Cisco MDS 9000 Series User manual

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

©2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface xvii
PREFACE
Audience xvii
Document Conventions xvii
Related Documentation xviii
Obtaining Documentation and Submitting a Service Request xviii
New and Changed Information 1
CHAPTER 1
Security Overview 3
CHAPTER 2
FIPS 3
Users and Common Roles 4
RADIUS and TACACS+ 4
IP ACLs 4
PKI 5
SSH Services 5
IPsec 5
FC-SP and DHCHAP 5
Port Security 6
Fibre Channel Common Transport Management Server Query 6
Fabric Binding 6
TrustSec Fibre Channel Link Encryption 6
Configuring FIPS 7
CHAPTER 3
Configuration Guidelines 7
Enabling FIPS Mode 8
Displaying FIPS Status 8
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
iii

FIPS Self-Tests 8
Common Roles 11
CHAPTER 4
Role-Based Authorization 11
About Roles 11
Configuring Roles and Profiles 12
Configuring Rules and Features for Each Role 12
Rule Changes Between SAN-OS Release 3.3(1c) and NX-OS Release 4.2(1a) Affect Role
Behavior 14
Modifying Profiles 14
Configuring the VSAN Policy 15
Modifying the VSAN Policy 15
Role Distributions 16
About Role Databases 16
Locking the Fabric 17
Committing Role-Based Configuration Changes 17
Discarding Role-Based Configuration Changes 17
Enabling Role-Based Configuration Distribution 18
Clearing Sessions 18
Database Merge Guidelines 18
Displaying Role-Based Information 19
Displaying Roles When Distribution is Enabled 20
Configuring Common Roles 22
Mapping of CLI Operations to SNMP 23
Configuring User Accounts 24
Guidelines on Creating Users 24
Checking Password Strength 25
Characteristics of Strong Passwords 25
Configuring Users 25
Logging Out Users 26
Displaying User Account Information 27
Default Settings 27
Configuring Security Features on an External AAA Server 29
CHAPTER 5
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
iv
Contents

Switch Management Security 30
CLI Security Options 30
SNMP Security Options 30
Switch AAA Functionalities 31
Authentication 31
Authorization 31
Accounting 31
Remote AAA Services 32
Remote Authentication Guidelines 32
Server Groups 32
AAA Service Configuration Options 32
Error-Enabled Status 33
AAA Server Monitoring 34
Authentication and Authorization Process 34
Configuring Role-based Authorization on TACACS+ Server 35
Configuring Fallback Mechanism for Authentication 37
Verifying Authorization Profile 38
Testing Authorization 38
Configuring Login Parameters 39
Configuring AAA Server Monitoring Parameters Globally 41
Configuring LDAP 42
LDAP Authentication and Authorization 42
Guidelines and Limitations for LDAP 43
Prerequisites for LDAP 43
Default Settings 44
Enabling LDAP 44
Configuring LDAP Server Hosts 45
Configuring the RootDN for an LDAP Server 45
Configuring LDAP Server Groups 46
Configuring the Global LDAP Timeout Interval 48
Configuring the Timeout Interval for an LDAP Server 48
Configuring the Global LDAP Server Port 49
Configuring TCP Ports 50
Configuring LDAP Search Maps 50
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
v
Contents

Configuring the LDAP Dead-Time Interval 51
Configuring AAA Authorization on LDAP Servers 52
Disabling LDAP 53
Configuration Examples for LDAP 53
Configuring RADIUS Server Monitoring Parameters 54
About RADIUS Server Default Configuration 54
Setting the RADIUS Server IPv4 Address 54
Setting the RADIUS Server IPv6 Address 55
Setting the RADIUS Server DNS name 56
About the Default RADIUS Server Encryption Type and Preshared Key 57
Configuring the Default RADIUS Server Encryption Type and Preshared Key 57
Setting the RADIUS Server Timeout Interval 57
Setting the Default RADIUS Server Timeout Interval and Retransmits 58
Configuring RADIUS Server Monitoring Parameters 58
Configuring the Test Idle Timer 58
Configuring Test User Name 59
Configuring the Dead Timer 60
About RADIUS Servers 60
Configuring the Test Idle Timer 60
Configuring Test User Name 61
About Validating a RADIUS Server 61
Sending RADIUS Test Messages for Monitoring 61
Allowing Users to Specify a RADIUS Server at Login 62
About Vendor-Specific Attributes 62
VSA Format 63
Specifying SNMPv3 on AAA Servers 63
Displaying RADIUS Server Details 64
Displaying RADIUS Server Statistics 64
One-Time Password Support 65
Recovering the Administrator Password 65
Using the CLI with Network-Admin Privileges 65
Power Cycling the Switch 66
Configuring TACACS+ Server Monitoring Parameters 67
About TACACS+ 68
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
vi
Contents

