Cisco Router IOS XR User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco IOS XR System Security
Configuration Guide
Cisco IOS XR Software Release 3.5
Text Part Number: OL-12287-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco IOS XR System Security Configuration Guide
© 2007 Cisco Systems, Inc. All rights reserved.
C
CVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of
C
isco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo,
C
isco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step,
F
ollow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study,
L
ightStream, Linksys, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to
I
ncrease Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
A
ll other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
b
etween Cisco and any other company. (0710R)

iii
Cisco IOS XR System Security Configuration Guide
CONTENTS
Preface xi
Changes to This Document xi
Obtaining Documentation, Obtaining Support, and Security Guidelines xi
Implementing Certification Authority Interoperability on Cisco IOS XR Software SC-1
Contents SC-1
Prerequisites for Implementing Certification Authority SC-2
Restrictions for Implementing Certification Authority SC-2
Information About Implementing Certification Authority SC-2
Supported Standards for Certification Authority Interoperability SC-2
Certification Authorities SC-3
How to Implement CA Interoperability SC-5
Configuring a Router Hostname and IP Domain Name SC-6
Generating an RSA Key Pair SC-7
Declaring a Certification Authority and Configuring a Trusted Point SC-8
Authenticating the CA SC-10
Requesting Your Own Certificates SC-11
Configuring Certificate Enrollment Using Cut-and-Paste SC-12
Configuration Examples for Implementing Certification Authority Interoperability SC-14
Configuring Certification Authority Interoperability: Example SC-14
Where to Go Next SC-16
Additional References SC-16
Related Documents SC-16
Standards SC-16
MIBs SC-17
RFCs SC-17
Technical Assistance SC-17
Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software SC-19
Contents SC-20
Prerequisites SC-20
Information About Implementing IKE Security Protocol Configurations for IPSec Networks SC-20
Supported Standards SC-21
Concessions for Not Enabling IKE SC-22
IKE Policies SC-22

Contents
iv
Cisco IOS XR System Security Configuration Guide
ISAKMP Identity SC-26
ISAKMP Profile Overview SC-26
Mask Preshared Keys SC-27
Preshared Keys Using a AAA Server SC-27
Internet Key Exchange Mode Configuration SC-28
Banner, Auto-Update, and Browser-Proxy SC-29
Pushing a Configuration URL Through a Mode-Configuration Exchange SC-29
Internet Key Exchange Extended Authentication SC-30
Call Admission Control SC-30
Information About IP Security VPN Monitoring SC-31
Information About IKE for the Cisco IPSec VPN SPA on Cisco IOS XR Software SC-32
IPSec Dead Peer Detection Periodic Message Option SC-32
How to Implement IKE Security Protocol Configurations for IPSec Networks SC-32
Enabling or Disabling IKE SC-33
Configuring IKE Policies SC-34
Defining Group Policy Information for Mode Configuration SC-36
Configuring a Banner SC-40
Configuring Auto-Upgrade SC-40
Configuring a Browser Proxy SC-41
Configuring a Browser-Proxy Map to a Group SC-42
Configuring the Pushing of a Configuration URL Through a Mode-Configuration Exchange SC-43
Manually Configuring RSA Keys SC-44
Configuring ISAKMP Preshared Keys in ISAKMP Keyrings SC-48
Configuring Call Admission Control SC-50
Configuring Crypto Keyrings SC-54
Configuring IP Security VPN Monitoring SC-57
How to Implement IKE for Locally Sourced and Destined Traffic SC-58
Configuring the ISAKMP Profile for Locally Sourced and Destined Traffic SC-58
How to Implement IKE for Cisco IPSec VPN SPAs on Cisco IOS XR Software SC-62
Configuring a Periodic Dead Peer Detection Message SC-63
Configuring the ISAKMP Profile for Service Interfaces SC-64
Configuration Examples for Implementing IKE Security Protocol SC-68
Creating IKE Policies: Example SC-69
Configuring a service-ipsec Interface with a Dynamic Profile: Example SC-69
Configuring Easy VPN with a Local AAA: Example SC-70
Configuring VRF-Aware: Example SC-71
Additional References SC-73
Related Documents SC-73
Standards SC-73

