Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software. Configuration Guide (2022) - page 8
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Note: If you configure both global and per-server functions (timeout, retransmission, and key commands) on the switch,
the per-server timer, retransmission, and key value commands override global timer, retransmission, and key value
commands. For information on configuring these settings on all RADIUS servers, see Configuring Settings for All RADIUS
Servers, page 176.
You can configure the switch to use AAA server groups to group existing server hosts for authentication. For more
information, see Defining AAA Server Groups, page 174.
RADIUS Login Authentication
To configure AAA authentication, you define a named list of authentication methods and then apply that list to various
ports. The method list defines the types of authentication to be performed and the sequence in which they are performed;
it must be applied to a specific port before any of the defined authentication methods are performed. The only exception
is the default method list (which, by coincidence, is named default). The default method list is automatically applied to
all ports except those that have a named method list explicitly defined.
Radius Method List
A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user.
You can use method lists to designate one or more security protocols to be used (such as TACACS+ or local username
lookup), which ensures a backup system if the initial method fails. The software uses the first method listed to
authenticate, to authorize, or to keep accounts on users. If that method does not respond, the software selects the next
method in the list. This process continues until there is successful communication with a listed method or the method list
is exhausted.
AAA Server Groups
You can configure the switch to use AAA server groups to group existing server hosts for authentication. You select a
subset of the configured server hosts and use them for a particular service. The server group is used with a global
server-host list, which lists the IP addresses of the selected server hosts.
Server groups also can include multiple host entries for the same server if each entry has a unique identifier (the
combination of the IP address and UDP port number), allowing different ports to be individually defined as RADIUS hosts
providing a specific AAA service. If you configure two different host entries on the same RADIUS server for the same
service, (for example, accounting), the second configured host entry acts as a failover backup to the first one.
You use the server group server configuration command to associate a particular server with a defined group server. You
can either identify the server by its IP address or identify multiple host instances or entries by using the optional auth-port
and acct-port keywords.
RADIUS Authorization for User Privileged Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch uses information
retrieved from the user’s profile, which is in the local user database or on the security server, to configure the user’s
session. The user is granted access to a requested service only if the information in the user profile allows it.
You can use the aaa authorization global configuration command with the radius keyword to set parameters that restrict
a user’s network access to privileged EXEC mode.
The aaa authorization exec radius local command sets these authorization parameters:
Use RADIUS for privileged EXEC access authorization if authentication was performed by using RADIUS.
Use the local database if authentication was not performed by using RADIUS.
Note: Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been
configured.
156
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
RADIUS Accounting
The AAA accounting feature tracks the services that users are accessing and the amount of network resources that they
are consuming. When AAA accounting is enabled, the switch reports user activity to the RADIUS security server in the
form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the
security server. This data can then be analyzed for network management, client billing, or auditing.
Establishing a Session with a Router if the AAA Server is Unreachable
The aaa accounting system guarantee-first command guarantees system accounting as the first record, which is the
default condition. In some situations, users might be prevented from starting a session on the console or terminal
connection until after the system reloads, which can take more than 3 minutes.
To establish a console or Telnet session with the router if the AAA server is unreachable when the router reloads, use
the no aaa accounting system guarantee-first command.
Vendor-Specific RADIUS Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific
information between the switch and the RADIUS server by using the vendor-specific attribute (attribute 26).
Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use.
The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the
specification. Cisco’s vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The
value is a string with this format:
protocol : attribute sep value *
protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an
appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification, and sep is = for mandatory attributes
and is * for optional attributes. The full set of features available for TACACS+ authorization can then be used for RADIUS.
For example, this AV pair activates Cisco’s multiple named ip address pools feature during IP authorization (during PPP
IPCP address assignment):
cisco-avpair= ”ip:addr-pool=first“
Vendor-Proprietary RADIUS Server Communication
Although an IETF draft standard for RADIUS specifies a method for communicating vendor-proprietary information
between the switch and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way.
Cisco IOS software supports a subset of vendor-proprietary RADIUS attributes.
As mentioned earlier, to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you must specify the
host running the RADIUS server daemon and the secret text string it shares with the switch. You specify the RADIUS host
and secret text string by using the radius-server global configuration commands.
Switch Access with Kerberos
This section describes how to enable and configure the Kerberos security system, which authenticates requests for
network resources by using a trusted third party. To use this feature, the cryptographic (that is, supports encryption)
versions of the switch software must be installed on your switch.
You must obtain authorization to use this feature and to download the cryptographic software files from Cisco.com. For
more information, see the release notes for this release.
157
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Understanding Kerberos
Kerberos is a secret-key network authentication protocol, which was developed at the Massachusetts Institute of
Technology (MIT). It uses the Data Encryption Standard (DES) cryptographic algorithm for encryption and authentication
and authenticates requests for network resources. Kerberos uses the concept of a trusted third party to perform secure
verification of users and services. This trusted third party is called the key distribution center (KDC).
Kerberos verifies that users are who they claim to be and the network services that they use are what the services claim
to be. To do this, a KDC or trusted Kerberos server issues tickets to users. These tickets, which have a limited lifespan,
are stored in user credential caches. The Kerberos server uses the tickets instead of usernames and passwords to
authenticate users and network services.
Note: A Kerberos server can be a switch that is configured as a network security server and that can authenticate users
by using the Kerberos protocol.
The Kerberos credential scheme uses a process called single logon. This process authenticates a user once and then
allows secure authentication (without encrypting another password) wherever that user credential is accepted.
This software release supports Kerberos 5, which allows organizations that are already using Kerberos 5 to use the same
Kerberos authentication database on the KDC that they are already using on their other network hosts (such as UNIX
servers and PCs).
In this software release, Kerberos supports these network services:
Telnet
rlogin
rsh (Remote Shell Protocol)
Table 5 lists the common Kerberos-related terms and definitions.
158
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Table 27
Kerberos-related terms
Term
Definition
Authentication
A process by which a user or service identifies itself to another service. For example,
a client can authenticate to a switch or a switch can authenticate to another switch.
Authorization
A means by which the switch identifies what privileges the user has in a network or
on the switch and what actions the user can perform.
Credential
A general term that refers to authentication tickets, such as TGTs1 and service
credentials. Kerberos credentials verify the identity of a user or service. If a network
service decides to trust the Kerberos server that issued a ticket, it can be used in
place of reentering a username and password. Credentials have a default lifespan
of eight hours.
Instance
An authorization level label for Kerberos principals. Most Kerberos principals are of
the form user@REALM (for example, smith@EXAMPLE.COM). A Kerberos principal
with a Kerberos instance has the form user/instance@REALM (for example,
smith/admin@EXAMPLE.COM). The Kerberos instance can be used to specify the
authorization level for the user if authentication is successful. The server of each
network service might implement and enforce the authorization mappings of
Kerberos instances but is not required to do so.
Note: The Kerberos principal and instance names must be in all lowercase
characters.
