Table Of Contents

Threat Information Distribution Protocol

Contents

Prerequisites for TIDP

Restrictions for TIDP

Information About TIDP

Threat Information Distribution Protocol

Secure Message Authentication and Encryption

TIDP-Based Mitigation Services

How to Configure TIDP

Generating an RSA Key Pair

Prerequisites

Examples

Configuring the Remote Peer to Use the RSA Key

Prerequisites

Examples

Configuring TIDP Authentication and Encryption Keys

Peer Authentication

Message Encryption

Locally Encrypting Message and Authentication Strings

Examples

Troubleshooting Tips

Configuring a TIDP Group

TIDP Groups

Prerequisites

Examples

Configuring the Source Interface and Enabling TIDP

Enabling and Disabling TIDP

Prerequisites

Restrictions

Examples

What to Do Next

Sending a Test Message to Verify that TIDP is Operational

Enabling the TIDP Test CLI

Examples

Troubleshooting Tips

Using Privileged EXEC Commands to Verify and Troubleshoot TIDP

Examples

Configuration Examples for TIDP

TIDP Controller: Example

TIDP Consumer: Example

Where to Go Next

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

Feature Information for TIDP

Threat Information Distribution Protocol

---

First Published: February 27, 2006

Last Updated: March 20, 2006

Threat Information Distribution Protocol (TIDP) provides a rapid and secure mechanism to distribute security threat information. TIDP is designed to support large groups of devices throughout the network. TIDP supports peer authentication and message encryption. TIDP is the distribution layer protocol for TIDP-Based Mitigation Services (TMS). TMS provides the framework to rapidly and efficiently distribute threat information to devices across the network. This document describes TIDP configuration. TIDP must be configured before TMS.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for TIDP" section

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for TIDP

•Restrictions for TIDP

•Information About TIDP

•How to Configure TIDP

•Configuration Examples for TIDP

•Additional References

•Command Reference

Prerequisites for TIDP

•You should have a clear understanding of the physical topology and traffic patterns in your network before deploying TIDP and TMS.

•All devices, configured to run TIDP, must be reachable by TIDP peers via TCP/IP.

Restrictions for TIDP

•In Cisco IOS Release 12.4(6)T, you can configure only a single controller for each TIDP group.

•Only a physical interface with a fixed IP address can be configured with the tidp source command.

Information About TIDP

You should understand the following concepts, before configuring TIDP and TMS:

•Threat Information Distribution Protocol

•TIDP-Based Mitigation Services

Threat Information Distribution Protocol

TIDP is a light-weight protocol that provides a rapid, scalable, and secure mechanism to distribute threat information to large groups of devices in the network. TIDP is configured on a per-group basis. Messages are bound to each group but can also be delivered to multiple groups. TIDP is deployed in a star or hub-and-spoke topology, similar to a client/server configuration, in which a controller supports multiple consumers. The controller is configured to peer with all consumers in the group. The consumers peer only with the controller and optionally with each other. Figure 1 shows a sample topology.

Figure 1 The Controller Peers with all Consumers

Secure Message Authentication and Encryption

TIDP was designed to be secure. TIDP messages are protected by peer authentication and can be optionally encrypted to prevent the message payload from being viewed or altered. Authentication and encryption are configured with inbound and outbound keys. TIDP can be configured to use AES-128, HMAC-SHA1-160, and RSA key generation. Figure 2 shows TIDP message transport and distribution.

Figure 2 TMS Service Run Over TIDP

TIDP-Based Mitigation Services

TIDP is designed to run over only TCP as the transport layer protocol. TIDP is the distribution layer protocol for TIDP-Based Mitigation Services (TMS). TMS provides the framework to rapidly and efficiently distribute threat information to devices across the network.

