Cisco CRS-1 - Carrier Routing System Router User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco IOS XR System Security
Configuration Guide for the Cisco CRS-1
Router
Cisco IOS XR Software Release 3.9
Text Part Number: OL-20382-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
© 2009 Cisco Systems, Inc. All rights reserved.

SC-iii
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01

Contents
SC-iv
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01

SC-v
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Preface
This guide describes the configuration and examples for system security.
For system security command descriptions, usage guidelines, task IDs, and examples, refer to the
Cisco IOS XR System Security Command Reference for the CRS-1 Router.
The preface contains the following sections:
• Changes to This Document, page SC-v
• Obtaining Documentation and Submitting a Service Request, page SC-v
Changes to This Document
Table 1 lists the technical changes made to this document since it was first printed.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional
information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and
revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free
service and Cisco currently supports RSS version 2.0.
Ta b l e 1 Changes to This Document
Revision Date Change Summary
OL-20382-01 December 2009 Initial release of this document.

Preface
SC-vi
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01

SC-1
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Configuring AAA Services on Cisco IOS XR
Software
This module describes the implementation of the administrative model of task-based authorization used
to control user access in the Cisco IOS XR system. The major tasks required to implement task-based
authorization involve configuring user groups and task groups.
User groups and task groups are configured through the Cisco IOS XR software command set used for
authentication, authorization and accounting (AAA) services. Authentication commands are used to
verify the identity of a user or principal. Authorization commands are used to verify that an authenticated
user (or principal) is granted permission to perform a specific task. Accounting commands are used for
logging of sessions and to create an audit trail by recording certain user- or system-generated actions.
AAA is part of the Cisco IOS XR software base package and is available by default.
Note For a complete description of the AAA commands listed in this module, see the Authentication,
Authorization, and Accounting Commands on Cisco IOS XR Software module in the
Cisco IOS XR System Security Command Reference publication. To locate documentation of other
commands that appear in this chapter, use the command reference master index, or search online.
Feature History for Configuring AAA Services on Cisco CRS-1
Release Modification
Release 2.0 This feature was introduced on the Cisco CRS-1.
Release 3.0 No modification.
Release 3.2 No modification.

Configuring AAA Services on Cisco IOS XR Software
SC-2
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Contents
• Prerequisites for Configuring AAA Services, page SC-3
• Restrictions for Configuring AAA Services, page SC-3
• Information About Configuring AAA Services, page SC-3
• How to Configure AAA Services, page SC-18
• Configuration Examples for Configuring AAA Services, page SC-56
• Additional References, page SC-58
Release 3.3.0 • Support for the RADIUS Dead-Server Detection feature was added.
• To enable interoperability based on Cisco IOS software, tasks must be
marked as an optional attribute.
• Support was added on Cisco IOS XR to allow you to specify task IDs
as an attribute in the external RADIUS or TACACS+ server. If the
server is also shared by non-Cisco IOS XR systems, these attributes are
marked as optional as indicated by the server documentation. For
example, CiscoSecure ACS and the freeware TACACS+ server from
Cisco require an asterisk (*) instead of an equal sign (=) before the
attribute value for optional attributes.
• A procedure on how to specify the task ID and user groups by using the
CiscoSecure ACS was added.
• All references to owner secure domain router (SDR) were replaced
with root SDR.
• Support was added to prompt the next logged-in user for a new
username and password if all the users were deleted.
• The predefined task group serviceadmin was added.
• An example was added for RADIUS Vendor -Specific Attribute (VSA).
• EXEC authorization was added to the “Administrative Access” section.
Release 3.4.0 • The server-private command was added to configure RADIUS server
groups.
• Support for the Per VRF AAA feature was added.
• Support for generating interim accounting records was added.
Release 3.5.0 No modification.
Release 3.6.0 The eventmanager keyword (fault manager) replaces the exec keyword to
authorize event managers (fault managers) from the aaa authorization
command.
Release 3.7.0 No modification.
Release 3.8.0 Information was edited to make clearer which features are supported on the
Cisco CRS-1 exclusively.
Release 3.9.0 No modification.