Note: The Kerberos realm name must be in all uppercase characters.
KDC2
Key distribution center that consists of a Kerberos server and database program that
is running on a network host.
Kerberized
A term that describes applications and services that have been modified to support
the Kerberos credential infrastructure.
Kerberos realm
A domain consisting of users, hosts, and network services that are registered to a
Kerberos server. The Kerberos server is trusted to verify the identity of a user or
network service to another user or network service.
Note: The Kerberos realm name must be in all uppercase characters.
Kerberos server
A daemon that is running on a network host. Users and network services register
their identity with the Kerberos server. Network services query the Kerberos server
to authenticate to other network services.
KEYTAB3
A password that a network service shares with the KDC. In Kerberos 5 and later
Kerberos versions, the network service authenticates an encrypted service
credential by using the KEYTAB to decrypt it. In Kerberos versions earlier than
Kerberos 5, KEYTAB is referred to as SRVTAB4.
Principal
Also known as a Kerberos identity, this is who you are or what a service is according
to the Kerberos server.
Note: The Kerberos principal name must be in all lowercase characters.
Service credential
A credential for a network service. When issued from the KDC, this credential is
encrypted with the password shared by the network service and the KDC. The
password is also shared with the user TGT.
SRVTAB
A password that a network service shares with the KDC. In Kerberos 5 or later
Kerberos versions, SRVTAB is referred to as KEYTAB.
TGT
Ticket granting ticket that is a credential that the KDC issues to authenticated users.
When users receive a TGT, they can authenticate to network services within the
Kerberos realm represented by the KDC.
159
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
1. TGT = ticket granting ticket
2. KDC = key distribution center
3. KEYTAB = key table
4. SRVTAB = server table
Kerberos Operation
A Kerberos server can be a switch that is configured as a network security server and that can authenticate remote users
by using the Kerberos protocol. Although you can customize Kerberos in a number of ways, remote users attempting to
access network services must pass through three layers of security before they can access network services.
To authenticate to network services by using a switch as a Kerberos server, remote users must follow these steps:
1. Authenticating to a Boundary Switch, page 160
2. Obtaining a TGT from a KDC, page 160
3. Authenticating to Network Services, page 160
Authenticating to a Boundary Switch
This section describes the first layer of security through which a remote user must pass. The user must first authenticate
to the boundary switch. This process then occurs:
1. The user opens an un-Kerberized Telnet connection to the boundary switch.
2. The switch prompts the user for a username and password.
3. The switch requests a TGT from the KDC for this user.
4. The KDC sends an encrypted TGT that includes the user identity to the switch.
5. The switch attempts to decrypt the TGT by using the password that the user entered.
• If the decryption is successful, the user is authenticated to the switch.
• If the decryption is not successful, the user repeats Step 2 either by reentering the username and password
(noting if Caps Lock or Num Lock is on or off) or by entering a different username and password.
A remote user who initiates a un-Kerberized Telnet session and authenticates to a boundary switch is inside the firewall,
but the user must still authenticate directly to the KDC before getting access to the network services. The user must
authenticate to the KDC because the TGT that the KDC issues is stored on the switch and cannot be used for additional
authentication until the user logs on to the switch.
Obtaining a TGT from a KDC
This section describes the second layer of security through which a remote user must pass. The user must now
authenticate to a KDC and obtain a TGT from the KDC to access network services.
Authenticating to Network Services
This section describes the third layer of security through which a remote user must pass. The user with a TGT must now
authenticate to the network services in a Kerberos realm.
160
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Kerberos Configuration
So that remote users can authenticate to network services, you must configure the hosts and the KDC in the Kerberos
realm to communicate and mutually authenticate users and network services. To do this, you must identify them to each
other. You add entries for the hosts to the Kerberos database on the KDC and add KEYTAB files generated by the KDC
to all hosts in the Kerberos realm. You also create entries for the users in the KDC database.
When you add or create entries for the hosts and users, follow these guidelines:
The Kerberos principal name must be in all lowercase characters.
The Kerberos instance name must be in all lowercase characters.
The Kerberos realm name must be in all uppercase characters.
Note: A Kerberos server can be a switch that is configured as a network security server and that can authenticate users
by using the Kerberos protocol.
To set up a Kerberos-authenticated server-client system, follow these steps:
Configure the KDC by using Kerberos commands.
Configure the switch to use the Kerberos protocol.
Local Authentication and Authorization
You can configure AAA to operate without a server by setting the switch to implement AAA in local mode. The switch
then handles authentication and authorization. No accounting is available in this configuration.
Secure Shell
To use this feature, you must install the cryptographic (encrypted) software image on your switch. You must obtain
authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information,
see the release notes for this release.
For SSH configuration examples, see the “SSH Configuration Examples” section in the “Configuring Secure Shell”
chapter of the Cisco IOS Security Configuration Guide, Cisco IOS Release 12.2.
SSH in IPv6 functions the same and offers the same benefits as SSH in IPv4. IPv6 enhancements to SSH consist of
support for IPv6 addresses that enable a Cisco router to accept and establish secure, encrypted connections with remote
IPv6 nodes over an IPv6 transport.
SSH
SSH is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote
connections than Telnet does by providing strong encryption when a device is authenticated. This software release
supports SSH Version 1 (SSHv1) and SSH Version 2 (SSHv2).
SSH Servers, Integrated Clients, and Supported Versions
The SSH feature has an SSH server and an SSH integrated client, which are applications that run on the switch. You can
use an SSH client to connect to a switch running the SSH server. The SSH server works with the SSH client supported
in this release and with non-Cisco SSH clients. The SSH client also works with the SSH server supported in this release
and with non-Cisco SSH servers.
The switch supports an SSHv1 or an SSHv2 server.
161
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
The switch supports an SSHv1 client.
SSH supports the Data Encryption Standard (DES) encryption algorithm, the Triple DES (3DES) encryption algorithm, and
password-based user authentication.
SSH also supports these user authentication methods:
TACACS+ (for more information, see Configuring TACACS+, page 169)
RADIUS (for more information, see Configuring Radius Server Communication, page 172)
Local authentication and authorization (for more information, see Configuring the Switch for Local Authentication and
Authorization, page 178)
Note: This software release does not support IP Security (IPSec).
Limitations
These limitations apply to SSH:
The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
SSH supports only the execution-shell application.
The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data encryption software.
The switch supports the Advanced Encryption Standard (AES) encryption algorithm with a 128-bit key, 192-bit key,
or 256-bit key. However, symmetric cipher AES to encrypt the keys is not supported.
SSH Configuration Guidelines
Follow these guidelines when configuring the switch as an SSH server or SSH client:
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key
pair has not been generated. Reconfigure the hostname and domain, and then enter the crypto key generate rsa
command. For more information, see Setting Up the Switch to Run SSH, page 179.
When generating the RSA key pair, the message No host name specified might appear. If it does, you must
configure a hostname by using the hostname global configuration command.
