-
Cisco IOS XR System Security Command Reference, Release 3.4
-
Preface
-
Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software
-
Internet Key Exchange Security Protocol Commands on Cisco IOS XR Software
-
IPSec Network Security Commands on Cisco IOS XR Software
-
Public Key Infrastructure Commands on Cisco IOS XR Software
-
Secure Shell Commands on Cisco IOS XR Software
-
Secure Socket Layer Protocol Commands on Cisco IOS XR Software
-
Software Authentication Manager Commands on Cisco IOS XR Software
-
Key Chain Management Commands on Cisco IOS XR Software
-
Index
-
Table Of Contents
Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software
deadtime (server-group configuration)
radius-server dead-criteria time
radius-server dead-criteria tries
Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software
This chapter describes the Cisco IOS XR software commands used to configure authentication, authorization, and accounting (AAA) services.
For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA Services on Cisco IOS XR Software configuration module.
aaa accounting
To create a method list for accounting, use the aaa accounting command in global configuration mode. To remove a list name from the system, use the no form of this command.
aaa accounting {commands | exec | network} {default | list-name} {start-stop | stop-only}
{none | method}no aaa accounting {commands | exec | network} {default | list-name}
Syntax Description
Defaults
AAA accounting is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the aaa accounting command to create default or named method lists defining specific accounting methods and that can be used on a per-line or per-interface basis. You can specify up to four methods in the method list. The list name can be applied to a line (console, aux, or vty template) to enable accounting on that particular line.
The Cisco IOS XR software supports both TACACS+ and RADIUS methods for accounting. The router reports user activity to the security server in the form of accounting records, which are stored on the security server.
Method lists for accounting define the way accounting is performed, enabling you to designate a particular security protocol that is used on specific lines or interfaces for particular types of accounting services.
For minimal accounting, include the stop-only keyword to send a "stop accounting" notice after the requested user process. For more accounting, you can include the start-stop keyword, so that TACACS+ or RADIUS sends a "start accounting" notice at the beginning of the requested process and a "stop accounting" notice after the process. The accounting record is stored only on the TACACS+ or RADIUS server.
The requested user process begins regardless of whether the "start accounting" notice was received by the accounting server.
Note
This command cannot be used with TACACS or extended TACACS.
Task ID
Examples
The following example shows how to define a default commands accounting method list, where accounting services are provided by a TACACS+ security server, with a stop-only restriction:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa accounting commands default stop-only group tacacs+Related Commands
aaa accounting system default
To enable authentication, authorization, and accounting (AAA) system accounting, use the aaa accounting system default command in global configuration mode. To disable system accounting, use the no form of this command.
aaa accounting system default {start-stop | stop-only} {none | method}
no aaa accounting system default
Syntax Description
Defaults
AAA accounting is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
System accounting does not use named accounting lists; you can define only the default list for system accounting.
The default method list is automatically applied to all interfaces or lines. If no default method list is defined, then no accounting takes place.
You can specify up to four methods in the method list.
Task ID
Examples
The following example shows how to cause a "start accounting" record to be sent to a TACACS+ server when a router initially boots. A "stop accounting" record is also sent when a router is shut down or reloaded.
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa accounting system default start-stop group tacacs+Related Commands
Creates a method list for authentication.
Creates a method list for authorization.
aaa accounting update
To enable periodic interim accounting records to be sent to the accounting server, use the aaa accounting update command in global configuration mode. To disable interim accounting updates, use the no form of this command.
aaa accounting update {newinfo | periodic minutes}
no aaa accounting update
Syntax Description
Defaults
Disabled
Command Modes
Global configuration
Command History
Release 3.4.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
If the newinfo keyword is used, interim accounting records are sent to the accounting server every time there is new accounting information to report. An example of this report would be when IP Control Protocol (IPCP) completes IP address negotiation with the remote peer. The interim accounting record includes the negotiated IP address used by the remote peer.
When used with the periodic keyword, interim accounting records are sent periodically as defined by the minutes argument. The interim accounting record contains all the accounting information recorded for that user up to the time the accounting record is sent.
When using both the newinfo and periodic keywords, interim accounting records are sent to the accounting server every time there is new accounting information to report, and accounting records are sent to the accounting server periodically as defined by the minutes argument. For example, if you configure the aaa accounting update command with the newinfo and periodic keywords, all users currently logged in continue to generate periodic interim accounting records while new users generate accounting records based on the newinfo algorithm.
Caution
Both periodic and newinfo keywords are mutually exclusive; therefore, only one keyword can be configured at a time.
Task ID
Examples
The following example shows how to send periodic interim accounting records to the RADIUS server at 30-minute intervals:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa accounting update periodic 30The following example shows how to send interim accounting records to the RADIUS server when there is new accounting information to report:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa accounting update newinfoRelated Commands
aaa authentication
To create a method list for authentication, use the aaa authentication command in global configuration mode or administration configuration mode. To disable this authentication method, use the no form of this command.
aaa authentication {login | ppp} {default | list-name | remote} method-list
no aaa authentication {login | ppp} {default | list-name | remote} method-list
Syntax Description
Defaults
Default behavior applies the local authentication on all ports.
Command Modes
Global configuration
Administration configurationCommand History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the aaa authentication command to create a series of authentication methods, or method list. You can specify up to four methods in the method list. A method list is a named list describing the authentication methods (such as TACACS+ or RADIUS) in sequence. The subsequent methods of authentication are used only if the initial method is not available, not if it fails.
The default method list is applied for all interfaces for authentication, except when a different named method list is explicitly specified—in which case the explicitly specified method list overrides the default list.
For console and vty access, if no authentication is configured, a default of local method is applied.
Note
•
•
•
Task ID
Examples
The following example shows how to specify the default method list for authentication, and also enable authentication for console in global configuration mode:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa authentication login default group tacacs+The following example shows how to specify the remote method list for authentication, and also enable authentication for console in administration configuration mode:
RP/0/RP0/CPU0:router# adminRP/0/RP0/CPU0:router (admin)# configureRP/0/RP0/CPU0:router(admin-config)# aaa authentication login remote local group tacacs+Related Commands
aaa authorization
To create a method list for authorization, use the aaa authorization command in global configuration mode. To disable authorization for a function, use the no form of this command.
aaa authorization {commands | exec | network} {default | list-name} {none | local | group {tacacs+ | radius | group-name}}
no aaa authorization {commands | exec | network} {default | list-name}
Syntax Description
Defaults
Authorization is disabled for all actions (equivalent to the method none keyword).
