Feedback
Table Of Contents
Enabling Management Protocols: NTP, SNMP, and Syslog
Understanding Network Management Basics
Enabling the Network Time Protocol
Disabling the Logging of Access Interfaces
Confirming the Final Running Configuration
Local and Remote Server Authentication
RADIUS Configuration Task List
Configure Router to RADIUS Server Communication
Configure Router to Use Vendor-Specific RADIUS Attributes
Configure Router for Vendor-Proprietary RADIUS Server Communication
Configure Router to Query RADIUS Server for Static Routes and IP Addresses
Configure Router to Expand Network Cisco AS5800 Port Information
Vendor-Proprietary RADIUS Attributes
RADIUS Cisco IOS Software Support
Securing Access to Privileged EXEC and Configuration Mode
Communicating Between the Access and Security Servers
Configuring Authentication on a TACACS+ Server
Defining Authentication Method Lists
Authentication Method List Examples
Applying Authentication Method Lists
Configuring Authorization on the Security Server
Configuring Authorization (Network or EXEC)
Specifying an Authorization Method
Specifying Authorization Parameters on a TACACS+ Server
Administration
This chapter describes management protocols and Network Access Server (NAS) security and control functionality with AAA and RADIUS servers.
•
Enabling Management Protocols: NTP, SNMP, and Syslog
–
–
–
•
Remote Monitor (RMON)
Remote Monitoring (RMON) is an Internet Engineering Task Force (IETF) monitoring standard (RFC 1757) that allows console systems and network monitors to exchange statistical and functional monitoring data, through RMON-compliant console managers and network probes. RMON provides network administrators with flexibility to satisfy networking demands through console and network monitoring probes to obtain fault diagnostics, planning, and performance information.
RMON delivers information in nine unique monitoring element groups that provide specific types of data, which satisfies common network-monitoring requirements. Some RMON groups are dependent upon others for support, but each is optional so that it is not necessary for vendors to support all groups within the management information base (MIB). See Table 4-1 for RMON group functions.
Enabling Management Protocols: NTP, SNMP, and Syslog
This section describes how to enable basic management protocols on a Cisco AS5800 as part of a dial access service. It does not however, describe how to integrate the Cisco IOS software with NT or UNIX servers. Management protocols are described only from the perspective of the Cisco IOS software.
Understanding Network Management Basics
Figure 4-1 shows a logical perspective of how management protocols interact between the Cisco IOS software (client) and a network element management server. Dashed lines represent different protocols and functions.
•
•
•
Figure 4-1 NTP, SNMP, and Syslog Interactions
Table 4-2 provides the RFCs and URLs for the management protocols described in this section.
For more information about system management, refer to Cisco IOS Release 12.0 Configuration Fundamentals Configuration Guide and Command Reference, available online at
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/index.htmEnabling the Network Time Protocol
The Network Time Protocol (NTP) provides a common time base for networked routers, servers, and other devices. A synchronized time enables you to correlate syslog and Cisco IOS debug output to specific events. For example, you can find call records for specific users within one millisecond.
Comparing logs from various networks is essential for:
•
•
•
Without precise time synchronization between all the various logging, management, and AAA functions, time comparisons are not possible.
An NTP enabled network usually gets its time from an authoritative time source, such as a Cisco router, radio clock, or an atomic clock attached to a timeserver. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two machines to within a millisecond of each another. NTP runs over UDP, which in turn runs over IP.
Step 1
Step 2
!ntp update-calendarntp server 172.22.66.18 prefer!Step 3
5800-NAS# show ntp statusClock is synchronized, stratum 5, reference is 172.22.66.18nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**24reference time is BB944312.4451C9E7 (23:11:30.266 PDT Wed Sep 22 1999)clock offset is 0.5343 msec, root delay is 13.26 msecroot dispersion is 18.02 msec, peer dispersion is 0.09 msec5800-NAS#The following command identifies how often the NAS is polling and updating to the stratum clock. An asterisk (*) next to the NTP servers IP address indicates successful synchronization with the stratum clock.
5800-NAS# show ntp associationaddress ref clock st when poll reach delay offset disp*~172.22.66.18 172.60.8.1 16 46 64 377 1.0 0.53 0.1* master (synced), # master (unsynced), + selected, - candidate, ~ configured5800-NAS#
Enabling Syslog
The Cisco IOS software can send syslog messages to one or more element manager servers. Syslog messages are then collected by a standard UNIX or NT type syslog daemon.
Syslog enables you to:
•
•
•
Figure 4-2 shows the Cisco IOS software sending syslog data to an element manager. Syslog data either stays in the Cisco IOS software buffer, or is pushed out and written to the element managers hard disk.
Figure 4-2 Syslog Messages Written to Hard Disk
Note
Step 1
!service timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezone!Step 2
5800-NAS# show loggingSyslog logging: enabled (0 messages dropped, 1 flushes, 0 overruns)Console logging: level debugging, 1523 messages loggedMonitor logging: level debugging, 0 messages loggedBuffer logging: level debugging, 911 messages loggedTrap logging: level informational, 44 message lines logged5800-NAS(config)# no logging console5800-NAS(config)# ^Z5800-NAS# show loggingSyslog logging: enabled (0 messages dropped, 1 flushes, 0 overruns)Console logging: disabledMonitor logging: level debugging, 0 messages loggedBuffer logging: level debugging, 912 messages loggedTrap logging: level informational, 45 message lines logged
Caution
Step 3
!logging 172.22.66.18logging buffered 10000 debugginglogging trap debugging!Table 4-3 describes the commands in the previous configuration fragment.
If you are working with multiple network access servers, assign a different logging facility tag to each server. Syslog information can be collected and sorted into different files on the syslog server.