The TMS framework transports messages that contain specific threat information about suspect traffic and associated mitigation enforcement actions to all devices in the network. Threat Information Messages (TIMs) are distributed throughout the network in near real time. TIMs are distributed from a central device, the TMS controller. TMS consumers are devices configured to receive TIMs. Each consumer can be configured with a unique rule set to locally enforce mitigation actions based on local requirements. Each rule set is customizable and can be modified on demand.

---

Note This document describes TIDP configuration. TIDP must be configured before TMS. For information about TMS, see TIDP-Based Mitigation Services documentation.

---

How to Configure TIDP

This section contains the following tasks:

•Generating an RSA Key Pair (optional)

•Configuring the Remote Peer to Use the RSA Key (optional)

•Configuring TIDP Authentication and Encryption Keys (required)

•Configuring a TIDP Group (required)

•Configuring the Source Interface and Enabling TIDP (required)

•Sending a Test Message to Verify that TIDP is Operational (optional)

•Using Privileged EXEC Commands to Verify and Troubleshoot TIDP (optional)

Generating an RSA Key Pair

This configuration task is optional. The steps in this task show how to generate the RSA key pair and then display the key so that the public key can be copied and input into the remote peer (receiving device).

Prerequisites

Before configuring the crypto key generate rsa command, ensure that your router has a hostname and IP domain name configured (with the hostname and ip domain-name commands). You will be unable to complete the crypto key generate rsa command without a hostname and IP domain name.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto key generate rsa {general-keys | usage-keys} [label key-label] [exportable] [modulus modulus-size] [storage device:]

4. exit

5. show crypto key mypubkey rsa

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	crypto key generate rsa {general-keys | usage-keys} [label key-label] [exportable] [modulus modulus-size] [storage device:] Example: Router(config)# crypto key generate rsa general-keys label CRYPTO_KEY_1 modulus 512	Generates an RSA key pair.
Step 4	exit Example: Router(config)# exit	Exits global configuration mode and enters privileged EXEC mode.
Step 5	show crypto key mypubkey rsa Example: Router# show crypto key mypubkey rsa	Displays the RSA public keys of your router.

Examples

The following example, starting in global configuration mode, shows how to generate and display an RSA key pair:

Router(config)# crypto key generate rsa general-keys label CRYPTO_KEY_1 modulus 512 

The name for the keys will be: crypto_key_1

% The key modulus size is 512 bits

% Generating 512 bit RSA keys, keys will be non-exportable...[OK]

Router(config)# exit 

Router# show crypto key mypubkey rsa 

% Key pair was generated at: 12:45:16 PST Jan 1 2006

Key name: CRYPTO_KEY_1

 Storage Device: not specified

 Usage: General Purpose Key

 Key is not exportable.

 Key Data:

  305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00AD3E88 3B3489CB 

  A4F77002 97FC4BEC 9AAFE414 973E7B38 B047EACE 5B4857BC 2606EEA3 6704041A 

  1F6D9659 89070D18 F4358111 90905012 53EEF5E0 5F41B3FD AB020301 0001

% Key pair was generated at: 12:45:23 PST Jan 9 2006

Key name: CRYPTO_KEY_1.server

Temporary key

 Usage: Encryption Key

 Key is not exportable.

 Key Data:

  307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D13A4D 1A668508 

  F291D3E3 46500F52 435C3A07 23A66EB0 FA3A0A3B 53DE2DD6 0E24F9B0 825370CB 

  BFB9E615 97E79BB1 95430760 CB68F399 502B509B 993935B3 A0EBE95C 33BEDD40 

  471AFCD5 0EB86242 F3F8E741 53C3C14E D20916CF 2BC33422 B5020301 0001

Configuring the Remote Peer to Use the RSA Key

This task shows how to enter the senders public RSA key on the remote peer. This task is required if an RSA key is configured for TIDP authentication on the sending device.