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the aaa authorization command to create method lists defining specific authorization methods that can be used on a per-line or per-interface basis. You can specify up to four methods in the method list.
Note
Method lists for authorization define the ways authorization will be performed and the sequence in which these methods will be performed. A method list is a named list describing the authorization methods (such as TACACS+), in sequence. Method lists enable you to designate one or more security protocols for authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS XR software uses the first method listed to authorize users for specific network services; if that method fails to respond, Cisco IOS XR software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method or until all methods defined have been exhausted.
Note
The Cisco IOS XR software supports the following methods for authorization:
•
•
•
•
•
Method lists are specific to the type of authorization being requested. The Cisco IOS XR software supports three types of AAA authorization:
•
Note
•
•
When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type. When defined, method lists must be applied to specific lines or interfaces before any of the defined methods are performed.
Task ID
Examples
The following example shows how to define the network authorization method list named listname1, which specifies that TACACS+ authorization is used:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa authorization commands listname1 group tacacs+Related Commands
aaa default-taskgroup
To specify a task group for both remote TACACS+ authentication and RADIUS authentication, use the aaa default-taskgroup command in global configuration mode. To remove this default task group, enter the no form of this command.
aaa default-taskgroup taskgroup-name
no aaa default-taskgroup
Syntax Description
Defaults
No default task group is assigned for remote authentication.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the aaa default-taskgroup command to specify an existing task group for remote TACACS+ authentication.
Task ID
Examples
The following example shows how to specify taskgroup1 as the default task group for remote TACACS+ authentication:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa default-taskgroup taskgroup1aaa group server radius
To group different RADIUS server hosts into distinct lists, use the aaa group server radius command in global configuration mode. To remove a group server from the configuration list, enter the no form of this command.
aaa group server radius group-name
no aaa group server radius group-name
Syntax Description
Defaults
This command is not enabled.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the aaa group server radius command to group existing server hosts, which allows you to select a subset of the configured server hosts and use them for a particular service. A server group is used in conjunction with a global server-host list. The server group lists the IP addresses or hostnames of the selected server hosts.
Server groups can also include multiple host entries for the same server, as long as each entry has a unique identifier. The combination of an IP address and User Datagram Protocol (UDP) port number creates a unique identifier, allowing different ports to individually defined as RADIUS hosts providing a specific authentication, authorization, and accounting (AAA) service. In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service, for example, accounting, the second host entry acts as an automatic switchover backup to the first host entry. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry on the same device for accounting services. The RADIUS host entries are tried in the order in which they are configured in the server group.
All members of a server group must be the same type, that is, RADIUS.
The server group cannot be named radius or tacacs.
This command enters server group configuration mode. You can use the server command to associate a particular RADIUS server with the defined server group.
Task ID
Examples
The following example shows the configuration of an AAA group server named radgroup1, which comprises three member servers:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius radgroup1RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.5 auth-port 1700 acct-port 1701RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.10 auth-port 1702 acct-port 1703RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.20 auth-port 1705 acct-port 1706
Note
Related Commands
aaa group server tacacs+
To group different TACACS+ server hosts into distinct lists, use the b command in global configuration mode. To remove a server group from the configuration list, enter the no form of this command.
aaa group server tacacs+ group-name
no aaa group server tacacs+ group-name
Syntax Description
Defaults
This command is not enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The AAA server-group feature introduces a way to group existing server hosts. The feature enables you to select a subset of the configured server hosts and use them for a particular service.
The aaa group server tacacs+ command enters server group configuration mode. The server command associates a particular TACACS+ server with the defined server group.
A server group is a list of server hosts of a particular type. The supported server host type is TACACS+ server hosts. A server group is used with a global server host list. The server group lists the IP addresses or hostnames of the selected server hosts.
The server group cannot be named radius or tacacs.
Note
Task ID
Examples
The following example shows the configuration of an AAA group server named tacgroup1, which comprises three member servers:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server tacacs+ tacgroup1RP/0/RP0/CPU0:router(config-sg-tacacs)# server 192.168.200.226RP/0/RP0/CPU0:router(config-sg-tacacs)# server 192.168.200.227RP/0/RP0/CPU0:router(config-sg-tacacs)# server 192.168.200.228Related Commands
accounting (line)
To enable authentication, authorization, and accounting (AAA) accounting services for a specific line or group of lines, use the accounting command in line configuration mode. To disable AAA accounting services, use the no form of this command.
accounting {commands | exec} {default | list-name}
no accounting {commands | exec}
Syntax Description
Defaults
Accounting is disabled.
Command Modes
Line configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
After you enable the aaa accounting command and define a named accounting method list (or use the default method list) for a particular type of accounting, you must apply the defined lists to the appropriate lines for accounting services to take place. Use the accounting command to apply the specified method lists to the selected line or group of lines. If a method list is not specified this way, no accounting is applied to the selected line or group of lines.
Task ID
Examples
The following example shows how to enable command accounting services using the accounting method list named listname2 on a line template named configure:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# line template configureRP/0/RP0/CPU0:router(config-line)# accounting commands listname2Related Commands
authorization
To enable authentication, authorization, and accounting (AAA) authorization for a specific line or group of lines, use the authorization command in line configuration mode. To disable authorization, use the no form of this command.
authorization {commands | exec} {default | list-name}
no authorization {commands | exec}
Syntax Description
Defaults
Authorization is not enabled.
Command Modes
Line configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
After you use the aaa authorization command to define a named authorization method list (or use the default method list) for a particular type of authorization, you must apply the defined lists to the appropriate lines for authorization to take place. Use the authorization command to apply the specified method lists (or, if none is specified, the default method list) to the selected line or group of lines.
Task ID
Examples
The following example shows how to enable command authorization using the method list named listname4 on a line template named configure:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# line template configureRP/0/RP0/CPU0:router(config-line)# authorization commands listname4Related Commands
deadtime (server-group configuration)
To configure the deadtime value at the RADIUS server group level, use the deadtime command in server-group configuration mode. To set deadtime to 0, use the no form of this command.
deadtime minutes
no deadtime
Syntax Description
minutes
Length of time, in minutes, for which a RADIUS server is skipped over by transaction requests, up to a maximum of 1440 (24 hours). The range is from 1 to 1440.
