Table Of Contents
Changing the Administrative Username and Password
Creating Usernames and Passwords
Controlling Remote User Access to the CSS
Configuring Virtual Authentication
Configuring Console Authentication
Controlling Administrative Access to the CSS
Enabling Administrative Access to the CSS
Disabling Administrative Access to the CSS
Controlling CSS Network Traffic Through Access Control Lists
Adding a Clause When ACLs are Globally Enabled
Applying an ACL to a Circuit or DNS Queries
Removing an ACL from Circuits or DNS Queries
Setting the Show ACL Counters to Zero
Configuring Network Qualifier Lists for ACLs
Adding an NQL to an ACL Clause
Controlling CSS Access
This chapter describes how to configure access to the CSS including network traffic. Information in this chapter applies to all models of the CSS, except where noted.
This chapter contains the following major sections:
•
Changing the Administrative Username and Password
•
•
•
•
•
Changing the Administrative Username and Password
During the initial log in to the CSS you enter the default user name admin and the default password system in lowercase text. For security reasons, you should change the administrative username and password. Security on your CSS can be compromised because the administrative username and password are configured to be the same for every CSS shipped from Cisco Systems.
The administrative username and password are stored in nonvolatile random access memory (NVRAM). Each time you reboot the CSS, it reads the username and password from NVRAM and reinserts them in to the user database. SuperUser status is assigned to the administrative username by default.
You can change the administrative username and password, but because the information is stored in NVRAM, you cannot permanently delete them. If you delete the administrative username using the no username command, the CSS deletes the username from the running-config file, but restores the username from NVRAM when you reboot the CSS.
Use the username-offdm name password text command to change the administrative username or password.
Note
For example, to change the default administrative username and password to a different username and password, enter.
(config)# username-offdm bobo password secretCreating Usernames and Passwords
Logging into the CSS requires a username and password. The CSS supports a maximum of 32 usernames, including the administrator and technician usernames. You can assign each user with SuperUser or User status.
•
•
From SuperUser mode, you can enter global configuration mode and its subordinate configuration modes. If you do not specify superuser when configuring a new user, the new user has only user-level status by default.
Caution
Use the username command to create usernames and passwords to log in to the CSS. The syntax for this global configuration mode command is:
username name [des-password|password] password {superuser} {dir-access access}
The following example creates a SuperUser named picard with a password of captain.
(config)# username picard password "captain" superuserThe options and variables are as follows:
•
•
•
•
Note
•
•
To use the dir-access option, you must first specify the restrict user-database command to implement security restrictions for the CSS user database.
•
–
–
–
–
Figure 1-1 illustrates the directory access privileges for a username.
Figure 1-1 CSS Directory Access Privileges
For example, to define directory access for username picard, enter:
(config)# username picard password "captain" superuser NWBNNNRTo display a list of existing usernames, enter:
(config)# username ?To remove an existing username, enter:
(config)# no username picardTo change a user password, reenter the username command and specify the new password. Remember to include SuperUser privileges if required. For example:
(config)# username picard password "flute" superuser
Caution
Controlling Remote User Access to the CSS
To control access to the CSS, you can configure the CSS to authenticate remote (virtual) or console users. The CSS can authenticate users by using the local user database, RADIUS server, or TACACS+ server. You can also allow user access without authenticating or disallowing all remote user access to the CSS.
You can set a maximum of three authentication methods: a primary, secondary, or tertiary authentication method. The primary method is the first authentication method that the CSS tries. If the primary authentication method fails (for example, the RADIUS server is down or is unreachable), the CSS tries the secondary method. And if the secondary method fails, then the CSS tries the tertiary method. In the event the tertiary method also fails, the CSS displays a message that authentication has failed.
