Cisco MDS 9000 Series User manual

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

©2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface xvii
PREFACE
Audience xvii
Document Conventions xvii
Related Documentation xviii
Obtaining Documentation and Submitting a Service Request xviii
New and Changed Information 1
CHAPTER 1
Security Overview 3
CHAPTER 2
FIPS 3
Users and Common Roles 4
RADIUS and TACACS+ 4
IP ACLs 4
PKI 5
SSH Services 5
IPsec 5
FC-SP and DHCHAP 5
Port Security 6
Fibre Channel Common Transport Management Server Query 6
Fabric Binding 6
TrustSec Fibre Channel Link Encryption 6
Configuring FIPS 7
CHAPTER 3
Configuration Guidelines 7
Enabling FIPS Mode 8
Displaying FIPS Status 8
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
iii

FIPS Self-Tests 8
Common Roles 11
CHAPTER 4
Role-Based Authorization 11
About Roles 11
Configuring Roles and Profiles 12
Configuring Rules and Features for Each Role 12
Rule Changes Between SAN-OS Release 3.3(1c) and NX-OS Release 4.2(1a) Affect Role
Behavior 14
Modifying Profiles 14
Configuring the VSAN Policy 15
Modifying the VSAN Policy 15
Role Distributions 16
About Role Databases 16
Locking the Fabric 17
Committing Role-Based Configuration Changes 17
Discarding Role-Based Configuration Changes 17
Enabling Role-Based Configuration Distribution 18
Clearing Sessions 18
Database Merge Guidelines 18
Displaying Role-Based Information 19
Displaying Roles When Distribution is Enabled 20
Configuring Common Roles 22
Mapping of CLI Operations to SNMP 23
Configuring User Accounts 24
Guidelines on Creating Users 24
Checking Password Strength 25
Characteristics of Strong Passwords 25
Configuring Users 25
Logging Out Users 26
Displaying User Account Information 27
Default Settings 27
Configuring Security Features on an External AAA Server 29
CHAPTER 5
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
iv
Contents

Switch Management Security 30
CLI Security Options 30
SNMP Security Options 30
Switch AAA Functionalities 31
Authentication 31
Authorization 31
Accounting 31
Remote AAA Services 32
Remote Authentication Guidelines 32
Server Groups 32
AAA Service Configuration Options 32
Error-Enabled Status 33
AAA Server Monitoring 34
Authentication and Authorization Process 34
Configuring Role-based Authorization on TACACS+ Server 35
Configuring Fallback Mechanism for Authentication 37
Verifying Authorization Profile 38
Testing Authorization 38
Configuring Login Parameters 39
Configuring AAA Server Monitoring Parameters Globally 41
Configuring LDAP 42
LDAP Authentication and Authorization 42
Guidelines and Limitations for LDAP 43
Prerequisites for LDAP 43
Default Settings 44
Enabling LDAP 44
Configuring LDAP Server Hosts 45
Configuring the RootDN for an LDAP Server 45
Configuring LDAP Server Groups 46
Configuring the Global LDAP Timeout Interval 48
Configuring the Timeout Interval for an LDAP Server 48
Configuring the Global LDAP Server Port 49
Configuring TCP Ports 50
Configuring LDAP Search Maps 50
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
v
Contents

