Cisco Catalyst 2960-XR User manual

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS
Release 15.0(2)EX1
First Published: May 07, 2013
Last Modified: August 08, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-29434-01

©Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface 19
Document Conventions 19
Related Documentation 21
Obtaining Documentation and Submitting a Service Request 21
CHAPTER 1 Using the Command-Line Interface 1
Information About Using the Command-Line Interface 1
Command Modes 1
Using the Help System 3
Understanding Abbreviated Commands 4
No and default Forms of Commands 4
CLI Error Messages 4
Configuration Logging 5
How to Use the CLI to Configure Features 5
Configuring the Command History 5
Changing the Command History Buffer Size 6
Recalling Commands 6
Disabling the Command History Feature 7
Enabling and Disabling Editing Features 7
Editing Commands through Keystrokes 8
Editing Command Lines That Wrap 9
Searching and Filtering Output of show and more Commands 10
Accessing the CLI through a Console Connection or through Telnet 11
CHAPTER 2 Security Features Overview 13
Security Features Overview 13
CHAPTER 3 Preventing Unauthorized Access 19
Finding Feature Information 19
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 iii

Preventing Unauthorized Access 19
CHAPTER 4 Controlling Switch Access with Passwords and Privilege Levels 21
Finding Feature Information 21
Restrictions for Controlling Switch Access with Passwords and Privileges 21
Information About Passwords and Privilege Levels 22
Default Password and Privilege Level Configuration 22
Additional Password Security 22
Password Recovery 23
Terminal Line Telnet Configuration 23
Username and Password Pairs 23
Privilege Levels 24
How to Control Switch Access with Passwords and Privilege Levels 24
Setting or Changing a Static Enable Password 24
Protecting Enable and Enable Secret Passwords with Encryption 25
Disabling Password Recovery 27
Setting a Telnet Password for a Terminal Line 28
Configuring Username and Password Pairs 30
Setting the Privilege Level for a Command 31
Changing the Default Privilege Level for Lines 32
Logging into and Exiting a Privilege Level 33
Monitoring Switch Access 34
Configuration Examples for Setting Passwords and Privilege Levels 35
Example: Setting or Changing a Static Enable Password 35
Example: Protecting Enable and Enable Secret Passwords with Encryption 35
Example: Setting a Telnet Password for a Terminal Line 35
Example: Setting the Privilege Level for a Command 35
CHAPTER 5 Configuring TACACS+ 37
Finding Feature Information 37
Prerequisites for Controlling Switch Access with Terminal Access Controller Access Control
System Plus (TACACS+) 37
Information About TACACS+ 39
TACACS+ and Switch Access 39
TACACS+ Overview 39
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
iv OL-29434-01
Contents

TACACS+ Operation 41
Method List Description 42
TACACS+ Configuration Options 42
TACACS+ Login Authentication 42
TACACS+ Authorization for Privileged EXEC Access and Network Services 42
TACACS+ Accounting 43
Default TACACS+ Configuration 43
How to Configure TACACS+ 43
Identifying the TACACS+ Server Host and Setting the Authentication Key 43
Configuring TACACS+ Login Authentication 45
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 47
Starting TACACS+ Accounting 48
Establishing a Session with a Router if the AAA Server is Unreachable 49
Monitoring TACACS+ 50
CHAPTER 6 Configuring RADIUS 51
Finding Feature Information 51
Prerequisites for Controlling Switch Access with RADIUS 51
Restrictions for Controlling Switch Access with RADIUS 52
Information about RADIUS 53
RADIUS and Switch Access 53
RADIUS Overview 53
RADIUS Operation 54
RADIUS Change of Authorization 55
Change-of-Authorization Requests 55
RFC 5176 Compliance 56
CoA Request Response Code 57
Session Identification 57
CoA ACK Response Code 58
CoA NAK Response Code 58
CoA Request Commands 58
Session Reauthentication 58
Session Reauthentication in a Switch Stack 59
Session Termination 59
CoA Disconnect-Request 60
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 v
Contents

CoA Request: Disable Host Port 60
CoA Request: Bounce-Port 60
Stacking Guidelines for Session Termination 61
Stacking Guidelines for CoA-Request Bounce-Port 61
Stacking Guidelines for CoA-Request Disable-Port 61
Default RADIUS Configuration 62
RADIUS Server Host 62
RADIUS Login Authentication 62
AAA Server Groups 63
AAA Authorization 63
RADIUS Accounting 63
Vendor-Specific RADIUS Attributes 64
Vendor-Proprietary RADIUS Server Communication 64
How to Configure RADIUS 65
Identifying the RADIUS Server Host 65
Configuring RADIUS Login Authentication 66
Defining AAA Server Groups 68
Configuring RADIUS Authorization for User Privileged Access and Network Services 71
Starting RADIUS Accounting 72
Configuring Settings for All RADIUS Servers 73
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 75
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 75
Configuring CoA on the Switch 77
Monitoring CoA Functionality 79
Configuration Examples for Controlling Switch Access with RADIUS 79
Examples: Identifying the RADIUS Server Host 79
Examples: Configuring the Switch to Use Vendor-Specific RADIUS Attributes 80
Example: Configuring the Switch for Vendor-Proprietary RADIUS Server
Communication 80
CHAPTER 7 Configuring Local Authentication and Authorization 81
Finding Feature Information 81
How to Configure Local Authentication and Authorization 81
Configuring the Switch for Local Authentication and Authorization 81
Monitoring Local Authentication and Authorization 83
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
vi OL-29434-01
Contents

