Downloads |
Table Of Contents
Roles of the USB eToken and the USB Flash
Functionality Differences Between an eToken and a USB Flash
How to Set Up and Use USB Modules on Cisco Routers
Storing the Configuration on an External USB Flash Drive or eToken
Accessing and Setting Up the eToken
Use of RSA Keys with an eToken
Setting Administrative Functions on the eToken
Troubleshooting USB Flash Drives and eTokens
The show usb controllers Command
Configuration Examples for Secure Token Support
Logging Into and Saving RSA Keys to eToken: Example
crypto pki token removal timeout
crypto pki token secondary config
USB Storage
The USB Storage feature enables certain models of Cisco routers to support USB flash modules and with SmartCard technology (which is owned by Aladdin Knowledge Systems) in a USB key form factor (also referred to as a USB eToken) to provide secure access to a router.
USB eTokens provides secure configuration distribution and allows users to store Virtual Private Network (VPN) credentials for deployment. USB flash drives allow users to store images and configurations external to the router.
Feature History for USB Storage
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for USB Storage
•
•
•
Prerequisites for USB Storage
Before you can use a USB Flash module or an eToken, you should have the following system requirements:
•
•
•
•
Restrictions for USB Storage
•
•
•
Information About USB Storage
To use a USB flash module and a secure eToken on your router, you should understand the following concepts:
•
Roles of the USB eToken and the USB Flash
Both USB eTokens and USB flash modules can be used to store files (such as router configurations). The following sections discuss how each device functions and describe the differences between each device:
•
How a USB eToken Works
A SmartCard is a small plastic card, containing a microprocessor and memory that allows you to store and process data. A SmartCard eToken is a SmartCard with a USB interface. The eToken can securely store any type of file within its available storage space (32KB). Configuration files that are stored on the eToken can be encrypted and accessed only via a user PIN. The router will not load the configuration file unless the proper PIN has been configured for secure deployment of router configuration files.
After you plug the eToken into the router, you must log into the eToken; thereafter, you can change default settings, such as the user PIN (default: 1234567890) and the allowed number of failed login attempts before future logins are refused (default: 15 attempts). For more information on accessing and configuring the eToken, see the section "Accessing and Setting Up the eToken."
After you have successfully logged into the eToken, you can copy files from the router on to the eToken via the copy command. By default, after the eToken is removed from the router, all associated RSA keys are removed; IPSec tunnels are not torn down until the next Internet Key Exchange (IKE) negotiation period. (To change the default behavior and configure a specified length of time before the IPSec tunnels are torn down, issue the crypto pki token removal timeout command.)
For more information about the eToken by Aladdin Knowledge Systems, see the Aladdin website at http://www.aladdin.com/etoken/cisco/.
How a USB Flash Works
A Cisco USB flash module allows you to store and deploy router configurations and Cisco IOS software images. Cisco USB flash modules are available in 64MB, 128 MB, and 256MB versions.
Note
After you plug the USB flash module into the router, the router will automatically begin to boot the configuration file if the start-up configuration contains the boot config command to specify the new configuration located on the USB flash device; for example boot config usbflash0: new-config.
Functionality Differences Between an eToken and a USB Flash
Both eTokens and USB flash provide users with secondary storage; however, each device has its own benefits and limitations. To help determine which device better suits your needs, Table 1 highlights the functionality differences between the eToken and the USB flash.
Benefits of USB Storage
USB flash drive and USB eToken support on a Cisco router provides the following application benefits:
Removable Credentials: Provide or Store VPN Credentials on an External Device for Deployment
An Aladdin eToken can use SmartCard technology to store a digital certificate and configuration for IPSec VPN deployment. This ability enhances the capability of the router to generate RSA public keys to authenticate at least one IPSec tunnel. (Because a router can initiate multiple IPSec tunnels, the eToken can contain several certificates, as appropriate.)
Storing VPN credentials on an external device reduces the threat of compromising secure data.
PIN Configuration for Secure File Deployment
An Aladdin eToken can store a configuration file that can be used for enabling encryption on the router via a user-configured PIN. (That is, no digital certificates, preshared keys, or VPNs are used.)
Touchless or Low Touch Configuration
Both the eToken and USB Flash can provide remote software configuration and provisioning with little or no human interaction. Configuration is set up as an automated process. That is, both devices can store a bootstrap configuration that the router can use to boot from after the eToken or USB Flash has been inserted into the router. The bootstrap configuration connects the router to a TFTP server, which contains a configuration that completely configures the router.