Prerequisites

The IP host statement in this task is optional. The remote peer will attempt to use domain name system (DNS) to resolve the name of the RSA key in the public key chain. If the remote peer is not configured to use DNS resolution, then the sending peer must be identified by configuring the ip host command on the remote peer. Configuration of the ip host command is optional in this task table.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip host {rsa-key-name ip-address}

4. crypto key pubkey-chain rsa

5. named-key key-name [encryption | signature]

6. address ip-address

7. key-string text-key

8. quit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip host {rsa-key-name ip-address} Example: Router(config) ip host CRYPTO_KEY_1 10.1.1.1	(Optional) Configures a static hostname-to-address mapping in the host cache. •This command is required only if DNS resolution is not configured.
Step 4	crypto key pubkey-chain rsa Example: Router(config)# crypto key pubkey-chain rsa	Enters public key configuration mode to specify an RSA public key for a remote device.
Step 5	named-key key-name [encryption | signature] Example: Router(config-pubkey-chain)# named-key CRYPTO_KEY_1 signature	Places the router in Crypto public key chain configuration mode. •The name of the RSA key configured on the remote peer is entered.
Step 6	address ip-address Example: Router(config-pubkey-key)# address 10.1.1.1	Specifies the IP address of the remote peer that generated the RSA public key.
Step 7	key-string text-key Example: Router(config-pubkey-key)# key-string	Specifies the RSA public key of the remote peer. •You will be prompted to enter the public key.
Step 8	quit Example: Router(config-pubkey) quit	Exits Hex-key input mode, and enters Crypto public key chain configuration mode.

Examples

The following example, starting in global configuration mode, configures the remote peer to process the RSA key generated in the first configuration task:

Router(config)# ip host CRYPTO_KEY_1 10.1.1.1 

Router(config)# crypto key pubkey-chain rsa 

Router(config-pubkey-chain)# named-key CRYPTO_KEY_1 signature 

Router(config-pubkey-key)# address 10.1.1.1 

Router(config-pubkey-key)# key-string 

Enter a public key as a hexidecimal number ....

Router(config-pubkey)# 305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00AD3E88 
3B3489CB 

Router(config-pubkey)# A4F77002 97FC4BEC 9AAFE414 973E7B38 B047EACE 5B4857BC 2606EEA3 
6704041A 

Router(config-pubkey)# 1F6D9659 89070D18 F4358111 90905012 53EEF5E0 5F41B3FD AB020301 0001 

Router(config-pubkey)# quit 

Configuring TIDP Authentication and Encryption Keys

The steps in this task show how to configure TIDP peer authentication and message encryption. Peer authentication is required. Message encryption is optional. TIDP can be configured to use AES-128, HMAC-SHA1-160, and RSA key generation.

Peer Authentication

TIDP peers are authenticated by configuring an RSA public key or by configuring an authentication string. The authentication string can be encrypted or transmitted as clear text. TIDP performs authentication by signing sent messages and verifying the signature in received messages. Two sets of authentication keys are configured for each TIDP group, a send key and receive key. If a message fails authentication, the invalid message counter is increased incrementally. This counter is displayed in the output of the show tidp detail command.

Message Encryption

TIDP messages can be optionally encrypted to prevent the contents from being viewed or altered. Two sets of encryption keys are configured for each TIDP group, a send key and receive key.

Locally Encrypting Message and Authentication Strings

A message or authentication string can be encrypted in the router configuration file so that encryption and/or authentication is not compromised for the TIDP group if one peer is compromised. The key string is saved as clear text when the 0 keyword is entered after the key-string argument. The key string text is encrypted if the 6 keyword is entered. Configuring the password encryption aes command in Global configuration mode will automatically encryption all key-strings in the router configuration file.

