Cisco CRS User manual

Cisco IOS XR System Security Command Reference for the Cisco CRS
Router, Release 4.1
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-24740-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2014 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface ix
Changes to This Document ix
Obtaining Documentation and Submitting a Service Request ix
CHAPTER 1 Authentication, Authorization, and Accounting Commands 1
aaa accounting 4
aaa accounting system default 7
aaa accounting system rp-failover 9
aaa accounting update 11
aaa authentication 13
aaa authorization 16
aaa default-taskgroup 19
aaa group server radius 20
aaa group server tacacs+ 22
accounting (line) 24
authorization (line) 26
deadtime (server-group configuration) 28
description (AAA) 30
group (AAA) 32
inherit taskgroup 34
inherit usergroup 36
key (RADIUS) 38
key (TACACS+) 40
login authentication 42
password (AAA) 44
radius-server dead-criteria time 46
radius-server dead-criteria tries 48
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 iii

radius-server deadtime 50
radius-server key 51
radius-server retransmit 52
radius-server timeout 54
radius source-interface 55
retransmit (RADIUS) 57
secret 59
server (RADIUS) 61
server (TACACS+) 63
server-private (RADIUS) 65
server-private (TACACS+) 68
show aaa 70
show radius 76
show radius accounting 78
show radius authentication 80
show radius client 82
show radius dead-criteria 84
show radius server-groups 86
show tacacs 89
show tacacs server-groups 91
show user 93
single-connection 97
tacacs-server host 99
tacacs-server key 102
tacacs-server timeout 104
tacacs source-interface 105
task 107
taskgroup 109
timeout (RADIUS) 111
timeout (TACACS+) 113
timeout login response 115
usergroup 117
username 119
users group 123
vrf (RADIUS) 125
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
iv OL-24740-01
Contents

vrf (TACACS+) 127
CHAPTER 2 IPSec Commands 129
clear crypto ipsec sa 130
description (IPSec profile) 132
interface tunnel-ip (GRE) 133
show crypto ipsec sa 134
show crypto ipsec summary 138
show crypto ipsec transform-set 140
tunnel mode (IP) 141
tunnel tos (IP) 142
tunnel ttl (IP) 143
tunnel dfbit disable (IP) 144
CHAPTER 3 Keychain Management Commands 145
accept-lifetime 146
accept-tolerance 148
key (key chain) 150
key chain (key chain) 152
key-string (keychain) 154
send-lifetime 156
show key chain 158
CHAPTER 4 Lawful Intercept Commands 161
lawful-intercept disable 162
CHAPTER 5 Management Plane Protection Commands 163
address ipv4 (MPP) 164
allow 166
control-plane 169
inband 170
interface (MPP) 172
management-plane 174
out-of-band 175
show mgmt-plane 177
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 v
Contents

vrf (MPP) 179
CHAPTER 6 Public Key Infrastructure Commands 181
clear crypto ca certificates 183
clear crypto ca crl 184
crl optional (trustpoint) 186
crypto ca authenticate 188
crypto ca cancel-enroll 190
crypto ca enroll 191
crypto ca import 193
crypto ca trustpoint 194
crypto key generate dsa 197
crypto key generate rsa 199
crypto key import authentication rsa 201
crypto key zeroize dsa 202
crypto key zeroize rsa 203
description (trustpoint) 205
enrollment retry count 206
enrollment retry period 208
enrollment terminal 210
enrollment url 211
ip-address (trustpoint) 213
query url 215
rsakeypair 217
serial-number (trustpoint) 218
sftp-password (trustpoint) 220
sftp-username (trustpoint) 222
subject-name (trustpoint) 224
show crypto ca certificates 226
show crypto ca crls 228
show crypto key mypubkey dsa 229
show crypto key mypubkey rsa 231
CHAPTER 7 Software Authentication Manager Commands 233
sam add certificate 234
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
vi OL-24740-01
Contents

sam delete certificate 236
sam prompt-interval 238
sam verify 240
show sam certificate 242
show sam crl 246
show sam log 248
show sam package 250
show sam sysinfo 253
CHAPTER 8 Secure Shell Commands 255
clear ssh 256
sftp 258
sftp (Interactive Mode) 262
show ssh 265
show ssh session details 267
ssh 269
ssh client knownhost 272
ssh client source-interface 274
ssh client vrf 276
ssh server 278
ssh server logging 280
ssh server rate-limit 282
ssh server session-limit 283
ssh server v2 285
ssh timeout 286
CHAPTER 9 Secure Socket Layer Protocol Commands 287
show ssl 288
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 vii
Contents

Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
viii OL-24740-01
Contents

Preface
This guide describes the commands used to display and configure system security on Cisco IOS XR software.
For System Security configuration information and examples, refer to the Cisco IOS XR System Security
Configuration Guide for the Cisco CRS Router.
The preface contains the following sections:
•Changes to This Document, page ix
•Obtaining Documentation and Submitting a Service Request, page ix
Changes to This Document
This table lists the technical changes made to this document since it was first printed.
Table 1: Changes to This Document
Change SummaryDateRevision
Initial release of this document.April 2011OL-24740-01
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation, at: http://
www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What's New in Cisco Product Documentation, which lists all new and revised Cisco technical
documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The
RSS feeds are a free service.
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 ix

Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
xOL-24740-01
Preface
Obtaining Documentation and Submitting a Service Request

Authentication, Authorization, and Accounting
Commands
This module describes the commands used to configure authentication, authorization, and accounting (AAA)
services.
For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA
Services on Cisco IOS XR Software configuration module.
•aaa accounting, page 4
•aaa accounting system default, page 7
•aaa accounting system rp-failover, page 9
•aaa accounting update, page 11
•aaa authentication , page 13
•aaa authorization , page 16
•aaa default-taskgroup, page 19
•aaa group server radius, page 20
•aaa group server tacacs+, page 22
•accounting (line), page 24
•authorization (line), page 26
•deadtime (server-group configuration), page 28
•description (AAA), page 30
•group (AAA), page 32
•inherit taskgroup, page 34
•inherit usergroup, page 36
•key (RADIUS), page 38
•key (TACACS+), page 40
•login authentication, page 42
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 1

•password (AAA), page 44
•radius-server dead-criteria time, page 46
•radius-server dead-criteria tries, page 48
•radius-server deadtime , page 50
•radius-server key , page 51
•radius-server retransmit , page 52
•radius-server timeout , page 54
•radius source-interface , page 55
•retransmit (RADIUS), page 57
•secret, page 59
•server (RADIUS), page 61
•server (TACACS+), page 63
•server-private (RADIUS), page 65
•server-private (TACACS+), page 68
•show aaa , page 70
•show radius, page 76
•show radius accounting, page 78
•show radius authentication, page 80
•show radius client, page 82
•show radius dead-criteria, page 84
•show radius server-groups, page 86
•show tacacs, page 89
•show tacacs server-groups, page 91
•show user, page 93
•single-connection, page 97
•tacacs-server host, page 99
•tacacs-server key, page 102
•tacacs-server timeout, page 104
•tacacs source-interface, page 105
•task, page 107
•taskgroup, page 109
•timeout (RADIUS), page 111
•timeout (TACACS+), page 113
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
2OL-24740-01
Authentication, Authorization, and Accounting Commands

•timeout login response, page 115
•usergroup, page 117
•username, page 119
•users group, page 123
•vrf (RADIUS), page 125
•vrf (TACACS+), page 127
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 3
Authentication, Authorization, and Accounting Commands

aaa accounting
To create a method list for accounting, use the aaa accounting command. To remove a list name from the
system, use the no form of this command.
aaa accounting {commands| exec| network | subscriber | system } {default| list-name} {start-stop|
stop-only} {none| method}
no aaa accounting {commands| exec| network} {default| list-name}
Syntax Description Enables accounting for EXEC shell commands.commands
Enables accounting of an EXEC session.exec
Enables accounting for all network-related service requests, such as Internet Key
Exchange (IKE) and Point-to-Point Protocol (PPP).
network
Sets accounting lists for subscribers.subscriber
Enables accounting for all system-related events.system
Uses the listed accounting methods that follow this keyword as the default list of
methods for accounting services.
default
Character string used to name the accounting method list.
list-name
Sends a “start accounting”notice at the beginning of a process and a “stop accounting”
notice at the end of a process. The requested user process begins regardless of
whether the “start accounting”notice was received by the accounting server.
start-stop
Sends a “stop accounting”notice at the end of the requested user process.
Note: This is not supported with system accounting.
stop-only
Uses no accounting.none
Method used to enable AAA system accounting. The value is one of the following
options:
•group tacacs+—Uses the list of all TACACS+ servers for accounting.
•group radius—Uses the list of all RADIUS servers for accounting.
•group named-group—Uses a named subset of TACACS+ or RADIUS servers
for accounting, as defined by the aaa group server tacacs+ or aaa group
server radius command.
method
Command Default AAA accounting is disabled.
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
4OL-24740-01
Authentication, Authorization, and Accounting Commands
aaa accounting