How to Set Up and Use USB Modules on Cisco Routers
This section contains the following procedures that allow you to configure a router to support USB modules:
•
•
•
Storing the Configuration on an External USB Flash Drive or eToken
Use the following task to store the configuration file in the USB flash drive module or in an eToken.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Accessing and Setting Up the eToken
After you have inserted the eToken into the Cisco router, you must log into the eToken as shown in the following task:
•
After you have logged into the eToken, you can perform administrative tasks, such as changing the user PIN and copying files from the router to the eToken, as shown in the following task:
•
Use of RSA Keys with an eToken
•
•
Logging Into the eToken
Use this task to log into an eToken manually or automatically.
Automatic Login
Automatic login allows the router to completely come back up without any user or operator intervention. The PIN is stored in the private configuration, so it is not visible in the startup or running configuration.
Note
Manual Login
Manual login can be used when storing a PIN on the router is not desirable. Manual login can be executed with or without privileges, and it will make files and RSA keys on the eToken available to the Cisco IOS software. If a secondary configuration file is configured, it will only be executed with the privileges of the user who is performing the login. Thus, if you want to use manual login and set up the secondary configuration on the eToken to perform anything useful, you need to enable privileges.
Manual login can also be used in recovery scenarios for which the router configuration has been lost. If the scenario contains a remote site that normally connects to the core network with a VPN, the loss of the configuration and RSA keys requires out-of-band services that the eToken can provide. The eToken can contain a boot configuration, a secondary configuration, or both, and RSA keys to authenticate the connection.
Manual login may also be suitable for some initial deployment or hardware replacement scenarios for which the router is obtained from the local supplier or drop-shipped to the remote site.
Unlike automatic login, manual login requires that the user know the actual token PIN. However, if the user also has physical access to the eToken, he or she can use Aladdin's Windows-based utilities to copy the RSA keys and secondary config files from the eToken.
SUMMARY STEPS
1.
2.
or
configure terminal
3.
4.
5.
DETAILED STEPS
Setting Administrative Functions on the eToken
Use this task to change default settings, such as the user PIN and the maximum number of failed on the eToken.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
crypto pki token token-name [admin] change-pin [pin]
Example:Router# crypto pki token usbtoken0 admin change-pin
(Optional) Changes the user PIN number on the USB eToken.
•
Note
Step 3
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 4
crypto pki token {token-name | default} removal timeout [seconds]
Example:Router(config)# crypto pki token usbtoken0 removal timeout 60
(Optional) Sets the time interval, in seconds, that the router will wait before removing the RSA keys that are stored in the eToken after the eToken has been removed from the router.
Note
Step 5
crypto pki token {token-name | default} max-retries [number]
Example:Router(config)# crypto pki token usbtoken0 max-retries 20
(Optional) Sets the maximum number of consecutive failed login attempts allowed before access to the eToken is denied.
•
Step 6
exit
Example:Router(config)# exit
Exits global configuration mode.
Step 7
copy usbflash[0-9]:filename destination-url
Example:Router# copy usbflash0:
Copies files from the router to the eToken.
•
Step 8
show usbtoken[0-9]:filename
Example:Router#
(Optional) Displays information about the USB eToken. You can use this command to verify whether the USB eToken has been logged onto the router.
Step 9
crypto pki token token-name logout
Example:Router# crypto pki toke usbtoken0 logout
Logs the router out of the USB eToken.
Note
Troubleshooting USB Flash Drives and eTokens
This section contains descriptions of the following Cisco IOS commands that can be used to help troubleshoot possible problems that may arise while using a USB Flash or a USB eToken:
•
•
The show file systems Command
Step 1
•
•
•
Step 2
Sample output from the show file systems command showing a USB Flash module and a USB eToken appear below. The USB module listing appears in the last line of the examples.
