Cisco NCS 5000 Series User manual

System Security Command Reference for Cisco NCS 5000 Series

Routers

First Published: 2015-12-23

Last Modified: 2017-03-16

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://

www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

CONTENTS

Preface

Preface vii

Changes to This Document vii

Obtaining Documentation and Submitting a Service Request vii

CHAPTER 1

Authentication, Authorization, and Accounting Commands 1

aaa accounting 4

aaa accounting system default 6

aaa accounting update 8

aaa authentication (XR-VM) 10

aaa authorization (XR-VM) 12

aaa default-taskgroup 15

aaa group server radius 16

aaa group server tacacs+ 18

aaa password-policy 20

accounting (line) 23

authorization (line) 25

description (AAA) 27

group (AAA) 28

inherit taskgroup 30

inherit usergroup 32

key (TACACS+) 34

password (AAA) 38

radius-server dead-criteria time 40

radius-server dead-criteria tries 42

radius-server deadtime (BNG) 44

radius-server key (BNG) 45

System Security Command Reference for Cisco NCS 5000 Series Routers

iii

radius-server retransmit (BNG) 47

radius-server timeout (BNG) 48

radius source-interface (BNG) 49

secret 51

server (RADIUS) 53

server (TACACS+) 55

server-private (RADIUS) 56

server-private (TACACS+) 58

show aaa (XR-VM) 60

show aaa accounting 65

show aaa password-policy 67

show radius 69

show radius accounting 71

show radius authentication 73

show radius dead-criteria 75

show radius server-groups 77

show tacacs 80

show tacacs server-groups 82

show user 84

show aaa user-group 88

show tech-support aaa 89

single-connection 90

tacacs-server host 91

tacacs-server key 93

tacacs-server timeout 95

tacacs-server ipv4 96

tacacs source-interface 98

task 100

taskgroup 102

timeout (TACACS+) 104

timeout login response 105

usergroup 106

username 108

users group 112

System Security Command Reference for Cisco NCS 5000 Series Routers

Contents

CHAPTER 2

Keychain Management Commands 115

accept-lifetime 116

accept-tolerance 118

cryptographic-algorithm 119

key (key chain) 121

key chain (key chain) 122

key-string (keychain) 123

send-lifetime 125

show key chain 127

CHAPTER 3

Management Plane Protection Commands 129

address ipv4 (MPP) 130

address ipv6 (MPP) 132

allow 133

control-plane 135

inband 136

interface (MPP) 137

management-plane 139

show mgmt-plane 140

CHAPTER 4

Secure Shell Commands 143

clear ssh 145

clear netconf-yang agent session 147

netconf-yang agent ssh 148

sftp 149

sftp (Interactive Mode) 152

show netconf-yang clients 155

show netconf-yang statistics 157

show ssh 159

show ssh session details 162

ssh 164

ssh client knownhost 166

ssh client source-interface 168

ssh server 170

System Security Command Reference for Cisco NCS 5000 Series Routers

Contents

ssh server logging 172

ssh server rate-limit 173

ssh server session-limit 174

ssh server v2 175

ssh server netconf 176

ssh timeout 177

System Security Command Reference for Cisco NCS 5000 Series Routers

Contents

Preface

This preface contains these sections:

•Changes to This Document, page vii

•Obtaining Documentation and Submitting a Service Request, page vii

Changes to This Document

This table lists the technical changes made to this document since it was first released.

Table 1: Changes to This Document

SummaryDate

Initial release of this document.December 2015

Republished with documentation updates for Cisco

IOS XR Release 6.2.1 features.

March 2017

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service

request, and gathering additional information, see What's New in Cisco Product Documentation.

To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's

New in Cisco Product Documentation RSS feed. RSS feeds are a free service.

System Security Command Reference for Cisco NCS 5000 Series Routers

vii

System Security Command Reference for Cisco NCS 5000 Series Routers

viii

Preface

Obtaining Documentation and Submitting a Service Request

Authentication, Authorization, and Accounting

Commands

This module describes the commands used to configure authentication, authorization, and accounting (AAA)

services.

For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA

Services chapter in the System Security Configuration Guide for Cisco NCS 5000 Series Routers.

Currently, only default VRF is supported. VPNv4, VPNv6 and VPN routing and forwarding (VRF) address

families will be supported in a future release.