Defaults
Deadtime is set to 0.
Command Modes
Server-group configuration
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The value of the deadtime set in the server groups overrides the deadtime that is configured globally. If the deadtime is omitted from the server group configuration, the value is inherited from the master list. If the server group is not configured, the default value of 0 applies to all servers in the group. If the deadtime is set to 0, no servers are marked dead.
Task ID
Examples
The following example specifies a one-minute deadtime for RADIUS server group group1 when it has failed to respond to authentication requests for the deadtime command:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server 1.1.1.1 auth-port 1645 acct-port 1646RP/0/RP0/CPU0:router(config-sg-radius)# server 2.2.2.2 auth-port 2000 acct-port 2001RP/0/RP0/CPU0:router(config-sg-radius)# deadtime 1Related Commands
description (AAA)
To create a description of a task group or user group during configuration, use the description command in task group configuration or user group configuration mode. To delete a task group description or user group description, use the no form of this command.
description string
no description
Syntax Description
Defaults
The default description is blank.
Command Modes
Task group configuration
User group configurationCommand History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the description command inside the task or user group configuration submode to define a description for the task or user group, respectively.
Task ID
Examples
The following example shows the creation of a task group description:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# taskgroup alphaRP/0/RP0/CPU0:router(config-tg)# description this is a sample taskgroupThe following example shows the creation of a user group description:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# usergroup alphaRP/0/RP0/CPU0:router(config-ug)# description this is a sample user groupRelated Commands
group (AAA)
To add a user to a group, use the group command in username configuration mode. To remove the user from a group, use the no form of this command.
group {root-system | root-lr | netadmin | sysadmin | operator | cisco-support | serviceadmin | group-name}
no group {root-system | root-lr | netadmin | sysadmin | operator | cisco-support |
serviceadmin | group-name}Syntax Description
Defaults
No default behavior or values
Command Modes
Username configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The predefined group root-system may be specified only by root-system users while configuring administration.
Use the group command in username configuration mode. To access username configuration mode, use the username command in global configuration mode.
If the group command is used in administration configuration mode, only root-system and cisco-support can be specified.
Task ID
Examples
The following example shows how to assign the user group operator to the user named user1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# username user1RP/0/RP0/CPU0:router(config-un)# group operatorRelated Commands
inherit taskgroup
To enable a task group to derive permissions from another task group, use the inherit taskgroup command in task group configuration mode.
inherit taskgroup {taskgroup-name | netadmin | operator | sysadmin | cisco-support | root-lr | root-system | serviceadmin}
Syntax Description
Defaults
No default behavior or values
Command Modes
Task group configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the inherit taskgroup command to inherit the permissions (task IDs) from one task group into another task group. Any changes made to the taskgroup from which they are inherited are reflected immediately in the group from which they are inherited.
Task ID
Examples
In the following example, the permissions of task group tg2 are inherited by task group tg1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# taskgroup tg1RP/0/RP0/CPU0:router(config-tg)# inherit taskgroup tg2RP/0/RP0/CPU0:router(config-tg)# endinherit usergroup
To enable a user group to derive characteristics of another user group, use the inherit usergroup command in user group configuration mode.
inherit usergroup usergroup-name
Syntax Description
Defaults
No default behavior or values
Command Modes
User group configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Each user group is associated with a set of task groups applicable to the users in that group. A task group is defined by a collection of task IDs. Task groups contain task ID lists for each class of action. The task permissions for a user are derived (at the start of the EXEC or XML session) from the task groups associated with the user groups to which that user belongs.
User groups support inheritance from other user groups. Use the inherit usergroup command to copy permissions (task ID attributes) from one user group to another user group. The "destination" user group inherits the properties of the inherited group and forms a union of all task IDs specified in those groups. For example, when user group A inherits user group B, the task map of the user group A is a union of that of A and B. Cyclic inclusions are detected and rejected. User groups cannot inherit properties from predefined groups, such as root-system users, root-sdr users, netadmin users, and so on. Any changes made to the usergroup from which it is inherited are reflected immediately in the group from which it is inherited.
Task ID
Examples
The following example shows how to enable the purchasing user group to inherit properties from the sales user group:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# usergroup purchasingRP/0/RP0/CPU0:router(config-ug)# inherit usergroup salesRelated Commands
key (RADIUS)
To specify the authentication and encryption key that is used between the router and the RADIUS daemon running on the RADIUS server, use the key command in RADIUS server-group private configuration mode.
key {0 clear-text-key | 7 encrypted-key | clear-text-key}
no key {0 clear-text-key | 7 encrypted-key | clear-text-key}
Syntax Description
0 clear-text-key
Specifies an unencrypted (cleartext) shared key.
7 encrypted-key
Specifies an encrypted shared key.
clear-text-key
Specifies an unencrypted (cleartext) user password.
Defaults
For submode key commands, the default is to use the radius-server key command in global configuration mode if defined. If the global key is also not defined, the configuration is not complete.
Command Modes
RADIUS server-group private configuration
Command History
Release 3.4.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following example shows how to set the encrypted key to anykey:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 auth-port 300RP/0/RP0/CPU0:router(config-sg-radius-private)# key anykeyRelated Commands
login authentication
To enable authentication, authorization, and accounting (AAA) authentication for logins, use the login authentication command in line configuration mode. To return to the default authentication settings, use the no form of this command.
login authentication {default | list-name}
no login authentication
Syntax Description
Defaults
This command uses the default set with the aaa authentication login command.
Command Modes
Line configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The login authentication command is a per-line command used with AAA that specifies the name of a list of AAA authentication methods to try at login.
Caution
Entering the no form of the login authentication command has the same effect as entering the command with the default keyword.
Before issuing this command, create a list of authentication processes by using the aaa authentication login global configuration command.
Task ID
Examples
The following example shows that the default AAA authentication is used for the line template template1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# line template template1RP/0/RP0/CPU0:router(config-line)# login authentication defaultThe following example shows that the AAA authentication list called list1 is used for the line template template2:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# line template template2RP/0/RP0/CPU0:router(config-line)# login authentication list1Related Commands
password (AAA)
To create a login password for a user, use the password command in username or line configuration mode. To remove the password, use the no form of this command.
password {0 | 7} password
no password {0 | 7} password
Syntax Description
0
Specifies that an unencrypted (clear-text) password follows.
