User Accounts and Authentication
After configuring the hostname, time zone, and identity of the MX204, MX301, MX304, MX10004, or MX10008 routers, you can create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.
A user account is an identity that allows a user to access a particular device and includes a username, password (or authentication method), and login class (permission level). For more information, see User Accounts.
Authentication is the process of verifying the user's identity before granting access. For more information, see User Authentication Overview.
The MX Series routers include predefined login classes such as operator, read-only, superuser, unauthorized. For more information, see Login Classes.
Local User Account
Initially, when you start any MX series router, it defaults to a root user with no password option. However, you are not allowed to do any configuration changes at the root level.
To make configuration changes, you must log in with a password-protected account. This is the simplest authentication method, where the username and password are stored locally on the switch. You can create a user and define permission and system access using login classes. For more information, see User Accounts and Login Classes.
Example: To create an admin user
set system login user admin class super-user set system login user admin authentication plain-text-password
RADIUS Authentication
This centralized authentication method validates users attempting to access a network device, which is a standard practice in telecom networks. For more information, see RADIUS Authentication.
To configure a RADIUS server:
set system radius-server server-address secret password set system radius-server server-address source-address ip-address
To configure an authentication order:
set system authentication-order [radius password]
This means, try the RADIUS method of authentication first, if that fails, use local user authentication method.
TACACS+ Authentication
This method serves as an alternative for authenticating network device access, providing both authentication and command authorization. This approach is widely used in enterprise networks. For more information, see TACACS+ Authentication.
To configure TACACS+ server:
set system tacplus-server server-address set system tacplus-server server-address secret password set system tacplus-server server-address source-address source-address
To configure an authentication order:
set system authentication-order [tacplus radius password]