Needing a Microsoft AD service for the virtual GNS3 network laboratory . Since i am using linux, installing samba 4 AD DC is a good enough for authentication and authorization testing. The use case for a Active Directory Service is authenticating and authorizing users to networking components using TACACS+ protocol. Networking components like routers and switches. This works for all TACACS+ client implementations as soon as the used TACACS+ server/daemon is able to read the directory service (LDAP), here the Active Directory flavour of LDAP protocol, to get the credentials, and group assignments.

Now let's begin with a citation from the official samba page:

... Starting from version 4.0 (released in 2012,) Samba is able to serve as an Active Directory (AD) domain controller (DC). Samba operates at the forest functional level of Windows Server 2008 R2 w ...

So samba should be able to work as a simple Windows AD DC server

The setup explained below is a samba 4 AD Domain Controller, stand alone, for authentication service only. Stand alone in the sense of the only one AD Domain Controller running samba in that networking environment, no clustering, no FSM roles etc. Not to be mixed up with the samba server role, which is also called stand alone. The samba server role is set to dc when populating the directory service.

Samba version used in this setup

click for more

Wireguard

This is the official WireGuard quickstart setup in a GNS3 netlab. Both linux WireGuard peers are connected using a routed IP connection via encrypted interface wg0. The IP addressing on both peers interface eth0 represent public IP addressing.

In the final step procedure, both linux peers automatically start up the wg0 tunnel connection at boot up sequence, and stop the service when the related wg0 interface has been stopped due to a system shutdown or manually reset as system root user. The procedure explained in this blog entry uses 2 linux system commands only, to configure a secure connection:

• wg
• ip

Topology

IP addressing

State

Traceroute mtr command from peerA to peerB in the current state of network, before interface wg0 is created on both peers.

                             My traceroute  [v0.96]
peerA (192.0.2.10) -> 198.51.100.10 (198.51.100.10)    2026-01-21T12:51:42+0100
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                       Packets               Pings
 Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.0.2.1                         0.0%     5    1.1   1.2   1.1   1.3   0.1
 2. 10.100.0.0                        0.0%     4    1.9   1.9   1.7   2.1   0.2
 3. 198.51.100.10                     0.0%     4    2.2   2.3   2.2   2.4   0.3

The full setup is explained if you click for more

This netlab has been configured using the official available documentation for the JUNOS vSRX appliance. This is my first ever JUNOS netlab, so if there are any obvious errors, send me and email.

I have been thinking about methods explaining specific JUNOS TACACS+ configuration steps. So it would make sense for someone not familiar with AAA JUNOS configuration, but maybe familiar with others vendors RBAC concepts.

This IP networking example uses clear text protocols like

• telnet
• cleartext password
• etc.

This is about IP protocols, not about security. The JUNOS vSRX in acts as a router in a trusted networking environment. Everything is allowed, to focus on the most simple example setup.

• Everything allowed
• IP forwarding first
• Packet filtering disabled

This is a sandbox IP networking solution.

Topology

IP addressing

The IP addressing used in this netlab. 4 appliances:

Authenticating example demo[0-3] users connecting from node-10 to FW170.

VSA's and RBAC roles

Finding the default RBAC or roles using RADIUS/TACACS+ VSA's vendor specific attributes. Most vendors publish VSA's on the RADIUS section in the documentation only. Sometimes VSA's are found on the TACACS+ documentation section.

The generic search terms in the vendors documentation, to have search results quickly:

• VSA
• RADIUS VSA
• TACACS+ VSA
• Vendor Specific Attribute

Configure the TACACS+ deamon using vendor's VSA's.

IOS-XR example VSA's

Vendors Cisco IOS-XR - Predefined Task Groups:

Table overview:

I have failed at finding IOS-XR command(s) to display these shown above in a handy overview. This is the closest of a IOS-XR command to display the defaults:

show aaa usergroup ?

Showing following output:

RP/0/0/CPU0:ios#show aaa usergroup ?
  |              Output Modifiers
  root-lr        Name of the usergroup
  netadmin       Name of the usergroup
  operator       Name of the usergroup
  retrieve       Name of the usergroup
  sysadmin       Name of the usergroup
  maintenance    Name of the usergroup
  root-system    Name of the usergroup
  provisioning   Name of the usergroup
  read-only-tg   Name of the usergroup
  serviceadmin   Name of the usergroup
  cisco-support  Name of the usergroup
  WORD           Name of the usergroup
  <cr>

VRP example VSA's

VRP, depending on the hardware platfrom, most differences are between switches and routers. This is from a VRP routing platform much like f.e.: NE-40,NE5000E, NE9000 :

Huawei VRP

Huawei VRP - NE9000 AAA and User Management Configuration Commands

Handy VRP CLI command to show the RBAC defaults:

display aaa user-group

Since the documentation above will most probably disappear in the future, here the output direct from the command line. Here a overview of the VRP router default RBAC groups:

<HUAWEI> display aaa user-group
------------------------------------------------------
User-group-name                          User-group-id
------------------------------------------------------
manage-ug                                            1
system-ug                                            2
monitor-ug                                           3
visit-ug                                             4
------------------------------------------------------
Total 4, 4 printed

Offer a ready to use pre-configured default-state 4 level RBAC framework, using vendors RADIUS and TACACS+ VSA's.

JUNOS example VSA's - Vendor Specific Attributes

JUNOS has something very similar, it results in the same state as above, but needs a bit more configuration at the end. It is not out-of-the box usable in the shipped state. The JUNOS configuration lacks additional glue information to get active.

This is the list of the JUNOS/vSRX availble VSA's needed for the TACACS+ daemon configuration. This is from JUNOS docs

...
service = junos-exec {
    local-user-name = <username-local-to-router>
    allow-commands = "<allow-commands-regex>"
    allow-configuration-regexps = "<allow-configuration-regex>"
    deny-commands = "<deny-commands-regex>"
    deny-configuration-regexps = "<deny-configuration-regex>"
}
...

This section above will be used to some part in the TACACS+ configuration. The prefix service = junos-exec setting.

• JUNOS login class overview

The local available class is shown when trying to configure a example user:

demo0@FW170# set system login user NET-ent class ?
Possible completions:
  <class>              Login class
  operator             permissions [ clear network reset trace view ]
  read-only            permissions [ view ]
  super-user           permissions [ all ]
  unauthorized         permissions [ none ]
[edit]

TACACS+

Prior the JUNOS vSRX configuration setup, the mandatory working TACACS+ daemon configuration.

TACACS+ server IP settings:

Overview of the TACACS+ configured users and groups.

click for more