The CSS does not attempt a secondary or tertiary authentication method under the following conditions:
•
•
•
•
Before you can use RADIUS or TACACS+ as either the virtual authentication method or the console authentication method, you must enable communication with the RADIUS or TACACS+ security server. Use either the radius-server command (refer to the Chapter 3, Configuring the CSS as a Client of a RADIUS Server) or the tacacs-server command (see the Chapter 4, Configuring the CSS as a Client of a TACACS+ Server).
This section includes the following topics:
•
•
To display virtual and console authentication settings, use the show user-database command.
Configuring Virtual Authentication
Virtual authentication allows remote users to log in to the CSS when they are using FTP, Telnet, SSHD, or the Device Management user interface with or without requiring a username and password. The CSS can also deny access to all remote users.
You can configure the CSS to authenticate users by using the local database, RADIUS server, or TACACS+ server. By default, the CSS uses the local database as the primary method to authenticate users and disallows user access for the secondary and tertiary method.
Use the virtual authentication command to configure the primary, secondary, or tertiary virtual authentication method. The syntax for this global configuration command is:
virtual authentication [primary|secondary|tertiary [local|radius|tacacs|disallowed]]
The options for this command are as follows:
•
•
Note
•
•
•
•
•
To remove users currently logged in to the CSS, use the disconnect command.
To define the TACACS+ server as the primary virtual authentication method, enter:
#(config) virtual authentication primary tacacsTo define local user database as the secondary virtual authentication method, enter:
#(config) virtual authentication secondary localConfiguring Console Authentication
Console authentication allows users to log in to the CSS through a terminal connected to the console port with or without requiring a username and password. The CSS cannot disallow user access as a primary authentication method; however, it can disallow user access as a secondary or tertiary authentication method.
You can configure the CSS to authenticate users by using the local database, RADIUS server, or TACACS+ server. By default, the CSS uses the local database as the primary method to authenticate users and disallows user access for the secondary and tertiary method.
Use the console authentication command to configure the primary, secondary, or tertiary console authentication method. The syntax for this global configuration command is:
console authentication [primary [local|radius|tacacs|none]
|secondary|tertiary [local|radius|tacacs|none|disallowed]]The options for this command are as follows:
•
•
•
•
•
•
Note
•
•
To remove users currently logged in to the CSS, use the disconnect command.
To define the TACACS+ server as the primary console authentication method, enter:
#(config) console authentication primary tacacsTo define local user database as the secondary console authentication method, enter:
#(config) console authentication secondary localTo disable authentication on the console port allowing users to access the CSS without a username and password, enter:
#(config) no console authenticationControlling Administrative Access to the CSS
CSS access through a console, FTP, SSH, SNMP, and Telnet is enabled by default. The CSS supports a maximum of four FTP sessions and a maximum of four Telnet sessions. Use the restrict and no restrict commands to enable or disable console, FTP, SNMP, SSH, Telnet, user database, secure and unsecure XML, and web management data transfer to the CSS.
Specifying the restrict command does not prevent the CSS from listening for connection attempts on the restricted port. For TCP connections, the CSS completes the TCP 3-way handshake, then terminates the connection with an error to prevent any data transfer from occurring. For UDP SNMP connections, the CSS simply discards the packets.
To secure restricted ports from unauthorized access, configure ACL clauses to deny packets destined to these ports, while permitting normal traffic to flow through the CSS. You can also use ACLs to secure the CSS itself. See the "Controlling CSS Network Traffic Through Access Control Lists" section for information about configuring ACLs for the CSS.
Enabling Administrative Access to the CSS
To enable console, FTP, SNMP, SSH, Telnet, user database, secure and unsecure XML, and web management access to the CSS, use the following no restrict commands:
•
•
•
•
•
•
•
•
•
Note
For example, to enable Device Management user interface access, enter:
(config)# no restrict web-mgmtRefer to the Cisco Content Services Switch Administration Guide for details on configuring the Simple Network Management Protocol (SNMP) features on your CSS. For details on making web-based configuration changes to the CSS using Extensible Markup Language (XML), refer to the Cisco Content Services Switch Administration Guide. For details on using the Device Management user interface, refer to the Cisco Content Services Switch Device Management User's Guide.
