Administration Guide vA1(7), Cisco ACE 4700 Series Application Control Engine Appliance
Enabling Remote Access to the ACE
Downloads: This chapterpdf (PDF - 261.0KB) The complete bookPDF (PDF - 6.38MB) | Feedback

Enabling Remote Access to the ACE

Table Of Contents

Enabling Remote Access to the ACE

Remote Access Configuration Quick Start

Configuring Remote Network Management Traffic Services

Creating and Configuring a Remote Management Class Map

Defining a Class Map Description

Defining Remote Network Management Protocol Match Criteria

Creating a Layer 3 and Layer 4 Remote Access Policy Map

Creating a Layer 3 and Layer 4 Policy Map for Network Management Traffic Received by the ACE

Defining a Layer 3 and Layer 4 Policy Map Description

Specifying a Layer 3 and Layer 4 Traffic Class With the Traffic Policy

Defining Layer 3 and Layer 4 Management Traffic Policy Actions

Applying a Service Policy

Configuring Telnet Management Sessions

Configuring SSH Management Sessions

Configuring Maximum Number of SSH Sessions

Generating SSH Host Key Pairs

Terminating an Active User Session

Enabling ICMP Messages to the ACE

Directly Accessing a User Context Through SSH

Example of a Remote Access Configuration

Viewing Session Information

Showing Telnet Session Information

Showing SSH Session Information

Showing SSH Session Information

Showing SSH Key Details


Enabling Remote Access to the ACE


This chapter describes how to configure remote access to the Cisco 4700 Series Application Control Engine (ACE) appliance by establishing a remote connection by using the Secure Shell (SSH) or Telnet protocols. It also describes how to configure the ACE to provide direct access to a user context from SSH. This chapter also covers how to configure the ACE to receive ICMP messages from a host.

This chapter includes the following major sections:

Remote Access Configuration Quick Start

Configuring Remote Network Management Traffic Services

Configuring Telnet Management Sessions

Configuring SSH Management Sessions

Terminating an Active User Session

Enabling ICMP Messages to the ACE

Directly Accessing a User Context Through SSH

Example of a Remote Access Configuration

Viewing Session Information


Note For information about how to make a direct connection using a dedicated terminal attached to the Console port on the front of the ACE, configure terminal display attributes, and configure terminal line settings for accessing the ACE by console or virtual terminal connection, see Chapter 1, Setting Up the ACE.


Remote Access Configuration Quick Start

Table 2-1 provides a quick overview of the steps required to configure remote network management access for the ACE. Each step includes the CLI command required to complete the task.

Table 2-1 Remote Network Management Configuration
Quick Start 

Task and Command Example

1. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the desired context. If necessary, log directly in to, or change to, the correct context.

host1/Admin# changeto C1
host1/C1# 

The rest of the examples in this table use the Admin context, unless otherwise specified. For details on creating contexts, see the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide.

2. Enter configuration mode.

host1/Admin# config
Enter configuration commands, one per line. End with CNTL/Z
host1/Admin(config)#

3. Create a class map that permits network management traffic to be received by the ACE based on the network management protocol (SSH or Telnet) and client source IP address.

host1/Admin(config)# class-map type management match-all 
SSH-ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# match protocol ssh source-address 
172.16.10.0 255.255.255.254
host1/Admin(config-cmap-mgmt)# exit
host1/Admin(config)# 
host1/Admin(config)# class-map type management match-all 
TELNET-ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# match protocol telnet 
source-address 172.16.10.0 255.255.255.254
host1/Admin(config-cmap-mgmt)# exit
host1/Admin(config)# 

4. Configure a policy map that activates the SSH and Telnet management protocol classifications.

host1/Admin(config)# policy-map type management first-match 
REMOTE_MGMT_ALLOW_POLICY
host1/Admin(config-pmap-mgmt)# class SSH-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit
host1/Admin(config-pmap-mgmt)# class TELNET-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit
host1/Admin(config-pmap-mgmt)# exit
host1/Admin(config)# 

5. Attach the traffic policy to a single VLAN interface or globally to all VLAN interfaces in the same context. For example, to specify an interface VLAN and apply the remote management policy map to the VLAN, enter:

host1/Admin(config)# interface vlan 50
host1/Admin(config-if)# ip address 172.16.1.100 255.255.0.0
host1/Admin(config-if)# service-policy input 
REMOTE_MGMT_ALLOW_POLICY
host1/Admin(config-if)# exit

6. (Optional) Configure the maximum number of Telnet sessions allowed for each context.

host1/Admin(config)# telnet maxsessions 3

7. (Optional) Configure the maximum number of SSH sessions allowed for each context.

