Central logins with TACACS+

NetLab lab Intermediate 4 tasks 20 points

The AAA server (10.1.1.50) runs TACACS+ with the shared key AAA!Key19. It knows netadmin (privilege 15) and helpdesk (privilege 1). Set up R1:

Turn on AAA. Keep a local fallback user backup with privilege 15 and secret Back!Up2026.
Logins (console and vty) try TACACS+ first, then the local users.
The privilege level from the server (or the local user) counts.
Telnet stays allowed for now (SSH comes later).

How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.

Solution explanation

The default login list applies to every line that doesn't name another list, so the console and the vty lines both use it. Without aaa authorization exec, netadmin would land at level 1 and need the enable secret.

Show solution

[R1]
enable
configure terminal
username backup privilege 15 secret Back!Up2026
aaa new-model
tacacs server AAA1
address ipv4 10.1.1.50
key AAA!Key19
exit
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
end
test aaa group tacacs+ netadmin Net!Admin19 legacy
[ADMIN]
telnet 10.1.1.1
netadmin
Net!Admin19
show privilege
exit