Configuring the LDAP Dead-Time Interval 51
Configuring AAA Authorization on LDAP Servers 52
Disabling LDAP 53
Configuration Examples for LDAP 53
Configuring RADIUS Server Monitoring Parameters 54
About RADIUS Server Default Configuration 54
Setting the RADIUS Server IPv4 Address 54
Setting the RADIUS Server IPv6 Address 55
Setting the RADIUS Server DNS name 56
About the Default RADIUS Server Encryption Type and Preshared Key 57
Configuring the Default RADIUS Server Encryption Type and Preshared Key 57
Setting the RADIUS Server Timeout Interval 57
Setting the Default RADIUS Server Timeout Interval and Retransmits 58
Configuring RADIUS Server Monitoring Parameters 58
Configuring the Test Idle Timer 58
Configuring Test User Name 59
Configuring the Dead Timer 60
About RADIUS Servers 60
Configuring the Test Idle Timer 60
Configuring Test User Name 61
About Validating a RADIUS Server 61
Sending RADIUS Test Messages for Monitoring 61
Allowing Users to Specify a RADIUS Server at Login 62
About Vendor-Specific Attributes 62
VSA Format 63
Specifying SNMPv3 on AAA Servers 63
Displaying RADIUS Server Details 64
Displaying RADIUS Server Statistics 64
One-Time Password Support 65
Recovering the Administrator Password 65
Using the CLI with Network-Admin Privileges 65
Power Cycling the Switch 66
Configuring TACACS+ Server Monitoring Parameters 67
About TACACS+ 68
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
vi
Contents

About TACACS+ Server Default Configuration 68
About the Default TACACS+ Server Encryption Type and Preshared Key 68
Enabling TACACS+ 68
Setting the TACACS+ Server IPv4 Address 69
Setting the TACACS+ Server IPv6 Address 70
Setting the TACACS+ Server DNS name 70
Setting the Global Secret Key 71
Setting the Default TACACS+ Server Timeout Interval and Retransmits 72
Setting the Timeout Value 72
About TACACS+ Servers 72
Configuring TACACS+ Server Monitoring Parameters 73
Configuring the TACACS+ Test Idle Timer 73
Configuring Test Username 73
Configuring the Dead Timer 74
Sending TACACS+ Test Messages for Monitoring 75
Password Aging Notification through TACACS+ Server 75
About Validating a TACACS+ Server 76
Periodically Validating a TACACS+ Server 76
About Users Specifying a TACACS+ Server at Login 76
Allowing Users to Specify a TACACS+ Server at Login 76
Defining Roles on the Cisco Secure ACS 5.x GUI 77
Defining Custom Attributes for Roles 77
Supported TACACS+ Server Parameters 77
Displaying TACACS+ Server Details 78
Clearing TACACS+ Server Statistics 79
Configuring Server Groups 79
About Configuring Radius Server Groups 80
About Configuring TACACS+ Server Groups 81
About Bypassing a Nonresponsive Server 82
AAA Server Distribution 82
Enabling AAA RADIUS Server Distribution 83
Enabling AAA TACACS+ Server Distribution 83
Starting a Distribution Session on a Switch 84
Displaying the Session Status 84
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
vii
Contents

Displaying the Pending Configuration to be Distributed 84
Committing the RADIUS Distribution 85
Committing the TACACS+ Distribution 85
Discarding the RADIUS Distribution Session 85
Discarding the TACACS+ Distribution Session 86
Clearing Sessions 86
Merge Guidelines for RADIUS and TACACS+ Configurations 86
CHAP Authentication 87
Enabling CHAP Authentication 88
MSCHAP Authentication 88
About Enabling MSCHAP 88
Enabling MSCHAP Authentication 89
Enabling MSCHAPv2 Authentication 89
Local AAA Services 90
Disabling AAA Authentication 91
Displaying AAA Authentication 91
Configuring Accounting Services 91
Displaying Accounting Configuration 92
Clearing Accounting Logs 93
Configuring Cisco Access Control Servers 93
Default Settings 97
Configuring IPv4 and IPv6 Access Control Lists 99
CHAPTER 6
About IPv4 and IPv6 Access Control Lists 100
IPv4-ACL and IPv6-ACL Configuration Guidelines 100
About Filter Contents 101
Protocol Information 101
Address Information 101
Port Information 102
ICMP Information 103
ToS Information 104
Creating IPv4-ACLs or IPv6-ACLs 104
Creating IPv4-ACLs 104
Creating IPv6-ACLs 105
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
viii
Contents