For example:
•
•
•
Assigning a different tag to each device enables you to intelligently sort and view syslog messages:
!logging facility local7!Step 4
5800-NAS# show loggingSyslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)Console logging: disabledMonitor logging: level debugging, 0 messages loggedBuffer logging: level debugging, 2 messages loggedTrap logging: level debugging, 53 message lines loggedLogging to 172.22.66.18, 2 message lines loggedLog Buffer (10000 bytes):Sep 26 16:32:02.848 PDT: %SYS-5-CONFIG_I: Configured from console by admin on consoleSep 26 16:33:16.069 PDT: %SYS-5-CONFIG_I: Configured from console by admin on console5800-NAS#
Enabling SNMP
The SNMP traps generated by Cisco routers provide:
•
•
•
•
The Cisco IOS software generates SNMP traps based on the features that the Cisco IOS software supports.
Figure 4-3 shows the interactions and timing of the SNMP protocol between the EM (SNMP manager) and the NAS (SNMP agent). Traps are unsolicited messages sent from the NAS to the EM. Four functions of SNMP include: trap, get request, get next, and set request.
Figure 4-3 SNMP Event Interaction and Timing
Note
http://www.cisco.com/warp/public/477/SNMP/snmp_traps.html
Step 1
•
•
!snmp-server contact admin user@the.docsnmp-server location 5800-NAS-corporatesnmp-server community poptarts RO 8snmp-server community pixysticks RW 5snmp-server host 172.22.66.18 maddogsnmp-server trap-source Loopback0snmp-server enable traps snmp!access-list 5 permit 172.22.67.1access-list 5 permit 0.0.0.1 172.22.68.20access-list 8 permit 172.22.67.1access-list 8 permit 0.0.0.1 172.22.68.20!Table 4-4 describes commands in the previous configuration fragment.
Caution
Step 2
Excessive polling will:
•
•
•
5800-NAS# show snmpChassis: 11811596Contact: admin user@the.docLocation: 5800-NAS-corporate0 SNMP packets input0 Bad SNMP version errors0 Unknown community name0 Illegal operation for community name supplied0 Encoding errors0 Number of requested variables0 Number of altered variables0 Get-request PDUs0 Get-next PDUs0 Set-request PDUs0 SNMP packets output0 Too big errors (Maximum packet size 1500)0 No such name errors0 Bad values errors0 General errors0 Response PDUs0 Trap PDUsSNMP logging: enabledLogging to 172.22.66.18.162, 0/10, 0 sent, 0 dropped.5800-NAS#
Disabling the Logging of Access Interfaces
Limit the amount of output logged from the group-async interface and ISDN D channels. Carefully choose the data sources for system management purposes. AAA accounting and the modem-call record terse feature provides the best data set for analyzing ISDN remote node device activity.
Link status up-down events and SNMP trap signals:
•
•
The following configuration fragment disables logging on access interfaces:
!interface Serial 0:23no logging event link-statusno snmp trap link-status!interface Serial 1:23no logging event link-statusno snmp trap link-status!interface Serial 2:23no logging event link-statusno snmp trap link-status!interface Serial 3:23no logging event link-statusno snmp trap link-status!interface Group-Async 1no logging event link-statusno snmp trap link-status!Confirming the Final Running Configuration
The following is an example of the Cisco AS5800 running configuration with Cisco IOS Release 12.0(4) XL1 installed.
5800-NAS# show running-configBuilding configuration...Current configuration:!version 12.xservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryption!hostname 5800-NAS!logging buffered 10000 debuggingno logging consoleaaa new-modelaaa authentication login default localaaa authentication ppp default if-needed localenable secret 5 $1$LKgL$tgi19XvWn7fld7JGt55p01!username dude password 7 045802150C2Eusername admin password 7 044E1F050024!!!shelf-id 0 router-shelfshelf-id 1 dial-shelf!!!resource-pool disable!modem-pool Defaultpool-range 1/2/0-1/10/143!!spe 1/2/0 1/10/11firmware ios-bundled defaultmodem recovery action noneip subnet-zerono ip source-routeip host guessme 172.22.100.9ip domain-name the.netip name-server 172.22.11.10ip name-server 172.22.12.11!async-bootp dns-server 172.30.10.1 172.30.10.2isdn switch-type primary-niisdn voice-call-failure 0!!controller T3 1/0/0framing m23cablelength 0t1 4 controller!controller T1 1/0/0:4framing esfpri-group timeslots 1-24!!voice-port 1/0/0:4:D!!process-max-time 200!interface Loopback0ip address 172.22.99.1 255.255.255.255no ip directed-broadcast!interface Loopback1ip address 172.22.90.1 255.255.255.0no ip directed-broadcast!interface FastEthernet0/1/0ip address 172.22.66.23 255.255.255.0no ip directed-broadcast!interface Serial1/0/0:4:23no ip addressno ip directed-broadcastno snmp trap link-statusisdn switch-type primary-niisdn incoming-voice modemno cdp enable!interface Group-Async0ip unnumbered FastEthernet0/1/0no ip directed-broadcastencapsulation pppasync mode interactiveno snmp trap link-statuspeer default ip address pool addr-poolno cdp enableppp authentication chap papgroup-range 1/2/00 1/10/143!ip local pool addr-pool 172.22.90.2 172.22.90.254ip classlessip route 0.0.0.0 0.0.0.0 172.22.66.1no ip http server!logging trap debugginglogging 172.22.66.18access-list 5 permit 172.22.67.1access-list 5 permit 0.0.0.1 172.22.68.20access-list 8 permit 172.22.67.1access-list 8 permit 0.0.0.1 172.22.68.20snmp-server engineID local 00000009020000D0D3424C1Csnmp-server community poptarts RO 8snmp-server community pixysticks RW 5snmp-server community maddog view v1default ROsnmp-server trap-source Loopback0snmp-server location 5800-NAS-Austinsnmp-server contact admin dude@the.netsnmp-server enable traps snmpsnmp-server enable traps isdn call-informationsnmp-server enable traps hsrpsnmp-server enable traps configsnmp-server enable traps entitysnmp-server enable traps envmonsnmp-server enable traps syslogsnmp-server enable traps rsvpsnmp-server enable traps frame-relaysnmp-server enable traps rtrsnmp-server enable traps dialsnmp-server enable traps dsp card-statussnmp-server enable traps bgpsnmp-server enable traps voice poor-qovsnmp-server host 172.22.66.18 maddog!banner login ^CThis is a secured device.Unauthorized use is prohibited by law.^C!line con 0transport input noneline aux 0transport input telnetline vty 0 4line 1/2/00 1/10/143autoselect during-loginautoselect pppmodem InOutno modem log rs232!ntp update-calendarntp server 172.22.66.18 preferendAccess Service Security
The Cisco AS5800 is designed to support a security paradigm providing authentication, authorization, and accounting (AAA) security measures using RADIUS and TACACS+.