Router# show file systemsFile Systems:Size(b) Free(b) Type Flags Prefixes- - opaque rw archive:- - opaque rw system:- - opaque rw null:- - network rw tftp:* 129880064 69414912 disk rw flash:#491512 486395 nvram rw nvram:- - opaque wo syslog:- - opaque rw xmodem:- - opaque rw ymodem:- - network rw rcp:- - network rw pram:- - network rw ftp:- - network rw http:- - network rw scp:- - network rw https:- - opaque ro cns:63158272 33037312 usbflash rw usbflash0:32768 858 usbtoken rw usbtoken1:
The show usb device Command
Step 1
The following sample output is for a USB Flash module:
Router# show usb deviceHost Controller:1Address:0x1Device Configured:YESDevice Supported:YESDescription:DiskOnKeyManufacturer:M-SysVersion:2.0Serial Number:0750D84030316868Device Handle:0x1000000USB Version Compliance:2.0Class Code:0x0Subclass Code:0x0Protocol:0x0Vendor ID:0x8ECProduct ID:0x15Max. Packet Size of Endpoint Zero:64Number of Configurations:1Speed:FullSelected Configuration:1Selected Interface:0Configuration:Number:1Number of Interfaces:1Description:Attributes:NoneMax Power:140 mAInterface:Number:0Description:Class Code:8Subclass:6Protocol:80Number of Endpoints:2Endpoint:Number:1Transfer Type:BULKTransfer Direction:Device to HostMax Packet:64Interval:0Endpoint:Number:2Transfer Type:BULKTransfer Direction:Host to DeviceMax Packet:64Interval:0The following sample output is for a supported USB eToken:
Router# show usb deviceHost Controller:1Address:0x11Device Configured:YESDevice Supported:YESDescription:eToken Pro 4254Manufacturer:AKSVersion:1.0Serial Number:Device Handle:0x1010000USB Version Compliance:1.0Class Code:0xFFSubclass Code:0x0Protocol:0x0Vendor ID:0x529Product ID:0x514Max. Packet Size of Endpoint Zero:8Number of Configurations:1Speed:LowSelected Configuration:1Selected Interface:0Configuration:Number:1Number of Interfaces:1Description:Attributes:NoneMax Power:60 mAInterface:Number:0Description:Class Code:255Subclass:0Protocol:0Number of Endpoints:0
The show usb controllers Command
Step 1
You can also use the show usb controllers command to verify that copy operations onto a USB Flash module are occurring successfully. Issuing the show usb controllers command after performing a file copy should display successful data transfers.
Sample output for the show usb controllers command for a working USB Flash module appears below:
Router# show usb controllersName:1362HCDController ID:1Controller Specific Information:Revision:0x11Control:0x80Command Status:0x0Hardware Interrupt Status:0x24Hardware Interrupt Enable:0x80000040Hardware Interrupt Disable:0x80000040Frame Interval:0x27782EDFFrame Remaining:0x13C1Frame Number:0xDA4CLSThreshold:0x628RhDescriptorA:0x19000202RhDescriptorB:0x0RhStatus:0x0RhPort1Status:0x100103RhPort2Status:0x100303Hardware Configuration:0x3029DMA Configuration:0x0Transfer Counter:0x1Interrupt:0x9Interrupt Enable:0x196Chip ID:0x3630Buffer Status:0x0Direct Address Length:0x80A00ATL Buffer Size:0x600ATL Buffer Port:0x0ATL Block Size:0x100ATL PTD Skip Map:0xFFFFFFFFATL PTD Last:0x20ATL Current Active PTD:0x0ATL Threshold Count:0x1ATL Threshold Timeout:0xFFInt Level:1Transfer Completion Codes:Success :920 CRC :0Bit Stuff :0 Stall :0No Response :0 Overrun :0Underrun :0 Other :0Buffer Overrun :0 Buffer Underrun :0Transfer Errors:Canceled Transfers :2 Control Timeout :0Transfer Failures:Interrupt Transfer :0 Bulk Transfer :0Isochronous Transfer :0 Control Transfer:0Transfer Successes:Interrupt Transfer :0 Bulk Transfer :26Isochronous Transfer :0 Control Transfer:894USBD Failures:Enumeration Failures :0 No Class Driver Found:0Power Budget Exceeded:0USB MSCD SCSI Class Driver Counters:Good Status Failures :3 Command Fail :0Good Status Timed out:0 Device not Found:0Device Never Opened :0 Drive Init Fail :0Illegal App Handle :0 Bad API Command :0Invalid Unit Number :0 Invalid Argument:0Application Overflow :0 Device in use :0Control Pipe Stall :0 Malloc Error :0Device Stalled :0 Bad Command Code:0Device Detached :0 Unknown Error :0Invalid Logic