Defining IPv4-ACLs 105
Defining IPv6-ACLs 106
Operand and port options for an IPv4-ACL 106
Operand and port options for an IPv6-ACL 107
Adding IP Filters to an Existing IPv4-ACL 107
Adding IP Filters to an Existing IPv6-ACL 108
Removing IP Filters from an Existing IPv4-ACL 108
Removing IP Filters from an Existing IPv6-ACL 109
Verifying the IPv4-ACL or IPv6-ACL Configuration 109
Reading the IP-ACL Log Dump 110
Applying an IP-ACL to an Interface 111
Applying an IPv6-ACL to an Interface 112
Applying an IP-ACL to mgmt0 113
Verifying Interface IP-ACL Configuration 113
Open IP Ports on Cisco MDS 9000 Series Platforms 114
IP-ACL Counter Cleanup 115
Configuring Certificate Authorities and Digital Certificates 117
CHAPTER 7
About CAs and Digital Certificates 117
Purpose of CAs and Digital Certificates 117
Trust Model, Trust Points, and Identity CAs 118
RSA Key-Pairs and Identity Certificates 118
Multiple Trusted CA Support 119
PKI Enrollment Support 119
Manual Enrollment Using Cut-and-Paste Method 120
Multiple RSA Key-Pair and Identity CA Support 120
Peer Certificate Verification 120
CRL Downloading, Caching, and Checking Support 120
Import and Export Support for Certificates and Associated Key-Pairs 121
Configuring CAs and Digital Certificates 121
Configuring the Host Name and IP Domain Name 121
Generating an RSA Key-Pair 122
Creating a Trust Point CA Association 122
Authenticating the CA 123
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
ix
Contents

Configuring Certificate Revocation Checking Methods 124
Generating Certificate Requests 125
Installing Identity Certificates 126
Saving Your Configuration 127
Ensuring Trust Point Configurations Persist Across Reboots 127
Monitoring and Maintaining CA and Certificates Configuration 127
Exporting and Importing Identity Information to PKCS12 Format 127
Exporting and Importing Identity Information from PKCS12 Format 128
Configuring a CRL 129
Deleting Certificates from the CA Configuration 129
Deleting RSA Key-Pairs from Your Switch 130
Displaying Key-Pair and CA Information 131
Example Configurations 131
Configuring Certificates on the MDS Switch 131
Downloading a CA Certificate 134
Requesting an Identity Certificate 138
Revoking a Certificate 145
Generating and Publishing the CRL 147
Downloading the CRL 149
Importing the CRL 151
Maximum Limits 153
Default Settings 154
Configuring SSH Services 155
CHAPTER 8
SSH Services 155
Generating the SSH Server Key Pair 156
Specifying the SSH Key 157
Specifying the SSH Key in OpenSSH 157
Specifying the SSH Key in IETF SECSH 157
Specifying the SSH Key in Public Key Certificate in PEM 158
Overwriting a Generated Key Pair 158
Configuring the Maximum Number of SSH Login Attempts 159
Clearing SSH Hosts 160
Enabling SSH or Telnet Service 161
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
x
Contents

Displaying SSH Protocol Status 161
SSH Authentication Using Digital Certificates 162
Passwordless File copy and SSH 163
Configuring IPSec Network Security 167
CHAPTER 9
About IPsec 168
About IKE 169
IPsec Prerequisites 170
Using IPsec 170
IPsec Compatibility 170
IPsec and IKE Terminology 171
Supported IPsec Transforms and Algorithms 172
Supported IKE Transforms and Algorithms 173
IPsec Digital Certificate Support 173
Implementing IPsec Without CAs and Digital Certificates 173
Implementing IPsec with CAs and Digital Certificates 174
How CA Certificates Are Used by IPsec Devices 175
Manually Configuring IPsec and IKE 176
About IKE Initialization 176
Enabling IKE 177
About the IKE Domain 177
Configuring the IKE Domain 177
About IKE Tunnels 178
About IKE Policy Negotiation 178
Configuring an IKE Policy 179
Optional IKE Parameter Configuration 181
Configuring the Lifetime Association for a Policy 182
Configuring the Keepalive Time for a Peer 183
Configuring the Initiator Version 183
Clearing IKE Tunnels or Domains 184
Refreshing SAs 184
Crypto IPv4-ACLs 184
About Crypto IPv4-ACLs 184
Crypto IPv4-ACL Guidelines 185
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xi
Contents