•
•
•
This section describes how to configure security using a local database resident on your Cisco AS5800 or using a remote security database for Terminal Access Controller Access Control System with Cisco proprietary enhancements (TACACS+) and Remote Authentication Dial-In User Service (RADIUS). Refer to the "Local and Remote Server Authentication" section for local and remote authentication definitions.
Note
This section describes the following topics:
•
Local and Remote Server Authentication
This section describes the differences between local and remote security databases and the basic authentication process for each. Remote security databases described in this section include Terminal Access Controller Access Control System with Cisco proprietary enhancements (TACACS+) and Remote Authentication Dial-In User Service (RADIUS).
Generally the size of the network and type of corporate security policies and control determine whether you use a local or remote security database.
Local Security Database
If you have one or two Cisco AS5800 providing access to your network, store username and password security information on your Cisco AS5800. This is referred to as local authentication.
Remote Security Database
As your network expands, you need a centralized security database that provides username and password information each access server in the network. This centralized security database resides in a security server.
A centralized security database helps establish consistent remote access policies throughout a corporation. An example of a remote security database server is the CiscoSecure product from Cisco Systems. CiscoSecure is a UNIX security daemon, with which the administrator creates a database that defines the network users and their privileges. CiscoSecure uses a central database that stores user and group profiles with authentication and authorization information.
The Cisco AS5800 exchanges user authentication information with a TACACS+ or RADIUS database on the security server by transmitting encrypted TACACS+ or RADIUS packets across the network.
For specific information about the interaction between the security server and the Cisco AS5800, refer to the security configuration guide in the Cisco IOS configuration guides and command references documentation.
Configuring RADIUS
This section describes the Remote Authentication Dial-In User (RADIUS) security system, defines its operation, and identifies appropriate and inappropriate network environments for using RADIUS technology. RADIUS Configuration Task List describes how to configure RADIUS with the authentication, authorization, and accounting (AAA) command set. RADIUS Configuration Examples offers two possible implementation scenarios.
This section includes the following topics:
•
For a complete description of the commands used in this section, refer to information on RADIUS commands in the security command reference for your Cisco IOS release. To locate documentation of other commands that appear in this section, use the command reference master index or search online.
RADIUS Overview
RADIUS is a distributed client/server system that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a central RADIUS server. The server contains all user authentication and network service access information.
RADIUS is a fully open protocol, distributed in source code format, that can be modified to work with any security system currently available on the market.
Cisco supports RADIUS under its AAA security paradigm. RADIUS can be used with other AAA security protocols, such as TACACS+, Kerberos, or local username lookup. RADIUS is supported on all Cisco platforms.
RADIUS has been implemented in a variety of network environments that require high levels of security while maintaining network access for remote users.
Use RADIUS in the following network environments that require access security:
•
•
•
•
•
•
RADIUS is not suitable in the following network security situations:
•
–
–
–
–
•
•
RADIUS Operation
When attempting to log in and authenticate to Cisco AS5800 using RADIUS, the following steps occur:
1.
2.
3.
–
–
–
–
The ACCEPT or REJECT response is bundled with additional data that is used for EXEC or network authorization. You must first complete RADIUS authentication before using RADIUS authorization. The additional data included with the ACCEPT or REJECT packets consists of the following:
•
•
RADIUS Configuration Task List
To configure RADIUS on your Cisco AS5800, you must perform the following tasks:
•
•
•
The following configuration tasks are optional:
•
•
This section describes how to set up RADIUS for authentication, authorization, and accounting on your network, and includes the following sections:
•
•
•
•
•
•
Configure Router to RADIUS Server Communication
The RADIUS host is normally a multi-user system running RADIUS server software from Livingston, Merit, Microsoft, or another software provider. A RADIUS server and a Cisco router use a shared secret text string to encrypt passwords and exchange responses.
To configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon, and a secret text string that it shares with the router. Use the radius-server commands to specify the RADIUS server host and a secret text string.
To specify a RADIUS server host and shared secret text string, perform the following tasks in global configuration mode:
•
radius-server host {hostname | ip-address}[auth-port port-number] [acct-port port-number]•
radius-server key stringTo customize communication between the router and the RADIUS server, use the following optional radius-server global configuration commands:
•
radius-server retransmit retries•
radius-server timeout seconds•
radius-server deadtime minutesConfigure Router to Use Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the network Cisco AS5800 and the RADIUS server, by using the vendor-specific attribute (Attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. The Cisco vendor-ID is 9, and the supported option has vendor-type 1, which is named "cisco-avpair." The value is a string of the format:
protocol : attribute sep value *•
•
•
This allows the full set of features available for TACACS+ authorization to also be used for RADIUS.
