Cisco Catalyst 2960-XR User manual

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS

Release 15.0(2)EX1

First Published: May 07, 2013

Last Modified: August 08, 2013

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Text Part Number: OL-29434-01

CONTENTS

Preface 19

Document Conventions 19

Related Documentation 21

Obtaining Documentation and Submitting a Service Request 21

CHAPTER 1

Using the Command-Line Interface 1

Information About Using the Command-Line Interface 1

Command Modes 1

Using the Help System 3

Understanding Abbreviated Commands 4

No and default Forms of Commands 4

CLI Error Messages 4

Configuration Logging 5

How to Use the CLI to Configure Features 5

Configuring the Command History 5

Changing the Command History Buffer Size 6

Recalling Commands 6

Disabling the Command History Feature 7

Enabling and Disabling Editing Features 7

Editing Commands through Keystrokes 8

Editing Command Lines That Wrap 9

Searching and Filtering Output of show and more Commands 10

Accessing the CLI through a Console Connection or through Telnet 11

CHAPTER 2

Security Features Overview 13

CHAPTER 3

Preventing Unauthorized Access 19

Finding Feature Information 19

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

OL-29434-01 iii

Preventing Unauthorized Access 19

CHAPTER 4

Controlling Switch Access with Passwords and Privilege Levels 21

Finding Feature Information 21

Restrictions for Controlling Switch Access with Passwords and Privileges 21

Information About Passwords and Privilege Levels 22

Default Password and Privilege Level Configuration 22

Additional Password Security 22

Password Recovery 23

Terminal Line Telnet Configuration 23

Username and Password Pairs 23

Privilege Levels 24

How to Control Switch Access with Passwords and Privilege Levels 24

Setting or Changing a Static Enable Password 24

Protecting Enable and Enable Secret Passwords with Encryption 25

Disabling Password Recovery 27

Setting a Telnet Password for a Terminal Line 28

Configuring Username and Password Pairs 30

Setting the Privilege Level for a Command 31

Changing the Default Privilege Level for Lines 32

Logging into and Exiting a Privilege Level 33

Monitoring Switch Access 34

Configuration Examples for Setting Passwords and Privilege Levels 35

Example: Setting or Changing a Static Enable Password 35

Example: Protecting Enable and Enable Secret Passwords with Encryption 35

Example: Setting a Telnet Password for a Terminal Line 35

Example: Setting the Privilege Level for a Command 35

CHAPTER 5

Configuring TACACS+ 37

Finding Feature Information 37

Prerequisites for Controlling Switch Access with Terminal Access Controller Access Control

System Plus (TACACS+) 37

Information About TACACS+ 39

TACACS+ and Switch Access 39

TACACS+ Overview 39

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

iv OL-29434-01

Contents

TACACS+ Operation 41

Method List Description 42

TACACS+ Configuration Options 42

TACACS+ Login Authentication 42

TACACS+ Authorization for Privileged EXEC Access and Network Services 42

TACACS+ Accounting 43

Default TACACS+ Configuration 43

How to Configure TACACS+ 43

Identifying the TACACS+ Server Host and Setting the Authentication Key 43

Configuring TACACS+ Login Authentication 45

Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 47

Starting TACACS+ Accounting 48

Establishing a Session with a Router if the AAA Server is Unreachable 49

Monitoring TACACS+ 50

CHAPTER 6

Configuring RADIUS 51

Finding Feature Information 51

Prerequisites for Controlling Switch Access with RADIUS 51

Restrictions for Controlling Switch Access with RADIUS 52

Information about RADIUS 53

RADIUS and Switch Access 53

RADIUS Overview 53

RADIUS Operation 54

RADIUS Change of Authorization 55

Change-of-Authorization Requests 55

RFC 5176 Compliance 56

CoA Request Response Code 57

Session Identification 57

CoA ACK Response Code 58

CoA NAK Response Code 58

CoA Request Commands 58

Session Reauthentication 58

Session Reauthentication in a Switch Stack 59

Session Termination 59

CoA Disconnect-Request 60

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

OL-29434-01 v

Contents

CoA Request: Disable Host Port 60

CoA Request: Bounce-Port 60

Stacking Guidelines for Session Termination 61

Stacking Guidelines for CoA-Request Bounce-Port 61

Stacking Guidelines for CoA-Request Disable-Port 61

Default RADIUS Configuration 62

RADIUS Server Host 62

RADIUS Login Authentication 62

AAA Server Groups 63

AAA Authorization 63

RADIUS Accounting 63

Vendor-Specific RADIUS Attributes 64

Vendor-Proprietary RADIUS Server Communication 64

How to Configure RADIUS 65

Identifying the RADIUS Server Host 65

Configuring RADIUS Login Authentication 66

Defining AAA Server Groups 68

Configuring RADIUS Authorization for User Privileged Access and Network Services 71

