Defining a Global Encryption Key | Cisco Systems OL-5650-02 guide

Chapter 4 Configuring the CSS as a Client of a TACACS+ Server

Configuring Global TACACS+ Attributes

Defining a Global Encryption Key

The CSS allows you to define a global encryption key for communications with all configured TACACS+ servers. To encrypt TACACS+ packet transactions between the CSS and the TACACS+ server, you must define an encryption key. If you do not define an encryption key, packets are not encrypted. The key is a shared secret value that is identical to the one on the TACACS+ server. Use the tacacs-server key command to specify a shared secret between the CSS and the server.

The shared secret key can be either clear text entered in quotes or the DES-encrypted secret. The clear text key is DES-encrypted before it is placed in the running configuration. Either key type can have a maximum of 100 characters. The CSS dynamically applies the modified key and the new value automatically takes effect on the next TACACS+ connection.

For example, to define the clear text key, enter:

#(config) tacacs-server key “market”

To define a DES-encrypted key, enter:

#(config) tacacs-server key acskefterefesdtx

To remove the key, enter:

#(config) no tacacs-server key

Note A shared secret that you configure when you specify a TACACS+ server overrides the global encryption key (see the “Defining a TACACS+ Server” section).

Setting the Global TACACS+ Keepalive Frequency

The CSS allows you to define a global keepalive frequency for use with all configured TACACS+ servers. To determine the availability of the TACACS+ servers, the CSS sends periodic TCP keepalive probes to them. If the server does not respond to the probe within the configured timeout period, the CSS considers the server unavailable.

		Cisco Content Services Switch Security Configuration Guide
		Cisco Content Services Switch Security Configuration Guide
	OL-5650-02			4-7
	OL-5650-02			4-7

Image 89

Cisco Systems OL-5650-02 manual Defining a Global Encryption Key, Setting the Global TACACS+ Keepalive Frequency