When generating the RSA key pair, the message No domain specified might appear. If it does, you must configure
an IP domain name by using the ip domain-name global configuration command.
When configuring the local authentication and authorization authentication method, make sure that AAA is disabled
on the console.
Switch for Secure Socket Layer HTTP
Secure Socket Layer (SSL) version 3.0 supports the HTTP 1.1 server and client. SSL provides server authentication,
encryption, and message integrity, as well as HTTP client authentication, to allow secure HTTP communications. To use
this feature, the cryptographic (encrypted) software image must be installed on your switch. You must obtain
authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information
about the crypto image, see the release notes for this release.
162
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Secure HTTP Servers and Clients
On a secure HTTP connection, data to and from an HTTP server is encrypted before being sent over the Internet. HTTP
with SSL encryption provides a secure connection to allow such functions as configuring a switch from a Web browser.
Cisco's implementation of the secure HTTP server and secure HTTP client uses an implementation of SSL Version 3.0
with application-layer encryption. HTTP over SSL is abbreviated as HTTPS; the URL of a secure connection begins with
https:// instead of http://.
The primary role of the HTTP secure server (the switch) is to listen for HTTPS requests on a designated port (the default
HTTPS port is 443) and pass the request to the HTTP 1.1 Web server. The HTTP 1.1 server processes requests and
passes responses (pages) back to the HTTP secure server, which responds to the original request.
The primary role of the HTTP secure client (the web browser) is to respond to Cisco IOS application requests for HTTPS
User Agent services, perform HTTPS User Agent services for the application, and pass the response back to the
application.
When SSL is used in a switch cluster, the SSL session terminates at the cluster commander. Cluster member switches
must run standard HTTP.
For secure HTTP connections, we recommend that you configure an official CA trustpoint. A CA trustpoint is more secure
than a self-signed certificate.
Before you configure a CA trustpoint, you should ensure that the system clock is set. If the clock is not set, the certificate
is rejected due to an incorrect date.
Default SSL Settings
Table 28
Default SSL Settings
Default Setting
The standard HTTP server is enabled.
SSL is enabled.
No CA trustpoints are configured.
No self-signed certificates are generated.
Certificate Authority Trustpoints
Certificate authorities (CAs) manage certificate requests and issue certificates to participating network devices. These
services provide centralized security key and certificate management for the participating devices. Specific CA servers
are referred to as trustpoints.
When a connection attempt is made, the HTTPS server provides a secure connection by issuing a certified X.509v3
certificate, obtained from a specified CA trustpoint, to the client. The client (usually a Web browser), in turn, has a public
key that allows it to authenticate the certificate.
For secure HTTP connections, we highly recommend that you configure a CA trustpoint. If a CA trustpoint is not
configured for the device running the HTTPS server, the server certifies itself and generates the needed RSA key pair.
Because a self-certified (self-signed) certificate does not provide adequate security, the connecting client generates a
notification that the certificate is self-certified, and the user has the opportunity to accept or reject the connection. This
option is useful for internal network topologies (such as testing).
If you do not configure a CA trustpoint, when you enable a secure HTTP connection, either a temporary or a persistent
self-signed certificate for the secure HTTP server (or client) is automatically generated.
163
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
If the switch is not configured with a hostname and a domain name, a temporary self-signed certificate is generated.
If the switch reboots, any temporary self-signed certificate is lost, and a new temporary new self-signed certificate
is assigned.
If the switch has been configured with a host and domain name, a persistent self-signed certificate is generated.
This certificate remains active if you reboot the switch or if you disable the secure HTTP server so that it will be there
the next time you reenable a secure HTTP connection.
Note: The certificate authorities and trustpoints must be configured on each device individually. Copying them from other
devices makes them invalid on the switch.
Note: The values that follow TP self-signed depend on the serial number of the device.
You can use an optional command (ip http secure-client-auth) to allow the HTTPS server to request an X.509v3
certificate from the client. Authenticating the client provides more security than server authentication by itself.
CipherSuites
A CipherSuite specifies the encryption algorithm and the digest algorithm to use on a SSL connection. When connecting
to the HTTPS server, the client Web browser offers a list of supported CipherSuites, and the client and server negotiate
the best encryption algorithm to use from those on the list that are supported by both. For example, Netscape
Communicator 4.76 supports U.S. security with RSA Public Key Cryptography, MD2, MD5, RC2-CBC, RC4, DES-CBC,
and DES-EDE3-CBC.
For the best possible encryption, you should use a client browser that supports 128-bit encryption, such as Microsoft
Internet Explorer Version 5.5 (or later) or Netscape Communicator Version 4.76 (or later). The
SSL_RSA_WITH_DES_CBC_SHA CipherSuite provides less security than the other CipherSuites, as it does not offer
128-bit encryption.
The more secure and more complex CipherSuites require slightly more processing time. This list defines the CipherSuites
supported by the switch and ranks them from fastest to slowest in terms of router processing load (speed):
1. SSL_RSA_WITH_DES_CBC_SHA—RSA key exchange (RSA Public Key Cryptography) with DES-CBC for message
encryption and SHA for message digest
2. SSL_RSA_WITH_RC4_128_MD5—RSA key exchange with RC4 128-bit encryption and MD5 for message digest
3. SSL_RSA_WITH_RC4_128_SHA—RSA key exchange with RC4 128-bit encryption and SHA for message digest
4. SSL_RSA_WITH_3DES_EDE_CBC_SHA—RSA key exchange with 3DES and DES-EDE3-CBC for message
encryption and SHA for message digest
RSA (in conjunction with the specified encryption and digest algorithm combinations) is used for both key generation and
authentication on SSL connections. This usage is independent of whether or not a CA trustpoint is configured.
Secure Copy Protocol
The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch configurations
or switch image files. SCP relies on Secure Shell (SSH), an application and a protocol that provides a secure replacement
for the Berkeley r-tools.
For SSH to work, the switch needs an RSA public/private key pair. This is the same with SCP, which relies on SSH for its
secure transport.
Because SSH also relies on AAA authentication, and SCP relies further on AAA authorization, correct configuration is
necessary.
Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
164
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Because SCP relies on SSH for its secure transport, the switch must have an Rivest, Shamir, and Adelman (RSA) key
pair.
Note: When using SCP, you cannot enter the password into the copy command. You must enter the password when
prompted.
The behavior of SCP is similar to that of remote copy (rcp), which comes from the Berkeley r-tools suite, except that SCP
relies on SSH for security. SCP also requires that authentication, authorization, and accounting (AAA) authorization be
configured so the router can determine whether the user has the correct privilege level.
A user who has appropriate authorization can use SCP to copy any file in the Cisco IOS File System (IFS) to and from a
switch by using the copy command. An authorized administrator can also do this from a workstation.