host1/Admin(config)# ssh maxsessions 3

8. If you have global administrator privileges, use the ssh key command to generate the SSH private key and the corresponding public key for use by the SSH server. There is only one host-key pair. For example, to generate an RSA1 key pair in the Admin context, enter:

host1/Admin(config)# ssh key rsa1 1024
generating rsa1 key
.....
generated rsa1 key

9. (Optional) Save your configuration changes to Flash memory.

host1/Admin(config)# exit
host1/Admin# copy running-config startup-config

Configuring Remote Network Management Traffic Services

You configure rules for remote access to the ACE through the use of class maps, policy maps, and service policies. The following items summarize the role of each function in configuring remote network management access to the ACE:

Class map—Provides the remote network traffic match criteria to permit traffic based on:

Remote access network management protocols (SSH, Telnet, or ICMP)

Client source IP address

Policy map—Enables remote network management access for a traffic classification that matches the criteria listed in the class map.

Service policy—Activates the policy map and attaches the traffic policy to an interface or globally on all interfaces.

This section provides an overview on creating a class map, policy map, and service policy for remote network access. For detailed information on creating class maps, policy maps, and service policies, see Chapter 4, Configuring Class Maps and Policy Maps.

Telnet and SSH remote access sessions are established to the ACE on a per context basis. For details on creating users and contexts, see the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide.

This section includes the following topics:

Creating and Configuring a Remote Management Class Map

Creating a Layer 3 and Layer 4 Remote Access Policy Map

Applying a Service Policy

Creating and Configuring a Remote Management Class Map

To create a Layer 3 and Layer 4 class map to classify the remote network management traffic received by the ACE, use the class-map type management configuration-mode command. This command permits network management traffic to be received by the ACE by identifying the incoming IP protocols that the ACE can receive as well as the client source IP address and subnet mask as the matching criteria. The type management keywords define the allowed network traffic to manage security for protocols such as SSH, Telnet, and ICMP.

A class map can have multiple match commands. You can configure class maps to define multiple management protocol and source IP address match commands in a group that you then associate with a traffic policy. The match-all and match-any keywords determine how the ACE evaluates multiple match statements operations when multiple match criteria exist in a class map.

The syntax of this command is:

class-map type management [match-all | match-any] map_name

The keywords, arguments, and options are:

match-all | match-any—(Optional) Determines how the ACE evaluates Layer 3 and Layer 4 network management traffic when multiple match criteria exist in a class map. The class map is considered a match if the match commands meet one of the following conditions.

match-all —(Default) All of the match criteria listed in the class map are satisfied to match the network traffic class in the class map, typically match commands of the same type.

match-any—Any one of the match criteria listed in the class map is satisfied to match the network traffic class in the class map, typically match commands of different types.

map_name—Specifies the name assigned to the class map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

The CLI enters the class map management configuration mode. To classify the remote network management traffic received by the ACE, include one or more of the match protocol commands to configure the match criteria for the class map:

For example, to allow SSH and Telnet access to the ACE from IP address 172.16.10.0, enter:

host1/Admin(config)# class-map type management match-all 
SSH-TELNET_ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# match protocol ssh source-address 
172.16.10.0 255.255.255.254
host1/Admin(config-cmap-mgmt)# match protocol telnet source-address 
172.16.10.0 255.255.255.254
host1/Admin(config-cmap-mgmt)# exit
host1/Admin(config)# 

To remove a Layer 3 and Layer 4 network management class map from the ACE, enter:

host1/Admin(config)# no class-map type management match-all 
SSH-TELNET_ALLOW_CLASS

Defining a Class Map Description

To provide a brief summary about the Layer 3 and Layer 4 remote management class map, use the description command in class map configuration mode.

The syntax of this command is:

description text

Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.

For example, to specify a description that the class map is to allow remote Telnet access, enter:

host1/Admin(config)# class-map type management TELNET-ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# description Allow Telnet access to the 
ACE

To remove the description from the class map, enter:

host1/Admin(config-cmap-mgmt)# no description

Defining Remote Network Management Protocol Match Criteria

To configure the class map to identify the remote network access management protocols that can be received by the ACE, use the match protocol command in class map configuration mode. You configure the associated policy map to permit access to the ACE for the specified management protocols. As part of the network management access traffic classification, you also specify either a client source host IP address and subnet mask as the matching criteria or instruct the ACE to allow any client source address for the management traffic classification.