Contents
v
Cisco IOS XR System Security Configuration Guide
MIBs SC-74
RFCs SC-74
Technical Assistance SC-74
Implementing Keychain Management on Cisco IOS XR Software SC-75
Contents SC-75
Restrictions for Implementing Keychain Management SC-75
Information About Implementing Keychain Management SC-76
Lifetime of a Key SC-76
How to Implement Keychain Management SC-76
Configuring a Keychain SC-77
Configuring a Tolerance Specification to Accept Keys SC-78
Configuring a Key Identifier for the Keychain SC-79
Configuring the Text for the Key String SC-81
Determining the Valid Keys SC-82
Configuring the Keys to Generate Authentication Digest for the Outbound Application Traffic SC-84
Configuring the Cryptographic Algorithm SC-85
Configuration Examples for Implementing Keychain Management SC-87
Configuring Keychain Management: Example SC-87
Additional References SC-88
Related Documents SC-88
Standards SC-88
MIBs SC-89
RFCs SC-89
Technical Assistance SC-89
Implementing IPSec Network Security on Cisco IOS XR Software SC-91
Contents SC-92
Prerequisites for Implementing IPSec Network Security SC-92
Restrictions for Implementing IPSec Network Security SC-93
Restrictions for Implementing IPSec Network with a
Cisco IPSec VPN SPA SC-93
Information About Implementing IPSec Networks SC-94
Crypto Profiles SC-94
Dynamic Crypto Profiles SC-95
Crypto Access Lists SC-95
Transform Sets SC-96
Global Lifetimes for IPSec Security Associations SC-96
Manual IPSec Security Associations SC-97

Contents
vi
Cisco IOS XR System Security Configuration Guide
Perfect Forward Secrecy SC-97
Checkpointing SC-98
DF Bit Override Functionality with IPSec Tunnels SC-98
IPSec Antireplay Window SC-98
IPSec NAT Transparency SC-99
IPSec Security Association Idle Timers SC-99
Prefragmentation for Cisco IPSec VPN SPAs SC-99
Reverse-Route Injection SC-100
IPSec—SNMP Support SC-101
Information About an IPSec Network with a Cisco IPSec VPN SPA on Cisco IOS XR Software SC-101
Cisco IPSec VPN SPA Overview SC-101
Displaying the SPA Hardware Type SC-101
Information About Security for VPNs with IPSec SC-102
How to Implement General IPSec Configurations for IPSec Networks SC-104
Setting Global Lifetimes for IPSec Security Associations SC-105
Creating Crypto Access Lists SC-106
Defining Transform Sets SC-108
Configuring Crypto Profiles SC-109
Configuring the DF Bit for the Encapsulating Header in IPSec Tunnels SC-114
Configuring the IPSec Antireplay Window: Expanding and Disabling SC-115
Configuring IPSec NAT Transparency SC-118
Configuring IPSec Security Association Idle Timers SC-120
Disabling Prefragmentation for Cisco IPSec VPN SPAs SC-124
Configuring Reverse-Route Injection in a Crypto Profile SC-127
Configuring IPSec Failure History Table Size SC-128
How to Implement IPSec Network Security for Locally Sourced and Destined Traffic SC-129
Applying Crypto Profiles to tunnel-ipsec Interfaces SC-130
Applying Crypto Profiles to Crypto Transport SC-131
How to Implement IPSec Network Security for VPNs SC-132
Configuring IPSec Virtual Interfaces SC-133
Configuring the Default Path Maximum Transmission Unit for the SA SC-139
Configuration Examples for Implementing IPSec Network Security for Locally Sourced Traffic and Destined
Traffic SC-140
Configuring a Static Profile and Attaching to a Tunnel-ipsec Interface: Example SC-140
Configuring a Dynamic Profile and Attaching to a Tunnel-ipsec Interface: Example SC-141
Configuring a Static Profile and Attaching to Transport: Example SC-142
Configuration Examples for an IPSec Network with a
Cisco IPSec VPN SPA SC-142
Configuring IPSec for a VRF-aware Service-ipsec Interface: Example SC-142