Note: For information about how to configure and verify SCP, see the “Secure Copy Protocol” section in the Cisco IOS
Security Configuration Guide: Securing User Services, Release 12.4:
cts_Configuration_Guide_Chapter.html
How to Configure Switch-Based Authentication
Configuring Password Protection
Setting or Changing a Static Enable Password
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
enable password password
Defines a new password or changes an existing password for access to
privileged EXEC mode.
By default, no password is defined.
password—Specifies a string from 1 to 25 alphanumeric characters. The
string cannot start with a number, is case sensitive, and allows spaces but
ignores leading spaces. It can contain the question mark (?) character if
you precede the question mark with the key combination Crtl-v when you
create the password; for example, to create the password abc?123, do
this:
Enter abc.
Press Crtl-v.
Enter ?123.
When the system prompts you to enter the enable password, you need
not precede the question mark by pressing Ctrl V; you can enter abc?123
at the password prompt.
3.
end
Returns to privileged EXEC mode.
165
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Protecting Enable and Enable Secret Passwords with Encryption
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
enable password [level level] {password |
Defines a new password or changes an existing password
encryption-type encrypted-password}
for access to privileged EXEC mode.
or
or
enable secret [level level] {password |
Defines a secret password, which is saved using a
encryption-type encrypted-password}
nonreversible encryption method.
(Optional) level—Specifies the range is from 0 to 15.
Level 1 is normal user EXEC mode privileges. The
default level is 15 (privileged EXEC mode privileges).
password—Specifies a string from 1 to 25 alphanumeric
characters. The string cannot start with a number, is
case sensitive, and allows spaces but ignores leading
spaces. By default, no password is defined.
(Optional) encryption-type—Only type 5, a Cisco
proprietary encryption algorithm, is available. If you
specify an encryption type, you must provide an
encrypted password—an encrypted password that you
copy from another switch configuration.
Note: If you specify an encryption type and then enter a clear
text password, you cannot reenter privileged EXEC mode.
You cannot recover a lost encrypted password by any
method.
3.
service password-encryption
(Optional) Encrypts the password when the password is
defined or when the configuration is written.
Encryption prevents the password from being readable in
the configuration file.
4.
end
Returns to privileged EXEC mode.
Disabling Password Recovery
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
no service password-recovery
Disables password recovery.
This setting is saved in an area of the flash memory that is accessible by
the boot loader and the Cisco IOS image, but it is not part of the file
system and is not accessible by any user.
3.
end
Returns to privileged EXEC mode.
4.
show version
Verifies the configuration by checking the last few lines of the command
output.
166
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Setting a Telnet Password for a Terminal Line
Command
Purpose
1.
Attaches a PC or workstation with emulation software to the switch
console port.
The default data characteristics of the console port are 9600, 8, 1, no
parity. You might need to press the Return key several times to see the
command-line prompt.
2.
enable password password
Enters privileged EXEC mode.
3.
configure terminal
Enters global configuration mode.
4.
line vty 0 15
Configures the number of Telnet sessions (lines), and enters line
configuration mode.
There are 16 possible sessions on a command-capable switch. The 0
and 15 mean that you are configuring all 16 possible Telnet sessions.
5.
password password
Enters a Telnet password for the line or lines.
password—Specifies a string from 1 to 25 alphanumeric characters. The
string cannot start with a number, is case sensitive, and allows spaces but
ignores leading spaces. By default, no password is defined.
6.
end
Returns to privileged EXEC mode.
Configuring Username and Password Pairs
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
username name [privilege level]
Enters the username, privilege level, and password for each user.
{password encryption-type password}
name—Specifies the user ID as one word. Spaces and quotation
marks are not allowed.
(Optional) level—Specifies the privilege level the user has after
gaining access. The range is 0 to 15. Level 15 gives privileged EXEC
mode access. Level 1 gives user EXEC mode access.
encryption-type—Enters 0 to specify that an unencrypted password
will follow. Enter 7 to specify that a hidden password will follow.
password—Specifies the password the user must enter to gain
access to the switch. The password must be from 1 to 25 characters,
can contain embedded spaces, and must be the last option specified
in the username command.
To disable username authentication for a specific user, use the no
username name global configuration command.
167
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
3.
line console 0
Enters line configuration mode, and configure the console port (line 0) or
the VTY lines (line 0 to 15).
or
line vty 0 15
4.
login local
Enables local password checking at login time. Authentication is based on
the username specified in Step 2.
To disable password checking and allow connections without a
password, use the no login line configuration command.
5.
end
Returns to privileged EXEC mode.
Setting the Privilege Level for a Command
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
privilege mode level level command
Sets the privilege level for a command.
mode—Enters configure for global configuration mode, exec for
EXEC mode, interface for interface configuration mode, or line for
line configuration mode.
level—The range is from 0 to 15. Level 1 is for normal user EXEC
mode privileges. Level 15 is the level of access permitted by the
enable password.
command—Specifies the command to which you want to restrict
access.
3.
enable password level level password
Specifies the enable password for the privilege level.
level—The range is from 0 to 15. Level 1 is for normal user EXEC
mode privileges.
password—Specifies a string from 1 to 25 alphanumeric characters.
The string cannot start with a number, is case sensitive, and allows
spaces but ignores leading spaces. By default, no password is
defined.
4.
end
Returns to privileged EXEC mode.
5.
show privilege
Verifies the password and accesses level configuration.
Changing the Default Privilege Level for Lines
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
line vty line
Selects the virtual terminal line on which to restrict access.
168
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
3.
privilege level level
Changes the default privilege level for the line.
level—The range is from 0 to 15. Level 1 is for normal user EXEC mode
privileges. Level 15 is the level of access permitted by the enable
password.
4.
end
Returns to privileged EXEC mode.
5.
show privilege
Verifies the password and accesses level configuration.
Logging Into and Exiting a Privilege Level
Command
Purpose
enable level
Logs in to a specified privilege level.
level—The range is 0 to 15.
disable level
Exits to a specified privilege level.
level—The range is 0 to 15.
Configuring TACACS+
This section describes how to configure your switch to support TACACS+. At a minimum, you must identify the host or
hosts maintaining the TACACS+ daemon and define the method lists for TACACS+ authentication. You can optionally
define method lists for TACACS+ authorization and accounting. A method list defines the sequence and methods to be
used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more
security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method
listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects
the next method in the list. This process continues until there is successful communication with a listed method or the
method list is exhausted.
169
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Identifying the TACACS+ Server Host and Setting the Authentication Key
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
tacacs-server host hostname [port
Identifies the IP host or hosts maintaining a TACACS+ server. Enters this
integer] [timeout integer] [key string]
command multiple times to create a list of preferred hosts. The software
searches for hosts in the order in which you specify them.
hostname—Specifies the name or IP address of the host.
(Optional) port integer—Specifies a server port number. The default
is port 49. The range is 1 to 65535.
(Optional) timeout integer—Specifies a time in seconds the switch
waits for a response from the daemon before it times out and
declares an error. The default is 5 seconds. The range is 1 to 1000
seconds.
