Table Of Contents

A - C - D - E - H - I - K - L - M - N - O - P - R - S -

Index

A

AAA (authentication, authorization, and accounting)

accounting method lists, configuring     SC-137

accounting services, enabling     SC-142

authentication     SC-103

authentication method lists, configuring     SC-130

authorization, enabling     SC-140

authorization method lists, configuring     SC-134

configuration     SC-102

database     SC-101

login parameters, configuring     SC-144

RADIUS server groups, configuring     SC-126

remote configuration     SC-102

router to RADIUS server communication, configuring     SC-118

services, configuration (examples)     SC-145

TACACS+ server, configuring     SC-124

TACACS+ server groups, configuring     SC-128

task-based authorization

task groups     SC-100

task IDs     SC-106

task groups

configuration     SC-112

user and group attributes     SC-98

user groups

configuring     SC-114

definition     SC-99

inheritance     SC-99

predefined     SC-99

prerequisites     SC-97

privilege level mapping     SC-109

restrictions     SC-97

users, configuring     SC-116

XML schema     SC-109

accept-lifetime command     SC-50

algorithms

See IKE, algorithms

C

CAs (certification authorities)

authenticating     SC-10

declaring     SC-8

description     SC-3, SC-88

domain names, configuring (example)     SC-6

host names     SC-6

RSA (Rivest, Shamir, and Adelman) key pairs

generating     SC-7

supported standards     SC-2

trusted point, configuring     SC-8

See also certificates; CRLs; IPSec; RAs

certificates     SC-3

requests     SC-11

See also CAs; CRLs; RSA keys

clock set command     SC-151

config-isakmp command mode, enabling     SC-29

D

dead-server detection

RADIUS     SC-122

radius-server dead-criteria time command     SC-123

radius-server dead-criteria tries command     SC-123

radius-server deadtime command     SC-122

deadtime command     SC-127

DES (Data Encryption Standard)     SC-19

IKE policy parameter     SC-21

domain names

certification authority interoperability, configuring     SC-6

E

encrypted nonces

See RSA encrypted nonces

encryption algorithm

See IKE, algorithms

end-time, key chain     SC-44

H

hash algorithm

See IKE, algorithms

host names

certification authority interoperability, configuring (examples)     SC-6

I

IKE (Internet Key Exchange) security protocol

algorithms

encryption     SC-29

hash     SC-29

options     SC-22

authentication

methods     SC-22, SC-29

DH (Diffie-Hellman)

group identifier, specifying     SC-29

IKE policy parameter     SC-21

enabling and disabling     SC-27

extended authentication     SC-26

group identifier, specifying     SC-29

ISAKMP identity, configuring     SC-24

keys

See keys, preshared; keys, preshared using AAA server; RSA keys

mode configuration     SC-26

negotiations     SC-21

policies

configuring (example)     SC-38

identifying     SC-29

multiple     SC-23

parameters     SC-21, SC-22

purpose     SC-20

viewing     SC-30

policies, configuring     SC-28

requirements

RSA encrypted nonces method     SC-23

RSA signatures method     SC-23

supported standards     SC-18

See also IPSec; RSA encrypted nonces; SAs

IPSec (IPSec Network Security Protocol)

CAs

implementing with     SC-5

implementing without     SC-5

IPSec (IP Security)

checkpointing

configuring     SC-62

description     SC-60

crypto access lists     SC-58

cautions, creating     SC-58

creating     SC-63

purpose     SC-58

crypto profiles     SC-56

applying to transport     SC-71

applying to tunnel interfaces     SC-70

static or dynamic, configuring     SC-67

dynamic crypto profiles     SC-57

group policy definition

mode configuration     SC-66

lifetimes

global, setting     SC-60

prerequisites, implementing     SC-56

transform sets

defining     SC-65

transform sets, description     SC-59

IPSec, implementing     SC-5

ISAKMP     SC-19

See also IKE     SC-17

K

key (key chain) command     SC-47

key chain

configuration (example)     SC-53

configuring     SC-44

end-time     SC-44

key identifier, configuring     SC-46

lifetime     SC-44

outbound traffic, configuring     SC-51

overview     SC-43

start-time     SC-44

text, configuring     SC-47

valid key, determining     SC-49

key chain command     SC-45

key identifier, configuring     SC-46

keys

mask preshared     SC-24

configuring (example)     SC-37

preshared

configuring (example)     SC-34, SC-38

IKE policy parameter     SC-21

preshared using AAA server     SC-25

key string, configuring     SC-47

key-string command     SC-49

key validation, determining     SC-49

L

lifetime, key chain     SC-44

M

MD5 (Message Digest 5) algorithm     SC-19

IKE policy parameter     SC-21

N

nonces

See RSA encrypted nonces

O

Oakley key exchange protocol     SC-19

See also IKE

outbound traffic (key chain), configuring     SC-51

P

preshared keys

See keys, preshared; keys, preshared using AAA server

public key configuration mode, enabling     SC-32

R

RADIUS

configuring

dead-server detection     SC-122

UDP ports     SC-119

operation     SC-111

radius-server dead-criteria time command     SC-123

radius-server dead-criteria tries command     SC-123

radius-server deadtime command     SC-122

RAs (registration authorities)

See CAs

RFC 2408, ISAKMP     SC-19

RFC 2409, The Internet Key Exchange     SC-18

RSA (Rivest, Shamir, and Adelman)

encrypted nonces     SC-19

keys     SC-3

deleting     SC-8

signatures     SC-19

RSA (Rivest, Shamir, and Adelman) encrypted nonces

IKE policy parameter     SC-21

requirements     SC-22, SC-23

RSA (Rivest, Shamir, and Adelman) keys

configuring, manually     SC-30

generating     SC-30

peer configuration     SC-32

RSA (Rivest, Shamir, and Adelman) signatures

IKE policy parameter     SC-21

requirements     SC-22

IKE configuration     SC-23

S

SAM (Software Authentication Manager)

description     SC-151

SAs (security associations)

lifetimes

configuring     SC-29

global values, configuring     SC-59

how they work     SC-59

IKE policy parameter     SC-21

send-lifetime command     SC-52

SHA (Secure Hash Algorithm)     SC-19

IKE policy parameter     SC-21

show key chain command     SC-46

show radius dead-criteria host command     SC-123

Skeme key exchange protocol     SC-19

See also IKE

SSH (Secure Shell)

client

configuring     SC-82

DES and 3DES support     SC-79

description     SC-79

server support     SC-79

configuring     SC-80

prerequisites, configuring     SC-78

restrictions, implementing     SC-78

server     SC-79

SFTP

overview     SC-79

supported versions     SC-77

troubleshooting     SC-83

SSL (Secure Socket Layer)

configuring     SC-89

description     SC-87

prerequisites, implementing     SC-88

start-time, key chain     SC-44