Defining a TACACS+ Server | Cisco Systems OL-5650-02 manual

Chapter 4 Configuring the CSS as a Client of a TACACS+ Server

Defining a TACACS+ Server

When it sends a keepalive to the TACACS+ server, the CSS attempts to use a persistent connection with the server. If the server is not configured for persistence, the CSS opens a new connection each time it sends a keepalive.

To set the global TACACS+ keepalive frequency, use the tacacs-server frequency command in global configuration mode. This command has the following syntax:

tacacs-server frequency number

The number variable defines the keepalive frequency in seconds. Enter an integer from 0 to 255. The default is 5 seconds. A setting of 0 disables keepalives. The CSS dynamically applies the modified keepalive frequency and immediately restarts the keepalive with the new value.

For example, to set the global TACACS+ keepalive frequency to 50 seconds, enter:

(config)# no tacacs-server frequency 50

Note A keepalive frequency that you configure when you specify a TACACS+ server overrides the global keepalive frequency (see the “Defining a TACACS+ Server” section).

To reset the global TACACS+ keepalive frequency to the default of 5 seconds, use the no tacacs-server frequency command.

For example, enter:

(config)# no tacacs-server frequency

Defining a TACACS+ Server

The TACACS+ server contains the TACACS+ authentication, authorization, and accounting databases. You can designate a maximum of three servers on the CSS. However, the CSS uses only one server at a time. The CSS selects the server based upon availability, giving preference to the configured primary server. The CSS sends periodic TCP keepalive probes at a frequency of every five seconds to the TACACS+ server to determine its operational state: Alive, Dying, or Dead. The TCP keepalive frequency is not user-configurable in the CSS.

	Cisco Content Services Switch Security Configuration Guide
4-8	OL-5650-02

Image 90

Cisco Systems OL-5650-02 manual Defining a TACACS+ Server, Config# no tacacs-server frequency

