-4-2010, Configuration Manual

Page: 362 / 794

Before You Configure
Before you begin to configure , you must determine the following for the
authentication and accounting servers:
■
IP addresses
■
TCP port numbers
■
Secret keys
Configuring Support
To use , you must enable AAA. To configure your router to support
, perform the following tasks. Some of the tasks are optional. Once you
configure support on the router, you can configure
authentication, authorization, and accounting independent of each other.
1.
Specify the names of the IP host or hosts maintaining a server.
Optionally, you can specify other parameters, such as port number, timeout
interval, and key.
host1(config)# tacacs-server host 192.168.1.27 port 10 timeout 3 key
your_secret primary
2.
(Optional) Set the authentication and encryption key value shared by all
servers that do not have a server-specific key set up by the
tacacs-server host
command.
host1(config)# tacacs-server key “ &#889P^”
3.
(Optional) Set alternative source address(es) to be used for server
communications.
host1(config)# tacacs-server source-address 192.168.134.63
4.
(Optional) Set the timeout value for all servers that do not have a
server-specific timeout set up by the
tacacs-server host command.
host1(config)# tacacs-server timeout 15
Configuring Authentication
Once support is enabled on the router, you can configure
authentication. Perform the following steps:
1.
Specify AAA new model as the authentication method for the vty lines on your
router.
host1(config)# aaa new-model
2.
Specify AAA authentication by defining an authorization methods list.
322 ■
Before You Configure
JUNOSe 11.1.x Broadband Access Configuration Guide