Disabling Administrative Access to the CSS
To disable console, FTP, SNMP, SSH, Telnet, user database, secure and unsecure XML, and web management access to the CSS, use the following restrict commands:
•
•
•
•
•
•
•
•
•
For example, to disable Telnet access, enter:
(config)# restrict telnetControlling CSS Network Traffic Through Access Control Lists
The CSS provides traffic filtering capabilities with access control lists (ACLs). ACLs filter inbound network traffic by controlling whether packets are forwarded or blocked at the CSS interfaces. You can configure ACLs for routed network protocols, filtering the protocol packets as the packets pass through the CSS.
The following sections describe how to configure an ACL:
•
•
•
•
•
ACL Overview
ACLs configured on the CSS provide a basic level of security for accessing your network. Without ACLs on the CSS, all packets passing through VLAN circuits on the CSS could be allowed onto the entire network. With ACLs, you may want to permit all e-mail traffic on the CSS circuit, but block Telnet traffic. You can also use ACLs to allow one client to access a part of the network and prevent another client from accessing the same area.
An ACL consists of clauses that you define. The CSS uses these clauses to determine how to handle each packet it processes on a VLAN circuit. When the CSS examines each packet, it either forwards or blocks the packet based on whether or not the packet matches a clause in the ACL. You must configure a permit clause in an ACL to allow traffic through the circuit. An implicit "deny all" clause exists at the end of every ACL.
When configuring ACLs on a CSS, you must apply an ACL to each VLAN circuit on the CSS to control traffic on the VLAN. An applied ACL on a circuit assigns the ACL and its clauses to the circuit.
After you apply an ACL to each CSS circuit, you must enable the ACLs on the CSS. Globally enabling ACLs affect all circuits in the CSS. When you enable ACLs, the CSS uses the clauses in all ACLs to permit or deny traffic on all circuits. If a circuit does not have an ACL, the CSS applies an implicit "deny all" clause to this circuit causing the CSS to deny all traffic on it.
For example, Figure 1-2 shows three VLAN circuits on the CSS.
Figure 1-2 ACLs Enabled on the CSS
For VLAN1, if you want to allow any TCP traffic to the destination VIP address 192.32.1.254, create ACL 1 and configure the following clause, clause 15 permit tcp any destination 192.32.1.254. Then apply ACL 1 to VLAN1.
For VLAN2, if you want to allow all traffic to any destination, create ACL 2 and configure the following clause, clause 15 permit any any destination any. Then apply ACL 2 to VLAN2.
When you enable ACLs on the CSS, VLAN1 and VLAN2 permit traffic as defined by the permit clauses configured for the ACL. Because no ACL is applied to VLAN3, the CSS applies an implicit "deny all" clause to this circuit causing the CSS to deny all traffic on it.
Caution
Enabling ACLs globally affects all traffic on all CSS circuits whether they have ACLs or not. When you enable ACLs, all traffic on a circuit that is not configured in an ACL permit clause is denied. If you do not apply an ACL on each circuit, the CSS denies traffic on that circuit.
When the CSS is using ACLs, its hardware implements a maximum of 10 ACLs with simple Layer 3 or Layer 4 clauses. The CSS software implements more complicated ACLs with Layer 5 clauses.
Note
ACLs do not block ARP packets.
You cannot use an ACL clause with a source group to perform source address translation of traffic destined to an SSL module. This clause will be accepted by the CSS but will be ignored for flows terminated at the SSL module. You can apply NAT to connections towards servers after SSL processing.If you are load-balancing passive FTP servers and you want to use an ACL to apply a source group, you must configure services directly in the source group. For details on using source groups to support FTP sessions, refer to the Cisco Content Services Switch Content Load-Balancing Configuration Guide.
ACL Configuration Quick Start
Use the quick-start procedure in Table 1-1 to configure an ACL. Each step includes the CLI command required to complete the task. For a complete description of each feature, see the sections following this procedure.