The syntax of this command is:

[line_number] match protocol {http | https | icmp | snmp | ssh | telnet | xml-https} {any | source-address ip_address mask}

line_number—(Optional) Assists you in editing or deleting individual match commands. Enter an integer from 2 to 255 as the line number. You can enter no line_number to delete long match commands instead of entering the entire line. The line numbers do not dictate a priority or sequence for the match statements.

http—Specifies the Hypertext Transfer Protocol (HTTP). The use of the HTTP management protocol for XML usage is described in Chapter 9, Configuring the XML Interface.

https—Specifies secure (SSL) Hypertext Transfer Protocol (HTTP) for connectivity with the Device Manager GUI on the ACE.

icmp—Specifies Internet Control Message Protocol messages to the ACE. The configuration of the ICMP management protocol is described in the "Enabling ICMP Messages to the ACE" section.

snmp—Specifies the Simple Network Management Protocol (SNMP). The use of the SNMP management protocol is described in Chapter 8, Configuring SNMP.

ssh—Specifies a Secure Shell (SSH) remote connection to the ACE. The ACE supports the SSH remote shell functionality provided in SSH Version 1 and supports DES and 3DES ciphers. The configuration of SSH sessions is described in the "Configuring SSH Management Sessions" section.


Note SSH v1.x and v2 are entirely different protocols and are not compatible. Make sure that you use an SSH v1.x client when accessing the ACE.


telnet—Specifies a Telnet remote connection to the ACE. The configuration of Telnet sessions is described in the "Configuring Telnet Management Sessions" section.

xml-https—Specifies HTTPS as transfer protocol to send and receive XML documents between the ACE and a Network Management System (NMS). The use of the HTTPS management protocol for XML usage is described in Chapter 9, Configuring the XML Interface.

any—Specifies any client source address for the management traffic classification.

source-address—Specifies a client source host IP address and subnet mask as the network traffic matching criteria. As part of the classification, the ACE implicitly obtains the destination IP address from the interface on which you apply the policy map.

ip_address—Source IP address of the client. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).

mask—The subnet mask of the client in dotted-decimal notation (for example, 255.255.255.0).

For example, to specify that the class map allows SSH access to the ACE, enter:

host1/Admin(config)# class-map type management SSH-ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# match protocol ssh source-address 
172.16.10.0 255.255.255.254

To deselect the specified network management protocol match criteria from the class map, enter:

host1/Admin(config-cmap-mgmt)# no match protocol ssh source-address 
172.16.10.0 255.255.255.254

Creating a Layer 3 and Layer 4 Remote Access Policy Map

For a Layer 3 and Layer 4 traffic classification, you create a Layer 3 and Layer 4 policy map with actions to configure the network management traffic received by the ACE This section outlines the general steps to configure a Layer 3 and Layer 4 network traffic policy and contains the following topics:

Creating a Layer 3 and Layer 4 Policy Map for Network Management Traffic Received by the ACE

Defining a Layer 3 and Layer 4 Policy Map Description

Specifying a Layer 3 and Layer 4 Traffic Class With the Traffic Policy

Defining Layer 3 and Layer 4 Management Traffic Policy Actions

Creating a Layer 3 and Layer 4 Policy Map for Network Management Traffic Received by the ACE

To configure a Layer 3 and Layer 4 policy map that defines the different actions that are applied to the IP management traffic received by the ACE, use the policy-map type management first-match configuration command. The ACE executes the specified action only for traffic that meets the first matching classification with a policy map. The ACE does not execute any additional actions.

The syntax of this command is as follows:

policy-map type management first-match map_name

The map_name argument specifies the name assigned to the Layer 3 and Layer 4 network management policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

When you use this command, you will access policy map management configuration mode.

For example, to create a Layer 3 and Layer 4 network traffic management policy map, enter:

host1/Admin(config)# policy-map type management first-match 
REMOTE_MGMT_ALLOW_POLICY
host1/Admin(config-pmap-mgmt)#

To remove a policy map from the ACE, enter:

host1/Admin(config)# no policy-map type management first-match 
REMOTE_MGMT_ALLOW_POLICY

Defining a Layer 3 and Layer 4 Policy Map Description

To provide a brief summary about the Layer 3 and Layer 4 remote management policy map, use the description command in policy map configuration mode.

The syntax of this command is as follows:

description text

The text argument specifies the description that you want to provide. Enter an unquoted text string with a maximum of 240 alphanumeric characters.

For example, to specify a description that the policy map is to allow remote Telnet access, enter:

host1/Admin(config-pmap-mgmt)# description Allow Telnet access to the 
ACE

To remove a description from the policy map, enter:

host1/Admin(config-pmap-mgmt)# no description

Specifying a Layer 3 and Layer 4 Traffic Class With the Traffic Policy

To specify a Layer 3 and Layer 4 traffic class created with the class-map command to associate network traffic with the traffic policy, use the class command in policy map configuration mode. This command enters the policy map management class configuration mode.