7
Specifies that an encrypted password follows.
password
Character-string password to be entered by the user to log in.
Defaults
No password is specified.
Command Modes
Username configuration
Line configurationCommand History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
You can specify one of two types of passwords: encrypted or clear text.
When an EXEC process is started on a line that has password protection, the process prompts for the password. If the user enters the correct password, the process issues the prompt. The user can try three times to enter a password before the process exits and returns the terminal to the idle state.
Passwords are two-way encrypted and should be used for applications such as PPP that need decryptable passwords.
Note
Task ID
Examples
The following example shows how to establish the unencrypted password pwd1 for the user user1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# username user1RP/0/RP0/CPU0:router(config-un)# password 0 pwd1Related Commands
radius-server dead-criteria time
To specify the minimum amount of time, in seconds, that must elapse from the time that the router last received a valid packet from the RADIUS server to the time the server is marked as dead, use the radius-server dead-criteria time command in global configuration mode. To disable the criteria that were set, use the no form of this command.
radius-server dead-criteria time seconds
no radius-server dead-criteria time seconds
Syntax Description
Defaults
If the seconds argument is not configured, the number of seconds ranges from 10 to 60 seconds, depending on the transaction rate of the server.
Command Modes
Global configuration
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Note
If a packet has not been received since the router booted and there is a timeout, the time criterion is treated as though it were met.
If the seconds argument is not indicated, the time is set to the defaults.
Task ID
Examples
The following example shows how to establish the time for the dead-criteria conditions for a RADIUS server to be marked as dead for the radius-server dead-criteria time command:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server dead-criteria time 5Related Commands
radius-server dead-criteria tries
To specify the number of consecutive timeouts that must occur on the router before the RADIUS server is marked as dead, use the radius-server dead-criteria tries command in global configuration mode. To disable the criteria that were set, use the no form of this command.
radius-server dead-criteria tries tries
no radius-server dead-criteria tries tries
Syntax Description
Defaults
If the tries argument is not configured, the number of consecutive timeouts ranges from 10 to 100, depending on the transaction rate of the server and the number of configured retransmissions.
Command Modes
Global configuration
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
If the server performs both authentication and accounting, both types of packet are included in the number. Improperly constructed packets are counted as though they were timeouts. All transmissions, including the initial transmit and all retransmits, are counted.
Note
If the tries argument is not indicated, the number of tries is set to the default.
Task ID
Examples
The following example shows how to establish the number of tries for the dead-criteria conditions for a RADIUS server to be marked as dead for the radius-server dead-criteria tries command:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server dead-criteria tries 4Related Commands
radius-server deadtime
To improve RADIUS response times when some servers are unavailable and cause the unavailable servers to be skipped immediately, use the radius-server deadtime command in global configuration mode. To set deadtime to 0, use the no form of this command.
radius-server deadtime minutes
no radius-server deadtime
Syntax Description
minutes
Length of time, in minutes, for which a RADIUS server is skipped over by transaction requests, up to a maximum of 1440 (24 hours). The range is from 1 to 1440. The default value is 0.
Defaults
Dead time is set to 0.
Command Modes
Global configuration
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
A RADIUS server marked as dead is skipped by additional requests for the duration of minutes unless all other servers are marked dead and there is no rollover method.
Task ID
Examples
The following example specifies five minutes of deadtime for RADIUS servers that fail to respond to authentication requests for the radius-server deadtime command:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server deadtime 5Related Commands
radius-server host
To specify a RADIUS server host, use the radius-server host command in global configuration mode. To delete the specified RADIUS host, use the no form of this command.
radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string]
no radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number]
Syntax Description
Defaults
No RADIUS host is specified; use global radius-server command values.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
You can use multiple radius-server host commands to specify multiple hosts. The Cisco IOS XR software searches for hosts in the order in which you specify them.
If no host-specific timeout, retransmit, or key values are specified, the global values apply to each host
Task ID
.
Examples
The following example shows how to establish host1 as the RADIUS server and use default ports for both accounting and authentication:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server host host1The following example shows how to establish port 1612 as the destination port for authentication requests and port 1616 as the destination port for accounting requests on the RADIUS host named host1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server host host1 auth-port 1612 acct-port 1616Because entering a line resets all the port numbers, you must specify a host and configure accounting and authentication ports on a single line.
The following example shows how to establish the host with IP address 172.29.39.46 as the RADIUS server, use ports 1612 and 1616 as the authorization and accounting ports, set the timeout value to 6, set the retransmit value to 5, and set "rad123" as the encryption key, matching the key on the RADIUS server:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server host 172.29.39.46 auth-port 1612 acct-port 1616 timeout 6 retransmit 5 key rad123To use separate servers for accounting and authentication, use the zero port value as appropriate.
The following example shows how to establish that RADIUS server host1 be used for accounting but not for authentication, and specify that RADIUS server host2 be used for authentication but not for accounting:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server host host1.example.com auth-port 0RP/0/RP0/CPU0:router(config)# radius-server host host2.example.com acct-port 0Related Commands
radius-server key
To set the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon, use the radius-server key command in global configuration mode. To disable the key, use the no form of this command.
radius-server key {0 clear-text-key | 7 encrypted-key | clear-text-key}
no radius-server key
Syntax Description
0 clear-text-key
Specifies an unencrypted (cleartext) shared key.
7 encrypted-key
Specifies a encrypted shared key.
clear-text-key
Specifies an unencrypted (cleartext) shared key.
Defaults
The authentication and encryption key is disabled.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The key entered must match the key used on the RADIUS server. All leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
Task ID
Examples
The following example shows how to set the cleartext key to samplekey:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server key 0 samplekeyThe following example shows how to set the encrypted shared key to "anykey":
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server key 7 anykeyRelated Commands
radius-server retransmit
To specify the number of times the Cisco IOS XR software retransmits a packet to a server before giving up, use the radius-server retransmit command in global configuration mode. To disable retransmission, use the no form of this command.
radius-server retransmit retries
no radius-server retransmit
Syntax Description
Defaults
The RADIUS servers are retried three times, or until a response is received.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The RADIUS client tries all servers, allowing each one to time out before increasing the retransmit count.
