Cisco NCS 5000 Series User manual

System Security Command Reference for Cisco NCS 5000 Series
Routers
First Published: 2015-12-23
Last Modified: 2017-03-16
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface vii
Changes to This Document vii
Obtaining Documentation and Submitting a Service Request vii
CHAPTER 1 Authentication, Authorization, and Accounting Commands 1
aaa accounting 4
aaa accounting system default 6
aaa accounting update 8
aaa authentication (XR-VM) 10
aaa authorization (XR-VM) 12
aaa default-taskgroup 15
aaa group server radius 16
aaa group server tacacs+ 18
aaa password-policy 20
accounting (line) 23
authorization (line) 25
description (AAA) 27
group (AAA) 28
inherit taskgroup 30
inherit usergroup 32
key (TACACS+) 34
login authentication 36
password (AAA) 38
radius-server dead-criteria time 40
radius-server dead-criteria tries 42
radius-server deadtime (BNG) 44
radius-server key (BNG) 45
System Security Command Reference for Cisco NCS 5000 Series Routers
iii

radius-server retransmit (BNG) 47
radius-server timeout (BNG) 48
radius source-interface (BNG) 49
secret 51
server (RADIUS) 53
server (TACACS+) 55
server-private (RADIUS) 56
server-private (TACACS+) 58
show aaa (XR-VM) 60
show aaa accounting 65
show aaa password-policy 67
show radius 69
show radius accounting 71
show radius authentication 73
show radius dead-criteria 75
show radius server-groups 77
show tacacs 80
show tacacs server-groups 82
show user 84
show aaa user-group 88
show tech-support aaa 89
single-connection 90
tacacs-server host 91
tacacs-server key 93
tacacs-server timeout 95
tacacs-server ipv4 96
tacacs source-interface 98
task 100
taskgroup 102
timeout (TACACS+) 104
timeout login response 105
usergroup 106
username 108
users group 112
System Security Command Reference for Cisco NCS 5000 Series Routers
iv
Contents

CHAPTER 2 Keychain Management Commands 115
accept-lifetime 116
accept-tolerance 118
cryptographic-algorithm 119
key (key chain) 121
key chain (key chain) 122
key-string (keychain) 123
send-lifetime 125
show key chain 127
CHAPTER 3 Management Plane Protection Commands 129
address ipv4 (MPP) 130
address ipv6 (MPP) 132
allow 133
control-plane 135
inband 136
interface (MPP) 137
management-plane 139
show mgmt-plane 140
CHAPTER 4 Secure Shell Commands 143
clear ssh 145
clear netconf-yang agent session 147
netconf-yang agent ssh 148
sftp 149
sftp (Interactive Mode) 152
show netconf-yang clients 155
show netconf-yang statistics 157
show ssh 159
show ssh session details 162
ssh 164
ssh client knownhost 166
ssh client source-interface 168
ssh server 170
System Security Command Reference for Cisco NCS 5000 Series Routers
v
Contents

ssh server logging 172
ssh server rate-limit 173
ssh server session-limit 174
ssh server v2 175
ssh server netconf 176
ssh timeout 177
System Security Command Reference for Cisco NCS 5000 Series Routers
vi
Contents

Preface
This preface contains these sections:
•Changes to This Document, page vii
•Obtaining Documentation and Submitting a Service Request, page vii
Changes to This Document
This table lists the technical changes made to this document since it was first released.
Table 1: Changes to This Document
SummaryDate
Initial release of this document.December 2015
Republished with documentation updates for Cisco
IOS XR Release 6.2.1 features.
March 2017
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation.
To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's
New in Cisco Product Documentation RSS feed. RSS feeds are a free service.
System Security Command Reference for Cisco NCS 5000 Series Routers
vii

System Security Command Reference for Cisco NCS 5000 Series Routers
viii
Preface
Obtaining Documentation and Submitting a Service Request

Authentication, Authorization, and Accounting
Commands
This module describes the commands used to configure authentication, authorization, and accounting (AAA)
services.
For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA
Services chapter in the System Security Configuration Guide for Cisco NCS 5000 Series Routers.
Currently, only default VRF is supported. VPNv4, VPNv6 and VPN routing and forwarding (VRF) address
families will be supported in a future release.
Note
•aaa accounting, page 4
•aaa accounting system default, page 6
•aaa accounting update, page 8
•aaa authentication (XR-VM), page 10
•aaa authorization (XR-VM), page 12
•aaa default-taskgroup, page 15
•aaa group server radius, page 16
•aaa group server tacacs+, page 18
•aaa password-policy, page 20
•accounting (line), page 23
•authorization (line), page 25
•description (AAA), page 27
•group (AAA), page 28
•inherit taskgroup, page 30
•inherit usergroup, page 32
•key (TACACS+), page 34
System Security Command Reference for Cisco NCS 5000 Series Routers
1

•login authentication, page 36
•password (AAA), page 38
•radius-server dead-criteria time, page 40
•radius-server dead-criteria tries, page 42
•radius-server deadtime (BNG), page 44
•radius-server key (BNG), page 45
•radius-server retransmit (BNG), page 47
•radius-server timeout (BNG), page 48
•radius source-interface (BNG), page 49
•secret, page 51
•server (RADIUS), page 53
•server (TACACS+), page 55
•server-private (RADIUS), page 56
•server-private (TACACS+), page 58
•show aaa (XR-VM), page 60
•show aaa accounting, page 65
•show aaa password-policy, page 67
•show radius, page 69
•show radius accounting, page 71
•show radius authentication, page 73
•show radius dead-criteria, page 75
•show radius server-groups, page 77
•show tacacs, page 80
•show tacacs server-groups, page 82
•show user, page 84
•show aaa user-group, page 88
•show tech-support aaa , page 89
•single-connection, page 90
•tacacs-server host, page 91
•tacacs-server key, page 93
•tacacs-server timeout, page 95
•tacacs-server ipv4, page 96
•tacacs source-interface, page 98
System Security Command Reference for Cisco NCS 5000 Series Routers
2
Authentication, Authorization, and Accounting Commands