For example, the following AV pair causes the Cisco "multiple named ip address pools" feature to be activated during IP authorization (during PPP's IPCP address assignment).
cisco-avpair= "ip:addr-pool=first"The following example causes a "NAS Prompt" user to have immediate access to EXEC commands.
cisco-avpair= "shell:priv-lvl=15"Other vendors have their own vendor-IDs, options, and associated VSAs. For more information about vendor-IDs and VSAs, refer to the RADIUS specification RFC 2138, "Remote Authentication Dial-In User Service (RADIUS)," described in How Does RADIUS Work?, available online at
http://www.cisco.com/warp/public/707/32.htmlTo configure the NAS to recognize and use VSAs, perform the following task in global configuration mode:
Enable the network Cisco AS5800 to recognize and use VSAs as defined by RADIUS IETF attribute 26.
radius-server vsa send [accounting|authentication]For a complete list of RADIUS attributes or more information about vendor-specific Attribute 26, refer to the RADIUS Attributes appendix.
Configure Router for Vendor-Proprietary RADIUS Server Communication
Although the IETF draft standard for RADIUS specifies a method for communicating vendor-specific information between the network Cisco AS5800 and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way. Cisco IOS software supports a subset of vendor-proprietary RADIUS attributes.
To configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you must specify the host running the RADIUS server daemon and the secret text string it shares with the Cisco device. You specify the RADIUS host and secret text string by using the radius-server commands. To identify that the RADIUS server is using a vendor-proprietary implementation of RADIUS, use the radius-server host nonstandard command.
Vendor-proprietary attributes will not be supported unless you use the radius-server host non-standard command.
To specify a vendor-proprietary RADIUS server host and a shared secret text string, perform the following tasks in global configuration mode.
Specify the IP address or host name of the remote RADIUS server host and identify that it is using a vendor-proprietary implementation of RADIUS.
radius-server host {hostname |ip-address} non-standardSpecify the shared secret text string used between the router and the vendor-proprietary RADIUS server. The router and the RADIUS server use this text string to encrypt passwords and exchange responses.
radius-server key stringConfigure Router to Query RADIUS Server for Static Routes and IP Addresses
Some vendor-proprietary implementations of RADIUS let the user define static routes and IP pool definitions on the RADIUS server, instead of on each individual Cisco AS5800 in the network. Each network Cisco AS5800 then queries the RADIUS server for static route and IP pool information.
To have the Cisco AS5800 query the RADIUS server for static routes and IP pool definitions when the device first starts up, use the following commands in global configuration mode:
radius-server configure-nas
Note
Configure Router to Expand Network Cisco AS5800 Port Information
In some situations, PPP or login authentication occurs on an interface different from the interface on which the call itself comes in. For example, in a V.120 ISDN call, login or PPP authentication occurs on a virtual asynchronous interface "ttt" but the call itself occurs on one of the channels of the ISDN interface.
The radius-server attribute nas-port extended command configures RADIUS to expand the size of the NAS-Port attribute (RADIUS IETF Attribute 5) field to 32 bits. The upper 16 bits of the NAS-Port attribute display the type and number of the controlling interface; the lower 16 bits indicate the interface undergoing authentication.
To display expanded interface information in the NAS-Port attribute field, perform the following task in global configuration mode.
Expand the NAS-Port attribute size from 16 to 32 bits to display extended interface information.
radius-server attribute nas-port extended
Note
On platforms with multiple interfaces (ports) per slot, the Cisco RADIUS implementation will not provide a unique NAS-Port attribute that permits distinguishing between the interfaces. For example, if a dual PRI interface is in slot 1, calls on both Serial1/0:1 and Serial1/1:1 will appear as NAS-Port = 20101. This is due to the 16-bit field size limitation associated with RADIUS IETF NAS-port attribute. In this case, replace the NAS-port attribute with a vendor-specific attribute (RADIUS IETF Attribute 26). The Cisco vendor-ID is 9, and the Cisco-NAS-Port attribute is subtype 2. Vendor-specific attributes (VSAs) can be turned on by entering the radius-server vsa send command. The port information in this attribute is provided and configured using the aaa nas port extended command.
To replace the NAS-Port attribute with RADIUS IETF Attribute 26 and to display extended field information, use the following commands in global configuration mode.
Enable the network Cisco AS5800 to recognize and use vendor-specific attributes as defined by RADIUS IETF Attribute 26.
radius-server vsa send [accounting | authentication]Expand the size of the VSA NAS-Port field from 16 to 32 bits to display extended interface information.
aaa nas-port extendedThe standard NAS-Port attribute (RADIUS IETF Attribute 5) will continue to be sent. If you do not want this information to be sent, you can suppress it by using the no radius-server attribute nas-port command. When this command is configured, the standard NAS-Port attribute will no longer be sent.
Specify RADIUS Authentication
After you have identified the RADIUS server and defined the RADIUS authentication key, you need to define method lists for RADIUS authentication. Because RADIUS authentication is facilitated through AAA, you need to enter the aaa authentication command, and specify RADIUS as the authentication method. For more information, refer to information on configuring authentication in the security configuration guide for your Cisco IOS release.
