Juniper devices can have local usernames and passwords,
but if we have a lot of devices, this can be hard to manage.
That's why it's often beneficial to configure external authentication,
such as radius or TAC acts.
But let's start with local logins.
Local logins are users that are configured directly on the device
We can create a user with a set system, log in user.
We'll call our user admin
Of course, our new user will need a password,
which we will set with authentication plaintext password.
This can be a little confusing
We're not telling Junos to store the password in plaintext.
We're telling Junos that we're going to type our plaintext password in June.
This will then encrypted and stored in the config.
We also need to set the log in class.
This is the permission level that this account has.
Super user is the highest default class.
Our other options include Operator Read-Only.
Only an unauthorized operator is good for level to support
staff who need to access devices and run some basic commands like clear.
If these classes don't suit us,
we can create our own where we allow or deny commands.
Anything we allow takes precedence over anything we deny.
If we look at the config that was created we can see a user ID
which was automatically generated and the encrypted password.
We can create a custom class
under system log in class.
This is where we set permissions.
As you can see, there's a lot to choose from.
We'll add view which allows the user to see things like interface statistics
and view configuration, which allows them to see the active config.
As I mentioned earlier,
we can allow specific commands.
We can list each command or use rejects to get fancy.
In this example, I'm allowing this class to use the configure command.
We can follow the same process to deny commands as well.
We can also dig further and allow or deny
areas in the hierarchy that our users are allowed to configure.
Once they're in configuration mode.
But ultimately, for this to be useful,
we need to assign the class to a user just like we did before.
I currently manage about 100 Juniper devices.
Can you imagine the pain I would have to endure if I needed
to configure usernames and passwords on them all
So what I really need is to have external authentication.
Do you know supports both radius and TAC acts?
If you're not familiar with how external authentication works.
Let me give you the high level overview.
User accounts are configured on an external authentication server
running the radius or TAC protocol
This may integrate with something like Active Directory
or some other user management system.
Our Juniper device is configured to send authentication requests to the server.
When a user tries to log on, the device will check that the account exists.
The password is correct and send back and allow or deny iMessage as appropriate.
It's a fantastic system, but what happens
if the external server fails or something along the path goes down?
Will we be locked out of our device?
If a genius device cannot reach the external server
at all, it will fall back to local usernames and passwords.
For that matter.
You could even have more than one external server configured
We will now take a look at how
we would configure a radio server on a June iOS device.
If you want to see how to configure a Windows Server as a radio server,
take a look at the lab that goes along with this video.
There are only two commands we need to get going in the first command.
We're setting the IP address of the radio server using the default port,
setting the radius secret
and telling our device which IP to send this information from.
Or we would be if I remember to type
the source IP and
we need to send a secret
as this is how radio authenticates our device.
We also set the source IP as radius is often configured
with a list of IP that are allowed to send authentication requests.
And we want to be sure that we're sending from the right one.
The next thing we can figure is the authentication order
In this case we're saying try radius first, but if it's unavailable,
then fallback to local usernames and passwords
we could add TAC plus if we also had a text server.
Keep in mind that journalists will always fall back
to local usernames and passwords if needed.
And that's all there is to it.
It's important to understand how external authentication
works when your authentication server dies.
Will you still get access to your device or will you be locked out?
Now that we've covered advanced configuration and authentication,
we're going to take a new device and configure it from scratch.
Click the video shown here to begin.