The syntax of this command is as follows:

class {name1 [insert-before name2] | class-default}

The arguments and keywords, and options are as follows:

name1—The name of a previously defined Layer 3 and Layer 4 traffic class, configured with the class-map command, to associate traffic to the traffic policy. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

insert-before name2—(Optional) Places the current class map ahead of an existing class map or inline match condition specified by the name2 argument in the policy map configuration. The ACE does not save the sequence reordering as part of the configuration. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

class-default—Specifies the class-default class map for the Layer 3 and Layer 4 traffic policy. This class map is a reserved class map created by the ACE. You cannot delete or modify this class. All network traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications match, the ACE then matches the action specified under the class class-default command. The class-default class map has an implicit match any statement in it and is used to match any traffic classification. The class-default class map has an implicit match any statement that matches all traffic.

For example, to specify an existing class map within the Layer 3 and Layer 4 remote access policy map, enter:

host1/Admin(config-pmap-mgmt)# class L4_REMOTE_ACCESS_CLASS 
host1/Admin(config-pmap-mgmt-c)# 

To use the insert-before command to define the sequential order of two class maps in the policy map, enter:

host1/Admin(config-pmap-mgmt)# class L4_SSH_CLASS insert-before 
L4_REMOTE_ACCESS_CLASS

To specify the class-default class map for the Layer 3 and Layer 4 traffic policy, enter:

host1/Admin(config-pmap-mgmt)# class class-default
host1/Admin(config-pmap-mgmt-c)# 

To remove a class map from a Layer 3 and Layer 4 policy map, enter:

host1/Admin(config-pmap-mgmt)# no class L4_REMOTE_ACCESS_CLASS

Defining Layer 3 and Layer 4 Management Traffic Policy Actions

To allow the network management traffic listed in the Layer 3 and Layer 4 class map to be received or rejected by the ACE, specify either the permit or deny command in policy map class configuration mode.

Use the permit command in policy map class configuration mode to allow the remote management protocols listed in the class map to be received by the ACE.

Use the deny command in policy map class configuration mode to refuse the remote management protocols listed in the class map to be received by the ACE.

For example, to create a Layer 3 and Layer 4 remote network traffic management policy map that permits SSH, Telnet, and ICMP connections to be received by the ACE, enter:

host1/Admin(config)# policy-map type management first-match 
REMOTE_MGMT_ALLOW_POLICY
host1/Admin(config-pmap-mgmt)# class SSH-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit
host1/Admin(config-pmap-mgmt)# class TELNET-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit
host1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit

For example, to create a policy map that restricts an ICMP connection by the ACE, enter:

host1/Admin(config)# policy-map type management first-action 
ICMP_RESTRICT_POLICY
host1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# deny

Applying a Service Policy

Use the service-policy command to perform the following tasks:

Apply a previously created policy map.

Attach the traffic policy to a specific VLAN interface or globally to all VLAN interfaces in the same context.

Specify that the traffic policy is to be attached to the input direction of an interface.

The service-policy command is available at both the interface configuration mode and at the configuration mode. Specifying a policy map in the interface configuration mode applies the policy map to a specific VLAN interface. Specifying a policy map in the configuration mode applies the policy to all of the VLAN interfaces associated with a context.

The syntax of this command is:

service-policy input policy_name

The keywords, arguments, and options are:

input—Specifies that the traffic policy is to be attached to the input direction of an interface. The traffic policy evaluates all traffic received by that interface.

policy_name—Specifies the name of a previously defined policy map, configured with a previously created policy-map command. The name can be a maximum of 40 alphanumeric characters.

For example, to specify an interface VLAN and apply the remote access policy map to a VLAN, enter:

host1/Admin(config)# interface vlan 50
host1/Admin(config-if)# ip address 172.16.1.100 255.255.0.0
host1/Admin(config-if)# service-policy input REMOTE_MGMT_ALLOW_POLICY

For example, to globally apply the remote access policy map to all of the VLANs associated with a context, enter:

host1/Admin(config)# service-policy input REMOTE_MGMT_ALLOW_POLICY

To detach the remote access traffic policy from an interface, enter:

host1/Admin(config-if)# no service-policy input 
REMOTE_MGMT_ALLOW_POLICY

To globally detach the remote access traffic policy from all VLANs associated with a context, enter:

host1/Admin(config)# no service-policy input REMOTE_MGMT_ALLOW_POLICY

You can detach a traffic policy by either of the following methods:

Individually from the last VLAN interface on which you applied the service policy

Globally from all VLAN interfaces in the same context

The ACE automatically resets the associated service policy statistics to provide a new starting point for the service policy statistics the next time that you attach a traffic policy to a specific VLAN interface or globally to all VLAN interfaces in the same context.

