Alcatel Carrier Internetworking Solutions omniswitch

Verifying the ASA Configuration Managing Switch Security

page 8-14 OmniSwitch 6600 Family Switch Management Guide March 2005

Contents

Main Page Contents Page Page Page Page Page Page Page About This Guide Supported Platforms Unsupported Platforms Who Should Read this Manual? When Should I Read this Manual? What is in this Manual? What is Not in this Manual? How is the Information Organized? Documentation Roadmap Stage 1: Using the Switch for the First Time Stage 2: Gaining Familiarity with Basic Switch Functions Stage 3: Integrating the Switch Into a Network Anytime Related Documentation User Manual CD Technical Support 1 Logging Into the Switch Login Specifications Login Defaults Quick Steps for Logging Into the Switch Overview of Switch Login Components Management Interfaces Logging Into the CLI Using the WebView Management Tool Using SNMP to Manage the Switch User Accounts Using Telnet Logging Into the Switch Via Telnet Starting a Telnet Session from the Switch Using FTP Using FTP to Log Into the Switch Using Secure Shell Secure Shell Components Secure Shell Interface Secure Shell File Transfer Protocol Secure Shell Application Overview Secure Shell Authentication Protocol Identification Algorithm and Key Exchange Authentication Phase Connection Phase Starting a Secure Shell Session Page Closing a Secure Shell Session Log Into the Switch with Secure Shell FTP Page Modifying the Login Banner Modifying the Text Display Before Login Configuring Login Parameters Configuring the Inactivity Timer Enabling the DNS Resolver Verifying Login Settings 2 Managing System Files File Management Specifications Switch Administration Overview File Transfer Switch Directories File and Directory Management Page Using Wildcards Multiple Characters Single Characters Directory Commands Determining Your Location in the File Structure Changing Directories Displaying Directory Contents Making a New Directory Displaying Directory Contents Including Subdirectories Copying an Existing Directory Removing a Directory and its Contents File Commands Creating or Modifying Files Copy an Existing File Move an Existing File or Directory Change File Attribute and Permissions Delete an Existing File Managing Files on Non Primary Switches Utility Commands Displaying Free Memory Space Performing a File System Check Deleting the Entire File System Loading Software onto the Switch Using the Switch as an FTP Server Page Using the Switch as an FTP Client Page Using Secure Shell FTP Using Zmodem Page Registering Software Image Files Directories on the Switch Using the Install Command Available Image Files Application Examples for File Management Transferring a File to the Switch Using FTP Creating a File Directory on the Switch 5Use the ls command to verify that the files are now located in the /flash/resources directory. FTP Client Application Example 1Log into the switch. Use the ls command to verify that your current directory is /flash. 2Use the cd command to change your current directory to /flash/working. Use the ls or pwd command to verify. Creating a File Directory Using Secure Shell FTP Page Transfer a File Using Secure Shell FTP Verifying Directory Contents Setting the System Clock Setting Date and Time Date Time Zone Time Daylight Savings Time Configuration Enabling DST Time Zone and DST Information Table (continued) Page 3 Configuring Network Time Protocol (NTP) NTP Specifications NTP Defaults Table NTP Quick Steps NTP Overview Stratum Using NTP in a Network Page Authentication Configuring NTP Configuring the OmniSwitch as a Client Setting the Client to Broadcast Mode Setting the Broadcast Delay NTP Servers Designating an NTP Server Setting the Minimum Poll Time Setting the Version Number Marking a Server as Preferred Using Authentication Setting the Key ID for the NTP Server Verifying NTP Configuration Page 4 Managing CMM Directory Content Page CMM Files CMM Software Directory Structure Where is the Switch Running From? Software Rollback Feature Software Rollback Configuration Scenarios for a Single Switch Scenario 1: Running Configuration Lost After Reboot Scenario 2: Running Configuration Saved to Working Directory Scenario 3: Saving the Working Directory to the Certified Directory Scenario 4: Rollback to Previous Version of Switch Software Redundancy Redundancy Scenarios Scenario 1: Booting the Stack Scenario 2: Rebooting from the Working Directory Scenario 3: Synchronizing Switches in a Stack Scenario 4: Adding a New Switch to a Stack Synchronizing a Stack with more three Switches WC WC WC WC Managing the Directory Structure (Non-Redundant) Rebooting the Switch Scheduling a Reboot Cancelling a Scheduled Reboot Checking the Status of a Scheduled Reboot Copying the Running Configuration to the Working Directory Page Rebooting from the Working Directory Rebooting the Switch from the Working Directory with No Rollback Timeout Scheduling a Working Directory Reboot Page Copying the Working Directory to the Certified Directory Copying the Certified Directory to the Working Directory Show Currently Used Configuration Show Switch Files Managing Redundancy in a Stack Rebooting the Switch Scheduling a Reboot Cancelling a Scheduled Reboot Secondary CMM Fail Over Copying the Working Directory to the Certified Directory Synchronizing the Primary and Secondary CMMs Synchronizing the Primary and Secondary CMMs Synchronizing the System Date and Time Swapping the Primary CMM for the Secondary CMM Show Currently Used Configuration Page Emergency Restore of the boot.cfg File Can I Restore the boot.file While Running from Certified? Displaying