Unit Num:0USB Aladdin Token Driver Counters:Token Inserted :1 Token Removed :0Send Insert Msg Fail :0 Response Txns :434Dev Entry Add Fail :0 Request Txns :434Dev Entry Remove Fail:0 Request Txn Fail:0Response Txn Fail :0 Command Txn Fail:0Txn Invalid Dev Handle:0USB Flash File System Counters:Flash Disconnected :0 Flash Connected :1Flash Device Fail :0 Flash Ok :1Flash startstop Fail :0 Flash FS Fail :0USB Secure Token File System Counters:Token Inserted :1 Token Detached :0Token FS success :1 Token FS Fail :0Token Max Inserted :0 Create Talker Failures:0Token Event :0 Destroy Talker Failures:0Watched Boolean Create Failures:0
The dir Command
Step 1
The following sample output displays directory information for the USB Flash:
Router# dir usbflash0:Directory of usbflash0:/1 -rw- 30125020 Dec 22 2032 05:31:32 +00:00 c3825-entservicesk9-mz.123-14.T63158272 bytes total (33033216 bytes free)The following sample output displays directory information for the USB eToken:
Router# dir usbtoken1:Directory of usbtoken1:/2 d--- 64 Dec 22 2032 05:23:40 +00:00 10005 d--- 4096 Dec 22 2032 05:23:40 +00:00 10018 d--- 0 Dec 22 2032 05:23:40 +00:00 100210 d--- 512 Dec 22 2032 05:23:42 +00:00 100312 d--- 0 Dec 22 2032 05:23:42 +00:00 500013 d--- 0 Dec 22 2032 05:23:42 +00:00 600014 d--- 0 Dec 22 2032 05:23:42 +00:00 700015 ---- 940 Jun 27 1992 12:50:42 +00:00 mystartup-config16 ---- 1423 Jun 27 1992 12:51:14 +00:00 myrunning-config32768 bytes total (858 bytes free)The following sample output displays directory information for all devices the router is aware of:
Router# dir all-filesystemsDirectory of archive:/No files in directoryNo space information availableDirectory of system:/2 drwx 0 <no date> its115 dr-x 0 <no date> lib144 dr-x 0 <no date> memory1 -rw- 1906 <no date> running-config114 dr-x 0 <no date> vfilesNo space information availableDirectory of flash:/1 -rw- 30125020 Dec 22 2032 03:06:04 +00:00 c3825-entservicesk9-mz.123-14.T129880064 bytes total (99753984 bytes free)Directory of nvram:/476 -rw- 1947 <no date> startup-config477 ---- 46 <no date> private-config478 -rw- 1947 <no date> underlying-config1 -rw- 0 <no date> ifIndex-table2 ---- 4 <no date> rf_cold_starts3 ---- 14 <no date> persistent-data491512 bytes total (486395 bytes free)Directory of usbflash0:/1 -rw- 30125020 Dec 22 2032 05:31:32 +00:00 c3825-entservicesk9-mz.123-14.T63158272 bytes total (33033216 bytes free)Directory of usbtoken1:/2 d--- 64 Dec 22 2032 05:23:40 +00:00 10005 d--- 4096 Dec 22 2032 05:23:40 +00:00 10018 d--- 0 Dec 22 2032 05:23:40 +00:00 100210 d--- 512 Dec 22 2032 05:23:42 +00:00 100312 d--- 0 Dec 22 2032 05:23:42 +00:00 500013 d--- 0 Dec 22 2032 05:23:42 +00:00 600014 d--- 0 Dec 22 2032 05:23:42 +00:00 700015 ---- 940 Jun 27 1992 12:50:42 +00:00 mystartup-config16 ---- 1423 Jun 27 1992 12:51:14 +00:00 myrunning-config32768 bytes total (858 bytes free)
Configuration Examples for Secure Token Support
This section contains the following configuration example:
•
Logging Into and Saving RSA Keys to eToken: Example
The following configuration example shows to how log into the eToken, generate RSA keys, and store the RSA keys onto the eToken:
! Configure the router to automatically log into the eTokenconfigure terminalcrypto pki token default user-pin 0 1234567890! Generate RSA keys and enroll certificates with the CA.crypto pki trustpoint IOSCAenrollment url http://10.23.2.2exitcrypto ca authenticate IOSCACertificate has the following attributes:Fingerprint MD5:23272BD4 37E3D9A4 236F7E1A F534444EFingerprint SHA1:D1B4D9F8 D603249A 793B3CAF 8342E1FE 3934EB7A% Do you accept this certificate? [yes/no]:yesTrustpoint CA certificate accepted.crypto pki enrollcrypto pki enroll IOSCA%% Start certificate enrollment ..