Cisco NCS 5000 Series User manual

System Security Command Reference for Cisco NCS 5000 Series
Routers
First Published: 2015-12-23
Last Modified: 2017-03-16
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface vii
Changes to This Document vii
Obtaining Documentation and Submitting a Service Request vii
CHAPTER 1 Authentication, Authorization, and Accounting Commands 1
aaa accounting 4
aaa accounting system default 6
aaa accounting update 8
aaa authentication (XR-VM) 10
aaa authorization (XR-VM) 12
aaa default-taskgroup 15
aaa group server radius 16
aaa group server tacacs+ 18
aaa password-policy 20
accounting (line) 23
authorization (line) 25
description (AAA) 27
group (AAA) 28
inherit taskgroup 30
inherit usergroup 32
key (TACACS+) 34
login authentication 36
password (AAA) 38
radius-server dead-criteria time 40
radius-server dead-criteria tries 42
radius-server deadtime (BNG) 44
radius-server key (BNG) 45
System Security Command Reference for Cisco NCS 5000 Series Routers
iii

radius-server retransmit (BNG) 47
radius-server timeout (BNG) 48
radius source-interface (BNG) 49
secret 51
server (RADIUS) 53
server (TACACS+) 55
server-private (RADIUS) 56
server-private (TACACS+) 58
show aaa (XR-VM) 60
show aaa accounting 65
show aaa password-policy 67
show radius 69
show radius accounting 71
show radius authentication 73
show radius dead-criteria 75
show radius server-groups 77
show tacacs 80
show tacacs server-groups 82
show user 84
show aaa user-group 88
show tech-support aaa 89
single-connection 90
tacacs-server host 91
tacacs-server key 93
tacacs-server timeout 95
tacacs-server ipv4 96
tacacs source-interface 98
task 100
taskgroup 102
timeout (TACACS+) 104
timeout login response 105
usergroup 106
username 108
users group 112
System Security Command Reference for Cisco NCS 5000 Series Routers
iv
Contents

CHAPTER 2 Keychain Management Commands 115
accept-lifetime 116
accept-tolerance 118
cryptographic-algorithm 119
key (key chain) 121
key chain (key chain) 122
key-string (keychain) 123
send-lifetime 125
show key chain 127
CHAPTER 3 Management Plane Protection Commands 129
address ipv4 (MPP) 130
address ipv6 (MPP) 132
allow 133
control-plane 135
inband 136
interface (MPP) 137
management-plane 139
show mgmt-plane 140
CHAPTER 4 Secure Shell Commands 143
clear ssh 145
clear netconf-yang agent session 147
netconf-yang agent ssh 148
sftp 149
sftp (Interactive Mode) 152
show netconf-yang clients 155
show netconf-yang statistics 157
show ssh 159
show ssh session details 162
ssh 164
ssh client knownhost 166
ssh client source-interface 168
ssh server 170
System Security Command Reference for Cisco NCS 5000 Series Routers
v
Contents

ssh server logging 172
ssh server rate-limit 173
ssh server session-limit 174
ssh server v2 175
ssh server netconf 176
ssh timeout 177
System Security Command Reference for Cisco NCS 5000 Series Routers
vi
Contents

Preface
This preface contains these sections:
•Changes to This Document, page vii
•Obtaining Documentation and Submitting a Service Request, page vii
Changes to This Document
This table lists the technical changes made to this document since it was first released.
Table 1: Changes to This Document
SummaryDate
Initial release of this document.December 2015
Republished with documentation updates for Cisco
IOS XR Release 6.2.1 features.
March 2017
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation.
To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's
New in Cisco Product Documentation RSS feed. RSS feeds are a free service.
System Security Command Reference for Cisco NCS 5000 Series Routers
vii

System Security Command Reference for Cisco NCS 5000 Series Routers
viii
Preface
Obtaining Documentation and Submitting a Service Request

Authentication, Authorization, and Accounting
Commands
This module describes the commands used to configure authentication, authorization, and accounting (AAA)
services.
For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA
Services chapter in the System Security Configuration Guide for Cisco NCS 5000 Series Routers.
Currently, only default VRF is supported. VPNv4, VPNv6 and VPN routing and forwarding (VRF) address
families will be supported in a future release.
Note
•aaa accounting, page 4
•aaa accounting system default, page 6
•aaa accounting update, page 8
•aaa authentication (XR-VM), page 10
•aaa authorization (XR-VM), page 12
•aaa default-taskgroup, page 15
•aaa group server radius, page 16
•aaa group server tacacs+, page 18
•aaa password-policy, page 20
•accounting (line), page 23
•authorization (line), page 25
•description (AAA), page 27
•group (AAA), page 28
•inherit taskgroup, page 30
•inherit usergroup, page 32
•key (TACACS+), page 34
System Security Command Reference for Cisco NCS 5000 Series Routers
1