Starting RADIUS Accounting 72

Configuring Settings for All RADIUS Servers 73

Configuring the Switch to Use Vendor-Specific RADIUS Attributes 75

Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 75

Configuring CoA on the Switch 77

Monitoring CoA Functionality 79

Configuration Examples for Controlling Switch Access with RADIUS 79

Examples: Identifying the RADIUS Server Host 79

Examples: Configuring the Switch to Use Vendor-Specific RADIUS Attributes 80

Example: Configuring the Switch for Vendor-Proprietary RADIUS Server

Communication 80

CHAPTER 7

Configuring Local Authentication and Authorization 81

Finding Feature Information 81

How to Configure Local Authentication and Authorization 81

Configuring the Switch for Local Authentication and Authorization 81

Monitoring Local Authentication and Authorization 83

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

vi OL-29434-01

Contents

CHAPTER 8

Configuring Secure Shell (SSH) 85

Finding Feature Information 85

Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol

(SCP) 85

Restrictions for Configuring the Switch for SSH 86

Information about SSH 86

SSH and Switch Access 86

SSH Servers, Integrated Clients, and Supported Versions 87

SSH Configuration Guidelines 87

Secure Copy Protocol Overview 88

Secure Copy Protocol Concepts 88

How to Configure SSH 89

Setting Up the Switch to Run SSH 89

Configuring the SSH Server 90

Monitoring the SSH Configuration and Status 92

CHAPTER 9

Configuring Secure Socket Layer HTTP 93

Finding Feature Information 93

Information about Secure Sockets Layer (SSL) HTTP 93

Certificate Authority Trustpoints 94

CipherSuites 95

Default SSL Configuration 96

SSL Configuration Guidelines 96

Secure HTTP Servers and Clients Overview 96

How to Configure Secure HTTP Servers and Clients 96

Configuring a CA Trustpoint 96

Configuring the Secure HTTP Server 99

Configuring the Secure HTTP Client 102

How to Configure Secure HTTP Servers and Clients 103

Monitoring Secure HTTP Server and Client Status 103

CHAPTER 10

Configuring IPv4 ACLs 105

Finding Feature Information 105

Prerequisites for Configuring Network Security with ACLs 105

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

OL-29434-01 vii

Contents

Restrictions for Configuring Network Security with ACLs 105

Information about Network Security with ACLs 107

ACL Overview 107

Access Control Entries 107

ACL Supported Types 107

Supported ACLs 108

ACL Precedence 108

Port ACLs 109

Router ACLs 110

VLAN Maps 110

ACEs and Fragmented and Unfragmented Traffic 111

Example: ACEs and Fragmented and Unfragmented Traffic 111

ACLs and Switch Stacks 112

Active Switch and ACL Functions 112

Stack Member and ACL Functions 112

Active Switch Failure and ACLs 112

Standard and Extended IPv4 ACLs 113

IPv4 ACL Switch Unsupported Features 113

Access List Numbers 113

Numbered Standard IPv4 ACLs 114

Numbered Extended IPv4 ACLs 114

Named IPv4 ACLs 115

ACL Logging 116

Hardware and Software Treatment of IP ACLs 116

VLAN Map Configuration Guidelines 117

VLAN Maps with Router ACLs 117

VLAN Maps and Router ACL Configuration Guidelines 118

VACL Logging 118

Time Ranges for ACLs 119

IPv4 ACL Interface Considerations 119

How to Configure ACLs 120

Configuring IPv4 ACLs 120

Creating a Numbered Standard ACL 120

Creating a Numbered Extended ACL 122

Creating Named Standard ACLs 125

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

viii OL-29434-01

Contents

Creating Extended Named ACLs 126

Configuring Time Ranges for ACLs 128

Applying an IPv4 ACL to a Terminal Line 129

Applying an IPv4 ACL to an Interface 130

Creating Named MAC Extended ACLs 132

Applying a MAC ACL to a Layer 2 Interface 133

Configuring VLAN Maps 135

Creating a VLAN Map 136

Applying a VLAN Map to a VLAN 138

Monitoring IPv4 ACLs 139

Configuration Examples for ACLs 140

Examples: Using Time Ranges with ACLs 140

Examples: Including Comments in ACLs 141

IPv4 ACL Configuration Examples 142

ACLs in a Small Networked Office 142

Examples: ACLs in a Small Networked Office 143

Example: Numbered ACLs 143

Examples: Extended ACLs 143

Examples: Named ACLs 144

Examples: Time Range Applied to an IP ACL 145

