-
Application Control Engine Module Administration Guide (Software Version A1(2))
-
Index
-
Preface
-
Setting Up the ACE
-
Enabling Remote Access to the ACE
-
Managing ACE Software Licenses
-
Configuring Class Maps and Policy Maps
-
Managing the ACE Software
-
Viewing ACE Hardware and Software Configuration Information
-
Configuring Redundant ACE Modules
-
Configuring SNMP
-
Configuring the XML Interface
-
Upgrading Your ACE Software
-
Table Of Contents
Enabling Remote Access to the ACE
Remote Access Configuration Quick Start
Configuring Remote Network Management Traffic Services
Creating and Configuring a Remote Management Class Map
Defining a Class Map Description
Defining Remote Network Management Protocol Match Criteria
Creating a Layer 3 and Layer 4 Remote Access Policy Map
Defining Management Traffic Policy Actions
Configuring Telnet Management Sessions
Configuring SSH Management Sessions
Configuring Maximum Number of SSH Sessions
Terminating an Active User Session
Enabling ICMP Messages To the ACE
Directly Accessing a User Context Through SSH
Showing Telnet Session Information
Showing SSH Session Information
Showing SSH Session Information
Enabling Remote Access to the ACE
This chapter describes how to configure remote access to the Cisco Application Control Engine (ACE) module by establishing a remote connection using the Secure Shell (SSH) or Telnet protocols. It also describes how to configure the ACE to provide direct access to a user context from SSH. This chapter also covers how to configure the ACE to receive ICMP messages from a host.
This chapter includes the following major sections:
•
Remote Access Configuration Quick Start
•
•
•
•
•
•
Refer to Chapter 1, Setting Up the ACE for details on:
•
•
•
Remote Access Configuration Quick Start
Table 2-1 provides a quick overview of the steps required to configure remote network management access for the ACE. Each step includes the CLI command required to complete the task.
Configuring Remote Network Management Traffic Services
You configure rules for remote access to the ACE through the use of class maps, policy maps, and service policies. The following items summarize the role of each function in configuring remote network management access to the ACE:
•
–
–
•
•
This section provides an overview on creating a class map, policy map, and service policy for remote network access. For detailed information on creating class maps, policy maps, and service policies, refer to Chapter 4, Configuring Class Maps and Policy Maps.
Telnet and SSH remote access sessions are established to the ACE on a per context basis. For details on creating users and contexts, refer to the Cisco Application Control Engine Module Virtualization Configuration Guide.
This section includes the following topics:
•
•
Creating and Configuring a Remote Management Class Map
To create a Layer 3 and Layer 4 class map to classify the remote network management traffic received by the ACE, use the class-map type management configuration command. This command permits network management traffic to be received by the ACE by identifying the incoming IP protocols that the ACE can receive as well as the client source IP address and subnet mask as the matching criteria. A class map of type management defines the allowed network traffic as a form of management security for protocols such as SSH, Telnet, and ICMP.
There can be multiple match commands in a class map. You can configure class maps to define multiple management protocol and source IP address match commands in a group that you then associate with a traffic policy. The match-all and match-any keywords determine how the ACE evaluates multiple match statements operations when multiple match criteria exist in a class map.
The syntax of this command is:
class-map type management [match-all | match-any] map_name
The keywords, arguments, and options are:
•
–
–
The default setting is to meet all of the match criteria (match-all) in a class map.
•
The CLI enters the class map management configuration mode. To classify the remote network management traffic received by the ACE, include one or more of the associated commands to configure the match criteria for the class map:
•
•
You may include multiple match protocol commands in a class map.
For example, to allow SSH and Telnet access to the ACE from IP address 172.16.10.0, enter:
host1/Admin(config)# class-map type management match-all SSH-TELNET_ALLOW_CLASShost1/Admin(config-cmap-mgmt)# match protocol ssh source-address 172.16.10.0 255.255.255.254host1/Admin(config-cmap-mgmt)# match protocol telnet source-address 172.16.10.0 255.255.255.254host1/Admin(config-cmap-mgmt)# exithost1/Admin(config)#To remove a Layer 3 and Layer 4 network management class map from the ACE, enter:
host1/Admin(config)# no class-map type management match-all SSH-TELNET_ALLOW_CLASSDefining a Class Map Description
Use the description command to provide a brief summary about the Layer 3 and Layer 4 remote management class map.