Note the following guidelines and restrictions when creating a service policy:

Policy maps, applied globally in a context, are internally applied on all interfaces existing in the context.

A policy activated on an interface overwrites any specified global policies for overlapping classification and actions.

The ACE allows only one policy of a specific feature type to be activated on a given interface.

To display service policy statistics for a Layer 3 and Layer 4 remote network traffic management policy map, use the show service-policy command in Exec mode.

The syntax of this command is:

show service-policy policy_name [detail]

The keywords, options, and arguments are as follows:

policy_name—The identifies an existing policy map that is currently in service (applied to an interface) as an unquoted text string with a maximum of 64 alphanumeric characters.

detail—(Optional) Displays a more detailed listing of policy map statistics and status information.


Note The ACE updates the counters that the show service-policy command displays after the applicable connections are closed.


For example, to display service policy statistics for the REMOTE_MGMT_ALLOW_POLICY policy map, enter:

host1/Admin# show service-policy REMOTE_MGMT_ALLOW_POLICY
Status     : ACTIVE
Description: Allow mgmt protocols
-----------------------------------------
Context Global Policy:
  service-policy: REMOTE_MGMT_ALLOW_POLICY

To clear the service policy statistics, use the clear service-policy command. The syntax of this command is:

clear service-policy policy_name

For the policy_name argument, enter the identifier of an existing policy map that is currently in service (applied to an interface).

For example, to clear the statistics for the policy map REMOTE_MGMT_ALLOW_POLICY that is currently in service, enter:

host1/Admin# clear service-policy REMOTE_MGMT_ALLOW_POLICY

Configuring Telnet Management Sessions

The ACE supports a maximum 16 concurrent Telnet management sessions for the Admin context and 4 concurrent Telnet management sessions for each user context.

To control the maximum number of Telnet sessions allowed for each context, use the telnet maxsessions command in configuration mode . The ACE supports a total maximum of 256 concurrent Telnet sessions.

Telnet remote access sessions are established on the ACE per context. You can create a context, assign an interface and IP address to it, and then log into the ACE by using Telnet to connect to that IP address. This capability allows you to specify a particular context when accessing the ACE. For details on creating users and contexts, see the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide.

The syntax of this command is:

telnet maxsessions max_sessions

The max_sessions argument sets the maximum number of concurrent Telnet sessions allowed for the associated context. The range is from 1 to 16 Telnet sessions for the Admin context and from 1 to 4 Telnet sessions for each user context. The defaults are 16 (Admin context) and 4 (user context).

For example, to configure the maximum number of concurrent Telnet sessions to 3 in the Admin context, enter:

host1/Admin(config)# telnet maxsessions 3

To revert to the default of 16 Telnet sessions for the Admin context, enter:

host1/Admin(config)# no telnet maxsessions

Configuring SSH Management Sessions

This section includes the following topics:

Configuring Maximum Number of SSH Sessions

Generating SSH Host Key Pairs

SSH remote access sessions are established on the ACE per context. You can create a context, assign an interface and IP address to it, and then log into the ACE by using SSH to connect to that IP address. This capability allows you to specify a particular context when accessing the ACE. For details on creating users and contexts, see the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide.

Configuring Maximum Number of SSH Sessions

The ACE supports a maximum of 16 concurrent SSH management sessions for the Admin context and 4 concurrent SSH management sessions for each user context.

To control the maximum number of SSH sessions allowed for each context, use the ssh maxsessions command in configuration mode. The ACE supports a total maximum of 256 concurrent SSH sessions.

The syntax of this command is:

ssh maxsessions max_sessions

The max_sessions argument sets the maximum number of concurrent SSH sessions allowed for the associated context. The range is from 1 to 16 SSH sessions for the Admin context and from 1 to 4 SSH sessions for each user context. The defaults are 16 (Admin context) and 4 (user context).

For example, to configure the maximum number of concurrent SSH sessions in the Admin context to 3, enter:

host1/Admin(config)# ssh maxsessions 3

To revert to the default of 16 Telnet sessions for the Admin context, enter:

host1/Admin(config)# no ssh maxsessions

Generating SSH Host Key Pairs

The ACE supports remote login over an SSH session that uses private and public key pairs to perform authentication for the context. DSA and RSA keys are generated in pairs—one public key and one private key. With this method of remote connection, use a generated private and public key pair to participate in a secure communication by encrypting and decrypting messages.

The global administrator performs the key generation in the Admin context. All contexts associated with the ACE share the common key. There is only a single host-key pair.


Note If you are the administrator or another user authorized in the Admin context, use the changeto command in Exec mode to move to the Admin context. An administrator can perform all allowable functions within the Admin context.