(Optional) key string—Specifies the encryption key for encrypting and
decrypting all traffic between the switch and the TACACS+ daemon.
You must configure the same key on the TACACS+ daemon for
encryption to be successful.
3.
aaa new-model
Enables AAA.
4.
aaa group server tacacs+ group-name
(Optional) Defines the AAA server-group with a group name.
This command puts the switch in a server group subconfiguration mode.
5.
server ip-address
(Optional) Associates a particular TACACS+ server with the defined
server group. Repeat this step for each TACACS+ server in the AAA
server group.
Each server in the group must be previously defined in Step 2.
6.
end
Returns to privileged EXEC mode.
7.
show tacacs
Verifies your entries.
Configuring TACACS+ Login Authentication
Before You Begin
To secure the switch for HTTP access by using AAA methods, you must configure the switch with the ip http
authentication aaa global configuration command. Configuring AAA authentication does not secure the switch for HTTP
access by using AAA methods.
170
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa new-model
Enables AAA.
3.
aaa authentication login {default |
Creates a login authentication method list.
list-name} method1 [method2...]
To create a default list that is used when a named list is not specified
in the login authentication command, use the default keyword
followed by the methods that are to be used in default situations. The
default method list is automatically applied to all ports.
list-name—Specifies a character string to name the list you are
creating.
method1...—Specifies the actual method the authentication algorithm
tries. The additional methods of authentication are used only if the
previous method returns an error, not if it fails.
Select one of these methods:
enable—Uses the enable password for authentication. Before you can
use this authentication method, you must define an enable password
by using the enable password global configuration command.
group tacacs+—Uses TACACS+ authentication. Before you can use
this authentication method, you must configure the TACACS+ server.
For more information, see Identifying the TACACS+ Server Host and
Setting the Authentication Key, page 170.
line—Uses the line password for authentication. Before you can use
this authentication method, you must define a line password. Use the
password password line configuration command.
local—Uses the local username database for authentication. You must
enter username information in the database. Use the username
password global configuration command.
local-case—Uses a case-sensitive local username database for
authentication. You must enter username information in the database
by using the username name password global configuration
command.
none—Does not use any authentication for login.
4.
line [console | tty | vty] line-number
Enters line configuration mode, and configures the lines to which you
[ending-line-number]
want to apply the authentication list.
5.
login authentication {default |
Applies the authentication list to a line or set of lines.
list-name}
If you specify default, use the default list created with the aaa
authentication login command.
list-name—Specifies the list created with the aaa authentication
login command.
6.
end
Returns to privileged EXEC mode.
171
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa authorization network tacacs+
Configures the switch for user TACACS+ authorization for all
network-related service requests.
3.
aaa authorization exec tacacs+
Configures the switch for user TACACS+ authorization if the user has
privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
4.
end
Returns to privileged EXEC mode.
Starting TACACS+ Accounting
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa accounting network start-stop
Enables TACACS+ accounting for all network-related service requests.
tacacs+
3.
aaa accounting exec start-stop tacacs+
Enables TACACS+ accounting to send a start-record accounting notice
at the beginning of a privileged EXEC process and a stop-record at the
end.
4.
end
Returns to privileged EXEC mode.
Configuring Radius Server Communication
Before You Begin
You should have access to and should configure a RADIUS server before configuring RADIUS features on your switch.
At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for
RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting.
Some configuration settings need to be configured on the RADIUS server that include the IP address of the switch and
the key string to be shared by both the server and the switch.
172
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
radius-server host {hostname |
Specifies the IP address or hostname of the remote RADIUS server host.
ip-address} [auth-port port-number]
[acct-port port-number] [timeout
(Optional) auth-port port-number—Specifies the UDP destination
port for authentication requests.
seconds] [retransmit retries] [key
string]
(Optional) acct-port port-number—Specifies the UDP destination
port for accounting requests.
(Optional) timeout seconds—Specifies the time interval that the
switch waits for the RADIUS server to reply before resending. The
range is 1 to 1000. This setting overrides the radius-server timeout
global configuration command setting. If no timeout is set with the
radius-server host command, the setting of the radius-server
timeout command is used.
(Optional) retransmit retries—Specifies the number of times a
RADIUS request is resent to a server if that server is not responding
or responding slowly. The range is 1 to 1000. If no retransmit value is
set with the radius-server host command, the setting of the
radius-server retransmit global configuration command is used.
(Optional) key string—Specifies the authentication and encryption key
used between the switch and the RADIUS daemon running on the
RADIUS server.
Note: The key is a text string that must match the encryption key used on
the RADIUS server. Always configure the key as the last item in the
radius-server host command. Leading spaces are ignored, but spaces
within and at the end of the key are used. If you use spaces in your key,
do not enclose the key in quotation marks unless the quotation marks are
part of the key.
To configure the switch to recognize more than one host entry associated
with a single IP address, enter this command as many times as necessary,
making sure that each UDP port number is different. The switch software
searches for hosts in the order in which you specify them. Set the timeout,
retransmit, and encryption key values to use with the specific RADIUS
host.
3.
end
Returns to privileged EXEC mode.
173
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Defining AAA Server Groups
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
radius-server host {hostname |
Specifies the IP address or hostname of the remote RADIUS server host.
ip-address} [auth-port
port-number] [acct-port
(Optional) auth-port port-number—Specifies the UDP destination port for
port-number] [timeout seconds]
authentication requests.
[retransmit retries] [key string]
(Optional) acct-port port-number—Specifies the UDP destination port for
accounting requests.
(Optional) timeout seconds—Specifies the time interval that the switch
waits for the RADIUS server to reply before resending. The range is 1 to
1000. This setting overrides the radius-server timeout global
configuration command setting. If no timeout is set with the
radius-server host command, the setting of the radius-server timeout
command is used.
(Optional) retransmit retries—Specifies the number of times a RADIUS
request is resent to a server if that server is not responding or responding
slowly. The range is 1 to 1000. If no retransmit value is set with the
radius-server host command, the setting of the radius-server
retransmit global configuration command is used.
(Optional) key string, specifies the authentication and encryption key
used between the switch and the RADIUS daemon running on the
RADIUS server.
Note: The key is a text string that must match the encryption key used on the
RADIUS server. Always configure the key as the last item in the radius-server
host command. Leading spaces are ignored, but spaces within and at the end
of the key are used. If you use spaces in your key, do not enclose the key in
quotation marks unless the quotation marks are part of the key.
To configure the switch to recognize more than one host entry associated with
a single IP address, enter this command as many times as necessary, making
sure that each UDP port number is different. The switch software searches for
hosts in the order in which you specify them. Set the timeout, retransmit, and
encryption key values to use with the specific RADIUS host.
3.
aaa new-model
Enables AAA.
4.
aaa group server radius
Defines the AAA server group with a group name.
group-name
This command puts the switch in a server group configuration mode.
