Cisco Catalyst 2960-X User manual

Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS
Release 15.0(2)EX
First Published: July 10, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-29048-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2013 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface xxi
Document Conventions xxi
Related Documentation xxiii
Obtaining Documentation and Submitting a Service Request xxiii
CHAPTER 1 Using the Command-Line Interface 1
Information About Using the Command-Line Interface 1
Command Modes 1
Understanding Abbreviated Commands 3
No and Default Forms of Commands 3
CLI Error Messages 4
Configuration Logging 4
Using the Help System 4
How to Use the CLI to Configure Features 6
Configuring the Command History 6
Changing the Command History Buffer Size 6
Recalling Commands 6
Disabling the Command History Feature 7
Enabling and Disabling Editing Features 7
Editing Commands Through Keystrokes 8
Editing Command Lines That Wrap 9
Searching and Filtering Output of show and more Commands 10
Accessing the CLI on a Switch Stack 11
Accessing the CLI Through a Console Connection or Through Telnet 11
CHAPTER 2 Security Features Overview 13
Security Features Overview 13
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 iii

CHAPTER 3 Preventing Unauthorized Access 17
Finding Feature Information 17
Preventing Unauthorized Access 17
CHAPTER 4 Controlling Switch Access with Passwords and Privilege Levels 19
Finding Feature Information 19
Restrictions for Controlling Switch Access with Passwords and Privileges 19
Information About Passwords and Privilege Levels 20
Default Password and Privilege Level Configuration 20
Additional Password Security 20
Password Recovery 21
Terminal Line Telnet Configuration 21
Username and Password Pairs 21
Privilege Levels 22
How to Control Switch Access with Passwords and Privilege Levels 22
Setting or Changing a Static Enable Password 22
Protecting Enable and Enable Secret Passwords with Encryption 24
Disabling Password Recovery 26
Setting a Telnet Password for a Terminal Line 27
Configuring Username and Password Pairs 29
Setting the Privilege Level for a Command 31
Changing the Default Privilege Level for Lines 33
Logging into and Exiting a Privilege Level 34
Monitoring Switch Access 35
Configuration Examples for Setting Passwords and Privilege Levels 35
Example: Setting or Changing a Static Enable Password 35
Example: Protecting Enable and Enable Secret Passwords with Encryption 35
Example: Setting a Telnet Password for a Terminal Line 36
Example: Setting the Privilege Level for a Command 36
Additional References 36
CHAPTER 5 Configuring TACACS+ 39
Finding Feature Information 39
Prerequisites for TACACS+ 39
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
iv OL-29048-01
Contents

Information About TACACS+ 41
TACACS+ and Switch Access 41
TACACS+ Overview 41
TACACS+ Operation 43
Method List 44
TACACS+ Configuration Options 44
TACACS+ Login Authentication 44
TACACS+ Authorization for Privileged EXEC Access and Network Services 44
TACACS+ Accounting 45
Default TACACS+ Configuration 45
How to Configure TACACS+ 45
Identifying the TACACS+ Server Host and Setting the Authentication Key 45
Configuring TACACS+ Login Authentication 47
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 50
Starting TACACS+ Accounting 52
Establishing a Session with a Router if the AAA Server is Unreachable 53
Monitoring TACACS+ 54
Additional References 54
Feature Information for TACACS+ 55
CHAPTER 6 Configuring RADIUS 57
Finding Feature Information 57
Prerequisites for Configuring RADIUS 57
Restrictions for Configuring RADIUS 58
Information about RADIUS 59
RADIUS and Switch Access 59
RADIUS Overview 59
RADIUS Operation 60
RADIUS Change of Authorization 61
Change-of-Authorization Requests 62
RFC 5176 Compliance 63
Preconditions 64
CoA Request Response Code 64
Session Identification 64
CoA ACK Response Code 65
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 v
Contents

CoA NAK Response Code 65
CoA Request Commands 65
Session Reauthentication 66
Session Reauthentication in a Switch Stack 66
Session Termination 67
CoA Disconnect-Request 67
CoA Request: Disable Host Port 67
CoA Request: Bounce-Port 68
Stacking Guidelines for Session Termination 68
Stacking Guidelines for CoA-Request Bounce-Port 68
Stacking Guidelines for CoA-Request Disable-Port 69
Default RADIUS Configuration 69
RADIUS Server Host 69
RADIUS Login Authentication 70
AAA Server Groups 70
AAA Authorization 71
RADIUS Accounting 71
Vendor-Specific RADIUS Attributes 71
Vendor-Proprietary RADIUS Server Communication 83
How to Configure RADIUS 83
Identifying the RADIUS Server Host 83
Configuring RADIUS Login Authentication 86
Defining AAA Server Groups 88
Configuring RADIUS Authorization for User Privileged Access and Network Services 90
Starting RADIUS Accounting 92
Establishing a Session with a Router if the AAA Server is Unreachable 93
Configuring Settings for All RADIUS Servers 93
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 95
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 97
Configuring CoA on the Switch 98
Configuring RADIUS Server Load Balancing 101
Monitoring CoA Functionality 101
Configuration Examples for Controlling Switch Access with RADIUS 102
Examples: Identifying the RADIUS Server Host 102
Example: Using Two Different RADIUS Group Servers 102
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
vi OL-29048-01
Contents