Examples: Commented IP ACL Entries 145

Examples: ACL Logging 145

Configuration Examples for ACLs and VLAN Maps 147

Example: Creating an ACL and a VLAN Map to Deny a Packet 147

Example: Creating an ACL and a VLAN Map to Permit a Packet 147

Example: Default Action of Dropping IP Packets and Forwarding MAC Packets 147

Example: Default Action of Dropping MAC Packets and Forwarding IP Packets 148

Example: Default Action of Dropping All Packets 148

Configuration Examples for Using VLAN Maps in Your Network 149

Example: Wiring Closet Configuration 149

Example: Restricting Access to a Server on Another VLAN 150

Example: Denying Access to a Server on Another VLAN 150

Configuration Examples of Router ACLs and VLAN Maps Applied to VLANs 151

Example: ACLs and Switched Packets 151

Example: ACLs and Bridged Packets 151

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

OL-29434-01 ix

Contents

Example: ACLs and Routed Packets 152

Example: ACLs and Multicast Packets 153

CHAPTER 11

Configuring IPv6 ACLs 155

Finding Feature Information 155

Information about IPv6 ACLs 155

Switch Stacks and IPv6 ACLs 156

Interactions with Other Features and Switches 156

Restrictions for IPv6 ACLs 156

Default Configuration for IPv6 ACLs 157

How to Configure IPv6 ACLs 157

How to Attach an IPv6 ACL to an Interface 161

Monitoring IPv6 ACLs 162

CHAPTER 12

Configuring DHCP 165

Finding Feature Information 165

Information About DHCP 165

DHCP Server 165

DHCP Relay Agent 165

DHCP Snooping 166

Option-82 Data Insertion 167

Cisco IOS DHCP Server Database 170

DHCP Snooping Binding Database 170

DHCP Snooping and Switch Stacks 171

How to Configure DHCP Features 172

Default DHCP Snooping Configuration 172

DHCP Snooping Configuration Guidelines 173

Configuring the DHCP Server 173

DHCP Server and Switch Stacks 173

Configuring the DHCP Relay Agent 173

Specifying the Packet Forwarding Address 174

Prerequisites for Configuring DHCP Snooping and Option 82 176

Enabling DHCP Snooping and Option 82 177

Enabling the Cisco IOS DHCP Server Database 180

Monitoring DHCP Snooping Information 180

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1

xOL-29434-01

Contents

Other manuals for Catalyst 2960-XR

Table of contents

Other Cisco Switch manuals

Cisco

Cisco CSS-11051-AC Manual

Cisco

Cisco Catalyst 3750 Metro Installation manual

Cisco

Cisco SRW248G4P User manual

Cisco

Cisco MDS 9124V-K9 Manual

Cisco

Cisco MGX 8850 Operating and maintenance instructions

Cisco

Cisco 7000 User manual

Cisco

Cisco Nexus 1000V User manual

Cisco

Cisco Catalyst 1800 Guide User manual

Cisco

Cisco 6503 - Catalyst Firewall Security Sys User manual

Cisco

Cisco Meraki MS120-8 Series User manual

Cisco

Cisco MDS 9396S Manual

Cisco

Cisco Nexus 5000 Series User manual

Cisco

Cisco SD208T-NA Instruction Manual

Cisco

Cisco Catalyst 9500 Series Manual

Cisco

Cisco 3020 - Cisco Catalyst Blade Switch User manual

Cisco

Cisco Linksys EZXS55W User manual

Cisco

Cisco AJ732A - MDS 9134 Fabric Switch Instruction Manual

Cisco

Cisco MEM-S1-128MB Installation and operation manual

Cisco

Cisco Sx350 Instruction Manual

Cisco

Cisco WS C4224V 8FXS - 200Mbps Ethernet Switch User manual

Cisco

Cisco LightStream 100 User manual

Cisco

Cisco Catalyst 4500 Series Installation guide

Cisco

Cisco MDS 9396T Instruction Manual

Cisco

Cisco Catalyst C9200L-24PXG-4X-E Manual

Popular Switch manuals by other brands

URC

URC Total Control MFS-8 installation manual

Azbil

Azbil HPQ-D11 user manual

Sony

Sony DFS-900M operating instructions

SICK

SICK i17S operating instructions

F&F

F&F SZR-277 quick start guide

Shure

Shure UAMS/BK user guide

Dräger

Dräger X-zone Switch Off Instructions for use

Asco

Asco Joucomatic 349 Series manual

BT Mini Hub user guide

D-Link

D-Link DES-1226G manual

Johnson Controls

Johnson Controls FS80-C installation instructions

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Configuration guide

MicroNet

MicroNet SP1200A user manual

Ruijie

Ruijie RG-PF2920 Series Hardware installation and reference guide

Altinex

Altinex DA1914SX user guide

MiLAN

MiLAN MIL-SM2401M user guide

RJM

RJM MASTERMIND PBC/6X user manual

Atlas

Atlas MMK-KVM8 owner's manual