Contents

Cisco Content Services Switch Security Configuration Guide Cisco Content Services Switch Security Configuration Guide Iii N T E N T S ACL Overview Configuring the CSS as a Client of a Radius Server Configuring Firewall Load Balancing Vii Example of Fwlb Viii B L E S OL-5650-02 Preface Xii How to Use This GuideAudience Xiii Related Documentation Xiv Rmon Document Title Description Xvi Symbols and Conventions Xvii Obtaining DocumentationCisco.com Documentation DVD Documentation FeedbackOrdering Documentation Xviii Xix Reporting Security Problems in Cisco ProductsCisco Product Security Overview Cisco Technical Support Website Obtaining Technical Assistance Xxi Submitting a Service Request Xxii Definitions of Service Request Severity Xxiii Xxiv Controlling CSS Access Config# username-offdm bobo password secret Changing the Administrative Username and Password Config# username picard password captain superuser Creating Usernames and Passwords Controlling CSS Access Creating Usernames and Passwords Config# username picard password flute superuser Config# username picard password captain superuser NwbnnnrConfig# no username picard Controlling Remote User Access to the CSS Configuring Virtual Authentication #config virtual authentication secondary local Configuring Console Authentication#config virtual authentication primary tacacs #config no console authentication #config console authentication primary tacacs#config console authentication secondary local Enabling Administrative Access to the CSS Controlling Administrative Access to the CSS Config# no restrict web-mgmt Disabling Administrative Access to the CSS Config# restrict telnet Controlling CSS Network Traffic Through Access Control Lists ACL Overview ACL ACL Configuration Quick Start Config-acl7#apply circuit-VLAN1 Config-acl7#clause 10 deny any any destination range 20Config-acl7#clause 15 permit any any destination any Creating an ACL Deleting an ACL Config# acl disableConfig-acl7#remove circuit-VLAN1 Configuring Clauses Cisco Content Services Switch Security Configuration Guide Variables Options Parameters Destination content ownername/ rulename for an Variables OptionsParameters Show group ? Variables Options Parameters Prefer Adding a Clause When ACLs are Globally Enabled Deleting a Clause Config-acl7remove circuit-VLAN1Config-acl7apply circuit-VLAN1 Applying an ACL to a Circuit or DNS Queries Removing an ACL from Circuits or DNS Queries Enabling ACLs on the CSS Showing ACLs Disabling ACLs on the CSS Field Description Logging ACL Activity Setting the Show ACL Counters to Zero Config-acl7#clause 1 log disable Config-acl7#clause 1 log enable ACL Example Config# no logging subsystem acl Configuring Network Qualifier Lists for ACLs Adding Networks to an NQL Creating an NQLDescribing an NQL Config-nqlbypassnql#no ip address 192.168.0.0/16 Config# logging subsystem nql level debug-7 Adding an NQL to an ACL Clause Showing NQL Configurations Configuring the Secure Shell Daemon Protocol # license Enabling SSH Configuring Sshd in the CSS Configuring SSH AccessConfiguring Sshd Keepalive Config# no restrict ssh Configuring Sshd Server-Keybits Configuring Sshd Port Config# sshd server-keybits Configuring Sshd VersionConfig# no sshd server-keybits Config# sshd version Showing Sshd Configurations Configuring Telnet Access When Using SshdConfig# no restrict telnet # show sshd config # show sshd sessions # show sshd version Ptyfd Radius Server Configuring the CSS as a Client of a Radius Server Config# radius-server secondary 172.27.56.79 secret Hello Radius Configuration Quick StartConfig# radius-server primary 172.27.56.76 secret Hello #config virtual authentication primary radius Configuring a Radius Server for Use with the CSS Configuring Authorization Settings Configuring Authentication Settings Specifying a Primary Radius Server Specifying a Secondary Radius Server Config# no radius-server primaryConfig# no radius-server secondary Configuring the Radius Server Retransmits Configuring the Radius Server TimeoutsConfig# radius-server timeout Config# no radius-server timeout Config# no radius-server retransmit Configuring the Radius Server Dead-TimeConfig# radius-server dead-time Config# no radius-server dead-time DOWN, Unknown Config# show radius statistics secondary 3describes the fields in the show radius statistics output OL-5650-02 TACACS+ Server TACACS+ Configuration Quick Start Config# show tacacs-server Configuring Authorization Settings Configuring Global TACACS+ Attributes #config no tacacs-server timeout Setting the Global CSS TACACS+ Timeout Period#config tacacs-server timeout #config tacacs-server key market Setting the Global TACACS+ Keepalive Frequency#config tacacs-server key acskefterefesdtx #config no tacacs-server key Defining a TACACS+ Server Config# no tacacs-server frequency OL-5650-02 #config no tacacs-server 192.168.11.1 Setting TACACS+ Authorization #config tacacs-server authorize non-config #config tacacs-server authorize config#config no tacacs-server authorize config #config no tacacs-server authorize non-config Setting TACACS+ Accounting Showing TACACS+ Server Configuration Information Field Description OL-5650-02 Configuring Firewall Load Balancing Overview of Fwlb Firewall Synchronization Configuring Fwlb Config# no ip firewall Configuring a Keepalive Timeout for a FirewallConfig# ip firewall 1 192.168.27.1 192.168.28.1 Config# no ip firewall timeout Configuring an IP Static Route for a FirewallConfig# ip firewall timeout Config# ip route 192.168.2.0/24 firewall 1 Configuring Ospf to Advertise Firewall RoutesConfig# no ip route 192.168.2.0/24 firewall Config# ospf redistribute firewall metric 3 type1 Example of Fwlb Static Route Configuration Configuring RIP to Advertise Firewall RoutesConfig# no ospf redistribute firewall Config# rip redistribute firewall Config# ip route 192.168.2.0/24 firewall Config# ip firewall 1 192.168.28.1 192.168.27.1Config# ip firewall 2 192.168.28.2 192.168.27.2 Config# ip route 0.0.0.0/0 firewall Example of Fwlb Configuring Fwlb with VIP and Virtual Interface Redundancy Fwlb with VIP/Interface Redundancy Configuration Cisco Content Services Switch Security Configuration Guide CSS-OUT-L Configuration Example of Firewall and Route Configurations CSS-IN-L Configuration Displaying Firewall Flow Summaries Config# show flows 192.165.22.1Config# show flows Displaying Firewall IP Routes Config# show ip routes firewall Displaying Firewall IP Information Config# show ip firewall OL-5650-02 IN-1 D E IN-2 IN-3 FTP IN-4 Radius IN-5 XML IN-6