For most of my helpdesk time, networking meant checking a link light.

This project put me on the other side. You decide who logs into the switch and how the config reaches it.

At Tegria I supported two small rural hospitals alongside a larger health system. Both sites used the same local admin account and password on every switch. That account gave full privilege. You could SSH and change anything. You logged no per-person action. You touched one switch at a time over CLI.

Auth, then distribution

You fix auth first. I built a read-only role on the switches and pointed AAA to RADIUS backed by Microsoft NPS and Active Directory. Hospital staff who need read access get the read-only role. Engineers keep the privileged role. Both roles authenticate to AD. You remove the shared local as primary.

The switch config stays small:

aaa new-model
radius server HOSPITAL-NPS
 address ipv4 10.x.x.10 auth-port 1812 acct-port 1813 key <secret>
!
aaa authentication login default group radius local
aaa authorization exec default group radius local
!
username fallback privilege 15 secret <local>

You map AD groups to roles in NPS. You keep local as fallback if RADIUS goes down. That fallback gives you a safety net.

You fix distribution next. You stop SSHing switch by switch. You push standard configs with Ansible. You keep an inventory and a template in the playbook. You run one push to both sites and you diff before you commit.

# inventory - two hospitals, same roles
[hospital_switches]
hosp-a-sw01 ansible_host=10.x.x.11
hosp-a-sw02 ansible_host=10.x.x.12
hosp-b-sw01 ansible_host=10.y.y.11

Current state

You can log in with the new role model on a subset of switches at both sites. You validated the RADIUS path there. You tested Ansible templates and you verified the inventory. You plan the full rollout next. I note that status so you see where the work stands.

Move to network engineering

You see production change control here, not a lab exercise. Two hospitals need correct AAA and repeatable config. You use device-level AAA for per-person accountability and you use Ansible for repeatability. Those two practices carry you from desktop support into network engineering. You lead with this work and you place desktop duties last.

Shared locals do not scale. Manual CLI does not scale. You replace the first with RADIUS and the second with Ansible, and you can run a small network without living in its CLI.

Status: in progress: I built and validated roles at two sites, Ansible standardization rolls out next. Stack: Ansible, RADIUS, NPS, switch AAA/RBAC. HIPAA-regulated environments.