Access the class map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to specify a description that the class map is to allow remote Telnet access, enter:
host1/Admin(config)# class-map type management TELNET-ALLOW_CLASShost1/Admin(config-cmap-mgmt)# description Allow Telnet access to the ACETo remove the description from the class map, enter:
host1/Admin(config-cmap-mgmt)# no descriptionDefining Remote Network Management Protocol Match Criteria
Use the match protocol command to configure the class map to identify the remote network access management protocols that can be received by the ACE. You configure the associated policy map to permit access to the ACE for the specified management protocols. As part of the network management access traffic classification, you also specify either a client source host IP address and subnet mask as the matching criteria or instruct the ACE to allow any client source address for the management traffic classification.
Access the class map configuration mode to specify the match protocol command.
The syntax of this command is:
[line_number] match protocol {http | https | icmp | snmp | ssh | telnet} {any | source-address ip_address mask}
•
•
•
•
•
•
Note
•
•
•
•
•
For example, to specify that the class map allows SSH access to the ACE, enter:
host1/Admin(config)# class-map type management SSH-ALLOW_CLASShost1/Admin(config-cmap-mgmt)# match protocol ssh source-address 172.16.10.0 255.255.255.254To deselect the specified network management protocol match criteria from the class map, enter:
host1/Admin(config-cmap-mgmt)# no match protocol ssh source-address 172.16.10.0 255.255.255.254Creating a Layer 3 and Layer 4 Remote Access Policy Map
The following procedure outlines the general steps to configure a Layer 3 and Layer 4 policy map that defines the actions executed on remote network management traffic that match the specified classifications.
1.
policy-map type management first-match map_name
The map_name argument specifies the name assigned to the Layer 3 and Layer 4 network management policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
The CLI The CLI enters the policy map management configuration mode.
For example, to create a Layer 3 and Layer 4 network traffic management policy map, enter:
host1/Admin(config) #policy-map type management first-match REMOTE_MGMT_ALLOW_POLICYhost1/Admin(config-pmap-mgmt) #To remove a policy map from the ACE, enter:
host1/Admin(config) #no policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY2.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to specify a description that the policy map is to allow remote Telnet access, enter:
host1/Admin(config-pmap-mgmt)# description Allow Telnet access to the ACETo remove a description from the policy map, enter:
host1/Admin(config-pmap-mgmt)# no description3.
class map_name
The map_name argument specifies the name of a previously defined traffic class, configured with the class-map command, to associate traffic to the traffic policy. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
The CLI enters the policy map management class configuration mode.
For example, to specify an existing class map within the Layer 3 and Layer 4 remote access policy map, enter:
host1/Admin(config-pmap-mgmt)# class L4_REMOTE_ACCESS_CLASShost1/Admin(config-pmap-mgmt-c)#To remove a class map from a Layer 3 and Layer 4 policy map, enter:
host1/Admin(config-pmap-mgmt)# no class L4_REMOTE_ACCESS_CLASS4.
The syntax of this command is:
class map_name1 insert-before map_name2
The arguments are:
–
–
For example, to use the insert-before command to define the sequential order of two class maps in the policy map, enter:
host1/Admin(config-pmap-c)# class L4_SSH_CLASS insert-before L4_REMOTE_ACCESS_CLASS5.
For example, to use the class class-default command, enter:
host1/Admin(config-pmap)# class class-defaulthost1/Admin(config-pmap-c)#The CLI enters the policy map class configuration mode.
6.
For example, to specify a traffic management action for the Layer 3 and Layer 4 policy map, enter:
host1/Admin(config) #policy-map type management first-match REMOTE_MGMT_ALLOW_POLICYhost1/Admin(config-pmap-mgmt)# class SSH-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c)# permithost1/Admin(config-pmap-mgmt-c)# exithost1/Admin(config-pmap-mgmt)# class TELNET-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c) #permitDefining Management Traffic Policy Actions
Use the permit command in policy map class configuration mode to permit the remote network management protocols listed in the class map to be received by the ACE.