SUMMARY STEPS

1. enable

2. configure terminal

3. tidp key-set name

4. authentication-key send {key-string [0 | 6] string-text | keypair-name name}

5. authentication-key receive {key-string [0 | 6] string-text | pubkey-name name}

6. encryption-key receive {key-string [0 | 6] string-text}

7. encryption-key send {key-string [0 | 6] string-text}

8. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	tidp key-set name Example: Router(config)# tidp key-set KEY_1	Enters TIDP key-set configuration mode to configure a key-set for TIDP peer authentication and/or message encryption. •Authentication and encryption keys are configured in send and receive pairs. •Authentication must be configured before a TIDP group can be activated. •Encryption key configuration is optional.
Step 4	authentication-key send {key-string [0 | 6] string-text | keypair-name name} Example: Router(config-tidp-ks)# authentication-key send keypair-name CRYPTO_KEY_1	Configures an authentication key for sent TIDP messages. •The authentication key can be configured as an RSA key, an encrypted text string, or as clear text. •There is a 32 character limit for configuring text strings. •Entering the 0 keyword configures a clear text string. Entering the 6 keyword configures an encrypted text string. •In the example, an authentication is configured using the RSA key pair that was generated in the first task.
Step 5	authentication-key receive {key-string [0 | 6] string-text | pubkey-name name} Example: Router(config-tidp-ks)# authentication-key receive key-string 6 Aa1Bb2Cc3	Configures an authentication key for received TIDP messages. •The receive key must match the send key configured on the remote peer in order for authentication to occur. •In the example, the 6 keyword is entered to encrypt the authentication string.
Step 6	encryption-key send {key-string [0 | 6] string-text} Example: Router(config-tidp-ks)# encryption-key receive Dd4Ee5Ff6	(Optional) Configures an encryption key to encrypt the contents of received TIDP messages. •Entering the 6 keyword encrypt the key-string in the router configuration file. The key string is saved as clear text by default.
Step 7	encryption-key send {key-string [0 | 6] string-text} Example: Router(config-tidp-ks)# encryption-key send Gg7Hh8Ii9	Configures an encryption key to decrypt the contents of received TIDP messages. •The receive key must match the send key configured on the remote peer in order for authentication to occur.
Step 8	exit Example: Router(config-tidp-ks)# exit	Exits TIDP key-set configuration mode, and enters global configuration mode.

Examples

The following examples, starting in global configuration mode, configure an encryption key and authentication key between two TIDP peers.

Sending Peer Key-Set

Router(config)#_tidp key-set KEY_1 

Router(config-tidp-ks)# authentication-key send keypair-name CRYPTO_KEY_1 

Router(config-tidp-ks)# encryption-key send key-string 6 Aa1Bb2Cc3 

Router(config-tidp-ks)# exit 

Receiving Peer Key-Set

Router(config)# tidp key-set KEY_2 

Router(config-tidp-ks)# authentication-key receive pub-key CRYPTO_KEY_1 

Router(config-tidp-ks)# encryption-key receive key-string 6 Aa1Bb2Cc3 

Router(config-tidp-ks)# exit 

Troubleshooting Tips

If a connection has been established, then the existing authentication and/or encryption keys are compatible. If a connection is not established, verify the following:

•The peer is reachable via TCP/IP.

•The authentication is key is properly configured on the sender and receiver. Also, verify the encryption key configuration, if one is configured.

If these tips do not resolve the problem, then you should check syslog for CONNFAIL error messages from the peer initiating the connection. The following debug command can also be helpful in troubleshooting a TIDP connection problem:

•Enabling the debug tidp test command allows you to send TIDP test messages. This command must be enabled on both the sender and receiver.

•Enabling the debug tidp registration command is helpful for troubleshooting authentication/encryption key mismatches.

•Enabling the debug tidp packets is helpful for troubleshooting key mismatches and general communication problems.

Configuring a TIDP Group

TIDP groups are designed to manage the distribution of threat information to TIDP consumers. The steps in this task show the following:

•TIDP group creation

•Associating the group with a key set for peer authentication and/or message encryption

•Configuring the time interval at which TIDP registers peers

•TIDP group activation

TIDP Groups

TIDP is deployed in groups following a star topology. Each group is configured with at least one TIDP controller. The controller is configured to communicate with each TIDP consumer. The consumer is configured to communicate only with the controller. Each group can have a maximum of 250 consumers. Each consumer can be a member of up to 64 groups.

