Local accounts first, then AAA logins through a TACACS+ server with a local fallback

Steps

1. Place the four devices and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Give PC1 and SRV1 their addresses and gateway in Desktop > IP Configuration. Then name and address R1 from its CLI tab:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 192.168.17.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit

From PC1's Command Prompt, C:\> ping 192.168.17.1 should get replies before you go on. 2. Give R1 what SSH needs. Lesson 18 explains these lines; here they only give the VTY lines an SSH login to accept. Packet Tracer accepts the older spelling ip domain-name, which the lesson writes as ip domain name:

R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa general-keys modulus 1024
R1(config)# ip ssh version 2

3. Create two local accounts and an enable secret. These are lab-only passwords. netops gets privilege 15; helpdesk gets the default level 1:

R1(config)# username netops privilege 15 secret lab-only-ops
R1(config)# username helpdesk secret lab-only-desk
R1(config)# enable secret lab-only-enable
R1(config)# do show running-config | include username

Each username line shows secret followed by a type number and a hash, never the password itself. That is the one-way hash the lesson describes. 4. A username changes nothing until the lines are told to use the local database. Point the VTY lines and the console at it, refuse Telnet, and log idle sessions out after ten minutes:

R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 10 0
R1(config-line)# exit
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# end

5. Test both accounts from PC1's Command Prompt. Log in as helpdesk with lab-only-desk, check the level, leave, then do the same as netops with lab-only-ops:

C:\> ssh -l helpdesk 192.168.17.1
Password:
R1> show privilege
Current privilege level is 1
R1> exit
C:\> ssh -l netops 192.168.17.1
Password:
R1# show privilege
Current privilege level is 15
R1# exit

netops lands straight at R1# without typing enable, because the privilege level on the username decides where a login starts. 6. Build the AAA server. On SRV1 open Services > AAA and set Service to On. Under Network Configuration enter Client Name R1, Client IP 192.168.17.1, Secret lab-only-tackey and ServerType Tacacs, then click Add. Under User Setup add Username aaaadmin with Password lab-only-aaa, then click Add. Note that netops and helpdesk exist only on R1, not on the server. The Secret is the shared key; it must match the key that R1 sends, and both are lab-only values. 7. Point R1 at the server and switch AAA on. A local privilege-15 account already exists, which is exactly the lesson's rule: create a local user before you type aaa new-model. The default list sends logins to TACACS+ first and to the local accounts only if the server gives no answer; the CON list keeps the console local:

R1# configure terminal
R1(config)# tacacs-server host 192.168.17.50
R1(config)# tacacs-server key lab-only-tackey
R1(config)# aaa new-model
R1(config)# aaa authentication login default group tacacs+ local
R1(config)# aaa authentication login CON local
R1(config)# line vty 0 4
R1(config-line)# login authentication default
R1(config-line)# exit
R1(config)# line console 0
R1(config-line)# login authentication CON
R1(config-line)# end

The lesson defines the server with the named form (tacacs server TAC1, then address ipv4 and key). This lab uses the older single-line tacacs-server commands, which do the same job and which Packet Tracer accepts. 8. From PC1, log in as the server's user. The login succeeds through TACACS+, yet it lands at user EXEC, because nothing asks the server for a privilege level (that is exec authorisation, which this lab leaves off):

C:\> ssh -l aaaadmin 192.168.17.1
Password:
R1> show privilege
Current privilege level is 1
R1> exit

9. Break it: on SRV1, set the AAA Service to Off. From PC1, try ssh -l aaaadmin 192.168.17.1 again: it fails, because the server is silent and R1 has no local account called aaaadmin. Now try ssh -l netops 192.168.17.1 with lab-only-ops: after a pause while R1 waits for the server, you land at R1#. No answer from the server is an error, so R1 moved on to the next method, local. Without local at the end of the default list, every SSH login would now be locked out. Fix it by setting SRV1's AAA Service back to On, and log in as aaaadmin once more to confirm.