The syntax of this command is:
permit
Use the deny command in policy map class configuration mode to deny the remote network management protocols listed in the class map to be received by the ACE.
The syntax of this command is:
deny
For example, to create a Layer 3 and Layer 4 remote network traffic management policy map that permits SSH, Telnet, and ICMP connections to be received by the ACE, enter:
host1/Admin(config) #policy-map type management first-match REMOTE_MGMT_ALLOW_POLICYhost1/Admin(config-pmap-mgmt)# class SSH-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c) #permithost1/Admin(config-pmap-mgmt-c)# exithost1/Admin(config-pmap-mgmt)# class TELNET-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c) #permithost1/Admin(config-pmap-mgmt-c)# exithost1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c) #permithost1/Admin(config-pmap-mgmt-c)# exitFor example, to create a policy map that restricts an ICMP connection by the ACE, enter:
host1/Admin(config) #policy-map type management first-action ICMP_RESTRICT_POLICYhost1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c)# denyApplying a Service Policy
Use the service-policy command to:
•
•
•
The service-policy command is available at both the interface configuration mode and at the configuration mode. Specifying a policy map in the interface configuration mode applies the polciy map to a specific VLAN interface. Specifying a policy map in the configuration mode applies the policy to all of the VLAN interfaces associated with a context.
The syntax of this command is:
service-policy input policy_name
The keywords, arguments, and options are:
•
•
For example, to specify an interface VLAN and apply the remote access policy map to a VLAN, enter:
host1/Admin(config)# interface vlan 50host1/Admin(config-if)# ip address 172.16.1.100 255.255.0.0host1/Admin(config-if)# service-policy input REMOTE_MGMT_ALLOW_POLICYFor example, to globally apply the remote access policy map to all of the VLANs associated with a context, enter:
host1/Admin(config)# service-policy input REMOTE_MGMT_ALLOW_POLICYTo detach the remote access traffic policy from an interface, enter:
host1/Admin(config-if)# no service-policy input REMOTE_MGMT_ALLOW_POLICYTo globally detach the remote access traffic policy from all VLANs associated with a context, enter:
host1/Admin(config)# no service-policy input REMOTE_MGMT_ALLOW_POLICYWhen you detach a traffic policy either:
•
•
the ACE automatically resets the associated service policy statistics. The ACE performs this action to provide a new starting point for the service policy statistics the next time you attach a traffic policy to a specific VLAN interface or globally to all VLAN interfaces in the same context.
Note the following when creating a service policy:
•
•
•
To display service policy statistics for a Layer 3 and Layer 4 remote network traffic management policy map, use the show service-policy command in Exec mode.
The syntax of this command is:
show service-policy policy_name [detail]
The keywords, options, and arguments are as follows:
•
•
Note
For example, to display service policy statistics for the REMOTE_MGMT_ALLOW_POLICY policy map, enter:
host1/Admin# show service-policy REMOTE_MGMT_ALLOW_POLICYStatus : ACTIVEDescription: Allow mgmt protocols-----------------------------------------Context Global Policy:service-policy: REMOTE_MGMT_ALLOW_POLICYTo clear the service policy statistics, use the clear service-policy command. The syntax of this command is:
clear service-policy policy_name
For the policy_name argument, enter the identifier of an existing policy map that is currently in service (applied to an interface).
For example, to clear the statistics for the policy map REMOTE_MGMT_ALLOW_POLICY that is currently in service, enter:
host1/Admin# clear service-policy REMOTE_MGMT_ALLOW_POLICYConfiguring Telnet Management Sessions
The ACE supports the following maximum number of concurrent Telnet management sessions:
•
•
Use the telnet maxsessions command in configuration mode to control the maximum number of Telnet sessions allowed for each context. The ACE supports a total maximum of 256 concurrent Telnet sessions.