5.
server ip-address
Associates a particular RADIUS server with the defined server group. Repeat
this step for each RADIUS server in the AAA server group.
Each server in the group must be previously defined in Step 2.
6.
end
Returns to privileged EXEC mode.
7.
Enable RADIUS login authentication. See Defining AAA Server Groups,
page 174.
174
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Configuring RADIUS Login Authentication
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa new-model
Enables AAA.
3.
aaa authentication login {default |
Creates a login authentication method list.
list-name} method1 [method2...]
To create a default list that is used when a named list is not specified in
the login authentication command, use the default keyword followed by
the methods that are to be used in default situations. The default method
list is automatically applied to all ports.
list-name—Specifies a character string to name the list you are creating.
method1...—Specifies the actual method the authentication algorithm tries.
The additional methods of authentication are used only if the previous
method returns an error, not if it fails.
Select one of these methods:
— enable—Uses the enable password for authentication. Before you can
use this authentication method, you must define an enable password
by using the enable password global configuration command.
— group radius—Uses RADIUS authentication. Before you can use this
authentication method, you must configure the RADIUS server. For
more information, see RADIUS Server Host, page 155.
— line—Uses the line password for authentication. Before you can use
this authentication method, you must define a line password. Use the
password password line configuration command.
— local—Uses the local username database for authentication. You must
enter username information in the database. Use the username name
password global configuration command.
— local-case—Uses a case-sensitive local username database for
authentication. You must enter username information in the database
by using the username password global configuration command.
— none—Does not use any authentication for login.
4.
line [console | tty | vty]
Enters line configuration mode, and configures the lines to which you want to
line-number [ending-line-number]
apply the authentication list.
5.
login authentication {default |
Applies the authentication list to a line or set of lines.
list-name}
If you specify default, use the default list created with the aaa
authentication login command.
list-name—Specifies the list created with the aaa authentication login
command.
6.
end
Returns to privileged EXEC mode.
175
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Configuring RADIUS Authorization for User Privileged Access and Network Services
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa authorization network radius
Configures the switch for user RADIUS authorization for all
network-related service requests.
3.
aaa authorization exec radius
Configures the switch for user RADIUS authorization if the user has
privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
4.
end
Returns to privileged EXEC mode.
Starting RADIUS Accounting
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa accounting network start-stop
Enables RADIUS accounting for all network-related service requests.
radius
3.
aaa accounting exec start-stop radius
Enables RADIUS accounting to send a start-record accounting notice at
the beginning of a privileged EXEC process and a stop-record at the
end.
4.
end
Returns to privileged EXEC mode.
Configuring Settings for All RADIUS Servers
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
radius-server key string
Specifies the shared secret text string used between the switch and all
RADIUS servers.
Note: The key is a text string that must match the encryption key used on
the RADIUS server. Leading spaces are ignored, but spaces within and at
the end of the key are used. If you use spaces in your key, do not enclose
the key in quotation marks unless the quotation marks are part of the key.
3.
radius-server retransmit retries
Specifies the number of times the switch sends each RADIUS request to
the server before giving up. The default is 3; the range 1 to 1000.
4.
radius-server timeout seconds
Specifies the number of seconds a switch waits for a reply to a RADIUS
request before resending the request. The default is 5 seconds; the range
is 1 to 1000.
176
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
5.
radius-server deadtime minutes
Specifies the number of minutes a RADIUS server, which is not responding
to authentication requests, to be skipped, thus avoiding the wait for the
request to timeout before trying the next configured server. The default is
0; the range is 1 to 1440 minutes.
6.
radius-server vsa send [accounting |
Enables the switch to recognize and use VSAs as defined by RADIUS IETF
authentication]
attribute 26.
(Optional) accounting—Limits the set of recognized vendor-specific
attributes to only accounting attributes.
(Optional) authentication—Limits the set of recognized
vendor-specific attributes to only authentication attributes.
If you enter this command without keywords, both accounting and
authentication vendor-specific attributes are used.
7.
end
Returns to privileged EXEC mode.
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
radius-server host {hostname | ip-address} non-standard
Specifies the IP address or hostname of the remote
RADIUS server host and identifies that it is using a
vendor-proprietary implementation of RADIUS.
3.
radius-server key string
Specifies the shared secret text string used between
the switch and the vendor-proprietary RADIUS
server. The switch and the RADIUS server use this
text string to encrypt passwords and exchange
responses.
Note: The key is a text string that must match the
encryption key used on the RADIUS server. Leading
spaces are ignored, but spaces within and at the end
of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the
quotation marks are part of the key.
4.
end
Returns to privileged EXEC mode.
5.
show running-config
Verifies your settings.
6.
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
Configuring CoA on the Switch
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa new-model
Enables AAA.
3.
aaa server radius dynamic-author
Configures the switch as an authentication, authorization, and accounting
(AAA) server to facilitate interaction with an external policy server.
177
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
4.
client {ip-address | name} [vrf vrfname]
Enters dynamic authorization local server configuration mode and
[server-key string]
specifies a RADIUS client from which a device will accept CoA and
disconnect requests.
5.
server-key [0 | 7] string
Configures the RADIUS key to be shared between a device and RADIUS
clients.
6.
port port-number
Specifies the port on which a device listens for RADIUS requests from
configured RADIUS clients.
7.
auth-type {any | all | session-key}
Specifies the type of authorization the switch uses for RADIUS clients.
The client must match all the configured attributes for authorization.
8.
ignore session-key
(Optional) Configures the switch to ignore the session-key.
9.
ignore server-key
(Optional) Configures the switch to ignore the server-key.
10.
authentication command bounce-port
(Optional) Configures the switch to ignore a CoA request to temporarily
ignore
disable the port hosting a session. The purpose of temporarily disabling
the port is to trigger a DHCP renegotiation from the host when a VLAN
change occurs and there is no supplicant on the endpoint to detect the
change.
11.
authentication command disable-port
(Optional) Configures the switch to ignore a nonstandard command
ignore
requesting that the port hosting a session be administratively shut down.
Shutting down the port results in termination of the session.
Uses standard CLI or SNMP commands to reenable the port.
12.
end
Returns to privileged EXEC mode.
Configuring the Switch for Local Authentication and Authorization
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
aaa new-model
Enables AAA.
3.
aaa authentication login default
Sets the login authentication to use the local username database. The default
local
keyword applies the local user database authentication to all ports.
4.
aaa authorization exec local
Configures user AAA authorization, checks the local database, and allows the
user to run an EXEC shell.
5.
aaa authorization network local
Configures user AAA authorization for all network-related service requests.
178
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
6.
username name [privilege level]
Enters the local database, and establishes a username-based authentication
{password encryption-type
system.
password}
Repeat this command for each user.
name—Specifies the user ID as one word. Spaces and quotation marks
are not allowed.