Task ID
Examples
The following example shows how to specify a retransmit counter value of five times:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server retransmit 5Related Commands
radius-server timeout
To set the interval for which a router waits for a server host to reply before timing out, use the radius-server timeout command in global configuration mode. To restore the default, use the no form of this command.
radius-server timeout seconds
no radius-server timeout
Syntax Description
Defaults
seconds: 5 seconds
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the radius-server timeout command to set the number of seconds a router waits for a server host to reply before timing out.
Task ID
Examples
The following example shows how to change the interval timer to 10 seconds:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius-server timeout 10Related Commands
radius source-interface
To force RADIUS to use the IP address of a specified interface or subinterface for all outgoing RADIUS packets, use the radius source-interface command in global configuration mode. To prevent only the specified interface from being the default and not from being used for all outgoing RADIUS packets, use the no form of this command.
radius source-interface interface-name [vrf vrf-id]
no radius source-interface
Syntax Description
interface-name
Name of the interface that RADIUS uses for all of its outgoing packets.
vrf vrf-id
Specifies the name of the assigned VRF.
Defaults
If a specific source interface is not configured, or the interface is down or does not have an IP address configured, the system selects an IP address.
Command Modes
Global configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
The vrf keyword was added.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the radius source-interface command to set the IP address of the specified interface or subinterface for all outgoing RADIUS packets. This address is used as long as the interface or subinterface is in the up state. In this way, the RADIUS server can use one IP address entry for every network access client instead of maintaining a list of IP addresses.
The specified interface or subinterface must have an IP address associated with it. If the specified interface or subinterface does not have an IP address or is in the down state, then RADIUS reverts to the default. To avoid this, add an IP address to the interface or subinterface or bring the interface to the up state.
The radius source-interface command is especially useful in cases in which the router has many interfaces or subinterfaces and you want to ensure that all RADIUS packets from a particular router have the same IP address.
Task ID
Examples
The following example shows how to make RADIUS use the IP address of subinterface s2 for all outgoing RADIUS packets:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# radius source-interface Loopback 10 vrf wal-martRelated Commands
retransmit (RADIUS)
To specify the number of times a RADIUS request is resent to a server if the server is not responding or is responding slowly, use the retransmit command in RADIUS server-group private configuration mode.
retransmit retries
no retransmit retries
Syntax Description
retries
The retries argument specifies the retransmit value. The range is from 1 to 100. If no retransmit value is specified, the global value is used.
Defaults
The default value is 3.
Command Modes
RADIUS server-group private configuration
Command History
Release 3.4.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following example shows how to set the retransmit value:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 auth-port 300RP/0/RP0/CPU0:router(config-sg-radius-private)# retransmit 100Related Commands
secret
To create a secure login secret for a user, use the secret command in username or line configuration mode. To remove the secure secret, use the no form of this command.
secret {0 | 5} secret
no secret {0 | 5} secret
Syntax Description
0
Specifies that an unencrypted (clear text) secure secret follows.
5
Specifies that an encrypted secure secret follows.
secret
Character-string secret to be entered by the user to log in.
Defaults
No password is specified.
Command Modes
Username configuration
Line configurationCommand History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
You can specify one of two types of secure secrets: encrypted or clear text.
When an EXEC process is started on a line that has password protection, the process prompts for the secret. If the user enters the correct secret, the process issues the prompt. The user can try three times to enter a secret before the process exits and returns the terminal to the idle state.
Secrets are one-way encrypted and should be used for applications such as login that do not need a decryptable secret.
Note
Task ID
Examples
The following example shows how to establish the secure encrypted secret pwd2 for the user user2:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# username user2RP/0/RP0/CPU0:router(config-un)# secret 5 pwd2Related Commands
server (RADIUS)
To associate a particular RADIUS server with a defined server group, use the server command in RADIUS server-group configuration mode. To remove the associated server from the server group, use the no form of this command.
server {hostname | ip-address} [auth-port port-number] [acct-port port-number]
no server {hostname | ip-address} [auth-port port-number] [acct-port port-number]
Syntax Description
Defaults
If no port attributes are defined, the defaults are as follows:
•
•
Command Modes
RADIUS server-group configuration
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the server command to associate a particular RADIUS server with a defined server group.
There are two different ways in which you can identify a server, depending on the way you want to offer AAA services. You can identify the server simply by using its IP address, or you can identify multiple host instances or entries using the optional auth-port and acct-port keywords.
When you use the optional keywords, the network access server identifies RADIUS security servers and host instances associated with a group server based on their IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS host entries providing a specific AAA service. If two different host entries on the same RADIUS server are configured for the same service, for example, accounting, the second host entry configured acts as an automatic switchover backup to the first one. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the order they are configured.)
Task ID
Examples
The following example shows how to use two different host entries on the same RADIUS server that are configured for the same services—authentication and accounting. The second host entry configured acts as fail-over backup to the first one.
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server 1.1.1.1 auth-port 1645 acct-port 1646RP/0/RP0/CPU0:router(config-sg-radius)# server 2.2.2.2 auth-port 2000 acct-port 2001Related Commands
server (TACACS+)
To associate a particular TACACS+ server with a defined server group, use the server command in TACACS+ server-group configuration mode. To remove the associated server from the server group, use the no form of this command.
server {hostname | ip-address}
no server {hostname | ip-address}
Syntax Description
Defaults
No default behavior or values
Command Modes
TACACS+ server-group configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the server command to associate a particular TACACS+ server with a defined server group. The server need not be accessible during configuration. Later, you can reference the configured server group from the method lists used to configure authentication, authorization, and accounting (AAA).
Task ID
Examples
The following example shows how to associate the TACACS+ server with the IP address 192.168.60.15 with the server group tac1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server tacacs+ tac1RP/0/RP0/CPU0:router(config-sg-tacacs+)# server 192.168.60.15Related Commands
server-private (RADIUS)
To configure the IP address of the private RADIUS server for the group server, use the server-private command in RADIUS server-group configuration mode. To remove the associated private server from the AAA group server, use the no form of this command.
server-private {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string]
no server-private {hostname | ip-address} [auth-port port-number] [acct-port port-number]
Syntax Description
Defaults
If no port attributes are defined, the defaults are as follows:
•
•
Command Modes
RADIUS server-group configuration
Command History
Release 3.4.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the server-private command to associate a particular private server with a defined server group. Possible overlapping of IP addresses between Virtual Router Forwardings (VRFs) are permitted. Private servers (servers with private addresses) can be defined within the server group and remain hidden from other groups, while the servers in the global pool (for example, default radius server group) can still be referred to by IP addresses and port numbers. Thus, the list of servers in server groups includes references to the hosts in the global configuration and the definitions of private servers.