Specify RADIUS Authorization
AAA authorization lets you set parameters that restrict users network access. Authorization using RADIUS provides one method for remote access control, including one-time authorization or authorization for each service, per-user account list and profile, user group support, and support of IP, IPX, ARA, and Telnet. Because RADIUS authorization is facilitated through AAA, you need to issue the aaa authorization command, specifying RADIUS as the authorization method.
Specify RADIUS Accounting
The AAA accounting feature enables you to track the services users access and the amount of network resources they consume. Because RADIUS accounting is facilitated through AAA, you need to issue the aaa accounting command, specifying RADIUS as the accounting method.
RADIUS Attributes
The network Cisco AS5800 monitors the RADIUS authorization and accounting functions defined by RADIUS attributes in each user-profile.
Vendor-Proprietary RADIUS Attributes
An Internet Engineering Task Force (IETF) draft standard for RADIUS specifies a method for communicating vendor-proprietary information between the network Cisco AS5800 and the RADIUS server. Some vendors, nevertheless, have extended the RADIUS attribute set in a unique way. Cisco IOS software supports a subset of vendor-proprietary RADIUS attributes.
RADIUS Configuration Examples
RADIUS configuration examples in this section include the following:
•
•
•
RADIUS Authentication and Authorization Example
The following example shows a router configuration to authenticate and authorize using RADIUS.
aaa authentication login use-radius radius localaaa authentication ppp user-radius if-needed radiusaaa authorization exec radiusaaa authorization network radiusThese RADIUS authentication and authorization configuration commands are defined as follows:
•
•
•
•
RADIUS Authentication, Authorization, and Accounting Example
The following sample is a general configuration using RADIUS with the AAA command set.
radius-server host 123.45.1.2radius-server key myRaDiUSpassWoRdusername root password ALongPasswordaaa authentication ppp dialins radius localaaa authorization network radius localaaa accounting network start-stop radiusaaa authentication login admins localaaa authorization exec localline 1 16autoselect pppautoselect during-loginlogin authentication adminsmodem ri-is-cdinterface group-async 1encaps pppppp authentication pap dialinsThe lines in this sample RADIUS authentication, authorization, and accounting configuration are defined as follows:
•
•
•
•
•
•
•
•
Vendor-Proprietary RADIUS Configuration Example
The following example is a general configuration using vendor-proprietary RADIUS with the AAA command set.
radius-server host alcatraz non-standardradius-server key myRaDiUSpassWoRdradius-server configure-nasusername root password ALongPasswordaaa authentication ppp dialins radius localaaa authorization network radius localaaa accounting network start-stop radiusaaa authentication login admins localaaa authorization exec localline 1 16autoselect pppautoselect during-loginlogin authentication adminsmodem ri-is-cdinterface group-async 1encaps pppppp authentication pap dialinsThe lines in this example RADIUS AAA configurations are defined as follows:
•
•
•
•
•
•
•
•
•
RADIUS Cisco IOS Software Support
The following Cisco IOS software support is available for RADIUS.
1.
2.
3.
AAA Commands
aaa new-modelaaa authentication login CONSOLE noneaaa authentication login RADIUS_LIST radiusaaa authentication login TAC_PLUS tacacs+ enableaaa authentication login V.120 noneaaa authentication enable default enable tacacs+aaa authentication ppp RADIUS_LIST if-needed radiusaaa authorization exec RADIUS_LIST radius if-authenticatedaaa authorization exec V.120 noneaaa authorization network default radius if-authenticatedaaa authorization network V.120 radius if-authenticatedaaa authorization network RADIUS_LIST if-authenticated radiusaaa accounting suppress null-usernameaaa accounting delay-startaaa accounting exec default start-stop radiusaaa accounting commands 0 default start-stop radiusaaa accounting network default start-stop radiusaaa accounting connection default start-stop radiusaaa accounting system default start-stop radiusaaa nas port extendedRADIUS Commands
ip radius source-interface subinterface-nameradius-server configure-nasradius-server dead-time minutesradius-server extended-portnames (*deprecated)radius-server attribute nas-port extended (old)radius-server attribute nas-port format {a | b | c} (new)radius-server host {hostname | ip} [auth-port port#] [acct-port port#]radius-server host {hostname | ip} non-standardradius-server host {hostname | ip} ignoreradius-server host {hostname | ip}radius-server key {string}radius-server retransmit retriesradius-server timeout secondsRADIUS & AAA Debug Commands
debug radiusdebug aaa authorizationdebug aaa authenticationdebug aaa peruserdebug ppp negotiationdebug ppp authenticationdebug isdn q931Configuring TACACS+
The following global configuration commands provide basic security and local database configuration.
Step 1
5800-1(config)# aaa new-modelStep 2
5800-1(config)# aaa authentication login default localStep 3
5800-1(config)# aaa authentication login console noneStep 4
5800-1(config)# aaa authentication ppp default if-needed localStep 5
5800-1(config)# username username password password
TACACS+ Authentication
Use the AAA facility to authenticate users with either a local or remote security database. For more information about a local and remote security database, refer to the "Local and Remote Server Authentication" section.
Whether you maintain a local or remote security database, or use TACACS+ or RADIUS authentication and authorization, the process of configuring the Cisco AS5800 for these different databases and protocols is similar. The basic process of configuring the Cisco IOS software for authentication requires the following tasks:
1.
2.
4.
–
–
–
–
5.
Securing Access to Privileged EXEC and Configuration Mode
The first step is to secure access to privileged EXEC (enable) mode. Enable mode provides access to configuration mode, which enables any type of configuration change to the Cisco AS5800. To secure privileged EXEC mode access, use one of the following commands.
•
•
The enable secret password takes precedence over the enable password when it exists. The same password cannot be used for both commands. You can view the encrypted version of the enable secret password using the show running-config or show startup-config commands. (The encrypted version of the password is noted with * in the following example.)