Note
Table 1-1 ACL Configuration Quick Start
1.
# config(config)#2.
1 to 99.(config)# acl 7 Create ACL <7>, [y,n]:y(config-acl[7])#3.
clause number permit|deny|bypass protocol [source_info {source_port}] dest [dest_info {dest_port}] {log} {prefer servicename} {sourcegroup name}
See Table 1-2 for information on the clause command options. For example, to block ports 20 to 23 for all user access coming into the CSS on a circuit from outside the network, enter:
(config-acl[7])# clause 10 deny any any destination range 20 23To permit all other traffic through the CSS on a circuit, enter:
(config-acl[7])# clause 15 permit any any destination any4.
(config-acl[7])# apply circuit-(VLAN1)You can also apply ACL 7 to all circuits on the CSS by using the apply all command.
5.
6.
Caution
For example, enter:
(config)# acl enable
The following running-config example shows the result of entering the commands in Table 1-1.
!**************************** ACL ****************************acl 7clause 10 deny any any destination range 20 23clause 15 permit any any destination anyapply circuit-(VLAN1)!************************** GLOBAL ***************************acl enableCreating an ACL
ACLs contain clauses to control traffic on CSS circuits. Because all circuits are affected when you globally enable ACLs on the CSS, you must create an ACL for each circuit. You can apply an ACL to more than one circuit. You can also apply an ACL to all circuits on the CSS.
Note
To create an ACL and access ACL mode, use the acl index number command. The index number defines the ACL and can range from 1 to 99. To display a list of existing ACLs, use the acl ? command.
(config)# acl 7When you access this mode, the prompt changes to the ACL mode of the index number you created. For example:
(config-acl[7])#After you create an ACL, you must add clauses to it. For more information, see the "Configuring Clauses" section.
Deleting an ACL
When you no longer need an ACL and its clauses on the CSS, you can delete the ACL. When you delete an ACL, all of its clauses are also deleted. To delete an ACL, use the no acl command. For example, to delete ACL 7, enter:
(config)# no acl 7If you delete an ACL that is currently applied to a circuit and ACLs are enabled on the CSS, the ACL is removed from the circuit and the CSS denies traffic on the circuit. If you want to permit traffic on the circuit, globally disable the ACLs on the CSS, which permits all traffic on a circuit.
For example:
1.
(config)# acl disable2.
(config-acl[7])# remove circuit-(VLAN1)3.
(config)# no acl 74.
5.
(config)# acl enableConfiguring Clauses
The clauses you configure on an ACL determine how the CSS controls traffic on a circuit. When you configure a clause, you must assign a number to it. The number assigned to each clause is important. The CSS processes the ACL starting from clause 1 and sequentially progresses through the rest of the clauses. When assigning numbers to clauses, assign the lowest numbers to clauses with the most specific matches. Then, assign higher numbers to clauses with less specific matches.
You do not need to enter the clauses sequentially. The CSS automatically inserts the clause in the appropriate order in the ACL. For example, if you enter clauses 10 and 24, and then clause 15, the CSS inserts the clauses in the correct sequence.
To create a clause to permit, deny, or bypass traffic on a circuit, use the clause command. The clause number is the number you want to assign to the clause. Enter a number from 1 to 254.
Note
When you create a clause, you cannot modify it. You must delete the clause and create a new clause. For information on deleting a clause, see the "Deleting a Clause" section.
The CSS applies a hidden default "deny all" clause as clause 255 to all ACLs. You must specify permit clauses that allow traffic including management traffic on the CSS.The syntax for the clause command is:
•
clause number bypass protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}
Note
•
clause number deny protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}•
clause number permit protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}
Note
clause 14 permit any any destination content Layer5/L5 eq 80 (original clause) clause 15 permit tcp any destination 200.200.200.200 eq 80 (This is an additional clause to handle the SYN, where the destination IP address is the IP address configured in the Layer 5 content rule. Note that this clause number must be greater than the destination content clause number.)Table 1-2 provides variables and options for the clause command. Bolded syntax defines keywords that you enter on the command line. Italics define variables where you enter a value such as an IP address or a host name.