CMM Conditions Page 5 Using the CLI CLI Specifications CLI Overview Online Configuration Offline Configuration Using Configuration Files Command Entry Rules and Syntax Text Conve ntio ns Using Show Commands Using the No Form Using Alias Commands Partial Keyword Completion Command Help Page Tutorial for Building a Command Using Help Page CLI Services Command Line Editing Deleting Characters Recalling the Previous Command Line Inserting Characters Syntax Checking Prefix Recognition Example for Using Prefix Recognition Show Prefix Prefix Prompt Command History Page Logging CLI Commands and Entry Results Enabling Command Logging Disabling Command Logging Viewing the Current Command Logging Status Viewing Logged CLI Commands and Command Entry Results Customizing the Screen Display Changing the Screen Size Changing the CLI Prompt Displaying Table Information Filtering Table Information Multiple User Sessions Listing Other User Sessions Listing Your Current Login Session Terminating Another Session Application Example Using a Wildcard to Filter Table Information Verifying CLI Usage 6 Working With Configuration Files Configuration File Specifications Tutorial for Creating a Configuration File Page Quick Steps for Applying Configuration Files Setting a File for Immediate Application Setting an Application Session for a Date and Time Setting an Application Session for a Specified Time Period Configuration Files Overview Applying Configuration Files to the Switch Verifying a Timed Session Cancelling a Timed Session Configuration File Error Reporting Setting the Error File Limit Syntax Checking Viewing Generated Error File Contents Verbose Mode Syntax Checking Displaying a Text File Text Editing on the Switch Invoke the Vi Editor Creating Snapshot Configuration Files Snapshot Feature List User-Defined Naming Options Editing Snapshot Files Example Snapshot File Text (Example Snapshot File - Continued) Verifying File Configuration 7 Managing Switch User Accounts User Database Specifications User Account Defaults Overview of User Accounts Startup Defaults Quick Steps for Network Administrator User Accounts Quick Steps for Creating Customer Login User Accounts Default User Settings How User Settings Are Saved Creating a User Removing a User User-Configured Password Setting a Minimum Password Size Configuring Password Expiration Default Password Expiration Specific User Password Expiration Configuring Privileges for a User Setting Up SNMP Access for a User Account SNMP Access Without Authentication/Encryption SNMP Access With Authentication/Encryption Removing SNMP Access From a User Setting Up End-User Profiles Creating End-User Profiles Setting Up Port Ranges in a Profile Setting Up VLAN Ranges in a Profile Associating a Profile With a User Removing a Profile From the Configuration Verifying the User Configuration 8 Managing Switch Security Page Switch Security Overview Authenticated Switch Access AAA ServersRADIUS or LDAP Authentication-onlyACE/Server Interaction With the User Database ASA and Authenticated VLANs Configuring Authenticated Switch Access Quick Steps for Setting Up ASA Page Setting Up Management Interfaces for ASA Enabling Switch Access Configuring the Default Setting Using Secure Shell Configuring Accounting for ASA Verifying the ASA Configuration Page 9 Using WebView WebView CLI Defaults Browser Setup WebView CLI Commands Enabling/Disabling WebView Enabling/Disabling SSL Quick Steps for Setting Up WebView WebVi ew Ov ervi ew WebView Page Layout Banner Toolbar Page Configuring the Switch With WebView Accessing WebView Home Page Configuration Page Global Configuration Page Table Configuration Page Adding a New Entry Modifying an Existing Entry Deleting an Existing Entry Table Features Table Views Table Sorting Page Table Paging Adjacencies WebView Help General WebView Help Specific-page Help Page 10 Using SNMP SNMP Specifications SNMP Defaults Quick Steps for Setting Up An SNMP Management Station Quick Steps for Setting Up Trap Filters Filtering by Trap Families Filtering by Individual Traps SNMP Overview SNMP Operations Using SNMP for Switch Management Setting Up an SNMP Management Station SNMP Versions SNMPv1 SNMPv2 SNMPv3 SNMP Traps Table Page Page Page Page Page Page Page Page Page Page Page Page Page Page traplnkaggIfIndex Page Using SNMP For Switch Security Community Strings (SNMPv1 and SNMPv2) Configuring Community Strings Encryption and Authentication (SNMPv3) Configuring Encryption and Authentication Setting Authentication for a User Account Setting SNMP Security Working with SNMP Traps Trap Filtering Filtering by Trap Families Filtering By Individual Trap Authentication Trap Trap Management Replaying Traps Absorbing Traps Sending Traps to WebView SNMP MIB Information MIB Tables MIB Table Description Industry Standard MIBs Page Page Page Enterprise (Proprietary) MIBs Page Page Verifying the SNMP Configuration Page A Software License and Copyright Statements Alcatel License Agreement ALCATEL INTERNETWORKING, INC. (AII) SOFTWARE LICENSE AGREEMENT Page Page Third Party Licenses and Notices A.Booting and Debugging Non-Proprietary Software B. The OpenLDAP Public License: Version 2.4, 8 December 2000 C. Linux D. GNU GENERAL PUBLIC LICENSE: Version 2, June 1991 Preamble GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION Page Page Page Appendix: How to Apply These Terms to Your New Programs E. University of California F. Carnegie-Mellon University G.Random.c H.Apptitude, Inc. I. Agranat J. RSA Security Inc. K. Sun Microsystems, Inc. L. Wind River Systems, Inc. M.Network Time Protocol Version 4 Index Symbols A B C E F H I K P R S T U V W Z