Mirror Image Crypto IPv4-ACLs 187
The any Keyword in Crypto IPv4-ACLs 188
Creating Crypto IPv4-ACLs 188
About Transform Sets in IPsec 189
Configuring Transform Sets 190
About Crypto Map Entries 191
SA Establishment Between Peers 191
Crypto Map Configuration Guidelines 192
Creating Crypto Map Entries 192
About SA Lifetime Negotiation 193
Setting the SA Lifetime 193
About the AutoPeer Option 194
Configuring the AutoPeer Option 195
About Perfect Forward Secrecy 196
Configuring Perfect Forward Secrecy 196
About Crypto Map Set Interface Application 196
Applying a Crypto Map Set 196
IPsec Maintenance 197
Global Lifetime Values 197
Displaying IKE Configurations 199
Displaying IPsec Configurations 200
Sample FCIP Configuration 204
Sample iSCSI Configuration 208
Default Settings 209
Configuring FC-SP and DHCHAP 211
CHAPTER 10
About Fabric Authentication 211
DHCHAP 212
DHCHAP Compatibility with Existing Cisco MDS Features 213
About Enabling DHCHAP 213
Enabling DHCHAP 213
About DHCHAP Authentication Modes 214
Configuring the DHCHAP Mode 215
About DHCHAP Hash Algorithm 216
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xii
Contents

Configuring the DHCHAP Hash Algorithm 216
About DHCHAP Group Settings 216
Configuring the DHCHAP Group Settings 217
About DHCHAP Password 217
Configuring DHCHAP Passwords for the Local Switch 218
About Password Configuration for Remote Devices 218
Configuring DHCHAP Passwords for Remote Devices 219
About DHCHAP Timeout Value 219
Configuring the DHCHAP Timeout Value 219
Configuring DHCHAP AAA Authentication 220
Displaying Protocol Security Information 220
Sample Configuration 222
Default Settings 223
Configuring Port Security 225
CHAPTER 11
About Port Security 225
Port Security Enforcement 226
About Auto-Learning 226
Port Security Activation 227
Port Security Configuration 227
Configuring Port Security with Auto-Learning and CFS Distribution 227
Configuring Port Security with Auto-Learning without CFS 228
Configuring Port Security with Manual Database Configuration 228
Enabling Port Security 229
Port Security Activation 229
Activating Port Security 229
Database Activation Rejection 230
Forcing Port Security Activation 230
Database Reactivation 231
Auto-learning 231
About Enabling Auto-learning 231
Enabling Auto-learning 232
Disabling Auto-learning 232
Auto-learning Device Authorization 232
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xiii
Contents

Authorization Scenarios 233
Port Security Manual Configuration 234
About WWN Identification 235
Adding Authorized Port Pairs 235
Port Security Configuration Distribution 236
Enabling Distribution 236
Locking the Fabric 237
Committing the Changes 238
Discarding the Changes 238
Activation and Auto-learning Configuration Distribution 238
Database Merge Guidelines 240
Database Interaction 240
Database Scenarios 241
Copying the Port Security Database 241
Deleting the Port Security Database 242
Cleaning the Port Security Database 242
Displaying Port Security Configuration 243
Default Settings 246
Configuring Fibre Channel Common Transport Management Security 247
CHAPTER 12
About Fibre Channel Common Transport 247
Configuration Guidelines 248
Configuring the Fibre Channel Common Transport Query 248
Verifying Fibre Channel Common Transport Management Security 249
Default Settings 249
Configuring Fabric Binding 251
CHAPTER 13
About Fabric Binding 251
Licensing Requirements 251
Port Security Versus Fabric Binding 251
Fabric Binding Enforcement 252
Fabric Binding Configuration 252
Enabling Fabric Binding 253
Configuring Switch WWN List for a FICON VSAN 254
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xiv
Contents