(Optional) level—Specifies the privilege level the user has after gaining
access. The range is 0 to 15. Level 15 gives privileged EXEC mode
access. Level 0 gives user EXEC mode access.
encryption-type—Enters 0 to specify that an unencrypted password
follows. Enter 7 to specify that a hidden password follows.
password—Specifies the password the user must enter to gain access to
the switch. The password must be from 1 to 25 characters, can contain
embedded spaces, and must be the last option specified in the
username command.
7.
end
Returns to privileged EXEC mode.
8.
show running-config
Verifies your entries.
9.
copy running-config
(Optional) Saves your entries in the configuration file.
startup-config
Configuring Secure Shell
Setting Up the Switch to Run SSH
Task
Purpose
1.
Download the cryptographic software image from
(Required) For more information, see the notes for
Cisco.com.
this release.
2.
Configure a hostname and IP domain name for the switch.
Follow this procedure only if you are configuring the
switch as an SSH server.
3.
Generate an RSA key pair for the switch, which automatically
Follow this procedure only if you are configuring the
enables SSH.
switch as an SSH server.
4.
Configure user authentication for local or remote access.
(Required) For more information, see Configuring
the Switch for Local Authentication and
Authorization, page 178.
Configuring the SSH Server
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
hostname hostname
Configures a hostname for your switch.
3.
ip domain-name domain_name
Configures a host domain for your switch.
179
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
4.
crypto key generate rsa
Enables the SSH server for local and remote authentication on the switch
and generates an RSA key pair.
We recommend that a minimum modulus size of 1024 bits.
When you generate RSA keys, you are prompted to enter a modulus
length. A longer modulus length might be more secure, but it takes longer
to generate and to use.
5.
ip ssh version [1 | 2]
(Optional) Configures the switch to run SSH Version 1 or SSH Version 2.
1—Configures the switch to run SSH Version 1.
2—Configures the switch to run SSH Version 2.
If you do not enter this command or do not specify a keyword, the SSH
server selects the latest SSH version supported by the SSH client. For
example, if the SSH client supports SSHv1 and SSHv2, the SSH server
selects SSHv2.
6.
ip ssh {timeout seconds |
Configures the SSH control parameters.
authentication-retries number}
Specifies the time-out value in seconds; the default is 120 seconds.
The range is 0 to 120 seconds. This parameter applies to the SSH
negotiation phase. After the connection is established, the switch
uses the default time-out values of the CLI-based sessions.
By default, up to five simultaneous, encrypted SSH connections for
multiple CLI-based sessions over the network are available (session
0 to session 4). After the execution shell starts, the CLI-based
session time-out value returns to the default of 10 minutes.
Specifies the number of times that a client can reauthenticate to the
server. The default is 3; the range is 0 to 5.
Repeat this step when configuring both parameters.
7.
line vty line_number
(Optional) Configures the virtual terminal line settings.
[ending_line_number]
Enters line configuration mode to configure the virtual terminal line
transport input ssh
settings. line_number and ending_line_number specifiy a pair of
lines. The range is 0 to 15.
Specifies that the switch prevent non-SSH Telnet connections. This
limits the router to only SSH connections.
8.
end
Returns to privileged EXEC mode.
9.
show ip ssh
Shows the version and configuration information for your SSH server.
or
show ssh
Shows the status of the SSH server on the switch.
180
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Configuring Secure HTTP Servers and Clients
Configuring a CA Trustpoint
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
hostname hostname
Specifies the hostname of the switch (required only if you have not
previously configured a hostname).
3.
ip domain-name domain-name
Specifies the IP domain name of the switch (required only if you have not
previously configured an IP domain name).
4.
crypto key generate rsa
(Optional) Generates an RSA key pair. RSA key pairs are required before
you can obtain a certificate for the switch. RSA key pairs are generated
automatically. You can use this command to regenerate the keys, if
needed.
5.
crypto ca trustpoint name
Specifies a local configuration name for the CA trustpoint and enter CA
trustpoint configuration mode.
6.
enrollment url url
Specifies the URL to which the switch should send certificate requests.
7.
enrollment http-proxy host-name
(Optional) Configures the switch to obtain certificates from the CA
port-number
through an HTTP proxy server.
8.
crl query url
Configures the switch to request a certificate revocation list (CRL) to
ensure that the certificate of the peer has not been revoked.
9.
primary
(Optional) Specifies that the trustpoint should be used as the primary
(default) trustpoint for CA requests.
10.
exit
Exits CA trustpoint configuration mode and returns to global configuration
mode.
11.
crypto ca authentication name
Authenticates the CA by getting the public key of the CA. Uses the same
name used in Step 5.
12.
crypto ca enroll name
Obtains the certificate from the specified CA trustpoint. This command
requests a signed certificate for each RSA key pair.
13.
end
Returns to privileged EXEC mode.
14.
show crypto ca trustpoints
Verifies the configuration.
Configuring the Secure HTTP Server
Before You Begin
If you are using a certificate authority for certification, you should use the previous procedure to configure the CA
trustpoint on the switch before enabling the HTTP server. If you have not configured a CA trustpoint, a self-signed
certificate is generated the first time that you enable the secure HTTP server. After you have configured the server, you
can configure options (path, access list to apply, maximum number of connections, or timeout policy) that apply to both
standard and secure HTTP servers.
181
Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication
Command
Purpose
1.
show ip http server status
(Optional) Displays the status of the HTTP server to determine if the
secure HTTP server feature is supported in the software. You should see
one of these lines in the output:
HTTP secure server capability: Present
or
HTTP secure server capability: Not present
2.
configure terminal
Enters global configuration mode.
3.
ip http secure-server
Enables the HTTPS server if it has been disabled. The HTTPS server is
enabled by default.
4.
ip http secure-port port-number
(Optional) Specifies the port number to be used for the HTTPS server. The
default port number is 443. Valid options are 443 or any number in the
range 1025 to 65535.
5.
ip http secure-ciphersuite
(Optional) Specifies the CipherSuites (encryption algorithms) to be used
{[3des-ede-cbc-sha] [rc4-128-md5]
for encryption over the HTTPS connection. If you do not have a reason to
[rc4-128-sha] [des-cbc-sha]}
specify a particularly CipherSuite, you should allow the server and client
to negotiate a CipherSuite that they both support. This is the default.
6.
ip http secure-client-auth
(Optional) Configures the HTTP server to request an X.509v3 certificate
from the client for authentication during the connection process. The
default is for the client to request a certificate from the server, but the
server does not attempt to authenticate the client.
7.
ip http secure-trustpoint name
Specifies the CA trustpoint to use to get an X.509v3 security certificate
and to authenticate the client certificate connection.
Note: Use of this command assumes you have already configured a CA
trustpoint according to the previous procedure.
8.
ip http path path-name
(Optional) Sets a base HTTP path for HTML files. The path specifies the
location of the HTTP server files on the local system (usually located in
system flash memory).
9.
ip http access-class
(Optional) Specifies an access list to use to allow access to the HTTP
access-list-number
server.
