Cisco CRS User manual

Cisco IOS XR System Security Command Reference for the Cisco CRS
Router, Release 4.1
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-24740-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2014 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface ix
Changes to This Document ix
Obtaining Documentation and Submitting a Service Request ix
CHAPTER 1 Authentication, Authorization, and Accounting Commands 1
aaa accounting 4
aaa accounting system default 7
aaa accounting system rp-failover 9
aaa accounting update 11
aaa authentication 13
aaa authorization 16
aaa default-taskgroup 19
aaa group server radius 20
aaa group server tacacs+ 22
accounting (line) 24
authorization (line) 26
deadtime (server-group configuration) 28
description (AAA) 30
group (AAA) 32
inherit taskgroup 34
inherit usergroup 36
key (RADIUS) 38
key (TACACS+) 40
login authentication 42
password (AAA) 44
radius-server dead-criteria time 46
radius-server dead-criteria tries 48
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 iii

radius-server deadtime 50
radius-server key 51
radius-server retransmit 52
radius-server timeout 54
radius source-interface 55
retransmit (RADIUS) 57
secret 59
server (RADIUS) 61
server (TACACS+) 63
server-private (RADIUS) 65
server-private (TACACS+) 68
show aaa 70
show radius 76
show radius accounting 78
show radius authentication 80
show radius client 82
show radius dead-criteria 84
show radius server-groups 86
show tacacs 89
show tacacs server-groups 91
show user 93
single-connection 97
tacacs-server host 99
tacacs-server key 102
tacacs-server timeout 104
tacacs source-interface 105
task 107
taskgroup 109
timeout (RADIUS) 111
timeout (TACACS+) 113
timeout login response 115
usergroup 117
username 119
users group 123
vrf (RADIUS) 125
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
iv OL-24740-01
Contents

vrf (TACACS+) 127
CHAPTER 2 IPSec Commands 129
clear crypto ipsec sa 130
description (IPSec profile) 132
interface tunnel-ip (GRE) 133
show crypto ipsec sa 134
show crypto ipsec summary 138
show crypto ipsec transform-set 140
tunnel mode (IP) 141
tunnel tos (IP) 142
tunnel ttl (IP) 143
tunnel dfbit disable (IP) 144
CHAPTER 3 Keychain Management Commands 145
accept-lifetime 146
accept-tolerance 148
key (key chain) 150
key chain (key chain) 152
key-string (keychain) 154
send-lifetime 156
show key chain 158
CHAPTER 4 Lawful Intercept Commands 161
lawful-intercept disable 162
CHAPTER 5 Management Plane Protection Commands 163
address ipv4 (MPP) 164
allow 166
control-plane 169
inband 170
interface (MPP) 172
management-plane 174
out-of-band 175
show mgmt-plane 177
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 v
Contents

vrf (MPP) 179
CHAPTER 6 Public Key Infrastructure Commands 181
clear crypto ca certificates 183
clear crypto ca crl 184
crl optional (trustpoint) 186
crypto ca authenticate 188
crypto ca cancel-enroll 190
crypto ca enroll 191
crypto ca import 193
crypto ca trustpoint 194
crypto key generate dsa 197
crypto key generate rsa 199
crypto key import authentication rsa 201
crypto key zeroize dsa 202
crypto key zeroize rsa 203
description (trustpoint) 205
enrollment retry count 206
enrollment retry period 208
enrollment terminal 210
enrollment url 211
ip-address (trustpoint) 213
query url 215
rsakeypair 217
serial-number (trustpoint) 218
sftp-password (trustpoint) 220
sftp-username (trustpoint) 222
subject-name (trustpoint) 224
show crypto ca certificates 226
show crypto ca crls 228
show crypto key mypubkey dsa 229
show crypto key mypubkey rsa 231
CHAPTER 7 Software Authentication Manager Commands 233
sam add certificate 234
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
vi OL-24740-01
Contents

sam delete certificate 236
sam prompt-interval 238
sam verify 240
show sam certificate 242
show sam crl 246
show sam log 248
show sam package 250
show sam sysinfo 253
CHAPTER 8 Secure Shell Commands 255
clear ssh 256
sftp 258
sftp (Interactive Mode) 262
show ssh 265
show ssh session details 267
ssh 269
ssh client knownhost 272
ssh client source-interface 274
ssh client vrf 276
ssh server 278
ssh server logging 280
ssh server rate-limit 282
ssh server session-limit 283
ssh server v2 285
ssh timeout 286
CHAPTER 9 Secure Socket Layer Protocol Commands 287
show ssl 288
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 vii
Contents

Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
viii OL-24740-01
Contents

Preface
This guide describes the commands used to display and configure system security on Cisco IOS XR software.
For System Security configuration information and examples, refer to the Cisco IOS XR System Security
Configuration Guide for the Cisco CRS Router.
The preface contains the following sections:
•Changes to This Document, page ix
•Obtaining Documentation and Submitting a Service Request, page ix
Changes to This Document
This table lists the technical changes made to this document since it was first printed.
Table 1: Changes to This Document
Change SummaryDateRevision
Initial release of this document.April 2011OL-24740-01
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation, at: http://
www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What's New in Cisco Product Documentation, which lists all new and revised Cisco technical
documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The
RSS feeds are a free service.
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 ix

Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
xOL-24740-01
Preface
Obtaining Documentation and Submitting a Service Request