Cisco MDS 9000 Series User manual

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CONTENTS

Preface xvii

PREFACE

Audience xvii

Document Conventions xvii

Related Documentation xviii

Obtaining Documentation and Submitting a Service Request xviii

New and Changed Information 1

CHAPTER 1

Security Overview 3

CHAPTER 2

FIPS 3

Users and Common Roles 4

RADIUS and TACACS+ 4

IP ACLs 4

PKI 5

SSH Services 5

IPsec 5

FC-SP and DHCHAP 5

Port Security 6

Fibre Channel Common Transport Management Server Query 6

Fabric Binding 6

TrustSec Fibre Channel Link Encryption 6

Configuring FIPS 7

CHAPTER 3

Configuration Guidelines 7

Enabling FIPS Mode 8

Displaying FIPS Status 8

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

iii

FIPS Self-Tests 8

Common Roles 11

CHAPTER 4

Role-Based Authorization 11

About Roles 11

Configuring Roles and Profiles 12

Configuring Rules and Features for Each Role 12

Rule Changes Between SAN-OS Release 3.3(1c) and NX-OS Release 4.2(1a) Affect Role

Behavior 14

Modifying Profiles 14

Configuring the VSAN Policy 15

Modifying the VSAN Policy 15

Role Distributions 16

About Role Databases 16

Locking the Fabric 17

Committing Role-Based Configuration Changes 17

Discarding Role-Based Configuration Changes 17

Enabling Role-Based Configuration Distribution 18

Clearing Sessions 18

Database Merge Guidelines 18

Displaying Role-Based Information 19

Displaying Roles When Distribution is Enabled 20

Configuring Common Roles 22

Mapping of CLI Operations to SNMP 23

Configuring User Accounts 24

Guidelines on Creating Users 24

Checking Password Strength 25

Characteristics of Strong Passwords 25

Configuring Users 25

Logging Out Users 26

Displaying User Account Information 27

Default Settings 27

Configuring Security Features on an External AAA Server 29

CHAPTER 5

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Contents

Switch Management Security 30

CLI Security Options 30

SNMP Security Options 30

Switch AAA Functionalities 31

Authentication 31

Authorization 31

Accounting 31

Remote AAA Services 32

Remote Authentication Guidelines 32

Server Groups 32

AAA Service Configuration Options 32

Error-Enabled Status 33

AAA Server Monitoring 34

Authentication and Authorization Process 34

Configuring Role-based Authorization on TACACS+ Server 35

Configuring Fallback Mechanism for Authentication 37

Verifying Authorization Profile 38

Testing Authorization 38

Configuring Login Parameters 39

Configuring AAA Server Monitoring Parameters Globally 41

Configuring LDAP 42

LDAP Authentication and Authorization 42

Guidelines and Limitations for LDAP 43

Prerequisites for LDAP 43

Default Settings 44

Enabling LDAP 44

Configuring LDAP Server Hosts 45

Configuring the RootDN for an LDAP Server 45

Configuring LDAP Server Groups 46

Configuring the Global LDAP Timeout Interval 48

Configuring the Timeout Interval for an LDAP Server 48

Configuring the Global LDAP Server Port 49

Configuring TCP Ports 50

Configuring LDAP Search Maps 50

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Contents

Configuring the LDAP Dead-Time Interval 51

Configuring AAA Authorization on LDAP Servers 52

Disabling LDAP 53

Configuration Examples for LDAP 53

Configuring RADIUS Server Monitoring Parameters 54

About RADIUS Server Default Configuration 54

Setting the RADIUS Server IPv4 Address 54

Setting the RADIUS Server IPv6 Address 55

Setting the RADIUS Server DNS name 56

About the Default RADIUS Server Encryption Type and Preshared Key 57

Configuring the Default RADIUS Server Encryption Type and Preshared Key 57

Setting the RADIUS Server Timeout Interval 57

Setting the Default RADIUS Server Timeout Interval and Retransmits 58

Configuring RADIUS Server Monitoring Parameters 58

Configuring the Test Idle Timer 58

Configuring Test User Name 59

Configuring the Dead Timer 60

About RADIUS Servers 60

Configuring the Test Idle Timer 60

Configuring Test User Name 61

About Validating a RADIUS Server 61

Sending RADIUS Test Messages for Monitoring 61

Allowing Users to Specify a RADIUS Server at Login 62