Both auth-port and acct-port keywords enter RADIUS server-group private configuration mode.
Task ID
Examples
The following example shows how to define the group1 RADIUS group server, associate private servers with it, and to enter RADIUS server-group private configuration mode:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 timeout 5RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 retransmit 3RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 key cokeRP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 auth-port 300RP/0/RP0/CPU0:router(config-sg-radius-private)# exitRP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.2.2.2 timeout 5RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.2.2.2 retransmit 3RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.2.2.2 key cokeRP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.2.2.2 auth-port 300RP/0/RP0/CPU0:router(config-sg-radius-private)#Related Commands
show aaa
To display information about an IKE group, user group, local user, or task group; to list all task IDs associated with all IKE groups, user groups, local users, or task groups in the system; or to list all task IDs for a specified IKE group, user group, local user, or task group, use the show aaa command in EXEC mode.
show aaa {ikegroup ikegroup-name | usergroup [usergroup-name] | userdb [username] | taskgroup [taskgroup-name]}
Syntax Description
Defaults
Details for all user groups, or all local users, or all task groups are listed if no argument is entered.
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show aaa command to list details for all IKE groups, user groups, local users, or task groups in the system. Use the optional ikegroup-name, usergroup-name, username, or taskgroup-name argument to display the details for a specified IKE group, user group, user, or task group, respectively.
Task ID
Examples
The following sample output is from the ikegroup keyword:
RP/0/RP0/CPU0:router# show aaa ikegroupIKE Group ike-groupMax-Users = 50IKE Group ikeuserGroup-Key = test-passwordDefault Domain = cisco.comIKE Group ike-userThe following sample output is from the show aaa usergroup command:
RP/0/RP0/CPU0:router# show aaa usergroup operatorUser group 'operator'Inherits from task group 'operator'User group 'operator' has the following combined setof task IDs (including all inherited groups):Task: basic-services : READ WRITE EXECUTE DEBUGTask: cdp : READTask: diag : READTask: ext-access : READ EXECUTETask: logging : READThe following sample output is from the taskgroup keyword for a task group named netadmin:
RP/0/RP0/CPU0:router# show aaa taskgroup netadminTask group 'netadmin'Task group 'netadmin' has the following combined setof task IDs (including all inherited groups):Task: aaa : READTask: acl : READ WRITE EXECUTE DEBUGTask: admin : READTask: atm : READ WRITE EXECUTE DEBUGTask: basic-services : READ WRITE EXECUTE DEBUGTask: bcdl : READTask: bfd : READ WRITE EXECUTE DEBUGTask: bgp : READ WRITE EXECUTE DEBUGTask: boot : READ WRITE EXECUTE DEBUGTask: bundle : READ WRITE EXECUTE DEBUGTask: cdp : READ WRITE EXECUTE DEBUGTask: cef : READ WRITE EXECUTE DEBUGTask: cisco-support : READTask: config-mgmt : READ WRITE EXECUTE DEBUGTask: config-services : READ WRITE EXECUTE DEBUGTask: crypto : READ WRITE EXECUTE DEBUGTask: diag : READ WRITE EXECUTE DEBUGTask: disallowed : READTask: drivers : READTask: ext-access : READ WRITE EXECUTE DEBUGTask: fabric : READ WRITE EXECUTE DEBUGTask: fault-mgr : READ WRITE EXECUTE DEBUGTask: filesystem : READ WRITE EXECUTE DEBUGTask: fr : READ WRITE EXECUTE DEBUGTask: hdlc : READ WRITE EXECUTE DEBUGTask: host-services : READ WRITE EXECUTE DEBUGTask: hsrp : READ WRITE EXECUTE DEBUGTask: interface : READ WRITE EXECUTE DEBUGTask: inventory : READTask: ip-services : READ WRITE EXECUTE DEBUGTask: ipv4 : READ WRITE EXECUTE DEBUGTask: ipv6 : READ WRITE EXECUTE DEBUGTask: isis : READ WRITE EXECUTE DEBUGTask: logging : READ WRITE EXECUTE DEBUGTask: lpts : READ WRITE EXECUTE DEBUGTask: monitor : READTask: mpls-ldp : READ WRITE EXECUTE DEBUGTask: mpls-static : READ WRITE EXECUTE DEBUGTask: mpls-te : READ WRITE EXECUTE DEBUGTask: multicast : READ WRITE EXECUTE DEBUGTask: netflow : READ WRITE EXECUTE DEBUGTask: network : READ WRITE EXECUTE DEBUGTask: ospf : READ WRITE EXECUTE DEBUGTask: ouni : READ WRITE EXECUTE DEBUGTask: pkg-mgmt : READTask: pos-dpt : READ WRITE EXECUTE DEBUGTask: ppp : READ WRITE EXECUTE DEBUGTask: qos : READ WRITE EXECUTE DEBUGTask: rib : READ WRITE EXECUTE DEBUGTask: rip : READ WRITE EXECUTE DEBUGTask: root-lr : READTask: route-map : READ WRITE EXECUTE DEBUGTask: route-policy : READ WRITE EXECUTE DEBUGTask: snmp : READ WRITE EXECUTE DEBUGTask: sonet-sdh : READ WRITE EXECUTE DEBUGTask: static : READ WRITE EXECUTE DEBUGTask: sysmgr : READTask: system : READ WRITE EXECUTE DEBUGTask: transport : READ WRITE EXECUTE DEBUGTask: tty-access : READ WRITE EXECUTE DEBUGTask: tunnel : READ WRITE EXECUTE DEBUGTask: universal : READTask: vlan : READ WRITE EXECUTE DEBUGTask: vrrp : READ WRITE EXECUTE DEBUGThe sample output is from the taskgroup keyword for an operator. The task group operator has the following combined set of task IDs, which includes all inherited groups:
Task: basic-services : READ WRITE EXECUTE DEBUGTask: cdp : READTask: diag : READTask: ext-access : READ EXECUTETask: logging : READThe sample output is from the taskgroup keyword for a root-system. The task group root-system has the following combined set of task IDs, which includes all inherited groups:
Task: aaa : READ WRITE EXECUTE DEBUGTask: acl : READ WRITE EXECUTE DEBUGTask: admin : READ WRITE EXECUTE DEBUGTask: atm : READ WRITE EXECUTE DEBUGTask: basic-services : READ WRITE EXECUTE DEBUGTask: bcdl : READ WRITE EXECUTE DEBUGTask: bfd : READ WRITE EXECUTE DEBUGTask: bgp : READ WRITE EXECUTE DEBUGTask: boot : READ WRITE EXECUTE DEBUGTask: bundle : READ WRITE EXECUTE DEBUGTask: cdp : READ WRITE EXECUTE DEBUGTask: cef : READ WRITE EXECUTE DEBUGTask: config-mgmt : READ WRITE EXECUTE DEBUGTask: config-services : READ WRITE EXECUTE DEBUGTask: crypto : READ WRITE EXECUTE DEBUGTask: diag : READ WRITE EXECUTE DEBUGTask: drivers : READ WRITE EXECUTE DEBUGTask: ext-access : READ WRITE EXECUTE DEBUGTask: fabric : READ WRITE EXECUTE DEBUGTask: fault-mgr : READ WRITE EXECUTE DEBUGTask: filesystem : READ WRITE EXECUTE DEBUGTask: fr : READ WRITE EXECUTE DEBUGTask: hdlc : READ WRITE EXECUTE DEBUGTask: host-services : READ WRITE EXECUTE DEBUGTask: hsrp : READ WRITE EXECUTE DEBUGTask: interface : READ WRITE EXECUTE DEBUGTask: inventory : READ WRITE EXECUTE DEBUGTask: ip-services : READ WRITE EXECUTE DEBUGTask: ipv4 : READ WRITE EXECUTE DEBUGTask: ipv6 : READ WRITE EXECUTE DEBUGTask: isis : READ WRITE EXECUTE DEBUGTask: logging : READ WRITE EXECUTE DEBUGTask: lpts : READ WRITE EXECUTE DEBUGTask: monitor : READ WRITE EXECUTE DEBUGTask: mpls-ldp : READ WRITE EXECUTE DEBUGTask: mpls-static : READ WRITE EXECUTE DEBUGTask: mpls-te : READ WRITE EXECUTE DEBUGTask: multicast : READ WRITE EXECUTE DEBUGTask: netflow : READ WRITE EXECUTE DEBUGTask: network : READ WRITE EXECUTE DEBUGTask: ospf : READ WRITE EXECUTE DEBUGTask: ouni : READ WRITE EXECUTE DEBUGTask: pkg-mgmt : READ WRITE EXECUTE DEBUGTask: pos-dpt : READ WRITE EXECUTE DEBUGTask: ppp : READ WRITE EXECUTE DEBUGTask: qos : READ WRITE EXECUTE DEBUGTask: rib : READ WRITE EXECUTE DEBUGTask: rip : READ WRITE EXECUTE DEBUGTask: root-lr : READ WRITE EXECUTE DEBUGTask: root-system : READ WRITE EXECUTE DEBUGTask: route-map : READ WRITE EXECUTE DEBUGTask: route-policy : READ WRITE EXECUTE DEBUGTask: snmp : READ WRITE EXECUTE DEBUGTask: sonet-sdh : READ WRITE EXECUTE DEBUGTask: static : READ WRITE EXECUTE DEBUGTask: sysmgr : READ WRITE EXECUTE DEBUGTask: system : READ WRITE EXECUTE DEBUGTask: transport : READ WRITE EXECUTE DEBUGTask: tty-access : READ WRITE EXECUTE DEBUGTask: tunnel : READ WRITE EXECUTE DEBUGTask: universal : READ WRITE EXECUTE DEBUGTask: vlan : READ WRITE EXECUTE DEBUGTask: vrrp : READ WRITE EXECUTE DEBUGThe following sample output is from show aaa command with the userdb keyword:
RP/0/RP0/CPU0:router# show aaa userdbUsername lab (admin plane)User group root-systemUser group cisco-supportUsername acmeUser group root-systemRelated Commands
show radius
To display information about the RADIUS servers that are configured in the system, use the show radius command in EXEC mode.
show radius
Syntax Description
This command has no arguments or keywords.
Defaults
If no radius servers are configured, no output is displayed.
Command Modes
EXEC
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show radius command to display statistics for each configured RADIUS server.
Task ID
Examples
The following sample output is for the show radius command:
RP/0/RP0/CPU0:router# show radiusGlobal dead time: 0 minute(s)Server: 1.1.1.1/1645/1646 is UPTimeout: 5 sec, Retransmit limit: 3Authentication:0 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttAccounting:0 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttServer: 2.2.2.2/1645/1646 is UPTimeout: 10 sec, Retransmit limit: 3Authentication:0 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttAccounting:0 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttTable 1 describes the significant fields shown in the display.
Related Commands
show radius accounting
To obtain information and detailed statistics for the RADIUS accounting server and port, use the show radius accounting command in EXEC mode.
show radius accounting
Syntax Description
This command has no arguments or keywords.
Defaults
If no RADIUS servers are configured on the router, the output is empty. If the default values are for the counter (for example, request and pending), the values are all zero because the RADIUS server was just defined and not used yet.
Command Modes
EXEC
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following sample output is displayed on a per-server basis for the show radius accounting command:
RP/0/RP0/CPU0:router# show radius accountingServer: 12.26.25.61, port: 18130 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttServer: 12.26.49.12, port: 18130 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttServer: 12.38.28.18, port: 291990 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttRP/0/RP0/CPU0:router#Table 2 describes the significant fields shown in the display.
Table 2 show radius accounting Field Descriptions
Server
Server IP address/UDP destination port for authentication requests; UDP destination port for accounting requests.
Related Commands
Creates a method list for accounting.
Creates a method list for authentication.
Obtains information and detailed statistics for the RADIUS authentication server and port.
show radius authentication
To obtain information and detailed statistics for the RADIUS authentication server and port, use the show radius authentication command in EXEC mode.
show radius authentication
Syntax Description
This command has no arguments or keywords.