•login authentication, page 36
•password (AAA), page 38
•radius-server dead-criteria time, page 40
•radius-server dead-criteria tries, page 42
•radius-server deadtime (BNG), page 44
•radius-server key (BNG), page 45
•radius-server retransmit (BNG), page 47
•radius-server timeout (BNG), page 48
•radius source-interface (BNG), page 49
•secret, page 51
•server (RADIUS), page 53
•server (TACACS+), page 55
•server-private (RADIUS), page 56
•server-private (TACACS+), page 58
•show aaa (XR-VM), page 60
•show aaa accounting, page 65
•show aaa password-policy, page 67
•show radius, page 69
•show radius accounting, page 71
•show radius authentication, page 73
•show radius dead-criteria, page 75
•show radius server-groups, page 77
•show tacacs, page 80
•show tacacs server-groups, page 82
•show user, page 84
•show aaa user-group, page 88
•show tech-support aaa , page 89
•single-connection, page 90
•tacacs-server host, page 91
•tacacs-server key, page 93
•tacacs-server timeout, page 95
•tacacs-server ipv4, page 96
•tacacs source-interface, page 98
System Security Command Reference for Cisco NCS 5000 Series Routers
2
Authentication, Authorization, and Accounting Commands

•task, page 100
•taskgroup, page 102
•timeout (TACACS+), page 104
•timeout login response, page 105
•usergroup, page 106
•username, page 108
•users group, page 112
System Security Command Reference for Cisco NCS 5000 Series Routers
3
Authentication, Authorization, and Accounting Commands

aaa accounting
To create a method list for accounting, use the aaa accounting command in the XR EXEC mode. To remove
a list name from the system, use the no form of this command.
aaa accounting {commands| exec| mobile | network | system } {default| list-name} {start-stop| stop-only}
{none| method}
no aaa accounting {commands| exec| mobile | network} {default| list-name}
Syntax Description Enables accounting for XR EXEC shell commands.commands
Enables accounting of a XR EXEC session.exec
Enables Mobile IP related accounting events.mobile
Enables accounting for all network-related service requests, such as Internet Key
Exchange (IKE) and Point-to-Point Protocol (PPP).
network
Enables accounting for all system-related events.system
Sets the authorization list for XR EXEC.event manager
Uses the listed accounting methods that follow this keyword as the default list of
methods for accounting services.
default
Character string used to name the accounting method list.
list-name
Sends a “start accounting”notice at the beginning of a process and a “stop
accounting”notice at the end of a process. The requested user process begins
regardless of whether the “start accounting”notice was received by the accounting
server.
start-stop
Sends a “stop accounting”notice at the end of the requested user process.
Note: This is not supported with system accounting.
stop-only
Uses no accounting.none
Method used to enable AAA system accounting. The value is one of the following
options:
•group tacacs+—Uses the list of all TACACS+ servers for accounting.
•group radius—Uses the list of all RADIUS servers for accounting.
•group named-group—Uses a named subset of TACACS+ or RADIUS servers
for accounting, as defined by the aaa group server tacacs+ or aaa group
server radius command.
method
System Security Command Reference for Cisco NCS 5000 Series Routers
4
Authentication, Authorization, and Accounting Commands
aaa accounting

Command Default AAA accounting is disabled.
Command Modes XR EXEC mode
Command History ModificationRelease
This command was introduced.Release 6.0
Usage Guidelines Use the aaa accounting command to create default or named method lists defining specific accounting methods
and that can be used on a per-line or per-interface basis. You can specify up to four methods in the method
list. The list name can be applied to a line (console, aux, or vty template) to enable accounting on that particular
line.
The Cisco IOS XR software supports both TACACS+ and RADIUS methods for accounting. The router
reports user activity to the security server in the form of accounting records, which are stored on the security
server.
Method lists for accounting define the way accounting is performed, enabling you to designate a particular
security protocol that is used on specific lines or interfaces for particular types of accounting services.
For minimal accounting, include the stop-only keyword to send a “stop accounting”notice after the requested
user process. For more accounting, you can include the start-stop keyword, so that TACACS+ or RADIUS
sends a “start accounting”notice at the beginning of the requested process and a “stop accounting”notice after
the process. The accounting record is stored only on the TACACS+ or RADIUS server.
The requested user process begins regardless of whether the “start accounting”notice was received by the
accounting server.
This command cannot be used with TACACS or extended TACACS.Note
Task ID OperationsTask ID
read, writeaaa
Examples The following example shows how to define a default commands accounting method list, where accounting
services are provided by a TACACS+ security server, with a stop-only restriction:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting commands default stop-only group tacacs+
System Security Command Reference for Cisco NCS 5000 Series Routers
5
Authentication, Authorization, and Accounting Commands
aaa accounting