Configuring Switch WWN List for a Fiber Channel VSAN 254
Fabric Binding Activation 255
Forcing Fabric Binding Activation 256
Saving Fabric Binding Configurations 257
Clearing the Fabric Binding Statistics 257
Deleting the Fabric Binding Database 257
Verifying Fabric Binding Configurations 257
Default Settings 261
Configuring Cisco TrustSec Fibre Channel Link Encryption 263
CHAPTER 14
Cisco TrustSec FC Link Encryption Terminology 263
Support for AES Encryption 263
About Cisco TrustSec FC Link Encryption 264
Supported Modules 264
Enabling Cisco TrustSec FC Link Encryption 264
Setting Up Security Associations 265
Setting Up Security Association Parameters 266
Configuring ESP Settings 266
Configuring ESP on Ingress and Egress Ports 266
Configuring ESP Modes 268
Viewing Cisco TrustSec FC Link Encryption Information 270
Viewing FC-SP Interface Information 270
Viewing Running System Information 270
Viewing FC-SP Interface Statistics 270
Cisco TrustSec FC Link Encryption Best Practices 271
General Best Practices 271
Best Practices for Changing Keys 271
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xv
Contents

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xvi
Contents

Preface
This preface describes the audience, organization of, and conventions used in the Cisco MDS 9000 Series
Configuration Guides. It also provides information on how to obtain related documentation, and contains the
following chapters:
•Audience, on page xvii
•Document Conventions, on page xvii
•Related Documentation, on page xviii
•Obtaining Documentation and Submitting a Service Request, on page xviii
Audience
To use this installation guide, you need to be familiar with electronic circuitry and wiring practices, and
preferably be an electronic or electromechanical technician.
Document Conventions
This document uses the following conventions:
Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual.
Note
Means reader be careful. In this situation, you might do something that could result in equipment damage or
loss of data.
Caution
Warnings use the following conventions:
This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work
on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard
practices for preventing accidents. Use the statement number provided at the end of each warning to locate
its translation in the translated safety warnings that accompanied this device. Statement 1071.
Warning
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xvii

Related Documentation
The documentation set for the Cisco MDS 9000 Series Switches includes the following documents.
Release Notes
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
products-release-notes-list.html
Regulatory Compliance and Safety Information
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/hw/regulatory/compliance/RCSI.html
Compatibility Information
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
products-device-support-tables-list.html
Installation and Upgrade
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
products-installation-guides-list.html
Configuration
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
products-installation-and-configuration-guides-list.html
CLI
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
products-command-reference-list.html
Troubleshooting and Reference
http://www.cisco.com/c/en/us/support/storage-networking/mds-9000-nx-os-san-os-software/
tsd-products-support-troubleshoot-and-alerts.html
To find a document online, use the Cisco MDS NX-OS Documentation Locator at:
http://www.cisco.com/c/en/us/td/docs/storage/san_switches/mds9000/roadmaps/doclocater.html
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation.
To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's
New in Cisco Product Documentation RSS feed. RSS feeds are a free service.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
xviii
Preface
Related Documentation

CHAPTER 1
New and Changed Information
Where DocumentedReleaseDescriptionFeature Name
Configuring User
Accounts, on page 24
8.2(1)User accounts will have
passwords encrypted with
SHA-2 by default.
SHA-2 Encryption and
Fingerprint Hashing
Support
Configuring LDAP Server
Hosts, on page 45
8.2(1)LDAP connections on
port 636 automatically
start securely with SSL or
TLS.
LDAP Enhancements
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
1

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
2
New and Changed Information