Contents

Cisco Content Services Switch Security Configuration Guide Cisco Content Services Switch Security Configuration Guide N T E N T S Iii ACL Overview Configuring the CSS as a Client of a Radius Server Configuring Firewall Load Balancing Example of Fwlb Vii Viii B L E S OL-5650-02 Preface How to Use This Guide AudienceXii Related Documentation Xiii Rmon Xiv Document Title Description Symbols and Conventions Xvi Obtaining Documentation Cisco.comXvii Ordering Documentation Documentation FeedbackDocumentation DVD Xviii Reporting Security Problems in Cisco Products Cisco Product Security OverviewXix Obtaining Technical Assistance Cisco Technical Support Website Submitting a Service Request Xxi Definitions of Service Request Severity Xxii Xxiii Xxiv Controlling CSS Access Changing the Administrative Username and Password Config# username-offdm bobo password secret Creating Usernames and Passwords Config# username picard password captain superuser Controlling CSS Access Creating Usernames and Passwords Config# username picard password captain superuser Nwbnnnr Config# no username picardConfig# username picard password flute superuser Controlling Remote User Access to the CSS Configuring Virtual Authentication Configuring Console Authentication #config virtual authentication primary tacacs#config virtual authentication secondary local #config console authentication primary tacacs #config console authentication secondary local#config no console authentication Controlling Administrative Access to the CSS Enabling Administrative Access to the CSS Disabling Administrative Access to the CSS Config# no restrict web-mgmt Controlling CSS Network Traffic Through Access Control Lists Config# restrict telnet ACL Overview ACL ACL Configuration Quick Start Config-acl7#clause 10 deny any any destination range 20 Config-acl7#clause 15 permit any any destination anyConfig-acl7#apply circuit-VLAN1 Creating an ACL Config# acl disable Config-acl7#remove circuit-VLAN1Deleting an ACL Configuring Clauses Cisco Content Services Switch Security Configuration Guide Variables Options Parameters Destination content ownername/ rulename for an Variables OptionsParameters Variables Options Parameters Show group ? Adding a Clause When ACLs are Globally Enabled Prefer Config-acl7remove circuit-VLAN1 Config-acl7apply circuit-VLAN1Deleting a Clause Applying an ACL to a Circuit or DNS Queries Removing an ACL from Circuits or DNS Queries Enabling ACLs on the CSS Disabling ACLs on the CSS Showing ACLs Field Description Setting the Show ACL Counters to Zero Logging ACL Activity Config-acl7#clause 1 log enable Config-acl7#clause 1 log disable Config# no logging subsystem acl ACL Example Configuring Network Qualifier Lists for ACLs Creating an NQL Describing an NQLAdding Networks to an NQL Config# logging subsystem nql level debug-7 Config-nqlbypassnql#no ip address 192.168.0.0/16 Showing NQL Configurations Adding an NQL to an ACL Clause Configuring the Secure Shell Daemon Protocol Enabling SSH # license Configuring Sshd Keepalive Configuring SSH AccessConfiguring Sshd in the CSS Config# no restrict ssh Configuring Sshd Port Configuring Sshd Server-Keybits Config# no sshd server-keybits Configuring Sshd VersionConfig# sshd server-keybits Config# sshd version Config# no restrict telnet Configuring Telnet Access When Using SshdShowing Sshd Configurations # show sshd config # show sshd sessions Ptyfd # show sshd version Radius Server Configuring the CSS as a Client of a Radius Server Radius Configuration Quick Start Config# radius-server primary 172.27.56.76 secret HelloConfig# radius-server secondary 172.27.56.79 secret Hello Configuring a Radius Server for Use with the CSS #config virtual authentication primary radius Configuring Authentication Settings Configuring Authorization Settings Specifying a Primary Radius Server Config# no radius-server primary Config# no radius-server secondarySpecifying a Secondary Radius Server Config# radius-server timeout Configuring the Radius Server TimeoutsConfiguring the Radius Server Retransmits Config# no radius-server timeout Config# radius-server dead-time Configuring the Radius Server Dead-TimeConfig# no radius-server retransmit Config# no radius-server dead-time Config# show radius statistics secondary DOWN, Unknown 3describes the fields in the show radius statistics output OL-5650-02 TACACS+ Server TACACS+ Configuration Quick Start Config# show tacacs-server Configuring Authorization Settings Configuring Global TACACS+ Attributes Setting the Global CSS TACACS+ Timeout Period #config tacacs-server timeout#config no tacacs-server timeout #config tacacs-server key acskefterefesdtx Setting the Global TACACS+ Keepalive Frequency#config tacacs-server key market #config no tacacs-server key Config# no tacacs-server frequency Defining a TACACS+ Server OL-5650-02 #config no tacacs-server 192.168.11.1 Setting TACACS+ Authorization #config no tacacs-server authorize config #config tacacs-server authorize config#config tacacs-server authorize non-config #config no tacacs-server authorize non-config Setting TACACS+ Accounting Showing TACACS+ Server Configuration Information Field Description OL-5650-02 Configuring Firewall Load Balancing Overview of Fwlb Configuring Fwlb Firewall Synchronization Configuring a Keepalive Timeout for a Firewall Config# ip firewall 1 192.168.27.1 192.168.28.1Config# no ip firewall Configuring an IP Static Route for a Firewall Config# ip firewall timeoutConfig# no ip firewall timeout Config# no ip route 192.168.2.0/24 firewall Configuring Ospf to Advertise Firewall RoutesConfig# ip route 192.168.2.0/24 firewall 1 Config# ospf redistribute firewall metric 3 type1 Config# no ospf redistribute firewall Configuring RIP to Advertise Firewall RoutesExample of Fwlb Static Route Configuration Config# rip redistribute firewall Config# ip firewall 2 192.168.28.2 192.168.27.2 Config# ip firewall 1 192.168.28.1 192.168.27.1Config# ip route 192.168.2.0/24 firewall Config# ip route 0.0.0.0/0 firewall Example of Fwlb Configuring Fwlb with VIP and Virtual Interface Redundancy Fwlb with VIP/Interface Redundancy Configuration Cisco Content Services Switch Security Configuration Guide Example of Firewall and Route Configurations CSS-OUT-L Configuration CSS-IN-L Configuration Config# show flows 192.165.22.1 Config# show flowsDisplaying Firewall Flow Summaries Config# show ip routes firewall Displaying Firewall IP Routes Config# show ip firewall Displaying Firewall IP Information OL-5650-02 D E IN-1 IN-2 FTP IN-3 Radius IN-4 XML IN-5 IN-6