Telnet remote access sessions are established on the ACE on a per context basis. You can create a context, assign an interface and IP address to it, and then log into the ACE by Telneting to that IP address. This capability allows you to specify a particular context when accessing the ACE. For details on creating users and contexts, refer to the Cisco Application Control Engine Module Virtualization Configuration Guide.
The syntax of this command is:
telnet maxsessions max_sessions
The max_sessions argument sets the maximum number of concurrent Telnet sessions allowed for the associated context. The range is 1 to 4 Telnet sessions per user context; 1 to 16 Telnet sessions for the Admin context. The defaults are 4 (user context) and 16 (Admin context).
For example, to configure the maximum number of concurrent Telnet sessions to 3 in the Admin context, enter:
host1/Admin(config)# telnet maxsessions 3To revert to the default of 16 Telnet sessions for the Admin context, enter:
host1/Admin(config)# no telnet maxsessionsConfiguring SSH Management Sessions
This section includes the following topics:
•
•
SSH remote access sessions are established on the ACE on a per context basis. You can create a context, assign an interface and IP address to it, and then log into the ACE by using specifying an SSH session to that IP address. This capability allows you to specify a particular context when accessing the ACE. For details on creating users and contexts, refer to the Cisco Application Control Engine Module Virtualization Configuration Guide.
Configuring Maximum Number of SSH Sessions
The ACE supports the following maximum number of concurrent SSH management sessions:
•
•
Use the ssh maxsessions command in configuration mode to control the maximum number of SSH sessions allowed for each context. The ACE supports a total maximum of 256 concurrent SSH sessions.
The syntax of this command is:
ssh maxsessions max_sessions
The max_sessions argument sets the maximum number of concurrent SSH sessions allowed for the associated context. The range is 1 to 4 SSH sessions per user context; 1 to 16 SSH sessions for the Admin context. The defaults are 4 (user context) and 16 (Admin context).
For example, to configure the maximum number of concurrent SSH sessions in the Admin context to 3, enter:
host1/Admin(config)# ssh maxsessions 3To revert to the default of 16 Telnet sessions for the Admin context, enter:
host1/Admin(config)# no ssh maxsessionsGenerating SSH Host Key Pairs
The ACE supports remote login over an SSH session that uses private and public key pairs to perform authentication for the context. DSA and RSA keys are generated in pairs—one public key and one private key. With this method of remote connection, use a generated private and public key pair to participate in a secure communication by encrypting and decrypting messages.
The global administrator performs the key generation in the Admin context. All contexts associated with the ACE share the common key. There is only a single host-key pair.
Note
Ensure that you have an SSH host key pair with the appropriate version before enabling the SSH service. The SSH service accepts three types of key pairs for use by SSH versions 1 and 2. Generate the SSH host key pair according to the SSH client version used. The number of bits specified for each key pair ranges from 768 to 4096.
Use the ssh key command in configuration mode to generate the SSH private key and the corresponding public key for use by the SSH server.
The syntax of this command is:
ssh key {dsa | rsa | rsa1} [bits [force]]
The arguments, keywords, and options are:
•
•
•
•
•
Before you generate the key, set the host name and the domain name. These two settings are used in the key. Refer to Chapter 1, Setting Up the ACE, for details on setting a hostname and to the Cisco Application Control Engine Module Virtualization Configuration Guide for details on configuring a domain.
For example, to generate an RSA1 key pair in the Admin context, enter:
host1/Admin(config)# ssh key rsa1 1024generating rsa1 key.....generated rsa1 keyTo remove the SSH host key pair, enter:
host1/Admin(config)# no ssh key rsa1To clear the public keys of all trusted hosts, use the clear ssh hosts Exec command. These keys are either sent to an SSH client by an SSH server or are entered manually. When a SSH connection is made from the ACE, the SSH client receives the public key and stores it locally. To clear all of these keys, use the clear ssh hosts command in Exec mode.