Prerequisites

Peer authentication is required and must be configured before a TIDP group can be activated. A key-set is first configured with the tidp key-set command in global configuration mode. The authentication and encryption keys are associated with the TIDP group by configuring the key-set command in Step 4.

SUMMARY STEPS

1. enable

2. configure terminal

3. tidp group number

4. key-set name

5. peer ip-address

6. registration retry-interval {min interval max interval}

7. active

8. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	tidp group number Example: Router(config)# tidp group 10	Creates the TIDP group, and enters TIDP group configuration mode.
Step 4	key-set name Example: Router(config-tidp-grp)# key-set KEY_1	Associates a key-set with a TIDP group. •A valid key-set must be associated before the group can be activated.
Step 5	peer ip-address Example: Router(config-tidp-grp)# peer 10.1.1.2	Configures a TIDP peer as a member of a TIDP group. •The IP address of the interface that is configured as the TIDP source on the remote peer is entered for the ip-address argument. •The TIDP peer must be reachable via TCP/IP before it can be configured to be a member of a TIDP group.
Step 6	registration retry-interval {min interval max interval} Example: Router(config-tidp-grp)# registration retry-interval min 30 max 600	Configures the length of time and number of attempts for TIDP group registration. •By default, TIDP will attempt register group members once every 60 seconds for up to 1 hour or until all group members have been registered. •Registration timers are reset to zero when this command is configured or reconfigured. •The example configures TIDP to attempt peer registration every 30 seconds for up to 10 minutes.
Step 7	active Example: Router(config-tidp-grp)# active	Activates the TIDP group. •The group cannot be activated until a key-set with valid authentication key is associated with the key-set command.
Step 8	exit Example: Router(config-tidp-grp)# exit	Exits TIDP Group configuration mode, and enters global configuration mode.

Examples

The following examples, starting in global configuration mode, configure TIDP group number 10 on a controller and consumer:

Controller (10.1.1.1)

Router(config)# tidp key-set KEY_1 

Router(config-tidp-ks)# authentication-key receive key-string Aa1Bb2Cc3 

Router(config-tidp-ks)# authentication-key send key-string Dd4Ee5Ff6 

Router(config-tidp-ks)# exit 

Router(config)# tidp group 10 

Router(config-tidp-grp)# key-set KEY_1 

Router(config-tidp-grp)# registration retry-interval min 30 max 600

Router(config-tidp-grp)# peer 10.1.1.2 

Router(config-tidp-grp)# peer 10.1.1.3 

Router(config-tidp-grp)# peer 10.1.1.4 

Router(config-tidp-grp)# active 

Router(config-tidp-grp)# exit 

Consumer (10.1.1.2)

Router(config)# tidp-set KEY_2 

Router(config-tidp-ks)# authentication-key receive key-string Dd4Ee5Ff6 

Router(config-tidp-ks)# authentication-key send key-string Aa1Bb2Cc3 

Router(config-tidp-ks)# exit 

Router(config)# tidp group 10 

Router(config-tidp-grp)# key-set KEY_2 

Router(config-tidp-grp)# peer 10.1.1.1 

Router(config-tidp-grp)# active 

Router(config-tidp-grp)# exit 

Configuring the Source Interface and Enabling TIDP

The steps in this task show how to configure the source interface for TIDP communication and enable TIDP globally on a router.

Enabling and Disabling TIDP

The source interface must be configured before TIDP can be enabled globally on a router. The source interface cannot be reconfigured while TIDP is enabled. TIDP can be disabled globally on a router by entering the no form of the tidp enable command. The TIDP configuration is not removed from the router configuration file when the no form of this command is entered.

Prerequisites

A physical interface, configured with a fixed IP address, must be in an enabled state and reachable by TIDP peers via TCP/IP.

