-
Cisco Anomaly Guard Module Configuration Guide (Software Version 4.0)
-
Index
-
Preface
-
Introduction
-
Configuring the Guard Module on the Supervisor Engine Module
-
Initializing the Guard Module
-
Configuring the Guard Module
-
Configuring Zone Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Interactive Protect Mode
-
Attack Reports
-
Guard Module Diagnostics and Maintenance
-
Analyzing Guard Module Mitigation
-
Glossary
-
Table Of Contents
Activating Guard Module Services
Configuring Authentication Methods
Configuring Local Authentication
Configuring TACACS+ Server Connection
Configuring the TACACS+ Server IP Address
Configuring TACACS+ Server Encryption Key
Configuring TACACS+ Server Connection Timeout
Displaying TACACS+ Server Statistics
Viewing the Guard Module Configuration
Configuring SNMP Community Strings
Flex Filter Default Configurations
Configuring the Guard Module
This chapter describes how to configure the Cisco Anomaly Guard Module (Guard module). These configuration procedures lay the foundation for Guard module management and diversion related communication.
This chapter includes the following major sections:
•
Activating Guard Module Services
•
•
•
Activating Guard Module Services
You can define which Guard module services are active. The service must be enabled and access to the service permitted to enable proper functionality. You can control the activation of the Guard module services and grant or deny permission from a specific IP address and thus limit the IP addresses from which the Guard module is accessed and controlled.
The Guard module services include the following:
•
•
•
•
To activate a Guard module service perform the following steps:
Step 1
service {ntp | snmp-server | snmp-trap | wbm}By default, all Guard module services, except SSH, are disabled.
Step 2
permit service ip-addr [ip-mask]Table 4-1 provides the arguments for the permit command.
Caution
For example:
admin@GUARD-conf# service ntpadmin@GUARD-conf# permit ntp 192.168.10.35Configuring Access Control
Access control is the way you control who is allowed access to the network server and what services they are allowed to use once they have access. Authentication and Authorization network security services provide the primary framework through which you set up access.
•
•
The following sections describe how to configure access control:
•
Configuring Authentication
You can configure which authentication method the Guard module uses when a user tries either to log into the Guard module or requests a higher privilege level (using the enable command). The Guard module offers the following authentication options:
•
•
You can configure a sequential authentication list. The authentication list defines the authentication methods used to authenticate a user. This enables you to designate one or more methods to be used for authentication. Thus, a backup system for authentication is provided, in case the initial method fails.
The Guard module uses the first method listed to authenticate users; if that method does not respond, the Guard module selects the second authentication method. Only if both authentication methods are exhausted, the authentication fails.
You can configure a distributed authentication scheme. The Guard module uses the first TACACS+ server to authenticate users. If the authentication returns a rejection, the Guard module scans the TACACS+ server list and the alternative authentication method (local), if one exists. Only if the list is exhausted, the authentication fails. This option is valid only if you do not configure the first-hit option.
Caution
Configuring Authentication Methods
To configure the authentication method the Guard module uses, perform the following steps:
Step 1
Step 2
aaa authentication {enable | login} {local | tacacs+} [tacacs+ | local]Table 4-2 provides the arguments for the aaa authentication command.
The following example shows how to configure authentication on entering a higher privilege level. The primary authentication method is configured to TACACS+ and the secondary authentication method is configured to the local user database:
admin@GUARD-conf# aaa authentication enable tacacs+ localConfiguring Local Authentication
The Guard module initially has a preconfigured user name with administration privileges, which enable you to create new users. User definition enables you to divide the Guard module user community into domains, and to assign passwords as required for secure management access.
To enable authentication of CLI users with a TACACS+ server, see the "Configuring Authentication" section.
Note
Adding a User
To add a user to the Guard module local database, enter the following command:
username username {admin | config | dynamic | show} [password]
Table 4-3 provides the arguments and keywords for the username command.
Table 4-3 Arguments and Keywords for the username Command
username
The user name. A case-sensitive alphanumeric string from 1 to 63 characters that starts with a letter. The string cannot contain spaces but can contain underscores.
admin | config | dynamic | show
The user privilege level. See Table 3-1 for further details.
password
(Optional) A password. Enter a case-sensitive, 6 to 24 characters long, string with no spaces. If you do not enter a password, you will be prompted for it.
For example:
admin@GUARD-conf# username Robbin config 1234
Note
username Jose config encrypted 840xdMk3
The encrypted keyword indicates that the password is encrypted and saved. The Guard module displays the encrypted password and not the password you enter to log in.To remove a user from the Guard module user list, enter the following command:
no username username
Tip
Changing a Password
You can change your own password. Administrators can change their own password and any other user's password.
To change your own password, perform the following steps:
Step 1
passwordStep 2
Step 3
For example:
admin@GUARD# passwordOld Password: <old-password>New Password: <new-password>Retype New Password: <new-password>An administrator can change the password of other users.
To change the password of a user, perform the following steps:
Step 1
password username-passwordThe username-password argument is the user whose password you are changing.