Command Modes Global configuration
Command History ModificationRelease
This command was introduced.Release 2.0
The network keyword and method argument were added.
Release 3.4.0
Usage Guidelines Use the aaa accounting command to create default or named method lists defining specific accounting methods
and that can be used on a per-line or per-interface basis. You can specify up to four methods in the method
list. The list name can be applied to a line (console, aux, or vty template) to enable accounting on that particular
line.
The Cisco IOS XR software supports both TACACS+ and RADIUS methods for accounting. The router
reports user activity to the security server in the form of accounting records, which are stored on the security
server.
Method lists for accounting define the way accounting is performed, enabling you to designate a particular
security protocol that is used on specific lines or interfaces for particular types of accounting services.
For minimal accounting, include the stop-only keyword to send a “stop accounting”notice after the requested
user process. For more accounting, you can include the start-stop keyword, so that TACACS+ or RADIUS
sends a “start accounting”notice at the beginning of the requested process and a “stop accounting”notice after
the process. The accounting record is stored only on the TACACS+ or RADIUS server.
The requested user process begins regardless of whether the “start accounting”notice was received by the
accounting server.
This command cannot be used with TACACS or extended TACACS.Note
Task ID OperationsTask ID
read, writeaaa
Examples The following example shows how to define a default commands accounting method list, where accounting
services are provided by a TACACS+ security server, with a stop-only restriction:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting commands default stop-only group tacacs+
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 5
Authentication, Authorization, and Accounting Commands
aaa accounting

Related Commands DescriptionCommand
Creates a method list for authorization.aaa authorization , on page 16
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
6OL-24740-01
Authentication, Authorization, and Accounting Commands
aaa accounting

aaa accounting system default
To enable authentication, authorization, and accounting (AAA) system accounting, use the aaa accounting
system default command. To disable system accounting, use the no form of this command.
aaa accounting system default {start-stop| stop-only} {none| method}
no aaa accounting system default
Syntax Description Sends a “start accounting”notice during system bootup and a “stop accounting”notice
during system shutdown or reload.
start-stop
Sends a “stop accounting”notice during system shutdown or reload.
stop-only
Uses no accounting.none
Method used to enable AAA system accounting. The value is one of the following
options:
•group tacacs+—Uses the list of all TACACS+ servers for accounting.
•group radius—Uses the list of all RADIUS servers for accounting.
•group named-group—Uses a named subset of TACACS+ or RADIUS servers
for accounting, as defined by the aaa group server tacacs+ or aaa group server
radius command.
method
Command Default AAA accounting is disabled.
Command Modes Global configuration
Command History ModificationRelease
This command was introduced.Release 2.0
The method argument was added to specify either group tacacs+ ,
group radius, or group named-group options.
Release 3.3.0
Usage Guidelines System accounting does not use named accounting lists; you can define only the default list for system
accounting.
The default method list is automatically applied to all interfaces or lines. If no default method list is defined,
then no accounting takes place.
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 7
Authentication, Authorization, and Accounting Commands
aaa accounting system default

You can specify up to four methods in the method list.
Task ID OperationsTask ID
read, writeaaa
Examples This example shows how to cause a “start accounting”record to be sent to a TACACS+ server when a router
initially boots. A “stop accounting”record is also sent when a router is shut down or reloaded.
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting system default start-stop group tacacs+
Related Commands DescriptionCommand
Creates a method list for authentication.aaa authentication , on page 13
Creates a method list for authorization.aaa authorization , on page 16
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
8OL-24740-01
Authentication, Authorization, and Accounting Commands
aaa accounting system default

aaa accounting system rp-failover
To create an accounting list to send rp-failover or rp-switchover start or stop accounting messages, use the
aaa accounting system rp-failover command in global configuration mode. To disable the system accounting
for rp-failover, use the no form of this command.
aaa accounting system rp-failover {list_name {start-stop| stop-only}| default {start-stop| stop-only}}
no aaa accounting system rp-failover {list_name {start-stop| stop-only}| default {start-stop| stop-only}}
Syntax Description Specifies the accounting list name.
list_name
Specifies the default accounting list.default
Enables the start and stop records.start-stop
Enables the stop records only.stop-only
Command Default None
Command Modes Global configuration mode
Command History ModificationRelease
This command was introduced.Release 4.2.0
Usage Guidelines
Task ID OperationTask ID
read, writeaaa
Examples This is an example of configuring the aaa accounting system rp-failover command for default accounting
list:
RP/0/RP0/CPU0:router(config)# aaa accounting system rp-failover default start-stop none
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 9
Authentication, Authorization, and Accounting Commands
aaa accounting system rp-failover

Related Commands DescriptionCommand
Create an AAA attribute format name.aaa attribute format
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
10 OL-24740-01
Authentication, Authorization, and Accounting Commands
aaa accounting system rp-failover