Note

•aaa accounting, page 4

•aaa accounting system default, page 6

•aaa accounting update, page 8

•aaa authentication (XR-VM), page 10

•aaa authorization (XR-VM), page 12

•aaa default-taskgroup, page 15

•aaa group server radius, page 16

•aaa group server tacacs+, page 18

•aaa password-policy, page 20

•accounting (line), page 23

•authorization (line), page 25

•description (AAA), page 27

•group (AAA), page 28

•inherit taskgroup, page 30

•inherit usergroup, page 32

•key (TACACS+), page 34

System Security Command Reference for Cisco NCS 5000 Series Routers

•login authentication, page 36

•password (AAA), page 38

•radius-server dead-criteria time, page 40

•radius-server dead-criteria tries, page 42

•radius-server deadtime (BNG), page 44

•radius-server key (BNG), page 45

•radius-server retransmit (BNG), page 47

•radius-server timeout (BNG), page 48

•radius source-interface (BNG), page 49

•secret, page 51

•server (RADIUS), page 53

•server (TACACS+), page 55

•server-private (RADIUS), page 56

•server-private (TACACS+), page 58

•show aaa (XR-VM), page 60

•show aaa accounting, page 65

•show aaa password-policy, page 67

•show radius, page 69

•show radius accounting, page 71

•show radius authentication, page 73

•show radius dead-criteria, page 75

•show radius server-groups, page 77

•show tacacs, page 80

•show tacacs server-groups, page 82

•show user, page 84

•show aaa user-group, page 88

•show tech-support aaa , page 89

•single-connection, page 90

•tacacs-server host, page 91

•tacacs-server key, page 93

•tacacs-server timeout, page 95

•tacacs-server ipv4, page 96

•tacacs source-interface, page 98

System Security Command Reference for Cisco NCS 5000 Series Routers

Authentication, Authorization, and Accounting Commands

Other manuals for NCS 5000 Series

Table of contents

Other Cisco Network Router manuals

Cisco

Cisco ME 3400G-2CS - Ethernet Access Switch User manual

Cisco

Cisco IAD2431-1T1E1 Installation guide

Cisco

Cisco 7200 Series Original instructions

Cisco

Cisco ASR-920-20SZ-M Operating and safety instructions

Cisco

Cisco ASR 903 Instruction Manual

Cisco

Cisco OL-4387-02 User manual

Cisco

Cisco 828 User manual

Cisco

Cisco RVS4000 - Gigabit Security Router User manual

Cisco

Cisco Linksys E-Series Installation guide

Cisco

Cisco Linksys RVL200 User manual

Cisco

Cisco Linksys WET54G-EU v3 User manual

Cisco

Cisco 3640 Series User manual

Cisco

Cisco 7301 Series Operator's manual

Cisco

Cisco Card Cage and Backplane 7513-MX Guide

Cisco

Cisco 7201 User manual

Cisco

Cisco 8011 User manual

Cisco

Cisco 7000 and 7507 LED Board MAS-7KLED Guide

Cisco

Cisco 4451-X Manual

Cisco

Cisco 1600 series Manual

Cisco

Cisco Catalyst 2928 User manual

Cisco

Cisco RV340 Series Quick start guide

Cisco

Cisco 3700 series Manual

Cisco

Cisco ASR 1000 Series User manual

Cisco

Cisco 910 User manual

Popular Network Router manuals by other brands

Allnet

Allnet ALL0333AU user guide

HomeSeer

HomeSeer HT-SEL Getting started guide

Sercomm

Sercomm Genesis OC3505D Quick installation guide

Billion

Billion BIPAC 5102 Series user manual

TP-Link

TP-Link TD-8817 QIG

Motorola

Motorola MR1900 user guide

Digi

Digi IX14 user guide

XAVi

XAVi X8821e user manual

BEC

BEC 6200WZL Quick installation guide

MikroTik

MikroTik hAP ac3 Series quick start

Korenix

Korenix JetNet 5428G Series user manual

NETGEAR

NETGEAR FS526T - Switch installation guide

Korenix

Korenix JetNet 5710G Series user manual

Automated Logic

Automated Logic ZN551 Technical instructions

EnGenius

EnGenius ESR-9710 quick start guide

LevelOne

LevelOne FBR-1416 user manual

Dynacord

Dynacord Promatrix 6000 Operation manual

Lorex

Lorex F5D8230-4 Guide