Restrictions

An interface that is configured with a dynamic IP address cannot be configured as the TIDP source interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. tidp source ip-address

4. tidp enable

5. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	tidp source ip-address Example: Router(config)# tidp source 10.1.1.1	Configures the source interface for TIDP communication. •The source interface must be a physical interface with a fixed IP address.
Step 4	tidp enable Example: Router(config)# tidp enable	Enables TIDP globally on a router. •Entering the no form disables TIDP without removing the TIDP configuration from the router configuration file.
Step 5	end Example: Router(config)# end	Exits global configuration mode, and enters privileged EXEC mode.

Examples

The following example, starting in global configuration mode, configures interface Ethernet 0/0 as the source interface for communication with TIDP peers:

Router(config)# interface Ethernet 0/0 

Router(config-if)# ip address 10.1.1.1 255.255.255.0 

Router(config-if)# no shutdown 

Router(config-if)# exit 

Router(config)# tidp source 10.1.1.1 

Router(config)# end 

What to Do Next

Configuring the source interface and enabling TIDP completes TIDP configuration. Proceed to the next sections to see information about verifying and troubleshooting TIDP. For information on configuring TMS, see TIDP-Based Mitigation Services documentation.

Sending a Test Message to Verify that TIDP is Operational

The steps in this task show how to verify the operational status of TIDP.

Enabling the TIDP Test CLI

The test tidp command is used test to transmit a text message a TIDP group or peer. The test tidp command is not visible or configurable until the debug tidp command has been entered with the test keyword. TIDP test debugging must be enabled on the source and destination devices.

SUMMARY STEPS

1. enable

2. debug tidp test

3. test tidp send group number [peer ip-address] message-string

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	debug tidp test Example: Router# debug tidp test	Enables the TIDP test CLI.
Step 3	test tidp send group number [peer ip-address] message-string Example: Router# test tidp send group 10 Group_Message	Sends a test message to a TIDP group or peer. •An alphanumeric text message up to 35 characters in length can be sent. White space is not permitted in the message string.

Examples

The following example shows a test messages sent to the 10.1.1.2 peer in TIDP group 10:

Sender (10.1.1.1)

Router1# debug tidp test 

TIDP test debugging is on 

Router1# test tidp send group 10 peer 10.1.1.2 Unicast_Test_Message 

Receiver (10.1.1.2)

Router2# debug tidp test 

TIDP test debugging is on 

Router2# 

03:36:03: TIDP msg from 10.1.1.1, group 10: 'Unicast_Test_Message'

Troubleshooting Tips

If a test message is not received by a group or peer, you should verify the following:

•The debug tidp test command has been enabled on the sender and receiver.

•The source interface on each device is enabled and reachable via TCP/IP.

•There are no errors or inconsistencies in sending and receiving authentication and/or encryption keys.

Using Privileged EXEC Commands to Verify and Troubleshoot TIDP

This section describes clear, debug, and show commands that are used to verify the operational status and configuration of TIDP. All commands in this section are optional.

SUMMARY STEPS

1. enable

2. clear tidp counters [group {number | all}]

3. debug tidp {errors | events | packets | registration | test}

4. show tidp [detail]

5. show tidp group {number | all} [detail]

6. show tidp key-set [name]

7. show tidp peer {ip-address | all}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	clear tidp counters [group {number | all}] Example: Router# clear tidp counters	Clears TIDP counters and message statistics. •The example clears all counters and messages statistics.
Step 3	debug tidp {errors | events | packets | registration | test} Example: Router# debug tidp events	Enables TIDP debugging.
Step 4	show tidp [detail] Example: Router# show tidp	Displays the status of TIDP. •This command displays the operational status, source interface, and groups of which this device is a member. •Entering the detail keyword displays the same information but also includes message statistics.
Step 5	show tidp group {number | all} [detail] Example: Router# show tidp group all	Displays information about TIDP groups. •This command displays the active status, total number of registered and unregistered peer, registration timer values, and associated key-set. •Entering the detail keyword displays group message statistics.
Step 6	show tidp key-set [name] Example: Router# show tidp key-set	Displays information about locally configured key-sets. •The group associated with the key-set is displayed in the output. •The example displays all locally configured key-sets.
Step 7	show tidp peer {ip-address | all} Example: Router# shot tidp peer all	Displays information about TIDP peers. •The output of this command displays connection status, group membership, and message statistics for a single TIDP peer or all peers.

