AAA Authorization Question

[JohnPtrs]

I am in the process of trying to get my Cisco IOS devices to authenticate to a RADIUS Server on my network and it is working, however I want to have two groups that can log in at different privilege levels... Is there a AAA Authorization command I can use on the IOS devices to set the users to their appropriate privilege level? I have a MS IAS server doing RADIUS and the users will be in two different Active Directory groups...

Here is the RADIUS setup I'm using->

conf t
aaa new-model

radius-server host 10.18.0.49 auth-port 1812 acct-port 1813 key C15K0!

aaa group server radius RadiusServers
server 10.18.0.49 auth-port 1812 acct-port 1813
exit

aaa authentication login default group RadiusServers local
exit

Thanks,

JP

 

[helpdeskdan]

I believe one requires TACACS+ to do different privilege levels. Radius will not work.

 

[chipk]

This should be possible with RADIUS by using Network Access Profiles:

http://cio.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs40/user/sp.htm

This took me forever to figure out back when I first implemented. That's because RADIUS is "open" and TACACS is "commercial". Of course it's going to be much easier to implement TACACS, it's the same reason people choose Windows over Linux.

There is an attribute in IAS called "cisco-AV-Pair", what you do is you set up policies to forward requests based on username, group membership etc., to a particular policy when connecting to IAS. I believe what you define is: "shellriv-lvl=15", which in turn gets passed back to the router doing the AAA and authorizes you at privlege level 15 (enable mode).

It's been a while for me since setting this up, but let me know if you get stuck, I'll try to help you out.

 

[JohnPtrs]

Hey, thanks for the article I'll make a run at it...

JP

 

[JohnPtrs]

OK, on my IAS (RADIUS) server I have it set up with the Cisco-AV-Pair and the "shellriv-lvl=15" attribute set... Don't I need to have a AAA Authorization command on the IOS device to tell it to look to RADIUS for the Authorization? If so, do you know what the syntax would be for that?? Thanks!

JP

 

[chipk]

See this thread for a sample config:

http://www.tek-tips.com/viewthread.cfm?qid=1344360&page=1

 

[JohnPtrs]

Well so far I have put in the following config, however it still just logs me in to the carrot prompt and not to enabled mode... when I do a show aaa servers command it doesn't look like its making any authorization requests as per the counters...

aaa new-model
aaa authentication password-prompt Password:
aaa authentication username-prompt Username:
aaa authentication login default group radius local
aaa authentication ppp default group radius local
aaa authorization network users group radius

 

[chipk]

On the RADIUS side, did you define a group and associate it with that Profile that's doing the priv-level=?? I'll have to get this up and running real quick on a switch. I seem to remember that the prompt doesn't change. Try doing a show privilege to see where you're at.

 

[JohnPtrs]

Basically I have an Active Directory group called Cisco15 and a Remote Access Policy on the IAS box that says for users of that group give them this attribute "shellriv-lvl=15" after getting this working I was planning to create a seperate group and policy for level 1...

I did a show privilege command and it did say level 1 unfortunately... and when I do that show aaa servers command my Author: Requests is still at 0... It doesn't seem like its trying to request authorization info...

Thanks,

JP

 

[chipk]

So you're using the AD credentials, and it's accepting them? or at least it appears to be? Is there anything in your IAS logs on the server? I think they're under program files\ias or something like that.

I'll get this set up on a device tomorrow and see if I can duplicate your problem.

 

[JohnPtrs]

Yes it appears to be... I logon with my Win AD username and password...I used a combo of these two articles to set it up...

http://www.tech-recipes.com/cisco_networking_tips1478.html

http://briandesmond.com/blog/archiv...-against-Active-Directory-from-Cisco-IOS.aspx

The below information is put into the Sytem Event Log-
Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 3/12/2007
Time: 1:24:28 PM
User: N/A
Computer: SHAPPS01
Description:
User petersjo was granted access.
Fully-Qualified-User-Name = SILVHOSPNET.ORG/Silverton Hospital/Information Services/John Peters
NAS-IP-Address = 10.18.11.46
NAS-Identifier = <not present>
Client-Friendly-Name = IS Bldg Switch
Client-IP-Address = 10.18.11.46
Calling-Station-Identifier = 10.18.22.126
NAS-Port-Type = Virtual
NAS-Port = 2
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Cisco Level 15
Authentication-Type = PAP
EAP-Type = <undetermined>

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 00 00 00 00 ....