5800-1(config)# show running-configUsing 1899 out of 126968 bytes!Version x AA...!hostname 5800-1!enable secret 5 $1$60L4$X2JYOwoDc0.kqa1lo0/w8/*...
Note
Caution
Note
The following global configuration commands provide an encrypted password using enable secret.
Step 1
5800-1(config)# enable secret password5800-1(config)#Step 2
5800-1(config)# exit5800-1#Step 3
5800-1# show running-configBuilding configuration...Current configuration:!version x AA! some of the configuration skippedenable secret 5 $1$h7dd$VTNs4.BAfQMUU0Lrvw6570**! the rest of the configuration skipped
Note
Step 4
5800-1(config)# Ctrl-Z5800-1#Step 5
5800-1# copy running-config startup-configYou can also specify additional protection for privileged EXEC mode, including the following:
•
•
•
•
For more information about these security tools, refer to the security configuration guide for your Cisco IOS release in the Cisco IOS configuration guides and command references documentation.
Communicating Between the Access and Security Servers
This section describes the Cisco IOS software commands that enable the Cisco AS5800 to communicate with a security server. This procedure is similar for communicating with TACACS+ and RADIUS servers, and the following sections describe the process.
If you are using a remote security server for authentication and authorization, you must configure the security server before performing the tasks described in this section. TACACS+ Security Examples shows typical TACACS+ and RADIUS server entries corresponding to the Cisco AS5800 security configurations.
Communicating with a TACACS+ Server
The following global configuration commands enable communication between the TACACS+ security (database) server and the Cisco AS5800.
Step 1
5800-1(config)# tacacs-server host {hostname | ip-address}Step 2
5800-1(config)# tacacs-server key shared-secret-text-stringStep 3
5800-1(config)# Ctrl-Z5800-1#Step 4
5800-1# copy running-config startup-configFor example, to enable the remote TACACS+ server to communicate with the Cisco AS5800, enter the commands as follows:
5800-1# configure terminal5800-1(config)# tacacs-server host alcatraz5800-1(config)# tacacs-server key abra2cadThe host name of the TACACS+ server in the previous example is alcatraz. The key in the previous example (abra2cad) is the encryption key shared between the TACACS+ server and the Cisco AS5800. Substitute your own TACACS+ server host name and password for those shown.
For more information about these commands, refer to the security command reference for your Cisco IOS release, which is part of the Cisco IOS configuration guides and command references documentation.
Configuring Authentication on a TACACS+ Server
On most TACACS+ security servers, there are three ways to authenticate a user for login:
•
The following is the configuration for global authentication:
user = birdman {global = cleartext "birdman global password"}To assign different passwords for CHAP, and a normal login, you must enter a string for each user. Each string must specify the security protocols, state whether the password is cleartext, and specify if the authentication is performed with a DES card. The following example shows a user aaaa, who has authentication configured for CHAP and login. The users CHAP password, "chap password," is shown in cleartext and the login password has been encrypted.
user = aaaachap = cleartext "chap password"login = des XQj4892fjk}•
The default authentication is to deny authentication. You can change this at the top level of the configuration file to have the default use passwd(5) file, by issuing the following command:
default authentication = /etc/passwd•
user= bbbb {login = skey}On the Cisco AS5800, configure authentication on all lines including the VTY and Console lines by entering the following commands:
5800-1# configure terminal5800-1(config)# aaa new-model5800-1(config)# aaa authentication login default tacacs+ enable
Caution
Enabling AAA Globally
To use the AAA security facility in the Cisco IOS software, you must issue the aaa new-model command from global configuration mode.
When you issue the aaa new-model command, all lines on the Cisco AS5800 receive the implicit login authentication default method list, and all interfaces with PPP enabled have an implicit ppp authentication pap default method list applied.
Caution
Note
5800-1# configure terminal5800-1(config)# aaa new-modelDefining Authentication Method Lists
After you enable AAA globally on the Cisco AS5800, you need to define authentication method lists, which you then apply to lines and interfaces. These authentication method lists are security profiles that indicate the protocol (PPP) or login and authentication method (TACACS+, RADIUS, or local authentication).
To define an authentication method list:
1.
2.
3.
4.
5.
After defining these authentication method lists, apply them to your interfaces (synchronous or asynchronous) configured for PPP.
Refer to the "Applying Authentication Method Lists" section for information about applying these lists.
Issue the aaa authentication Command
To define an authentication method list, enter the aaa authentication global configuration command, as shown in the following example:
5800-1# configure terminal5800-1(config)# aaa authenticationSpecify Protocol or Login Authentication
After you enter aaa authentication, you must specify one of the following dial-in protocols as applicable for your network:
•
•
You can specify only one dial-in protocol per authentication method list; however, you can create multiple authentication method lists with each of these options. You must give each list a different name, as described in Identify a List Name.
If you specify the ppp option, the default authentication method for PPP is PAP. For greater security, specify CHAP. The full command is aaa authentication ppp chap.
For example, if you specify PPP authentication, the configuration looks like this:
5800-1# configure terminal5800-1(config)# aaa authentication pppIdentify a List Name
A list name identifies each authentication list. You can choose either to use the keyword default, or choose any other name that describes the authentication list. For example, you name it ppp-radius if you intend to apply it to interfaces configured for PPP and RADIUS authentication. The list name can be any alphanumeric string. Use default as the list name for most lines and interfaces, and use different names on an exception basis.
You can create different authentication method lists and apply them to lines and interfaces selectively. You can even create a named authentication method list that you do not apply to a line or interface, but which you intend to apply at some later point, such as when you deploy a new log-in method for users.