Ensure that you have an SSH host key pair with the appropriate version before enabling the SSH service. The SSH service accepts three types of key pairs for use by SSH versions 1 and 2. Generate the SSH host key pair according to the SSH client version used. The number of bits specified for each key pair ranges from 768 to 4096.

To generate the SSH private key and the corresponding public key for use by the SSH server, use the ssh key command in configuration mode.

The syntax of this command is:

ssh key {dsa | rsa | rsa1} [bits [force]]

The arguments, keywords, and options are:

dsa—Generates the DSA key pair for the SSH version 2 protocol.

rsa—Generates the RSA key pair for the SSH version 2 protocol.

rsa1—Generates the RSA1 key pair for the SSH version 1 protocol.

bits—(Optional) Specifies the number of bits for the key pair. For DSA, the range is from 768 to 2048. For RSA and RSA1, the range is from 768 to 4096. The greater the number of bits that you specify, the longer it takes to generate the key. The default is 768.

force—(Optional) Forces the generation of a DSA or RSA key even when previous keys exist. If the SSH key pair option is already generated for the required version, use the force option to overwrite the previously generated key pair.

Before you generate the key, set the hostname and the domain name. These two settings are used in the key. See Chapter 1, Setting Up the ACE, for details on setting a hostname and to the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide for details on configuring a domain.

For example, to generate an RSA1 key pair in the Admin context, enter:

host1/Admin(config)# ssh key rsa1 1024
generating rsa1 key
.....
generated rsa1 key

To remove the SSH host key pair, enter:

host1/Admin(config)# no ssh key rsa1

To clear the public keys of all trusted hosts, use the clear ssh hosts Exec command. These keys are either sent to an SSH client by an SSH server or are entered manually. When a SSH connection is made from the ACE, the SSH client receives the public key and stores it locally. To clear all these keys, use the clear ssh hosts command in Exec mode.

Terminating an Active User Session

To terminate an active SSH or Telnet session for the active context, use one of the following commands in Exec mode:

clear ssh {session_id | hosts}

clear telnet {session_id}

The arguments, keywords, and options are:

session_id—Specifies the identifier of the SSH or Telnet session to disconnect. You can obtain the specific session_id value using either the show ssh session-info command or the show telnet command in Exec mode. See the "Directly Accessing a User Context Through SSH" section for details.

hosts—Clears the list of trusted SSH hosts from the ACE configuration.

For example, to terminate an SSH session, enter:

host1/Admin # clear ssh 345

Enabling ICMP Messages to the ACE

By default, the ACE does not allow ICMP messages to be received by an ACE interface or to pass through the ACE interface. ICMP is an important tool for testing your network connectivity; however, network hackers can also use ICMP to attack the ACE or your network. We recommend that you allow ICMP during your initial testing, but then disallow it during normal operation.

To permit or deny address(es) to reach an ACE interface with ICMP messages, either from a host to the ACE, or from the ACE to a host which requires the ICMP reply to be allowed back, configure a:

Class map to provide the ICMP network traffic match criteria for the ACE.

Policy map to enable ICMP network management access to and from the ACE.

Service policy to activate the policy map, attach the traffic policy to an interface or globally on all interfaces, and specify the direction in which the policy should be applied.

See the "Configuring Remote Network Management Traffic Services" section for details on configuring a network management class map, policy map, and service policy for the ACE.

To allow ICMP messages to pass through the ACE, configure an ICMP ACL to permit or deny network connections based on the ICMP type (for example, echo, echo-reply, or unreachable). See the Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide for details.


Note If you want only to allow the ACE to ping a host (and allow the echo reply back to the interface), but not allow hosts to ping the ACE, enable the ICMP application protocol inspection function instead of defining a class map and policy map. See the Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide for details.


For example, to allow the ACE to receive ICMP pings, enter the following commands:

host1/Admin(config)# class-map type management match-all 
ICMP-ALLOW_CLASS
host1/Admin(config-cmap-mgmt)# description Allow ICMP packets
host1/Admin(config-cmap-mgmt)# match protocol icmp source-address 
172.16.10.0 255.255.255.254
host1/Admin(config-cmap-mgmt)# exit
host1/Admin(config)# policy-map type management first-action 
ICMP_ALLOW_POLICY
host1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASS
host1/Admin(config-pmap-mgmt-c)# permit
host1/Admin(config-pmap-mgmt-c)# exit
host1/Admin(config-pmap-mgmt)# exit
host1/Admin(config)# interface vlan 50
host1/Admin(config-if)# ip address 172.16.1.100 255.255.0.0
host1/Admin(config-if)# service-policy input ICMP_ALLOW_POLICY

Directly Accessing a User Context Through SSH

As the global administrator, from the Admin context, you can configure a user context and enable direct login access to that user context from a remote SSH session. To configure the ACE to provide direct access to a user context from SSH, perform the following steps:


Step 1 Create a user context by entering the following command:

host1/Admin(config)# context C1
host1/Admin(config-context)#

See the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide.