 

[helpdeskdan]

Very interesting stuff, I was told it couldn't be done.

 

[JohnPtrs]

Well I got it working now... MS IAS is doing RADIUS auth for IOS devices and assigning privilege levels at login as per the remote access policies in IAS which are based on two AD groups... I like it!!!

JP

 

[chipk]

Ah, cool. Glad you got it working. I was just getting my setup going and saw that you figured it out. Good stuff, eh? Cuts down on time, and also allows you to let other people get into devices with minimal privileges.

 

[routernoob]

I am also trying to set this up for a lab of mine.

I am able to login to the router/switch fine with my AD username and password, but I am not able to get to the different privilege levels.


I have two groups configured. level 1 and 15. I used the tutorial posted here:

http://www.tech-recipes.com/cisco_networking_tips1478.html

I configured exactly step by step what was listed here.

my router config looks like this:

aaa new-model
!
!
aaa group server radius RadiusServer
server 10.0.0.1 auth-port 1812 acct-port 1813
!
aaa authentication password-prompt Password:
aaa authentication username-prompt Username:
aaa authentication login default group radius local
aaa authentication ppp default group radius local
aaa authorization network users group radius
aaa accounting network default start-stop group radius
aaa session-id common

radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 key *****

The Remote Access Policies are created, the Windows-Group is specified, under "edit profile" , click on the advanced tab, the Service-Type is login and the Vendor-Specific is set to Radius Standard and the "shellriv-lvl=15" attributes are set.

When I created the AD groups, I added the users I wanted to have permission. I noticied at first they could not login, I went under the User properties and selected the "Dial In" tab, then check marked "Allow Access", this allowed my devices to login to the router.

I was thinking well what if I selected "Use remote access policy" instead, but everytime I click APPLY, then OK after selecting, it takes the setting back to Deny Access.

So is there anything I am missing? I cannot figure out why it won't grant privilege level 15 to my account even though its set.

Thanks!

 

[ADB100]

I am able to login to the router/switch fine with my AD username and password, but I am not able to get to the different privilege levels.

Did you enable AAA Authorization for exec? You need that to get the IOS device to use the Cisco-AV Pair Radius attribute it receives from the server (shellriv-lvl=15):

aaa authorization exec default group Radius-Server if-authenticated

HTH

Andy

 

[routernoob]

Thanks so much for your help. This works!

 

[routernoob]

I am guessing also you could create custom access level policies? For access levels between 2-14.

The policies would be configured on the cisco device I would assume.

Fun Stuff!

 

[whatz]

Hello Everybody,

First of all thanks for this threat. It was an excelent resource for me. I have been able to implement an MS IAS (integrated into AD) as RADIUS for my Cisco devices.

I created to AD groups: One for Level 1 and one for Level 15 (enable) access. If I login as a member of the Level15 group then I get right into enable mode on my Cisco device (NAME#). If I login as a member of my Level 1 group then I am logged in with no special rights (NAME>). However it is possible for a member of the Level 1 group to use the ENABLE command to elevate the rights to Level 15 once logged into the Cisco device.

Now here is my question: Since the Cisco device is always querying the RADIUS even for the statement of ENABLE, is it possible to restrict a Level 1 member to only stay at Level 1? I would like to prevent such a user from using the ENABLE statement to gain more rights? I would like to look at Level 1 as a READ-ONLY group that can maybe do a SHOW RUN but that would be it.

Is such a thing possible?

Thank you.

 

[ADB100]

When using Radius for the enable secret/password Cisco IOS devices attempt to authenticate the username '$enab15$'. Simply not creating this account in AD will achive the result you want but make sure you are using Radius for enable:

aaa authentication enable default group Radius-Server enable

You could also create the account but don't tell anyone the password....

HTH

Andy