Terminating an Active User Session
To terminate an active SSH or Telnet session for the active context, use one of the following commands in Exec mode:
•
•
The arguments, keywords, and options are:
•
•
For example, to terminate an SSH session, enter:
host1/Admin # clear ssh 345Enabling ICMP Messages To the ACE
By default, the ACE does not allow ICMP messages to be received by an ACE interface or to pass through the ACE interface. ICMP is an important tool for testing your network connectivity; however, it can also be used to attack the ACE or your network. We recommend allowing ICMP during your initial testing, but then disallowing it during normal operation.
To permit or deny address(es) to reach an ACE interface with ICMP messages, either from a host to the ACE, or from the ACE to a host which requires the ICMP reply to be allowed back, configure a:
•
•
•
See the "Configuring Remote Network Management Traffic Services" section for details on configuring a network management class map, policy map, and service policy for the ACE.
To allow ICMP messages to pass through the ACE, configure an ICMP ACL to permit or deny network connections based on the ICMP type (for example, echo, echo-reply, unreachable). Refer to the Cisco Application Control Engine Module Security Configuration Guide for details.
Note
For example, to allow the ACE to receive ICMP pings, enter the following commands:
host1/Admin(config)# class-map type management match-all ICMP-ALLOW_CLASShost1/Admin(config-cmap-mgmt)# description Allow ICMP packetshost1/Admin(config-cmap-mgmt)# match protocol icmp source-address 172.16.10.0 255.255.255.254host1/Admin(config-cmap-mgmt)# exithost1/Admin(config)# policy-map type management first-action ICMP_ALLOW_POLICYhost1/Admin(config-pmap-mgmt)# class ICMP-ALLOW_CLASShost1/Admin(config-pmap-mgmt-c)# permithost1/Admin(config-pmap-mgmt-c)# exithost1/Admin(config-pmap-mgmt)# exithost1/Admin(config)# interface vlan 50host1/Admin(config-if)# ip address 172.16.1.100 255.255.0.0host1/Admin(config-if)# service-policy input ICMP_ALLOW_POLICYDirectly Accessing a User Context Through SSH
As the global administrator, from the Admin context you can configure a user context and enable direct login access to that user context from a remote SSH session. The following summarize the sequence of steps to configure the ACE to provide direct access to a user context from SSH:
1.
host1/Admin(config)# context C1host1/Admin(config-context)#2.
host1/Admin(config-context)# allocate-interface vlan 1003.
host1/Admin(config-context)# ssh key rsa1 1024generating rsa1 key.....generated rsa1 key4.
host1/Admin(config-context)# do changeto C1host1/C1(config-context)# exithost1/C1(config)#5.
host1/C1(config)# interface vlan 50host1/C1(config-if)# ip address 192.168.1.1 255.255.255.0host1/C1(config-if)# no shutdownhost1/C1(config-if)# exithost1/C1(config)#6.
host1/C1(config)# class-map type management match-all SSH-ALLOW_CLASShost1/C1(config-cmap-mgmt)# match protocol ssh source-address 172.16.10.0 255.255.255.254host1/C1(config-cmap-mgmt)# exithost1/C1(config)#host1/C1(config) #policy-map type management first-match REMOTE_MGMT_ALLOW_POLICYhost1/C1(config-pmap-mgmt)# class SSH-ALLOW_CLASShost1/C1(config-pmap-mgmt-c)# permithost1/C1(config-pmap-mgmt-c)# exithost1/C1(config)# interface vlan 50host1/C1(config-if)# ip address 192.168.1.1 255.255.255.0host1/C1(config-if)# service-policy input REMOTE_MGMT_ALLOW_POLICYhost1/C1(config-if)# exithost1/C1(config)#7.
host1/C1(config)# ip route 0.0.0.0 255.255.255.0 192.168.4.8To directly access the user context from an SSH client:
1.
2.
host1/C1#Viewing Session Information
This section includes the following procedures:
•
•
Showing Telnet Session Information
Use the show telnet command in Exec mode to display information related to the Telnet session. Only the context administrator can view Telnet information associated with a particular context.
The syntax of this command is:
show telnet [context_name]
The optional context_name argument specifies the name of the context for which you want to view specific Telnet session information. The context_name argument is case-sensitive.
For example, enter:
host1/Admin# show telnetTable 2-2 describes the fields in the show telnet command output.