After you create clauses for an ACL, you can apply the ACL to a circuit. For more information, see the "Applying an ACL to a Circuit or DNS Queries" section.
Adding a Clause When ACLs are Globally Enabled
If you are adding a new clause to an applied ACL when ACLs are globally enabled on the CSS, you must reapply the ACL to the circuit using the apply circuit command for the clause to take effect.
For example, you apply ACL 7 to VLAN1 and then globally enable ACLs on the CSS. At a later time, to add a new clause to ACL 7 and to have the clause take effect on the CSS, enter:
(config-acl[7])# clause 200 permit any any destination any(config-acl[7])# apply circuit-(VLAN1)Deleting a Clause
If you modify an existing clause, you must delete it from the ACL and then readd it. To delete a clause, use the no clause command. For example, to delete clause 6, enter:
(config-acl[7]) no clause 6When ACLs are applied to a circuit and enabled on a CSS, the CSS considers them in use. You cannot delete a clause from an ACL in use. To delete the clause, remove its applied ACL from the circuit, delete a clause, and then reapply the ACL to the circuit.
For example, to delete clause 6 from ACL 7 on circuit VLAN1:
1.
(config-acl[7]) remove circuit-(VLAN1)2.
(config-acl[7]) no clause 63.
(config-acl[7]) apply circuit-(VLAN1)
Note
Applying an ACL to a Circuit or DNS Queries
After you configure the clauses on an ACL, use the apply command to assign an ACL to all circuits, an individual circuit, or to DNS queries.
Note
You cannot apply an empty ACL to a circuit. If you attempt to do so, this error message appears: Cannot apply ACL for it has no clauses.The syntax and options for this ACL mode command are:
•
(config-acl[7])# apply all•
(config-acl[7])# apply circuit-(VLAN1)To display a list of circuits, use the apply ? command.
•
(config-acl[7])# apply dnsIf you configure a domain name on a content rule on a CSS using the add dns domain_ name command, a DNS query for that domain name does match an ACL that is configured with the apply dns command.
However, if you configure a CSS with the dns-server command, and the CSS receives a DNS query for a domain name that you configured on the CSS using the host command, the DNS query does not match an ACL that is configured with the apply dns command.
After you apply an ACL and ACLs are disabled on the CSS, you must enter the global configuration acl enable command to enable the ACLs on the CSS. For information on the acl enable command, see the "Enabling ACLs on the CSS" section later in this chapter.
Removing an ACL from Circuits or DNS Queries
Remove an ACL from the circuit when you need to delete a clause from an ACL, the ACL applied to the circuit, or an ACL from DNS queries. To remove an ACL from all circuits, an individual circuit, or DNS queries, use the remove command. The syntax and options for this ACL mode command are:
•
(config-acl[7])# remove all•
(config-acl[7])# remove circuit-(VLAN1)To display a list of circuits that you can remove, use the remove ? command.
•
(config-acl[7])# remove dnsWe recommend that you globally disable ACLs on the CSS before removing an ACL from a circuit. If you remove an ACL from a circuit when ACLs are enabled on the CSS, the CSS applies an implicit "deny all" clause to this circuit causing the CSS to deny all traffic on it. If you do not want to deny traffic on the circuit, you must disable all ACLs on the CSS and then remove ACL from the circuit. By disabling all ACLs on the CSS, the CSS permits all traffic on all circuits.
For example:
1.
(config)# acl disable2.
(config-acl[7])# remove circuit-(VLAN1)3.
If you delete an ACL from the circuit, configure another ACL with a permit clause for the circuit, and then apply it to the circuit. Otherwise, when you reenable the ACLs on the CSS, the CSS denies traffic on the circuit.
4.