Contents
vii
Cisco IOS XR System Security Configuration Guide
Configuring a Service-gre Interface: Example SC-145
Additional References SC-147
Related Documents SC-147
Standards SC-147
MIBs SC-147
RFCs SC-148
Technical Assistance SC-148
Implementing Secure Shell on Cisco IOS XR Software SC-149
Contents SC-149
Prerequisites to Implementing Secure Shell SC-150
Restrictions for Implementing Secure Shell SC-150
Information About Implementing Secure Shell SC-151
SSH Server SC-151
SSH Client SC-151
SFTP Feature Overview SC-151
AAA Feature SC-152
How to Implement Secure Shell SC-152
Configuring SSH SC-152
Configuring the SSH Client SC-154
Configuration Examples for Implementing Secure Shell SC-156
Configuring Secure Shell: Example SC-156
Additional References SC-156
Related Documents SC-156
Standards SC-157
MIBs SC-157
RFCs SC-157
Technical Assistance SC-158
Implementing Secure Socket Layer on Cisco IOS XR Software SC-159
Contents SC-160
Prerequisites for Implementing Secure Socket Layer SC-160
Information About Implementing Secure Socket Layer SC-160
Purpose of Certification Authorities SC-160
How to Implement Secure Socket Layer SC-161
Configuring Secure Socket Layer SC-161
Configuration Examples for Implementing Secure Socket Layer SC-164
Configuring Secure Socket Layer: Example SC-164
Additional References SC-164

Contents
viii
Cisco IOS XR System Security Configuration Guide
Related Documents SC-164
Standards SC-165
MIBs SC-165
RFCs SC-165
Technical Assistance SC-165
Configuring AAA Services on Cisco IOS XR Software SC-167
Contents SC-168
Prerequisites for Configuring AAA Services SC-169
Restrictions for Configuring AAA Services SC-169
Information About Configuring AAA Services SC-169
User, User Groups, and Task Groups SC-170
Cisco IOS XR Software Administrative Model SC-172
Password Types SC-177
Task-Based Authorization SC-178
Task IDs for TACACS+ and RADIUS Authenticated Users SC-179
XML Schema for AAA Services SC-181
About RADIUS SC-182
How to Configure AAA Services SC-183
Configuring Task Groups SC-184
Configuring User Groups SC-186
Configuring Users SC-188
Configuring Router to RADIUS Server Communication SC-190
Configuring RADIUS Dead-Server Detection SC-194
Configuring Per VRF AAA SC-196
Configuring a TACACS+ Server SC-198
Configuring RADIUS Server Groups SC-201
Configuring TACACS+ Server Groups SC-203
Configuring AAA Method Lists SC-204
Applying Method Lists for Applications SC-216
Configuring Login Parameters SC-220
Configuration Examples for Configuring AAA Services SC-221
Configuring AAA Services: Example SC-221
Additional References SC-223
Related Documents SC-223
Standards SC-223
MIBs SC-223
RFCs SC-224
Technical Assistance SC-224

Contents
ix
Cisco IOS XR System Security Configuration Guide
Configuring Software Authentication Manager on Cisco IOS XR Software SC-225
Implementing Management Plane Protection on Cisco IOS XR Software SC-227
Contents SC-227
Restrictions for Implementing Management Plane Protection SC-228
Information About Implementing Management Plane Protection SC-228
Inband Management Interface SC-228
Control Plane Protection Overview SC-228
Management Plane SC-228
Management Plane Protection Feature SC-229
Benefits of the Management Plane Protection Feature SC-229
How to Configure a Device for Management Plane Protection SC-229
Configuring a Device for Management Plane Protection SC-230
Configuration Examples for Implementing Management Plane Protection SC-232
Configuring Management Plane Protection: Example SC-232
Additional References SC-233
Related Documents SC-233
Standards SC-233
MIBs SC-233
RFCs SC-234
Technical Assistance SC-234
Index

Contents
x
Cisco IOS XR System Security Configuration Guide