Step 2 Associate an existing VLAN with the user context so that the context can receive traffic classified for it by entering the following command:

host1/Admin(config-context)# allocate-interface vlan 100

See the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide.

Step 3 Generate the SSH host key pair by entering the following command:

host1/Admin(config-context)# ssh key rsa1 1024
generating rsa1 key
.....
generated rsa1 key

See the "Generating SSH Host Key Pairs" section.

Step 4 Change to the C1 context that you created in Step 1 and enter configuration mode in that context by entering the following commands:

host1/Admin(config-context)# do changeto C1
host1/C1(config-context)# exit
host1/C1(config)#

Only users authenticated in the Admin context can use the changeto command.

Step 5 Configure the VLAN interface that you allocated to the user context in Step 2 by entering the following commands:

host1/C1(config)# interface vlan 50
host1/C1(config-if)# ip address 192.168.1.1 255.255.255.0
host1/C1(config-if)# no shutdown
host1/C1(config-if)# exit
host1/C1(config)#

For example, assign an IP address to the interface and reenable the interface within the context with the no shutdown command. See the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide.

Step 6 Create an SSH remote management policy and apply the associated service policy to all VLAN interfaces or just to the VLAN interface allocated to the user context by entering the following commands:

host1/C1(config)# class-map type management match-all SSH-ALLOW_CLASS
host1/C1(config-cmap-mgmt)# match protocol ssh source-address 
172.16.10.0 255.255.255.254
host1/C1(config-cmap-mgmt)# exit
host1/C1(config)# 
host1/C1(config)# policy-map type management first-match 
REMOTE_MGMT_ALLOW_POLICY
host1/C1(config-pmap-mgmt)# class SSH-ALLOW_CLASS
host1/C1(config-pmap-mgmt-c)# permit
host1/C1(config-pmap-mgmt-c)# exit
host1/C1(config)# interface vlan 50
host1/C1(config-if)# ip address 192.168.1.1 255.255.255.0
host1/C1(config-if)# service-policy input REMOTE_MGMT_ALLOW_POLICY
host1/C1(config-if)# exit
host1/C1(config)# 

See the "Configuring Remote Network Management Traffic Services" section.

Step 7 Create an IP route by entering the following command:

host1/C1(config)# ip route 0.0.0.0 255.255.255.0 192.168.4.8

See the Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide.


To directly access the user context from an SSH client, perform the following steps:


Step 1 From the SSH client, establish a remote SSH session to the IP address of the user context VLAN interface.

Step 2 Enter the password for the user context VLAN interface. The ACE CLI prompt appears in Exec mode of the user context.

host1/C1# 

Example of a Remote Access Configuration

The following example illustrates a running-configuration that defines rules for remote access to the ACE through the use of class maps, policy maps, and service policies. The remote access configuration appears in bold in the example

telnet maxsessions 3

ssh maxsessions 3

access-list ACL1 line 10 extended permit ip any any

class-map type management match-any L4_REMOTE-MGT_CLASS
  description Allows Telnet, SSH, and ICMP protocols
  2 match protocol telnet any
  3 match protocol ssh any
  4 match protocol icmp any
 
policy-map type management first-match L4_REMOTE-MGT_POLICY
  class L4_REMOTE-MGT_CLASS
    permit

interface vlan 50
  ip address 192.168.1.1 255.255.255.0
  access-group input ACL1
  service-policy input L4_REMOTE-MGT_POLICY
  no shutdown

ssh key rsa1 1024 force

Viewing Session Information

This section includes the following procedures:

Showing Telnet Session Information

Showing SSH Session Information

Showing Telnet Session Information

To display information related to the Telnet session, use the show telnet command in Exec mode. Only the context administrator can view Telnet information associated with a particular context.

The syntax of this command is:

show telnet [context_name]

The optional context_name argument specifies the name of the context for which you want to view specific Telnet session information. The context_name argument is case sensitive.

For example, enter:

host1/Admin# show telnet

Table 2-2 describes the fields in the show telnet command output.

Table 2-2 Field Descriptions for the show telnet Command

Field
Description

SessionID

Unique session identifier for the Telnet session.

Remote Host

IP address and port of the remote Telnet client.

Active Time

Time since the Telnet connection request was received by the ACE.