Configuring AAA Services on Cisco IOS XR Software
Prerequisites for Configuring AAA Services
SC-3
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Prerequisites for Configuring AAA Services
The following are the prerequisites to configure AAA services:
• You must be in a user group associated with a task group that includes the proper task IDs. The
command reference guides include the task IDs required for each command.
• If you suspect user group assignment is preventing you from using a command, contact your AAA
administrator for assistance.
Establish a root system user using the initial setup dialog. The administrator may configure a few
local users without any specific AAA configuration. The external security server becomes necessary
when user accounts are shared among many routers within an administrative domain. A typical
configuration would include the use of an external AAA security server and database with the local
database option as a backup in case the external server becomes unreachable.
Restrictions for Configuring AAA Services
This section lists the restrictions for configuring AAA services.
Compatibility
Compatibility is verified with the Cisco freeware TACACS+ server and FreeRADIUS only.
Interoperability
Router administrators can use the same AAA server software and database (for example,
CiscoSecure ACS) for the router and any other Cisco equipment that does not currently run
Cisco IOS XR software. To support interoperability between the router and external TACACS+ servers
that do not support task IDs, see the “Task IDs for TACACS+ and RADIUS Authenticated Users”
section.
Information About Configuring AAA Services
This section lists all the conceptual information that a Cisco IOS XR software user must understand
before configuring user groups and task groups through AAA or configuring Remote Authentication
Dial-in User Service (RADIUS) or TACACS+ servers. Conceptual information also describes what AAA
is and why it is important.
• User, User Groups, and Task Groups, page SC-4
• Cisco IOS XR Software Administrative Model, page SC-6
• Password Types, page SC-11
• Task-Based Authorization, page SC-11
• Task IDs for TACACS+ and RADIUS Authenticated Users, page SC-14
• XML Schema for AAA Services, page SC-16
• About RADIUS, page SC-17

Configuring AAA Services on Cisco IOS XR Software
Information About Configuring AAA Services
SC-4
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
User, User Groups, and Task Groups
Cisco IOS XR software user attributes form the basis of the Cisco IOS XR software administrative
model. Each router user is associated with the following attributes:
• User ID (ASCII string) that identifies the user uniquely across an administrative domain
• Length limitation of 253 characters for passwords and one-way encrypted secrets
• List of user groups (at least one) of which the user is a member (thereby enabling attributes such as
task IDs). (See the “Task IDs” section)
User Categories
Router users are classified into the following categories:
• Root system user (complete administrative authority)
• Root SDR user (specific secure domain router administrative authority)
• Secure domain router user (specific secure domain router user access)
Root System Users
The root system user is the entity authorized to “own” the entire router chassis. The root system user
functions with the highest privileges over all router components and can monitor all secure domain
routers in the system. At least one root system user account must be created during router setup. Multiple
root system users can exist.
The root system user can perform any configuration or monitoring task, including the following:
• Configure secure domain routers.
• Create, delete, and modify root SDR users (after logging in to the secure domain router as the root
system user). (See the “Root SDR Users” section.)
• Create, delete, and modify secure domain router users and set user task permissions (after logging
in to the secure domain router as the root system user). (See the “Secure Domain Router Users”
section.)
• Access fabric racks or any router resource not allocated to a secure domain router, allowing the root
system user to authenticate to any router node regardless of the secure domain router configurations.
Root SDR Users
A root SDR user controls the configuration and monitoring of a particular SDR. The root SDR user can
create users and configure their privileges within the SDR. Multiple root SDR users can work
independently. A single SDR may have more than one root SDR user.
A root SDR user can perform the following administrative tasks for a particular SDR:
• Create, delete, and modify secure domain router users and their privileges for the SDR. (See the
“Secure Domain Router Users” section.)
• Create, delete, and modify user groups to allow access to the SDR.
• Manage nearly all aspects of the SDR.
A root SDR user cannot deny access to a root system user. (See the “Root System Users” section.)