Step 2
In this example, the administrator changes the password of the user John.
admin@GUARD# password JoseNew Password: <new-password>Retype New Password: <new-password>Configuring Authorization
You can limit the services available to a user. When authorization is enabled, the Guard module verifies the user profile to verify the user access rights. The user is granted access to the requested service only if the information in the user profile allows it. The authorization database is stored locally. It uses configured user profiles for command group access control. Authorization is defined for all commands at the specified privilege level.
Access to Guard services depends on the user privilege level. You can limit the services available to a user. The Guard module checks the user profile to verify the user access rights. Once authorized, the user is granted access to the requested service only if the information in the user profile allows it. See Table 3-1 for information on user privilege levels.
Assigning Privilege Levels with Passwords
An administrator can set passwords that restrict access to user privilege levels.
To set a local password to control access to a privilege level, enter the following command:
enable password [level level] [password]
Table 4-4 provides the arguments for the enable password command.
Table 4-4 Arguments for the enable password Command
(Optional) The required privilege level. This can be one of the following: admin, config, dynamic, show. See Table 3-1 for further details. The default level is admin.
(Optional) The password for the privilege level. Enter a case-sensitive, 6 to 24 characters long, string with no spaces. If you do not enter a password, you will be prompted for it.
For example:
admin@GUARD-conf# enable password level admin <password>Moving between User Privilege Levels
Authorized users can move between user privilege levels. To move between user privilege levels, perform the following steps:
Step 1
enable [level]The level argument specifies the required privilege level. This can be one of the following: admin, config, dynamic. The default level is admin. See Table 3-1 for further details.
Step 2
For example:
admin@GUARD> enable adminEnter enable admin Password: <password>To switch back to the lower privilege level (show) use the disable command.
Configuring TACACS+ Server Connection
The TACACS+ server configuration includes the following:
•
•
•
•
Caution
The Guard module user privilege levels relate to the TACACS+ privilege numeration as follows:
•
•
•
•
Configuring the TACACS+ Server IP Address
You can configure the Guard module to use a sequential list of TACACS+ servers for authentication. The Guard module uses the TACACS+ server listed to authenticate users; if that server does not respond, the Guard module selects the second server. Only if all servers listed are exhausted, authentication fails.
Alternatively, you can configure the Guard module to use only the first TACACS+ server on the list to authenticate users (see the "Configuring TACACS+ Search" section for further details).
You must define the IP address of each TACACS+ server on the list. You can define up to nine TACACS+ servers.
To add a TACACS+ server to the list and assign its IP address, enter the following command:
tacacs-server host ip-address
The ip-address argument specifies the IP address of the TACACS+ server.
The TACACS+ servers are added to the list in the order in which you enter them. You can add up to nine servers to the list.
For example:
admin@GUARD-conf# tacacs-server host 192.168.33.45Configuring TACACS+ Server Encryption Key
You must configure the encryption key to access a TACACS+ server. The key entered as part of the command must match the key on the TACACS+ servers. The key can not contain spaces.
To configure the server encryption access key, enter the following command:
tacacs-server key tacacs-key
The argument tacacs-key is an alphanumeric string.
Note
The following example shows how to set the TACACS+ server encryption key to TacacsKey.
admin@GUARD-conf# tacacs-server key <TacacsKey>Configuring TACACS+ Search
You can configure the Guard module to regard an authentication rejection as final and stop further search with other TACACS+ servers or the local authentication method. The Guard module, in this case, does not fall back to the local authentication method, and does not move on to the next configured TACACS+ server (if one exists).
If you do not configure the TACACS+ search method to first-hit, the Guard module, by default, tries all TACACS+ servers in its list to authenticate a user.
Note
To configure the Guard module to use only the first TACACS+ server on the list to authenticate users, enter the following command:
tacacs-server first-hit
For example:
admin@GUARD-conf# tacacs-server first-hitConfiguring TACACS+ Server Connection Timeout
You can configure the timeout for the Guard module to wait for a reply from the TACACS+ server. When the timeout ends, the Guard module either attempts to establish a connection with the next TACACS+ server (if such a server was configured) or falls back to local authentication (if such fallback was configured). Authentication fails if no fallback method is configured.
Note
To configure the TACACS+ server connection timeout enter the following command:
tacacs-server timeout timeout
The timeout argument specifies the timeout in seconds.
For example:
admin@GUARD-conf# tacacs-server timeout 600
Tip
Displaying TACACS+ Server Statistics
You can display statistical information related to the TACACS+ servers. Statistical data is provided for each server.
To display TACACS+ related statistics, use the show tacacs statistics command.
To clear the TACACS+ statistics, use the clear tacacs statistics command.
For example:
admin@GUARD-conf# show tacacs statisticsServer 10.56.36.63:PASS FAIL ERRORAuthentication 11 5 0Authorization 0 0 0Accounting 11 N/A 0Server 10.56.36.64:PASS FAIL ERRORAuthentication 0 5 0Authorization 0 0 0Accounting 0 N/A 0
Table 4-5 displays the fields in the show tacacs statistics command output.