aaa accounting system default
To enable authentication, authorization, and accounting (AAA) system accounting, use the aaa accounting
system default command in the XR Config mode. To disable system accounting, use the no form of this
command.
aaa accounting system default {start-stop| stop-only} {none| method}
no aaa accounting system default
Syntax Description Sends a “start accounting”notice during system bootup and a “stop accounting”notice
during system shutdown or reload.
start-stop
Sends a “stop accounting”notice during system shutdown or reload.
stop-only
Uses no accounting.none
Method used to enable AAA system accounting. The value is one of the following
options:
•group tacacs+—Uses the list of all TACACS+ servers for accounting.
•group radius—Uses the list of all RADIUS servers for accounting.
•group named-group—Uses a named subset of TACACS+ or RADIUS servers
for accounting, as defined by the aaa group server tacacs+ or aaa group server
radius command.
method
Command Default AAA accounting is disabled.
Command Modes XR Config mode
Command History ModificationRelease
This command was introduced.Release 6.0
Usage Guidelines System accounting does not use named accounting lists; you can define only the default list for system
accounting.
The default method list is automatically applied to all interfaces or lines. If no default method list is defined,
then no accounting takes place.
You can specify up to four methods in the method list.
System Security Command Reference for Cisco NCS 5000 Series Routers
6
Authentication, Authorization, and Accounting Commands
aaa accounting system default

Task ID OperationsTask ID
read, writeaaa
Examples This example shows how to cause a “start accounting”record to be sent to a TACACS+ server when a router
initially boots. A “stop accounting”record is also sent when a router is shut down or reloaded.
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting system default start-stop group tacacs+
System Security Command Reference for Cisco NCS 5000 Series Routers
7
Authentication, Authorization, and Accounting Commands
aaa accounting system default

aaa accounting update
To enable periodic interim accounting records to be sent to the accounting server, use the aaa accounting
update command in the XR Config mode. To disable the interim accounting updates, use the no form of this
command.
aaa accounting update {newinfo|periodic minutes}
no aaa accounting update
Syntax Description (Optional) Sends an interim accounting record to the accounting server whenever
there is new accounting information to report relating to the user in question.
newinfo
(Optional) Sends an interim accounting record to the accounting server periodically,
as defined by the minutes argument, which is an integer that specifies the number
of minutes. The range is from 1 to 35791394 minutes.
periodic minutes
Command Default AAA accounting update is disabled.
Command Modes XR Config mode
Command History ModificationRelease
This command was introduced.Release 6.0
Usage Guidelines If the newinfo keyword is used, interim accounting records are sent to the accounting server every time there
is new accounting information to report. An example of this report would be when IP Control Protocol (IPCP)
completes IP address negotiation with the remote peer. The interim accounting record includes the negotiated
IP address used by the remote peer.
When used with the periodic keyword, interim accounting records are sent periodically as defined by the
minutes argument. The interim accounting record contains all the accounting information recorded for that
user up to the time the accounting record is sent.
When using both the newinfo and periodic keywords, interim accounting records are sent to the accounting
server every time there is new accounting information to report, and accounting records are sent to the
accounting server periodically as defined by the minutes argument. For example, if you configure the aaa
accounting update command with the newinfo and periodic keywords, all users currently logged in continue
to generate periodic interim accounting records while new users generate accounting records based on the
newinfo algorithm.
System Security Command Reference for Cisco NCS 5000 Series Routers
8
Authentication, Authorization, and Accounting Commands
aaa accounting update

Using the aaa accounting update command with the periodic keyword can cause heavy congestion when
many users are logged into the network.
Caution
Both periodic and newinfo keywords are mutually exclusive; therefore, only one keyword can be configured
at a time.
Task ID OperationsTask ID
read, writeaaa
Examples The following example shows how to send periodic interim accounting records to the RADIUS server at
30-minute intervals:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting update periodic 30
The following example shows how to send interim accounting records to the RADIUS server when there is
new accounting information to report:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa accounting update newinfo
System Security Command Reference for Cisco NCS 5000 Series Routers
9
Authentication, Authorization, and Accounting Commands
aaa accounting update