Use the show telnet maxsessions command in Exec mode to display the maximum number of enabled Telnet sessions. Only context administrators can view Telnet session information associated with a particular context.
The syntax of this command is:
show telnet maxsessions [context_name]
The optional context_name argument specifies the name of the context for which you want to view the maximum number of Telnet sessions. The context_name argument is case-sensitive.
For example, enter:
host1/Admin# show telnet maxsessionsMaximum Sessions Allowed is 4Showing SSH Session Information
This section contains the following procedures:
•
Showing SSH Session Information
Use the show ssh session-info command in Exec mode to display information related to the SSH session. Only context administrators can view SSH session information associated with a particular context.
The syntax of this command is:
show ssh session-info [context_name]
The optional context_name argument specifies the name of the context for which you want to view specific SSH session information. The context_name argument is case-sensitive.
For example, enter:
host1/Admin# show ssh session-infoTable 2-3 describes the fields in the show ssh session-info command output.
Use the show ssh maxsessions command in Exec mode to display the maximum number of enabled SSH sessions. Only context administrators can view SSH session information associated with a particular context.
The syntax of this command is:
show ssh maxsessions [context_name]
The optional context_name argument specifies the name of the context that the context administrator wants to view the maximum number of SSH sessions. The context_name argument is case-sensitive.
For example, enter:
host1/Admin# show ssh maxsessionsMaximum Sessions Allowed is 4(SSH Server is enabled)Showing SSH Key Details
Use the show ssh key command in Exec mode to display the host key pair details for the specified key or for all keys if you do not specify a key.
The syntax of this command is:
show ssh key [dsa | rsa | rsa1]
The arguments, keywords, and options are:
•
•
•
For example, enter:
host1/Admin # show ssh key**************************************could not retrieve rsa1 key information**************************************rsa Keys generated:Tue Mar 7 19:37:17 2006ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA4v4DQ8aNl482qDTRju9G07hEIxCgTWanPm+WOCU1ki hZQNd5ZwA50CBAJSfIIIB4iED6iQbhOkbXSneCvTb5mVoish2wvJrETpIDIeGxxh/jWVsU/M eBbA/7o5tvgCeT6p7pGF5oUNYFP0OeZ9BiIWDc4jBmYEQLEqJHPrMhSFE=bitcount:1024fingerprint:f5:55:00:18:bc:af:41:74:b6:bc:aa:8e:46:31:74:4f**************************************dsa Keys generated:Tue Dec 20 19:37:17 2005ssh-dss AAAAB3NzaC1kc3MAAACBAPqDdEqU+0gNtKRXM+DQAXnvcB+H89nq8jA4WgJ7uQcuDCLaG7 LqjtKTltJjA6aZVywsQWQ6n4kTlkavZy3cj6PUbSyqvmCTsaYyYo4UQ6CKrK9V+NsfgzTSLW TH8iDUvYjLc3nU51QEKjy7mPsQeX31y1M1rhp8qhkbMKxkc49XAAAAFQCPM0QJrq6+kkaghJpeNxeXhU H9HwAAAIEAkeZ1ZJM6sfKqJDYPLHkTro+lpbV9uR4VyYoZmSoehi/LmSaZDq+Mc8UN1LM+i5vkOgnKce arD9lM4/hKzZGYx5hJOiYCKj/ny2a5p/8HK152cnsOAg6ebkiTTWAprcWrcHDS/1mcaI5GzLrZCdlXW5 gBFZtMTJGstICmVWjibewAAACBAJQ66zdZQqYiCWtZfmakridEGDTLV6ixIDjBNgb84qlj+Y1XMzqLL0 D4oMSb7idEL3BmhQYQW7hkTK0oS4kVawI1VmW2kvrqoGQnLNQRMvisAXuJWKk1Ln6vWPGZZe8KoALv0G XxsOv2gk/zTDk01oCaTVw//bXJtoVRgIlWXLIPbitcount:1024fingerprint:8e:13:5c:3e:1a:9c:7a:ed:d0:84:eb:96:12:db:82:be**************************************