% Create a challenge password. You will need to verbally provide thispassword to the CA Administrator in order to revoke your certificate.For security reasons your password will not be saved in the configuration.Please make a note of it.Password:Re-enter password:% The subject name in the certificate will include:c2851-27.cisco.com% Include the router serial number in the subject name? [yes/no]:no% Include an IP address in the subject name? [no]:noRequest certificate from CA? [yes/no]:yes% Certificate request sent to Certificate Authority% The 'show crypto ca certificate IOSCA verbose' command will show the fingerprint.*Jan 13 06:47:19.413:CRYPTO_PKI: Certificate Request Fingerprint MD5:E6DDAB1B0E30EFE6 54529D8A DA787DBA*Jan 13 06:47:19.413:CRYPTO_PKI: Certificate Request Fingerprint SHA1:3B0F33B7 57C02A10 3935042B C4B6CD3D 61039251*Jan 13 06:47:21.021:%PKI-6-CERTRET:Certificate received from Certificate Authority! Issue the write memory command, which will automatically save the RSA keys to the eToken ! instead of private NVRAM.Router# write memoryBuilding configuration...[OK]*Jan 13 06:47:29.481:%CRYPTO-6-TOKENSTOREKEY:Key c2851-27.cisco.com stored onCryptographic Token eToken SuccessfullyThe following sample output from the show crypto key mypubkey rsa command displays stored credentials after they are successfully load from the eToken. Credentials that are stored on the eToken are in the protected area. When storing the credentials on the eToken, the files are stored in a directory called /keystore. However, the key files are hidden from the CLI.
Router# show crypto key mypubkey rsa% Key pair was generated at:06:37:26 UTC Jan 13 2005Key name:c2851-27.cisco.comUsage:General Purpose KeyKey is not exportable.Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E3C644 43AA7DDD732E0F4E 3CA0CDAB 387ABF05 EB8F22F2 2431F1AE 5D51FEE3 FCDEA934 7FBD36037C977854 B8E999BF 7FC93021 7F46ABF8 A4BA2ED6 172D3D09 B5020301 0001% Key pair was generated at:06:37:27 UTC Jan 13 2005Key name:c2851-27.cisco.com.serverUsage:Encryption KeyKey is not exportable.Key Data:307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00DD96AE 4BF912EB2C261922 4784EF98 2E70E837 774B3778 7F7AEB2D 87F5669B BF5DDFBC F0D521A556AB8FDC 9911968E DE347FB0 A514A856 B30EAFF4 D1F453E1 003CFE65 0CCC6DC721FBE3AC 2F8DEA16 126754BC 1433DEF9 53266D33 E7338C95 BB020301 0001Additional References
The following sections provide references related to USB storage support.
Related Documents
Standards
MIBs
None
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents new and modified commands only.
New Commands
•
•
Modified Commands
•
•
boot config
To specify the device and filename of the configuration file from which the router configures itself during initialization (startup), use the boot config command in global configuration mode. To remove the specification, use the no form of this command.
boot config file-system-prefix:[directory/]filename
no boot config
Syntax Description
Defaults
NVRAM (nvram:)
Command Modes
Global configuration
Command History
11.0
This command was introduced.
12.3(14)T
Support for Class B file system platforms and the following file system prefix options were added: usbflash[0-9]: and usbtoken[0-9]:.
Usage Guidelines
This command is available only on Class A and Class B file system platforms.
You set the CONFIG_FILE environment variable in the current running memory when you use the boot config command. This variable specifies the configuration file used for initialization (startup). The configuration file must be an ASCII file located in either NVRAM or Flash memory.
Note
The software displays an error message and does not update the CONFIG_FILE environment variable in the following situations:
•
•
The router uses the NVRAM configuration during initialization when the CONFIG_FILE environment variable does not exist or when it is null (such as at first-time startup). If the software detects a problem with NVRAM or the configuration it contains, the device enters setup mode.
When you use the no form of this command, the router returns to using the default NVRAM configuration file as the startup configuration.
Examples
In the following example, the first line specifies that the router should use the configuration file named router-config