(config-acl[7])# apply circuit-(VLAN1)5.
(config)# acl enableEnabling ACLs on the CSS
After you configure ACLs and their clauses, and apply an ACL to each CSS circuit, you can globally enable all ACLs for use on the CSS. When you globally enable all ACLs, the CSS affects all traffic on all circuits and only allows traffic on circuits with ACLs containing a permit clause.
Caution
For example, you configure three circuits on the CSS (VLAN1, VLAN2, and VLAN3). Then you configure an ACL for VLAN1 only. When you globally enable ACLs, VLAN1 passes traffic based on the ACL. However, VLAN2 and VLAN3 discard all packets because of the implicit "deny all" clause that the CSS applies to the circuits because they do not have an ACL.
Before you globally enable ACLs on the CSS, make sure that you have console access. The console port is not affected if you lose network connectivity because of an ACL configuration problem.
Use the global configuration acl enable command to enable all ACLs on the CSS. To globally enable all ACLs, enter:
(config)# acl enableDisabling ACLs on the CSS
If you need to add, change, or delete an ACL or delete an ACL clause, we recommend that you disable all ACLs on the CSS before removing the ACL from the circuit. If you remove an ACL before globally disabling ACLs, the CSS applies an implicit "deny all" clause to the circuit from which the ACL is removed and denies traffic on the circuit.
Note
To globally disable all ACLs on the CSS, enter:
(config)# acl disableShowing ACLs
Use the show acl commands to display access control lists and clauses. The show acl commands are available in all modes.
When you show an ACL clause that is applied to a circuit, the display includes:
•
•
•
The total number of ACL hits for each packet received by the CSS can vary depending on the type of flow and whether an ACL match occurred. The CSS performs an ACL check for every packet received until the ACL flow is completely set up. Once the ACL flow is set up, remaining packets received by the CSS that are associated with the flow are not subject to an ACL match and the ACL hit counters do not increment.
The syntax is:
•
•
•
For example, enter:
(config)# show acl 2Table 1-3 describes the fields in the show acl command output.
Setting the Show ACL Counters to Zero
Use the zero counts command to reset the content and DNS hit counters in the
show acl command screen to zero for a specific ACL. You must be in an ACL to use this command. The CSS clears counters only for that ACL.The syntax and options for this command are:
(config-acl[7])# zero countsLogging ACL Activity
When you configure the CSS to log ACL activity, it logs the event of the packet matching the clause and ACL. The CSS sends log information to the location you specified in the logging command. For information on the logging command, refer to the Cisco Content Services Switch Administration Guide.
Note
Before you configure logging for a specific ACL clause, ensure that global ACL logging is enabled. To globally enable ACL logging, use the global configuration mode logging subsystem acl level debug-7 command.
Because the CSS does not save the clause log enable command in the running-config, you must reenable logging if the CSS reboots.To enable logging on an existing ACL clause, use the log enable option for the clause command and enter:
(config-acl[7])# clause 1 log enableIf ACLs are globally enabled on the CSS, configure logging on an existing ACL clause:
1.
(config)# acl disable2.
(config)# acl 7 (config-acl[7])#3.
(config-acl[7]) remove circuit-(VLAN1)4.
(config-acl[7])# clause 1 log enable5.
(config-acl[7])# apply circuit-(VLAN1)6.
(config)# acl enableTo disable ACL logging for a specific clause, enter:
1.
(config)# acl disable2.
(config)# acl 7 (config-acl[7])#3.
(config-acl[7]) remove circuit-(VLAN1)4.
(config-acl[7])# clause 1 log disable5.
(config-acl[7])# apply circuit-(VLAN1)6.
(config)# acl enableTo globally disable logging for all ACL clauses, enter:
(config)# no logging subsystem aclACL Example
The following ACL provides security for a CSS, Server1, and Server2 on one VLAN (VLAN1). The ACL:
•
•
•
The individual clauses provide the following security.
•
•
•
R