To display the maximum number of enabled Telnet sessions, use the show telnet maxsessions command in Exec mode. Only context administrators can view Telnet session information associated with a particular context.

The syntax of this command is:

show telnet maxsessions [context_name]

The optional context_name argument specifies the name of the context for which you want to view the maximum number of Telnet sessions. The context_name argument is case sensitive.

For example, enter:

host1/Admin# show telnet maxsessions

Maximum Sessions Allowed is 4

Showing SSH Session Information

This section contains the following procedures:

Showing SSH Session Information

Showing SSH Key Details

Showing SSH Session Information

To display information related to the SSH session, use the show ssh session-info command in Exec mode. Only context administrators can view SSH session information associated with a particular context.

The syntax of this command is:

show ssh session-info [context_name]

The optional context_name argument specifies the name of the context for which you want to view specific SSH session information. The context_name argument is case sensitive.

For example, enter:

host1/Admin# show ssh session-info

Table 2-3 describes the fields in the show ssh session-info command output.

Table 2-3 Field Descriptions for the show ssh session-info Command

Field
Description

SessionID

Unique session identifier for the SSH session.

Remote Host

IP address and port of the remote SSH client.

Active Time

Time since the SSH connection request was received by the ACE.


To display the maximum number of enabled SSH sessions, use the show ssh maxsessions command in Exec mode. Only context administrators can view SSH session information associated with a particular context.

The syntax of this command is:

show ssh maxsessions [context_name]

The optional context_name argument specifies the name of the context for which the context administrator wants to view the maximum number of SSH sessions. The context_name argument is case sensitive.

For example, enter:

host1/Admin# show ssh maxsessions
Maximum Sessions Allowed is 4(SSH Server is enabled)

Showing SSH Key Details

Use the show ssh key command in Exec mode to display the host key pair details for the specified key or for all keys if you do not specify a key.

The syntax of this command is:

show ssh key [dsa | rsa | rsa1]

The arguments, keywords, and options are:

dsa—Specifies the DSA key pair for the SSH version 2 protocol.

rsa—Specifies the RSA key pair for the SSH version 2 protocol.

rsa1—Specifies the RSA1 key pair for the SSH version 1 protocol.

For example, enter:

host1/Admin # show ssh key
**************************************
could not retrieve rsa1 key information
**************************************
rsa Keys generated:Tue May 8 19:37:17 2007

ssh-rsa 
AAAAB3NzaC1yc2EAAAABIwAAAIEA4v4DQ8aNl482qDTRju9G07hEIxCgTWanPm+WOCU1ki
hZ
QNd5ZwA50CBAJSfIIIB4iED6iQbhOkbXSneCvTb5mVoish2wvJrETpIDIeGxxh/jWVsU/M
eBbA/7o5tv
gCeT6p7pGF5oUNYFP0OeZ9BiIWDc4jBmYEQLEqJHPrMhSFE=

bitcount:1024
fingerprint:
f5:55:00:18:bc:af:41:74:b6:bc:aa:8e:46:31:74:4f
**************************************
dsa Keys generated:Tue May 8 19:37:17 2007

ssh-dss 
AAAAB3NzaC1kc3MAAACBAPqDdEqU+0gNtKRXM+DQAXnvcB+H89nq8jA4WgJ7uQcuDCLaG7
Lq
jtKTltJjA6aZVywsQWQ6n4kTlkavZy3cj6PUbSyqvmCTsaYyYo4UQ6CKrK9V+NsfgzTSLW
TH8iDUvYjL
c3nU51QEKjy7mPsQeX31y1M1rhp8qhkbMKxkc49XAAAAFQCPM0QJrq6+kkaghJpeNxeXhU
H9HwAAAIEA
keZ1ZJM6sfKqJDYPLHkTro+lpbV9uR4VyYoZmSoehi/LmSaZDq+Mc8UN1LM+i5vkOgnKce
arD9lM4/hK
zZGYx5hJOiYCKj/ny2a5p/8HK152cnsOAg6ebkiTTWAprcWrcHDS/1mcaI5GzLrZCdlXW5
gBFZtMTJGs
tICmVWjibewAAACBAJQ66zdZQqYiCWtZfmakridEGDTLV6ixIDjBNgb84qlj+Y1XMzqLL0
D4oMSb7idE
L3BmhQYQW7hkTK0oS4kVawI1VmW2kvrqoGQnLNQRMvisAXuJWKk1Ln6vWPGZZe8KoALv0G
XxsOv2gk/z
TDk01oCaTVw//bXJtoVRgIlWXLIP

bitcount:1024
fingerprint:
8e:13:5c:3e:1a:9c:7a:ed:d0:84:eb:96:12:db:82:be
**************************************