About Vendor-Specific Attributes 62

VSA Format 63

Specifying SNMPv3 on AAA Servers 63

Displaying RADIUS Server Details 64

Displaying RADIUS Server Statistics 64

One-Time Password Support 65

Recovering the Administrator Password 65

Using the CLI with Network-Admin Privileges 65

Power Cycling the Switch 66

Configuring TACACS+ Server Monitoring Parameters 67

About TACACS+ 68

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Contents

About TACACS+ Server Default Configuration 68

About the Default TACACS+ Server Encryption Type and Preshared Key 68

Enabling TACACS+ 68

Setting the TACACS+ Server IPv4 Address 69

Setting the TACACS+ Server IPv6 Address 70

Setting the TACACS+ Server DNS name 70

Setting the Global Secret Key 71

Setting the Default TACACS+ Server Timeout Interval and Retransmits 72

Setting the Timeout Value 72

About TACACS+ Servers 72

Configuring TACACS+ Server Monitoring Parameters 73

Configuring the TACACS+ Test Idle Timer 73

Configuring Test Username 73

Configuring the Dead Timer 74

Sending TACACS+ Test Messages for Monitoring 75

Password Aging Notification through TACACS+ Server 75

About Validating a TACACS+ Server 76

Periodically Validating a TACACS+ Server 76

About Users Specifying a TACACS+ Server at Login 76

Allowing Users to Specify a TACACS+ Server at Login 76

Defining Roles on the Cisco Secure ACS 5.x GUI 77

Defining Custom Attributes for Roles 77

Supported TACACS+ Server Parameters 77

Displaying TACACS+ Server Details 78

Clearing TACACS+ Server Statistics 79

Configuring Server Groups 79

About Configuring Radius Server Groups 80

About Configuring TACACS+ Server Groups 81

About Bypassing a Nonresponsive Server 82

AAA Server Distribution 82

Enabling AAA RADIUS Server Distribution 83

Enabling AAA TACACS+ Server Distribution 83

Starting a Distribution Session on a Switch 84

Displaying the Session Status 84

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

vii

Contents

Displaying the Pending Configuration to be Distributed 84

Committing the RADIUS Distribution 85

Committing the TACACS+ Distribution 85

Discarding the RADIUS Distribution Session 85

Discarding the TACACS+ Distribution Session 86

Clearing Sessions 86

Merge Guidelines for RADIUS and TACACS+ Configurations 86

CHAP Authentication 87

Enabling CHAP Authentication 88

MSCHAP Authentication 88

About Enabling MSCHAP 88

Enabling MSCHAP Authentication 89

Enabling MSCHAPv2 Authentication 89

Local AAA Services 90

Disabling AAA Authentication 91

Displaying AAA Authentication 91

Configuring Accounting Services 91

Displaying Accounting Configuration 92

Clearing Accounting Logs 93

Configuring Cisco Access Control Servers 93

Default Settings 97

Configuring IPv4 and IPv6 Access Control Lists 99

CHAPTER 6

About IPv4 and IPv6 Access Control Lists 100

IPv4-ACL and IPv6-ACL Configuration Guidelines 100

About Filter Contents 101

Protocol Information 101

Address Information 101

Port Information 102

ICMP Information 103

ToS Information 104

Creating IPv4-ACLs or IPv6-ACLs 104

Creating IPv4-ACLs 104

Creating IPv6-ACLs 105

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

viii

Contents

Defining IPv4-ACLs 105

Defining IPv6-ACLs 106

Operand and port options for an IPv4-ACL 106

Operand and port options for an IPv6-ACL 107

Adding IP Filters to an Existing IPv4-ACL 107

Adding IP Filters to an Existing IPv6-ACL 108

Removing IP Filters from an Existing IPv4-ACL 108

Removing IP Filters from an Existing IPv6-ACL 109

Verifying the IPv4-ACL or IPv6-ACL Configuration 109

Reading the IP-ACL Log Dump 110

Applying an IP-ACL to an Interface 111

Applying an IPv6-ACL to an Interface 112

Applying an IP-ACL to mgmt0 113

Verifying Interface IP-ACL Configuration 113

Open IP Ports on Cisco MDS 9000 Series Platforms 114

IP-ACL Counter Cleanup 115

Configuring Certificate Authorities and Digital Certificates 117

CHAPTER 7

About CAs and Digital Certificates 117

Purpose of CAs and Digital Certificates 117

Trust Model, Trust Points, and Identity CAs 118

RSA Key-Pairs and Identity Certificates 118