Examples: Configuring the Switch to Use Vendor-Specific RADIUS Attributes 103
Example: Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 103
Additional References 104
Feature Information for RADIUS 105
CHAPTER 7 Configuring Local Authentication and Authorization 107
Finding Feature Information 107
How to Configure Local Authentication and Authorization 107
Configuring the Switch for Local Authentication and Authorization 107
Monitoring Local Authentication and Authorization 110
Additional References 110
Feature Information for Local Authentication and Authorization 111
CHAPTER 8 Configuring Secure Shell (SSH) 113
Finding Feature Information 113
Prerequisites for Configuring Secure Shell 113
Restrictions for Configuring Secure Shell 114
Information about SSH 114
SSH and Switch Access 115
SSH Servers, Integrated Clients, and Supported Versions 115
SSH Configuration Guidelines 115
Secure Copy Protocol Overview 116
Secure Copy Protocol 116
How to Configure SSH 117
Setting Up the Switch to Run SSH 117
Configuring the SSH Server 118
Monitoring the SSH Configuration and Status 121
Additional References 121
Feature Information for SSH 122
CHAPTER 9 Configuring Secure Socket Layer HTTP 125
Finding Feature Information 125
Information about Secure Sockets Layer (SSL) HTTP 125
Secure HTTP Servers and Clients Overview 125
Certificate Authority Trustpoints 126
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 vii
Contents

CipherSuites 127
Default SSL Configuration 128
SSL Configuration Guidelines 128
How to Configure Secure HTTP Servers and Clients 129
Configuring a CA Trustpoint 129
Configuring the Secure HTTP Server 131
Configuring the Secure HTTP Client 134
Monitoring Secure HTTP Server and Client Status 135
Additional References 136
Feature Information for Secure Socket Layer HTTP 137
CHAPTER 10 Configuring IPv4 ACLs 139
Finding Feature Information 139
Prerequisites for Configuring IPv4 Access Control Lists 139
Restrictions for Configuring IPv4 Access Control Lists 140
Information about Network Security with ACLs 141
Cisco TrustSec and ACLs 141
ACL Overview 141
Access Control Entries 142
ACL Supported Types 142
Supported ACLs 142
ACL Precedence 142
Port ACLs 143
Router ACLs 144
VLAN Maps 145
ACEs and Fragmented and Unfragmented Traffic 145
ACEs and Fragmented and Unfragmented Traffic Examples 146
ACLs and Switch Stacks 146
Active Switch and ACL Functions 146
Stack Member and ACL Functions 147
Active Switch Failure and ACLs 147
Standard and Extended IPv4 ACLs 147
IPv4 ACL Switch Unsupported Features 147
Access List Numbers 148
Numbered Standard IPv4 ACLs 149
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
viii OL-29048-01
Contents

Numbered Extended IPv4 ACLs 149
Named IPv4 ACLs 150
ACL Logging 150
Smart Logging 151
Hardware and Software Treatment of IP ACLs 151
VLAN Map Configuration Guidelines 151
VLAN Maps with Router ACLs 152
VLAN Maps and Router ACL Configuration Guidelines 152
Time Ranges for ACLs 153
IPv4 ACL Interface Considerations 153
How to Configure ACLs 154
Configuring IPv4 ACLs 154
Creating a Numbered Standard ACL 154
Creating a Numbered Extended ACL 156
Creating Named Standard ACLs 160
Creating Extended Named ACLs 161
Configuring Time Ranges for ACLs 163
Applying an IPv4 ACL to a Terminal Line 165
Applying an IPv4 ACL to an Interface 167
Creating Named MAC Extended ACLs 168
Applying a MAC ACL to a Layer 2 Interface 170
Configuring VLAN Maps 172
Creating a VLAN Map 174
Applying a VLAN Map to a VLAN 176
Configuring VACL Logging 177
Monitoring IPv4 ACLs 179
Configuration Examples for ACLs 180
Examples: Using Time Ranges with ACLs 180
Examples: Including Comments in ACLs 180
Examples: Troubleshooting ACLs 181
IPv4 ACL Configuration Examples 182
ACLs in a Small Networked Office 182
Examples: ACLs in a Small Networked Office 183
Example: Numbered ACLs 183
Examples: Extended ACLs 183
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 ix
Contents

Examples: Named ACLs 184
Examples: Time Range Applied to an IP ACL 185
Examples: Configuring Commented IP ACL Entries 185
Examples: ACL Logging 186
Configuration Examples for ACLs and VLAN Maps 187
Example: Creating an ACL and a VLAN Map to Deny a Packet 187
Example: Creating an ACL and a VLAN Map to Permit a Packet 187
Example: Default Action of Dropping IP Packets and Forwarding MAC Packets 187
Example: Default Action of Dropping MAC Packets and Forwarding IP Packets 188
Example: Default Action of Dropping All Packets 188
Configuration Examples for Using VLAN Maps in Your Network 189
Example: Wiring Closet Configuration 189
Example: Restricting Access to a Server on Another VLAN 190
Example: Denying Access to a Server on Another VLAN 190
Configuration Examples of Router ACLs and VLAN Maps Applied to VLANs 191
Example: ACLs and Switched Packets 191
Example: ACLs and Bridged Packets 192
Example: ACLs and Routed Packets 193
Example: ACLs and Multicast Packets 193
Additional References 194
Feature Information for IPv4 Access Control Lists 195
CHAPTER 11 Configuring IPv6 ACLs 197
Finding Feature Information 197
IPv6 ACLs Overview 197
Switch Stacks and IPv6 ACLs 198
Interactions with Other Features and Switches 198
Restrictions for IPv6 ACLs 199
Default Configuration for IPv6 ACLs 199
Configuring IPv6 ACLs 200
Attaching an IPv6 ACL to an Interface 203
Monitoring IPv6 ACLs 205
Additional References 206
CHAPTER 12 Configuring DHCP 209
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xOL-29048-01
Contents