After you define a list name, you must identify additional security attributes (such as local authentication versus TACACS+ or RADIUS).
In the following example, the default authentication method list for PPP dial-in clients uses the local security database:
5800-1# configure terminal5800-1(config)# aaa authentication ppp defaultIn the following example, the PPP authentication method list name is insecure:
5800-1# configure terminal5800-1(config)# aaa authentication ppp insecureIn the following example, the login authentication method list name is deveng:
5800-1# configure terminal5800-1(config)# aaa authentication login devengSpecify the Authentication Method
After you identify a list name, you must specify an authentication method to identify how users will be authenticated. Authentication methods are defined with optional keywords in the aaa authentication command.
The following global configuration commands configure authentication methods for PPP.
Step 1
5800-1(config)# aaa new-modelStep 2
5800-1(config)# aaa authentication ppp {default | list-name} method1 [method2]Step 3
5800-1(config)# ppp authentication {chap | pap | chap pap | pap chap} [if-needed] {default | list-name} [callin]Step 4
5800-1(config)# Ctrl-Z5800-1#Step 5
5800-1# copy running-config startup-configThe keyword list-name is any character string used to name the list you are creating. The keyword method refers to the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an error, specify none as the final method in the command line.
Timesaver
You can specify multiple authentication methods for each authentication list. The following authentication method example for PPP first queries a TACACS+ server, then a RADIUS server, then the local security database. Multiple authentication methods can be useful if you have multiple types of security servers on the network, and one or more types of security server do not respond.
5800-1(config)# aaa authentication ppp testbed tacacs+ radius localIf you specify more than one authentication method and the first method (TACACS+ in the previous example) is not available, the Cisco IOS software attempts to authenticate using the next method (such as RADIUS). If, in the previous example, the RADIUS server has no information about the user, or if no RADIUS server can be found, the user is authenticated using the local username database that was populated with the username command.
If authentication fails using the first method listed, the Cisco IOS software does not permit access. It does not attempt to authenticate using the subsequent security methods if the user entered the incorrect password.
Populate the Local Username Database if Necessary
If you specify local as the security method, you must specify username profiles for each user who might log in. An example of specifying local authentication is as follows:
5800-1(config)# aaa authentication login deveng localThis command specifies that anytime a user attempts to log in to a line on an Cisco AS5800, the Cisco IOS software checks the username database. To create a local username database, define username profiles using the username global configuration command.
The following example shows how to use the username command and password:
5800-1(config)# username username password passwordThe show running-config command shows the encrypted version of the password, as follows:
5800-1# show running-configBuilding configuration...Current configuration:!version x AA! most of config omittedusername xxx password 7 0215055500070C294D
Note
Authentication Method List Examples
This section includes authentication method list examples for:
•
Users Logging In to the Cisco AS5800
The following example creates a local authentication list for users logging in to any line on the Cisco AS5800:
5800-1(config)# aaa authentication login default localThe following example specifies login authentication using RADIUS (the RADIUS daemon is polled for authentication profiles):
5800-1(config)# aaa authentication login default radiusThe following example specifies login authentication using TACACS+ (the TACACS+ daemon is polled for authentication profiles):
5800-1(config)# aaa authentication login default tacacs+Users Dialing In Using PPP
The following example creates a TACACS+ authentication list for users connecting to interfaces configured for dial-in using PPP. The name of the list is marketing. This example specifies that a remote TACACS+ daemon be used as the security database. If this security database is not available, the Cisco IOS software then polls the RADIUS daemon. Users are not authenticated if they are already authenticated on a TTY line.
5800-1(config)# aaa authentication ppp marketing if-needed tacacs+ radiusIn this example, default can be substituted for marketing if the administrator wants this list to be the default list.
Applying Authentication Method Lists
As described in Defining Authentication Method Lists, the aaa authentication global configuration command creates authentication method lists or profiles. You apply these authentication method lists to lines or interfaces by issuing the login authentication or ppp authentication command, as described in Table 4-5.
Table 4-5 Line and Interface Authentication Method Lists
login authentication
Logs directly in to the Cisco AS5800
Console port or VTY lines
aaa authentication login
ppp authentication1
Uses PPP to access IP or IPX network resources
Interface
aaa authentication ppp
1 If you issued the ppp authentication command, you must specify either CHAP or PAP authentication. PAP is enabled by default, but Cisco recommends that you use CHAP because CHAP is more secure. For more information, refer to the security configuration guide for your Cisco IOS release, which is part of the Cisco IOS configuration guides and command references documentation.
You can create more than one authentication list or profile for login and protocol authentication and apply them to different lines or interfaces. The following examples show the line or interface authentication commands that correspond to the aaa authentication global configuration command.
Login Authentication Example
The following example shows the default log-in authentication list applied to the console port and the default virtual terminal (VTY) lines on the Cisco AS5800:
5800-1(config)# aaa authentication login default local5800-1(config)# line console 05800-1(config-line)# login authentication default5800-1(config-line)# line vty 0 695800-1(config-line)# login authentication defaultIn the following example, the login authentication list named rtp2-office, which uses RADIUS authentication, is created. It is applied to all 54 lines on an configured with a channelized T1 PRI card, including the console (CTY) port, the 48 physical asynchronous (TTY) lines, the auxiliary (AUX) port, and 69 virtual terminal (VTY) lines:
5800-1(config)# aaa authentication login rtp2-office radius5800-1(config)# line 0 1185800-1(config-line)# login authentication rtp2-officeThe following sample output shows lines and their status on the Cisco AS5800.