Multiple Trusted CA Support 119

PKI Enrollment Support 119

Manual Enrollment Using Cut-and-Paste Method 120

Multiple RSA Key-Pair and Identity CA Support 120

Peer Certificate Verification 120

CRL Downloading, Caching, and Checking Support 120

Import and Export Support for Certificates and Associated Key-Pairs 121

Configuring CAs and Digital Certificates 121

Configuring the Host Name and IP Domain Name 121

Generating an RSA Key-Pair 122

Creating a Trust Point CA Association 122

Authenticating the CA 123

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Contents

Configuring Certificate Revocation Checking Methods 124

Generating Certificate Requests 125

Installing Identity Certificates 126

Saving Your Configuration 127

Ensuring Trust Point Configurations Persist Across Reboots 127

Monitoring and Maintaining CA and Certificates Configuration 127

Exporting and Importing Identity Information to PKCS12 Format 127

Exporting and Importing Identity Information from PKCS12 Format 128

Configuring a CRL 129

Deleting Certificates from the CA Configuration 129

Deleting RSA Key-Pairs from Your Switch 130

Displaying Key-Pair and CA Information 131

Example Configurations 131

Configuring Certificates on the MDS Switch 131

Downloading a CA Certificate 134

Requesting an Identity Certificate 138

Revoking a Certificate 145

Generating and Publishing the CRL 147

Downloading the CRL 149

Importing the CRL 151

Maximum Limits 153

Default Settings 154

Configuring SSH Services 155

CHAPTER 8

SSH Services 155

Generating the SSH Server Key Pair 156

Specifying the SSH Key 157

Specifying the SSH Key in OpenSSH 157

Specifying the SSH Key in IETF SECSH 157

Specifying the SSH Key in Public Key Certificate in PEM 158

Overwriting a Generated Key Pair 158

Configuring the Maximum Number of SSH Login Attempts 159

Clearing SSH Hosts 160

Enabling SSH or Telnet Service 161

Cisco MDS 9000 Series Security Configuration Guide, Release 8.x

Contents

Other manuals for MDS 9000 Series

Table of contents

Other Cisco Switch manuals

Cisco

Cisco Nexus 9000 Series User manual

Cisco

Cisco WS C4224V 8FXS - 200Mbps Ethernet Switch User manual

Cisco

Cisco IGX 8400 Series Operator's manual

Cisco

Cisco 550XG series User manual

Cisco

Cisco VCO/4K User manual

Cisco

Cisco Nexus 9348GC-FX3 Manual

Cisco

Cisco IE-3000-8TC Installation manual

Cisco

Cisco Meraki MS225 Series Parts list manual

Cisco

Cisco CSS5 SSL K9 - Syst. CSS11500 SSL MODULE Manual

Cisco

Cisco SG 300-10 User manual

Cisco

Cisco Cisco mds 9216 - fabric switch User manual

Cisco

Cisco 3750 - Catalyst EMI Switch Installation manual

Cisco

Cisco Catalyst 2960-XR User manual

Cisco

Cisco Nexus 9372PX User manual

Cisco

Cisco 2950SX 48 SI - Catalyst Switch User manual

Cisco

Cisco Catalyst 2960-X User manual

Cisco

Cisco Catalyst 3750-X Series User manual

Cisco

Cisco Catalyst 2960-L User manual

Cisco

Cisco Aironet 350 Series Instruction Manual

Cisco

Cisco Nexus 2000 Series Manual

Cisco

Cisco CBS 220 Series User manual

Cisco

Cisco MGX 8850 Operating and maintenance instructions

Cisco

Cisco 2960 8TC - Catalyst Switch User manual

Cisco

Cisco Network Analysis Module 6000 Operating and maintenance instructions

Popular Switch manuals by other brands

URC

URC Total Control MFS-8 installation manual

Azbil

Azbil HPQ-D11 user manual

Sony

Sony DFS-900M operating instructions

SICK

SICK i17S operating instructions

F&F

F&F SZR-277 quick start guide

Shure

Shure UAMS/BK user guide

Dräger

Dräger X-zone Switch Off Instructions for use

Asco

Asco Joucomatic 349 Series manual

BT Mini Hub user guide

D-Link

D-Link DES-1226G manual

Johnson Controls

Johnson Controls FS80-C installation instructions

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Configuration guide

MicroNet

MicroNet SP1200A user manual

Ruijie

Ruijie RG-PF2920 Series Hardware installation and reference guide

Altinex

Altinex DA1914SX user guide

MiLAN

MiLAN MIL-SM2401M user guide

RJM

RJM MASTERMIND PBC/6X user manual

Atlas

Atlas MMK-KVM8 owner's manual