About TACACS+ Server Default Configuration 68
About the Default TACACS+ Server Encryption Type and Preshared Key 68
Enabling TACACS+ 68
Setting the TACACS+ Server IPv4 Address 69
Setting the TACACS+ Server IPv6 Address 70
Setting the TACACS+ Server DNS name 70
Setting the Global Secret Key 71
Setting the Default TACACS+ Server Timeout Interval and Retransmits 72
Setting the Timeout Value 72
About TACACS+ Servers 72
Configuring TACACS+ Server Monitoring Parameters 73
Configuring the TACACS+ Test Idle Timer 73
Configuring Test Username 73
Configuring the Dead Timer 74
Sending TACACS+ Test Messages for Monitoring 75
Password Aging Notification through TACACS+ Server 75
About Validating a TACACS+ Server 76
Periodically Validating a TACACS+ Server 76
About Users Specifying a TACACS+ Server at Login 76
Allowing Users to Specify a TACACS+ Server at Login 76
Defining Roles on the Cisco Secure ACS 5.x GUI 77
Defining Custom Attributes for Roles 77
Supported TACACS+ Server Parameters 77
Displaying TACACS+ Server Details 78
Clearing TACACS+ Server Statistics 79
Configuring Server Groups 79
About Configuring Radius Server Groups 80
About Configuring TACACS+ Server Groups 81
About Bypassing a Nonresponsive Server 82
AAA Server Distribution 82
Enabling AAA RADIUS Server Distribution 83
Enabling AAA TACACS+ Server Distribution 83
Starting a Distribution Session on a Switch 84
Displaying the Session Status 84
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
vii
Contents

Displaying the Pending Configuration to be Distributed 84
Committing the RADIUS Distribution 85
Committing the TACACS+ Distribution 85
Discarding the RADIUS Distribution Session 85
Discarding the TACACS+ Distribution Session 86
Clearing Sessions 86
Merge Guidelines for RADIUS and TACACS+ Configurations 86
CHAP Authentication 87
Enabling CHAP Authentication 88
MSCHAP Authentication 88
About Enabling MSCHAP 88
Enabling MSCHAP Authentication 89
Enabling MSCHAPv2 Authentication 89
Local AAA Services 90
Disabling AAA Authentication 91
Displaying AAA Authentication 91
Configuring Accounting Services 91
Displaying Accounting Configuration 92
Clearing Accounting Logs 93
Configuring Cisco Access Control Servers 93
Default Settings 97
Configuring IPv4 and IPv6 Access Control Lists 99
CHAPTER 6
About IPv4 and IPv6 Access Control Lists 100
IPv4-ACL and IPv6-ACL Configuration Guidelines 100
About Filter Contents 101
Protocol Information 101
Address Information 101
Port Information 102
ICMP Information 103
ToS Information 104
Creating IPv4-ACLs or IPv6-ACLs 104
Creating IPv4-ACLs 104
Creating IPv6-ACLs 105
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
viii
Contents

Defining IPv4-ACLs 105
Defining IPv6-ACLs 106
Operand and port options for an IPv4-ACL 106
Operand and port options for an IPv6-ACL 107
Adding IP Filters to an Existing IPv4-ACL 107
Adding IP Filters to an Existing IPv6-ACL 108
Removing IP Filters from an Existing IPv4-ACL 108
Removing IP Filters from an Existing IPv6-ACL 109
Verifying the IPv4-ACL or IPv6-ACL Configuration 109
Reading the IP-ACL Log Dump 110
Applying an IP-ACL to an Interface 111
Applying an IPv6-ACL to an Interface 112
Applying an IP-ACL to mgmt0 113
Verifying Interface IP-ACL Configuration 113
Open IP Ports on Cisco MDS 9000 Series Platforms 114
IP-ACL Counter Cleanup 115
Configuring Certificate Authorities and Digital Certificates 117
CHAPTER 7
About CAs and Digital Certificates 117
Purpose of CAs and Digital Certificates 117
Trust Model, Trust Points, and Identity CAs 118
RSA Key-Pairs and Identity Certificates 118
Multiple Trusted CA Support 119
PKI Enrollment Support 119
Manual Enrollment Using Cut-and-Paste Method 120
Multiple RSA Key-Pair and Identity CA Support 120
Peer Certificate Verification 120
CRL Downloading, Caching, and Checking Support 120
Import and Export Support for Certificates and Associated Key-Pairs 121
Configuring CAs and Digital Certificates 121
Configuring the Host Name and IP Domain Name 121
Generating an RSA Key-Pair 122
Creating a Trust Point CA Association 122
Authenticating the CA 123
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
ix
Contents

Configuring Certificate Revocation Checking Methods 124
Generating Certificate Requests 125
Installing Identity Certificates 126
Saving Your Configuration 127
Ensuring Trust Point Configurations Persist Across Reboots 127
Monitoring and Maintaining CA and Certificates Configuration 127
Exporting and Importing Identity Information to PKCS12 Format 127
Exporting and Importing Identity Information from PKCS12 Format 128
Configuring a CRL 129
Deleting Certificates from the CA Configuration 129
Deleting RSA Key-Pairs from Your Switch 130
Displaying Key-Pair and CA Information 131
Example Configurations 131
Configuring Certificates on the MDS Switch 131
Downloading a CA Certificate 134
Requesting an Identity Certificate 138
Revoking a Certificate 145
Generating and Publishing the CRL 147
Downloading the CRL 149
Importing the CRL 151
Maximum Limits 153
Default Settings 154
Configuring SSH Services 155
CHAPTER 8
SSH Services 155
Generating the SSH Server Key Pair 156
Specifying the SSH Key 157
Specifying the SSH Key in OpenSSH 157
Specifying the SSH Key in IETF SECSH 157
Specifying the SSH Key in Public Key Certificate in PEM 158
Overwriting a Generated Key Pair 158
Configuring the Maximum Number of SSH Login Attempts 159
Clearing SSH Hosts 160
Enabling SSH or Telnet Service 161
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
x
Contents