aaa authentication (XR-VM)
To create a method list for authentication, use the aaa authentication command in the XR Config mode or
System Admin Config mode. To disable this authentication method, use the no form of this command.
aaa authentication {login| ppp} {default|list-name}method-list
no aaa authentication {login| ppp} {default|list-name}method-list
Syntax Description Sets authentication for login.login
Sets authentication for Point-to-Point Protocol.ppp
Uses the listed authentication methods that follow this keyword as the default list of
methods for authentication.
default
Character string used to name the authentication method list.
list-name
Method used to enable AAA system accounting. The value is one of the following options:
•group tacacs+—Specifies a method list that uses the list of all configured TACACS+
servers for authentication.
•group radius—Specifies a method list that uses the list of all configured RADIUS
servers for authentication.
•group named-group —Specifies a method list that uses a named subset of
TACACS+ or RADIUS servers for authentication, as defined by the aaa group
server tacacs+ or aaa group server radius command.
•local—Specifies a method list that uses the local username database method for
authentication. AAA method rollover happens beyond the local method if username
is not defined in the local group.
•line—Specifies a method list that uses the line password for authentication.
method-list
Command Default Default behavior applies the local authentication on all ports.
Command Modes XR Config mode or System Admin Config mode
Command History ModificationRelease
This command was introduced.Release 6.0
System Security Command Reference for Cisco NCS 5000 Series Routers
10
Authentication, Authorization, and Accounting Commands
aaa authentication (XR-VM)

Usage Guidelines Use the aaa authentication command to create a series of authentication methods, or method list. You can
specify up to four methods in the method list. A method list is a named list describing the authentication
methods (such as TACACS+ or RADIUS) in sequence. The subsequent methods of authentication are used
only if the initial method is not available, not if it fails.
The default method list is applied for all interfaces for authentication, except when a different named method
list is explicitly specified—in which case the explicitly specified method list overrides the default list.
For console and vty access, if no authentication is configured, a default of local method is applied.
Note •The group tacacs+,group radius, and group group-name forms of this command refer to a set of
previously defined TACACS+ or RADIUS servers.
•Use the tacacs-server host or radius-server host command to configure the host servers.
•Use the aaa group server tacacs+ or aaa group server radius command to create a named subset
of servers.
•The login keyword, local option, and group option are available only in System Admin Config
mode.
Task ID OperationsTask ID
read, writeaaa
Examples The following example shows how to specify the default method list for authentication, and also enable
authentication for console in XR Config mode:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# aaa authentication login default group tacacs+
The following example shows how to specify the remote method list for authentication, and also enable
authentication for console in System Admin Config mode:
RP/0/RP0/CPU0:router# admin
sysadmin-vm:0_RP0# configure
sysadmin-vm:0_RP0(config)# aaa authentication users user lab
RP/0/RP0/CPU0:router# admin
sysadmin-vm:0_RP0# configure
sysadmin-vm:0_RP0(config)# aaa authentication groups group aaa-r
System Security Command Reference for Cisco NCS 5000 Series Routers
11
Authentication, Authorization, and Accounting Commands
aaa authentication (XR-VM)

aaa authorization (XR-VM)
To create a method list for authorization, use the aaa authorization command in the XR Config mode. To
disable authorization for a function, use the no form of this command.
aaa authorization {commands| eventmanager| exec| network } {default|list-name} {none| local|group
{tacacs+| radius|group-name}}
no aaa authorization {commands| eventmanager| exec| network } {default|list-name}
Syntax Description Configures authorization for all XR EXEC mode shell commands.commands
Applies an authorization method for authorizing an event manager (fault
manager).
eventmanager
Configures authorization for an interactive (XR EXEC mode) session.exec
Configures authorization for network services, such as PPP or Internet Key
Exchange (IKE).
network
Uses the listed authorization methods that follow this keyword as the default list
of methods for authorization.
default
Character string used to name the list of authorization methods.
list-name
Uses no authorization. If you specify none, no subsequent authorization methods
is attempted. However, the task ID authorization is always required and cannot
be disabled.
none
Uses local authorization. This method of authorization is not available for
command authorization.
local
Uses the list of all configured TACACS+ servers for authorization.group tacacs+
Uses the list of all configured RADIUS servers for authorization. This method
of authorization is not available for command authorization.
group radius
Uses a named subset of TACACS+ or RADIUS servers for authorization as
defined by the aaa group server tacacs+ or aaa group server radius command.
group group-name
Command Default Authorization is disabled for all actions (equivalent to the method none keyword).
Command Modes XR Config mode
System Security Command Reference for Cisco NCS 5000 Series Routers
12
Authentication, Authorization, and Accounting Commands
aaa authorization (XR-VM)