WAAS Express/APPNAV XE使用aaa命令授权
Contents
Introduction
本文提供配置广域应用程序(WAAS) Express/APPNAV XE细节使用终端访问控制器访问控制系统(TACACS)和认证、授权和认为的(AAA) authorization命令。
Prerequisites
Requirements
Cisco 建议您了解以下主题：
- Cisco WAAS
- AAA授权
- TACACS
Components Used
本文档中的信息基于以下软件和硬件版本：
- WAAS 6.1.1x
- 2900路由器
- IOS Versoin 15.2(4)M3
The information in this document was created from the devices in a specific lab environment.All of the devices used in this document started with a cleared (default) configuration.If your network is live, make sure that you understand the potential impact of any command.
背景信息
WAAS中央管理器要求安全壳SSH和安全的HTTPS为了访问WAAS Express和APPNAV - XE路由器。
安全壳SSH使用初始配置/registratoin。
HTTPS使用持续的配置和监视。
通常HTTPS和AAA配置的组合在设备防止中央管理器正确通信与这些设备。
示例TACACS设置
aaa new-model ! ! aa group server tacacs+ tacacsgroup server name server1 server name server2 aaa authentication login AUTH group AAA-Servers aaa authorization commands 1 PRIV1 group AAA-Servers aaa authorization commands 15 PRIV15 group AAA-Servers aaa authorization exec AUTHLIST group AAA-Servers
示例HTTPS配置
ip http server
ip http authentication aaa exec-authorization AUTHLIST
ip http authentication aaa command-authorization 1 PRIV1 ip http authentication aaa command-authorization 15 PRIV15 ip http authentication aaa login-authentication AUTH ip http secure-server
ip http secure-trustpoint TP-self-signed-2945720990
ip http client source-interface GigabitEthernet0/0
ip http client secure-trustpoint TP-self-signed-2945720990
命令由在WAAS Express/APPNAV XE的CM负责通过HTTP
这是中央管理器在远端设备需要为了能运作命令的列表。
配置模式CLIs
do show running-config | section crypto pki trustpoint
crypto pki export
EXEC模式CLIs
WAASX -状态
show waas token | format show waas status | format show waas alarms | format show running-config | section hostname show ip interface brief | format show interfaces | include line protocol | Internet address | address is | *uplex show running-config brief | include clock timezone show clock show crypto pki trustpoints | include Trustpoint show inventory
WAASX -配置
show parameter-map type waas waas_global | format show class-map type waas | format show policy-map type waas | format write memory
WAASX -统计数据
show waas statistics peer | format show waas statistics application | format show waas connection brief show waas statistics accelerator http-express | format show waas statistics accelerator http-express https | format show waas statistics accelerator ssl-express | format show waas statistics class | format show waas statistics accelerator cifs-express detail | format
注册
registration show waas status extended | format
AppNav XE
show service-insertion token | format show service-insertion status | format show class-map type appnav | format show ip int br | format show service-insertion service-context | format show service-insertion service-node-group | format show service-insertion statistics service-node-group | format show policy-map type appnav | format show policy-map target service-context | format show service-insertion config service-context | format show service-insertion config service-node-group | format show service-insertion config appnav-controller-group | format show service-insertion alarms | format show ip access-list show vrf show running-config | section interface show running-config | include service-insertion swap src-ip
Troubleshoot
在终端设备的不正确AAA或HTTP配置能的注册和状态更新故障导致故障。
在WAAS中央管理器CLI
确认您能从CM CLI的SSH到远端设备。
#ssh <device-name>
enable (event)在CM的cms调试和在注册时查看cms.log和waasx-audit.log文件，推出设置和统计数据收集。
# debug cms waasx-regis # debug cms router-config # debug cms stats (config)# logging disk priority 7
# cd errorlog
# type-tail cms.log follow # type-tail waasx-audit.log follow
示例日志条目，当CM不能推进WAAS快速的命令或AppNav XE。
05/27/2016 00:14:03.760 [I] cdm(RtrSync-40) Configuration commands failed on the device CeConfig_2875943/USNY25W39-R02. Not Taking backup of complete device configuration.
05/27/2016 00:14:03.774 [W] cdm(RtrSync-64) 700001 Failed configuration commands are ...
05/27/2016 00:14:03.774 [W] cdm(RtrSync-64) 700001
class-map type appnav match-any HTTPS
CLI:class-map type appnav match-any HTTPS
Status:8
Output:Command authorization failed.
测试从浏览器的HTTPS访问
您能登陆到HTTP接口。
https://<IP_ADDRESS>/level/15/exec/-/
然后请键入您的命令到
部分。
工作的示例显示invetory命令
失败的示例显示库存命令
调试在WAAS Express路由器
#debug AAA授权
成功Running命令
Jul 5 07:09:19.161: AAA/AUTHOR/TAC+: (2935402750): user=waasx
Jul 5 07:09:19.161: AAA/AUTHOR/TAC+: (2935402750): send AV service=shell
Jul 5 07:09:19.161: AAA/AUTHOR/TAC+: (2935402750): send AV cmd=show
Jul 5 07:09:19.161: AAA/AUTHOR/TAC+: (2935402750): send AV cmd-arg=vrf
Jul 5 07:09:19.161: AAA/AUTHOR/TAC+: (2935402750): send AV cmd-arg=
Jul 5 07:09:19.365: AAA/AUTHOR (2935402750): Post authorization status = PASS_ADD
认证失败
Jul 5 07:08:32.485: AAA/AUTHOR/TAC+: (819547031): user=waasx
Jul 5 07:08:32.485: AAA/AUTHOR/TAC+: (819547031): send AV service=shell
Jul 5 07:08:32.485: AAA/AUTHOR/TAC+: (819547031): send AV cmd=show
Jul 5 07:08:32.485: AAA/AUTHOR/TAC+: (819547031): send AV cmd-arg=inventory
Jul 5 07:08:32.485: AAA/AUTHOR/TAC+: (819547031): send AV cmd-arg=
Jul 5 07:08:32.685: AAA/AUTHOR (819547031): Post authorization status = FAIL
反馈