Examples

The following is sample output from the show tidp command:

Router# show tidp 

Global TIDP information: 

TIDP status: enabled 

TIDP source: 10.1.1.1 

TIDP groups: 1 (1 active, 0 inactive)

The following is sample output from the show tidp group command:

Router# show tidp group 10 

TIDP Group 10:

    Group status: active

    Total registered peers: 2

    Total unregistered peers: 1

    Registration retry interval - min: 60, max: 3600

    Key-set: KEY_1 

The following is sample output for the show tidp key-set command:

Router# show tidp key-set KEY_1

TIDP keyset KEY_1:

    Groups:

    10 

The following is sample output for the show tidp peer command:

Router# show tidp peer 10.1.1.3 

TIDP Peer 10.1.1.3:

    Peer state: Connected

    Configured in groups:

    10

    Total messages received: 1

    Total messages transmitted: 1

    Total messages transmit dropped: 0

    Duplicate messages received: 0

    Replayed messages received: 0 

Configuration Examples for TIDP

This section provides TIDP controller and consumer examples. These configurations are similar to each other. The main difference is that TIDP peering is configured between the controller and each peer. However, the TIDP consumers are configured to peer only with the controller and not other peers.

•TIDP Controller: Example

•TIDP Consumer: Example

TIDP Controller: Example

Ethernet 0/0 is configured as the source interface for TIDP communication.

Router(config)# interface Ethernet 0/0 

Router(config-if)# ip address 10.1.1.1 255.255.255.0 

Router(config-if)# no shutdown 

Router(config-if)# exit 

Router(config)# tidp source 10.1.1.1 

An RSA key named CRYPTO_KEY_1 is generated.

Router(config)# crypto key generate rsa general-keys label CRYPTO_KEY_1 modulus 512 

The name for the keys will be: crypto_key_1

% The key modulus size is 512 bits

% Generating 512 bit RSA keys, keys will be non-exportable...[OK]

Router(config)# exit

Key-set KEY_1 is configured with an authentication and encryption key-set. The RSA key in generated in the previous step is configured as the sender authentication key.

Router(config)# tidp key-set KEY_1

Router(config-tidp-ks)# authentication-key send keypair-name CRYPTO_KEY_1 

Router(config-tidp-ks)# authentication-key receive key-string 6 Aa1Bb2Cc3 

Router(config-tidp-ks)# encryption-key receive key-string 6 Dd4Ee5Ff6

Router(config-tidp-ks)# encryption-key send key-string 6 Gg7Hh8Ii9 

Router(config-tidp-ks)# exit 

TIDP group 10 is configured and activated. KEY_1 is associated with group 10. The peer registration timers are configured to register unregistered peer at 30 second intervals for up to 10 minutes. Remote peers in the 10.1.1/24 network are configured as TIDP peers.

Router(config)# tidp group 10 

Router(config-tidp-grp)# key-set KEY_1 

Router(config-tidp-grp)# registration retry-interval min 30 max 600 

Router(config-tidp-grp)# peer 10.1.1.2 

Router(config-tidp-grp)# peer 10.1.1.3 

Router(config-tidp-grp)# peer 10.1.1.4 

Router(config-tidp-grp)# active 

Router(config-tidp-grp)# exit

TIDP is enabled globally on the router. This is the final step of the TIDP configuration.

Router(config)# tidp enable 

TIDP Consumer: Example

Ethernet 0/0 is configured as the source interface for TIDP communication.