10.
ip http max-connections value
(Optional) Sets the maximum number of concurrent connections that are
allowed to the HTTP server. The range is 1 to 16; the default value is 5.
11.
ip http timeout-policy idle seconds life
(Optional) Specifies how long a connection to the HTTP server can remain
seconds requests value
open under the defined circumstances:
idle—Specifies the maximum time period when no data is received or
response data cannot be sent. The range is 1 to 600 seconds. The
default is 180 seconds (3 minutes).
life—Specifies the maximum time period from the time that the
connection is established. The range is 1 to 86400 seconds (24
hours). The default is 180 seconds.
requests—Specifies the maximum number of requests processed on
a persistent connection. The maximum value is 86400. The default
is 1.
12.
end
Returns to privileged EXEC mode.
13.
show ip http server secure status
Displays the status of the HTTP secure server to verify the configuration.
182
Configuring Switch-Based Authentication
Monitoring and Maintaining Switch-Based Authentication
Configuring the Secure HTTP Client
Before You Begin
The standard HTTP client and secure HTTP client are always enabled. A certificate authority is required for secure HTTP
client certification. This procedure assumes that you have previously configured a CA trustpoint on the switch. If a CA
trustpoint is not configured and the remote HTTPS server requires client authentication, connections to the secure HTTP
client fail.
Command
Purpose
1.
configure terminal
Enters global configuration mode.
2.
ip http client secure-trustpoint name
(Optional) Specifies the CA trustpoint to be used if the remote HTTP
server requests client authentication. Using this command assumes that
you have already configured a CA trustpoint by using the previous
procedure. The command is optional if client authentication is not needed
or if a primary trustpoint has been configured.
3.
ip http client secure-ciphersuite
(Optional) Specifies the CipherSuites (encryption algorithms) to be used
{[3des-ede-cbc-sha] [rc4-128-md5]
for encryption over the HTTPS connection. If you do not have a reason to
[rc4-128-sha] [des-cbc-sha]}
specify a particular CipherSuite, you should allow the server and client to
negotiate a CipherSuite that they both support. This is the default.
4.
end
Returns to privileged EXEC mode.
5.
show ip http client secure status
Displays the status of the HTTP secure server to verify the configuration.
6.
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
Monitoring and Maintaining Switch-Based Authentication
Command
Purpose
show running-config
Verifies your configured entries.
copy running-config startup-config
Saves your entries in the configuration file.
show tacacs
Displays the TACACS+ server statistics.
debug radius
Displays the information associated with RADIUS.
debug aaa coa
Displays the debug information for CoA processing.
debug cmdhd
Displays the debug information for the command handler.
show aaa attributes protocol radius
Displays the RADIUS attributes.
show ip ssh
Displays the version and configuration information for the
SSH server.
show ssh
Displays the status of the SSH server.
show ip http client secure status
Displays the HTTP secure client configuration.
show ip http server secure status
Displays the HTTP secure server configuration.
183
Configuring Switch-Based Authentication
Configuration Examples for Configuring Switch-Based Authentication
Configuration Examples for Configuring Switch-Based
Authentication
Changing the Enable Password: Example
This example shows how to change the enable password to l1u2c3k4y5. The password is not encrypted and provides
access to level 15 (traditional privileged EXEC mode access):
Switch(config)# enable password l1u2c3k4y5
Configuring the Encrypted Password: Example
This example shows how to configure the encrypted password $1$FaD0
$Xyti5Rkls3LoyxzS8 for privilege level 2:
Switch(config)# enable secret level 2 5
$1$FaD0
$Xyti5Rkls3LoyxzS8
Setting the Telnet Password for a Terminal Line: Example
This example shows how to set the Telnet password to let45me67in89:
Switch(config)# line vty 10
Switch(config-line)# password let45me67in89
Setting the Privilege Level for a Command: Example
This example shows how to set the configure command to privilege level 14 and define SecretPswd14 as the password
users must enter to use level 14 commands:
Switch(config)# privilege exec level 14 configure
Switch(config)# enable password level 14 SecretPswd14
Configuring the RADIUS Server: Examples
This example shows how to configure one RADIUS server to be used for authentication and another to be used for
accounting:
Switch(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1
Switch(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2
This example shows how to configure host1 as the RADIUS server and to use the default ports for both authentication
and accounting:
Switch(config)# radius-server host host1
Defining AAA Server Groups: Example
In this example, the switch is configured to recognize two different RADIUS group servers (group1 and group2). Group1
has two different host entries on the same RADIUS server configured for the same services. The second host entry acts
as a fail-over backup to the first entry.
Switch(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001
Switch(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646
Switch(config)# aaa new-model
Switch(config)# aaa group server radius group1
Switch(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001
184
Configuring Switch-Based Authentication
Configuration Examples for Configuring Switch-Based Authentication
Switch(config-sg-radius)# exit
Switch(config)# aaa group server radius group2
Switch(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001
Switch(config-sg-radius)# exit
Configuring Vendor-Specific RADIUS Attributes: Examples
This example shows how to provide a user logging in from a switch with immediate access to privileged EXEC
commands:
cisco-avpair= ”shell:priv-lvl=15“
This example shows how to specify an authorized VLAN in the RADIUS server database:
cisco-avpair= ”tunnel-type(#64)=VLAN(13)”
cisco-avpair= ”tunnel-medium-type(#65)=802 media(6)”
cisco-avpair= ”tunnel-private-group-id(#81)=vlanid”
This example shows how to apply an input ACL in ASCII format to an interface for the duration of this connection:
cisco-avpair= “ip:inacl#1=deny ip 10.10.10.10 0.0.255.255 20.20.20.20 255.255.0.0”
cisco-avpair= “ip:inacl#2=deny ip 10.10.10.10 0.0.255.255 any”
cisco-avpair= “mac:inacl#3=deny any any decnet-iv”
This example shows how to apply an output ACL in ASCII format to an interface for the duration of this connection:
cisco-avpair= “ip:outacl#2=deny ip 10.10.10.10 0.0.255.255 any”
Configuring a Vendor-Proprietary RADIUS Host: Example
This example shows how to specify a vendor-proprietary RADIUS host and to use a secret key of rad124 between the
switch and the server:
Switch(config)# radius-server host 172.20.30.15 nonstandard
Switch(config)# radius-server key rad124
Sample Output for a Self-Signed Certificate: Example
If a self-signed certificate has been generated, this information is included in the output of the show running-config
privileged EXEC command. This is a partial sample output from that command displaying a self-signed certificate.
Switch# show running-config
Building configuration...
<output truncated>
crypto pki trustpoint TP-self-signed-3080755072
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3080755072
revocation-check none
rsakeypair TP-self-signed-3080755072
!
!
crypto ca certificate chain TP-self-signed-3080755072
certificate self-signed 01
3082029F 30820208 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
59312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33303830 37353530 37323126 30240609 2A864886 F70D0109
185