Viewing the Guard Module Configuration
You can display the Guard module configuration file. This file includes information relating to the Guard module configuration such as interface IP addresses, default Gateway address and configured zones.
To display the Guard module configuration file, enter the following command:
show running-config [all | Guard module | interfaces interface-name | self-protection | zones]]
Table 4-6 provides the keywords for the show running-config command.
For example:
admin@GUARD# show running-config guardThe configuration file consists of the commands that are executed to configure the Guard module with the current settings. You can export the Guard module configuration file to a remote FTP server for backup purposes, or to enable implementing the Guard module configuration parameters on another Guard module. See the "Copying Guard Module Configuration" section for further details.
Configuring Date and Time
To set the time and the date, enter the following command:
date MMDDhhmm[[CC]YY][.ss]
Table 4-7 provides the arguments and keywords for the date command.
The following example shows how to configure the date to October 8 of the year 2003, and the time to 5:10 pm (1710) and 17 seconds.admin@GUARD-conf# date 1008171003.17Wed Oct 8 17:10:17 EDT 2003Managing SSH Keys
The following sections describe how you can manipulate the Guard module SSH key list:
Adding SSH Keys
To enable SSH connection without the need to enter a login and password, add the remote connection SSH public key to the Guard module SSH key list.
Enter the following command:
key add [user-name] {ssh-dsa | ssh-rsa} key-string comment
Table 4-8 provides the arguments and keywords for the key add command.
For example:
admin@GUARD-conf# key add ssh-rsa 14513797528175730. . .user@Guard module.comDeleting SSH Keys
You can remove an SSH key from the list. If you remove the SSH key, you will have to authenticate the next time you establish an SSH session with the Guard module.
To remove an SSH key from the Guard module, enter the following command:
key remove [user-name] key-string
Table 4-9 provides the arguments for the key remove command.
For example:
admin@GUARD-conf# show keys Lilacssh-rsa 2352345234523456... user@Guard module.comadmin@GUARD-conf# key remove Lilac ssh-rsa 2352345234523456...Changing the Host Name
You can change the Guard module host name. This change takes effect immediately, and the new host name is automatically integrated into the CLI prompt string.
To change the Guard module host name, enter the following command:
hostname name
The name argument specifies the new host name.
For example:
admin@GUARD-conf# hostname CiscoGuardadmin@CiscoGuard-conf#Enabling SNMP Traps
You can configure the Guard module to send SNMP traps and notify the manager of significant events that occur on the Guard module. You can configure the Guard module SNMP trap generator and define the trap information scope.
A trap is logged in the Guard module event log and displayed in the event monitor when a trap condition occurs, regardless of whether the SNMP agent sends the trap.
To configure the Guard module to send SNMP traps, perform the following steps:
Step 1
service snmp-trapStep 2
snmp trap-dest ip-address [community-string [min-severity]]Table 4-10 provides the arguments for the snmp trap-dest command.
To delete SNMP trap generator parameters use the no snmp trap-dest command. Use * to remove all SNMP trap destination parameters.
The following example shows that traps with a severity level equal to or higher than errors are sent to the destination IP address 192.168.100.52 with the SNMP community string of tempo.
admin@GUARD-conf# snmp trap-dest 192.168.100.52 tempo errorsConfiguring SNMP Community Strings
You may access the Guard module SNMP server and retrieve information as defined by the Management Information Base 2 (MIB2) and the Riverhead proprietary MIB. The community string acts like a password and permits read access from the Guard module SNMP agent. You can configure the Guard module SNMP community string and thus enable access to the SNMP agent from clients in different organizational units and with different community strings.
To add an SNMP community string, enter the following command:
snmp community community-string
The community-string argument specifies the desired Guard module community string. The string can have a maximum length of 15 alphanumeric characters and cannot contain spaces. The Guard module default community string is riverhead. You can specify as many community names as you wish. To delete a community string, use the no cummunity string command.
For example:
admin@GUARD-conf# snmp community tempoGuard Module Self-Protection
The Guard module, as a network element having an independent IP address, is exposed to potential DDoS attacks. The default configuration provides protection against such attacks. You can access the self-defense protection configuration and modify it.
Caution
To change the Guard module self-defense protection configuration, you must enter self-protection configuration mode.
To enter self-protection configuration mode, enter the following command in configuration mode:
self-protection
The set of commands available for the Guard module self-defense protection is identical to that of an ordinary zone. See "Configuring Zones", "Configuring Zone Filters", "Configuring Policy Templates and Policies" and "Interactive Protect Mode" for further details on zone configuration.
To display the Guard module self-protection configuration file, use the show running-config command. See "Viewing the Guard Module Configuration" for further details.
Flex Filter Default Configurations
The Guard module Flex filter is configured, by default, to block (drop) all traffic flows, unless explicitly specified. Table 4-11 displays the Flex filter default configuration to enable communication required for proper Guard module functionality.
The Flex filter default configuration consists the following:
•
•
•
•
•
•
•
•
•
•
•
•