Router(config)# interface Ethernet 0/0 

Router(config-if)# ip address 10.1.1.2 255.255.255.0 

Router(config-if)# no shutdown 

Router(config-if)# exit 

Router(config)# tidp source 10.1.1.2 

The TIDP consumer is configured to process the RSA key generated on the controller. An IP host statement is entered to configure a static hostname-to-IP-adress mapping.

Router(config)# ip host CRYPTO_KEY_1 10.1.1.1 

Router(config)# crypto key pubkey-chain rsa 

Router(config-pubkey-chain)# named-key CRYPTO_KEY_1 signature 

Router(config-pubkey-key)# address 10.1.1.1 

Router(config-pubkey-key)# key-string 

Enter a public key as a hexidecimal number ....

Router(config-pubkey)# 305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00AD3E88 
3B3489CB 

Router(config-pubkey)# A4F77002 97FC4BEC 9AAFE414 973E7B38 B047EACE 5B4857BC 2606EEA3 
6704041A 

Router(config-pubkey)# 1F6D9659 89070D18 F4358111 90905012 53EEF5E0 5F41B3FD AB020301 0001 

Router(config-pubkey)# quit 

Router(config-pubkey-key)# exit 

Router(config-pubkey-chain)# exit 

Key-set KEY_2 is configured with an authentication and encryption key-set. The RSA key in processed in the previous step is configured as the receiving authentication key.

Router(config)# tidp key-set KEY_2

Router(config-tidp-ks)# authentication-key receive pubkey-name CRYPTO_KEY_1 

Router(config-tidp-ks)# authentication-key send key-string 6 Aa1Bb2Cc3 

Router(config-tidp-ks)# encryption-key receive key-string 6 Dd4Ee5Ff6

Router(config-tidp-ks)# encryption-key send key-string 6 Gg7Hh8Ii9 

Router(config-tidp-ks)# exit 

TIDP group 10 is configured and activated. KEY_2 is associated with group 10. Peering is established only with the TIDP controller.

Router(config)# tidp group 10 

Router(config-tidp-grp)# key-set KEY_2 

Router(config-tidp-grp)# peer 10.1.1.1 

Router(config-tidp-grp)# active 

Router(config-tidp-grp)# exit

TIDP is enabled globally on the router.

Router(config)# tidp enable

Where to Go Next

This document describes the configuration of TIDP. After TIDP is up and running, see TIDP-Based Mitigation Services (TMS) documentation for information about configuring TMS.

Additional References

The following sections provide references related to TIDP:

Related Documents

Related Topic	Document Title
TIDP-Based Mitigation Services	TIDP-Based Mitigation Services

Standards

Standard	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIB	MIBs Link
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.	To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB gateways, go to the Cisco MIB website on Cisco.com at the following URL: http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

RFCs

RFC	Title
No new or modified RFCs are supported by this feature, and support for existing standards has not been modified by this feature.	—

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Command Reference

The following commands are introduced or modified in the feature or features

•active

•authentication-key receive

•authentication-key send

•clear tidp counters

•debug tidp

•encryption-key receive

•encryption-key send

•key-set

•peer

•registration retry-interval (TIDP)

•show tidp

•show tidp group

•show tidp key-set

•show tidp peer

•test tidp

•tidp enable

•tidp group

•tidp key-set

•tidp source

For information about these commands, see the Cisco IOS Security Command Reference at

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html.

For information about all Cisco IOS commands, see the Command Lookup Tool at

http://tools.cisco.com/Support/CLILookup or the Master Command List.

Feature Information for TIDP

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

---

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

---

Table 1

TIDP-Based Mitigation Services

12.4(6)T

TIDP provides a rapid and secure mechanism to distribute security threat information. TIDP is designed to support large groups of devices throughout the network. TIDP supports peer authentication and message encryption. TIDP is the distribution layer protocol for TIDP Based Mitigation Services (TMS). TMS provides the framework to rapidly and efficiently distribute threat information to devices across the network.

Feature Information for TIDP

CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.