CHAPTER 8 Configuring Secure Shell (SSH) 85
Finding Feature Information 85
Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol
(SCP) 85
Restrictions for Configuring the Switch for SSH 86
Information about SSH 86
SSH and Switch Access 86
SSH Servers, Integrated Clients, and Supported Versions 87
SSH Configuration Guidelines 87
Secure Copy Protocol Overview 88
Secure Copy Protocol Concepts 88
How to Configure SSH 89
Setting Up the Switch to Run SSH 89
Configuring the SSH Server 90
Monitoring the SSH Configuration and Status 92
CHAPTER 9 Configuring Secure Socket Layer HTTP 93
Finding Feature Information 93
Information about Secure Sockets Layer (SSL) HTTP 93
Certificate Authority Trustpoints 94
CipherSuites 95
Default SSL Configuration 96
SSL Configuration Guidelines 96
Secure HTTP Servers and Clients Overview 96
How to Configure Secure HTTP Servers and Clients 96
Configuring a CA Trustpoint 96
Configuring the Secure HTTP Server 99
Configuring the Secure HTTP Client 102
How to Configure Secure HTTP Servers and Clients 103
Monitoring Secure HTTP Server and Client Status 103
CHAPTER 10 Configuring IPv4 ACLs 105
Finding Feature Information 105
Prerequisites for Configuring Network Security with ACLs 105
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 vii
Contents

Restrictions for Configuring Network Security with ACLs 105
Information about Network Security with ACLs 107
ACL Overview 107
Access Control Entries 107
ACL Supported Types 107
Supported ACLs 108
ACL Precedence 108
Port ACLs 109
Router ACLs 110
VLAN Maps 110
ACEs and Fragmented and Unfragmented Traffic 111
Example: ACEs and Fragmented and Unfragmented Traffic 111
ACLs and Switch Stacks 112
Active Switch and ACL Functions 112
Stack Member and ACL Functions 112
Active Switch Failure and ACLs 112
Standard and Extended IPv4 ACLs 113
IPv4 ACL Switch Unsupported Features 113
Access List Numbers 113
Numbered Standard IPv4 ACLs 114
Numbered Extended IPv4 ACLs 114
Named IPv4 ACLs 115
ACL Logging 116
Hardware and Software Treatment of IP ACLs 116
VLAN Map Configuration Guidelines 117
VLAN Maps with Router ACLs 117
VLAN Maps and Router ACL Configuration Guidelines 118
VACL Logging 118
Time Ranges for ACLs 119
IPv4 ACL Interface Considerations 119
How to Configure ACLs 120
Configuring IPv4 ACLs 120
Creating a Numbered Standard ACL 120
Creating a Numbered Extended ACL 122
Creating Named Standard ACLs 125
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
viii OL-29434-01
Contents

Creating Extended Named ACLs 126
Configuring Time Ranges for ACLs 128
Applying an IPv4 ACL to a Terminal Line 129
Applying an IPv4 ACL to an Interface 130
Creating Named MAC Extended ACLs 132
Applying a MAC ACL to a Layer 2 Interface 133
Configuring VLAN Maps 135
Creating a VLAN Map 136
Applying a VLAN Map to a VLAN 138
Monitoring IPv4 ACLs 139
Configuration Examples for ACLs 140
Examples: Using Time Ranges with ACLs 140
Examples: Including Comments in ACLs 141
IPv4 ACL Configuration Examples 142
ACLs in a Small Networked Office 142
Examples: ACLs in a Small Networked Office 143
Example: Numbered ACLs 143
Examples: Extended ACLs 143
Examples: Named ACLs 144
Examples: Time Range Applied to an IP ACL 145
Examples: Commented IP ACL Entries 145
Examples: ACL Logging 145
Configuration Examples for ACLs and VLAN Maps 147
Example: Creating an ACL and a VLAN Map to Deny a Packet 147
Example: Creating an ACL and a VLAN Map to Permit a Packet 147
Example: Default Action of Dropping IP Packets and Forwarding MAC Packets 147
Example: Default Action of Dropping MAC Packets and Forwarding IP Packets 148
Example: Default Action of Dropping All Packets 148
Configuration Examples for Using VLAN Maps in Your Network 149
Example: Wiring Closet Configuration 149
Example: Restricting Access to a Server on Another VLAN 150
Example: Denying Access to a Server on Another VLAN 150
Configuration Examples of Router ACLs and VLAN Maps Applied to VLANs 151
Example: ACLs and Switched Packets 151
Example: ACLs and Bridged Packets 151
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 ix
Contents

Example: ACLs and Routed Packets 152
Example: ACLs and Multicast Packets 153
CHAPTER 11 Configuring IPv6 ACLs 155
Finding Feature Information 155
Information about IPv6 ACLs 155
Switch Stacks and IPv6 ACLs 156
Interactions with Other Features and Switches 156
Restrictions for IPv6 ACLs 156
Default Configuration for IPv6 ACLs 157
How to Configure IPv6 ACLs 157
How to Attach an IPv6 ACL to an Interface 161
Monitoring IPv6 ACLs 162
CHAPTER 12 Configuring DHCP 165
Finding Feature Information 165
Information About DHCP 165
DHCP Server 165
DHCP Relay Agent 165
DHCP Snooping 166
Option-82 Data Insertion 167
Cisco IOS DHCP Server Database 170
DHCP Snooping Binding Database 170
DHCP Snooping and Switch Stacks 171
How to Configure DHCP Features 172
Default DHCP Snooping Configuration 172
DHCP Snooping Configuration Guidelines 173
Configuring the DHCP Server 173
DHCP Server and Switch Stacks 173
Configuring the DHCP Relay Agent 173
Specifying the Packet Forwarding Address 174
Prerequisites for Configuring DHCP Snooping and Option 82 176
Enabling DHCP Snooping and Option 82 177
Enabling the Cisco IOS DHCP Server Database 180
Monitoring DHCP Snooping Information 180
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xOL-29434-01
Contents