5800-1# show lineTty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns* 0 CTY - - - - - 0 0 0/0I 1 TTY 115200/115200 - inout - - - 0 0 0/0I 2 TTY 115200/115200 - inout - - - 0 0 0/0...I 48 TTY 115200/115200 - inout - - - 0 0 0/049 AUX 9600/9600 - - - - - 0 0 0/050 VTY - - - - - 0 0 0/051 VTY - - - - - 0 0 0/052 VTY - - - - - 0 0 0/053 VTY - - - - - 0 0 0/054 VTY - - - - - 0 0 0/0PPP Authentication Example
The following example creates the PPP authentication list marketing, which uses TACACS+, and RADIUS authentication. The list marketing requires authentication only if the user has not been authenticated on another line. It is then applied to asynchronous lines 1-48 on a Cisco AS5800 and uses CHAP authentication, instead of the default of PAP.
5800-1(config)# aaa authentication ppp marketing if-needed tacacs+ radius5800-1(config)# line shelf/slot/1 shelf/slot/485800-1(config-line)# ppp authentication chap marketingTACACS+ Authorization
You can configure the Cisco AS5800 to restrict user access to the network so that users can only perform certain functions after successful authentication. As with authentication, authorization can be used with either a local or remote security database. This guide describes only remote security server authorization.
A typical configuration often uses the EXEC facility and network authorization. EXEC authorization restricts access to the EXEC, and network authorization restricts access to network services, including PPP.
Authorization must be configured on both the Cisco AS5800 and the security daemon. The default authorization is different on the Cisco AS5800 and the security server:
•
•
Timesaver
Configuring Authorization on the Security Server
You typically have the three following methods for configuring default authorization on the security server:
•
default authorization = permit•
default service = permit•
a.
b.
c.
d.
e.
f.
g.
h.
i.
Configuring Authorization (Network or EXEC)
The following global configuration commands configure network and EXEC authorization.
Step 1
5800-1(config)# aaa authorization networkStep 2
5800-1(config)# aaa authorization execStep 3
5800-1(config)# Ctrl-Z5800-1#Step 4
5800-1# copy running-config startup-config
Note
Specifying an Authorization Method
Authorization methods are defined as optional keywords in the aaa authorization command. The following global configuration command configure both network and EXEC AAA authorization. Table 4-5 defines authorization methods.
Step 1
5800-1(config)# aaa authorization {if-authenticated | local | none | radius | tacacs+}Step 2
5800-1(config)# Ctrl-Z5800-1#Step 3
5800-1# copy running-config startup-config
Specifying Authorization Parameters on a TACACS+ Server
When you configure authorization, you must ensure that the parameters established on the Cisco AS5800 correspond with those set on the TACACS+ server.
Authorization Examples
The following example uses a TACACS+ server to authorize the use of network services, including PPP. If the TACACS+ server is not available or has no information about a user, no authorization is performed, and the user can use all network services.
5800-1(config)# aaa authorization network tacacs+ noneThe following example permits the user to run the EXEC process if the user is authenticated. If the user is not authenticated, the Cisco IOS software defers to a RADIUS server for authorization information.
5800-1(config)# aaa authorization exec if-authenticated radiusThe following example configures network authorization. If the TACACS+ server does not respond or has no information about the username being authorized, the RADIUS server is polled for authorization information for the user. If the RADIUS server does not respond, the user still can access all network resources without authorization requirements.
5800-1(config)# aaa authorization network tacacs+ radius noneTACACS+ Security Examples
The following examples show complete security configuration components of a configuration file on a Cisco AS5800. Each example shows authentication and authorization.
Local TACACS+ Security Example
The following sample configuration uses AAA to configure default authentication using a local security database on the Cisco AS5800. All lines and interfaces have the default authentication lists applied. Users aaaa, bbbb, and cccc have been assigned privilege level 7. This prevents them from issuing ppp and slip commands because these commands have been assigned to privilege level 8.
aaa new-modelaaa authentication login default localaaa authentication arap default localaaa authentication ppp default localaaa authorization exec localaaa authorization network localaaa authorization!username aaaa privilege exec level 7 privilege network level 8 password 7 095E470B1110username bbbb privilege network level 7 password 7 0215055500070C294Dusername cccc privilege network level 7 password 7 095E4F10140A1916!privilege exec level 8 pppprivilege exec level 8 slipline console 0login authentication default!line 2/2/0 2/2/47interface Group-Async1ppp authentication chap defaultgroup-range 2/2/0 2/2/47The following configuration displays the sign-on dialog from a remote PC:
atdt5551234CONNECT 14400/ARQ/V32/LAPM/V42BISUser Access VerificationUsername: usernamePassword: password5800-1> enablePassword: password5800-1#TACACS+ Security Example for Login and PPP
The following example shows how to create and apply the following authentication lists:
•
•
•
Note
hostname 5800-1!tacacs-server host aaatacacs-server key 007!aaa authentication login rtp-office tacacs+aaa authentication ppp marketing if-needed tacacs+!line console0login authentication rtp-office!tacacs-server host aaatacacs-server key 007!aaa authentication login rtp-office tacacs+aaa authentication ppp marketing if-needed tacacs+!line console0login authentication rtp-office!interface group-async0ppp authentication chap marketinggroup-range 2/2/0 2/2/47!line 2/2/0 2/2/47The following example shows how to create the following authentication lists:
•
•
•
radius-server host aaaradius-server key 007!privilege exec level 14 configureprivilege exec level 14 reloadprivilege exec level 8 ppp!aaa authentication login fly radiusaaa authentication ppp itsme if-needed radiusaaa authorization network radiusaaa authorization exec radius!line 2/1/0 2/1/53login authentication fly!interface group-async6ppp authentication chap itsmegroup-range 2/2/0 2/2/47