Defaults
If no RADIUS servers are configured on the router, the output is empty. If the default values are for the counter (for example, request and pending), the values are all zero because the RADIUS server was just defined and not used yet.
Command Modes
EXEC
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following sample output is for the show radius authentication command:
RP/0/RP0/CPU0:router# show radius authenticationServer: 12.26.25.61, port: 18120 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttServer: 12.26.49.12, port: 18120 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttServer: 12.38.28.18, port: 210990 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttRP/0/RP0/CPU0:router#Table 3 describes the significant fields shown in the display.
Table 3 show radius authentication Field Descriptions
Server
Server IP address/UDP destination port for authentication requests; UDP destination port for accounting requests.
Related Commands
Creates a method list for accounting.
Creates a method list for authentication.
Obtains information and detailed statistics for the RADIUS accounting server and port.
show radius client
To obtain general information about the RADIUS client on Cisco IOS XR software, use the show radius client command in EXEC mode.
show radius client
Syntax Description
This command has no arguments or keywords.
Defaults
The default value for the counters (for example, an invalid address) is 0. The network access server (NAS) identifier is the hostname that is defined on the router.
Command Modes
EXEC
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The show radius client command displays the authentication and accounting responses that are received from the invalid RADIUS servers, for example, unknown to the NAS. In addition, the show radius client command displays the hostname or NAS identifier for the RADIUS authentication client, accounting client, or both.
Task ID
Examples
The following sample output is for the show radius client command:
RP/0/RP0/CPU0:router# show radius clientClient NAS identifier: miniqAuthentication responses from invalid addresses: 0Accounting responses from invalid addresses: 0Table 4 describes the significant fields shown in the display.
Table 4 show radius client Field Descriptions
Client NAS identifier
Identifies the NAS-identifier of the RADIUS authentication client.
Related Commands
Specifies a RADIUS server host.
Associates a particular RADIUS server with a defined server group.
Displays information about the RADIUS servers that are configured in the system.
show radius dead-criteria
To obtain information about the dead server detection criteria, use the show radius dead-criteria command in EXEC mode.
show radius dead-criteria host ip-addr [auth-port auth-port] [acct-port acct-port]
Syntax Description
Defaults
The default values for time and tries are not fixed to a single value; therefore, they are calculated and fall within a range of 10 to 60 seconds for time and 10 to 100 for tries.
Command Modes
EXEC
Command History
Release 3.3.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following sample output is for the show radius dead-criteria command:
RP/0/RP0/CPU0:router# show radius dead-criteria host 12.26.49.12 auth-port 11000 acct-port 11001Server: 12.26.49.12/11000/11001Dead criteria time: 10 sec (computed) tries: 10 (computed)Table 5 describes the significant fields shown in the display.
Related Commands
Forces one or both of the criteria that is used to mark a RADIUS server as dead.
Defines the length of time in minutes for a RADIUS server to remain marked dead.
show radius server-groups
To display information about the RADIUS server groups that are configured in the system, use the show radius server-groups command in EXEC mode.
show radius server-groups [group-name [detail]]
Syntax Description
group-name
(Optional) Name of the server group.The properties are displayed.
detail
(Optional) Displays properties for all the server groups.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show radius server-groups command to display information about each configured RADIUS server group, including the group name, numbers of servers in the group, and a list of servers in the named server group. A global list of all configured RADIUS servers, along with authentication and accounting port numbers, is also displayed.
Task ID
Examples
The inherited global message is displayed if no group level deadtime is defined for this group; otherwise, the group level deadtime value is displayed and this message is omitted. The following sample output is for the show radius server-groups command:
RP/0/RP0/CPU0:router# show radius server-groupsGlobal list of serversContains 2 server(s)Server 1.1.1.1/1645/1646Server 2.2.2.2/1645/1646Server group 'radgrp1' has 2 server(s)Dead time: 0 minute(s) (inherited from global)Contains 2 server(s)Server 1.1.1.1/1645/1646Server 2.2.2.2/1645/1646Server group 'radgrp-priv' has 1 server(s)Dead time: 0 minute(s) (inherited from global)Contains 1 server(s)Server 3.3.3.3/1645/1646 [private]The following sample output shows the properties for all the server groups in radgrp1:
RP/0/RP0/CPU0:router# show radius server-groups radgrp1 detailServer group 'radgrp1' has 2 server(s)VRF default (id 0x60000000)Dead time: 0 minute(s) (inherited from global)Contains 2 server(s)Server 1.1.1.1/1645/1646Authentication:0 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttAccounting:0 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttServer 2.2.2.2/1645/1646Authentication:0 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttAccounting:0 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttThe following sample output shows the properties for all the server groups in raddgrp-priv:
RP/0/RP0/CPU0:router# show radius server-groups radgrp-priv detailServer group 'radgrp-priv' has 1 server(s)VRF default (id 0x60000000)Dead time: 0 minute(s) (inherited from global)Contains 1 server(s)Server 3.3.3.3/1645/1646 [private]Authentication:0 requests, 0 pending, 0 retransmits0 accepts, 0 rejects, 0 challenges0 timeouts, 0 bad responses, 0 bad authenticators0 unknown types, 0 dropped, 0 ms latest rttAccounting:0 requests, 0 pending, 0 retransmits0 responses, 0 timeouts, 0 bad responses0 bad authenticators, 0 unknown types, 0 dropped0 ms latest rttTable 6 describes the significant fields shown in the display.
Table 6 show radius server-groups Field Descriptions
Server
Server IP address/UDP destination port for authentication requests/UDP destination port for accounting requests.
Related Commands
Configures the Virtual Private Network (VPN) routing and forwarding (VRF) reference of an AAA RADIUS server group.
Specifies a RADIUS server host.
show tacacs
To display information about the TACACS+ servers that are configured in the system, use the show tacacs command in EXEC mode.
show tacacs
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show tacacs command to display statistics for each configured TACACS+ server.
Task ID
Examples
The following is sample output from the show tacacs command:
RP/0/RP0/CPU0:router# show tacacsServer:1.1.1.1/21212 opens=0 closes=0 aborts=0 errors=0packets in=0 packets out=0status=up single-connect=falseServer:2.2.2.2/21232 opens=0 closes=0 aborts=0 errors=0packets in=0 packets out=0status=up single-connect=falseTable 7 describes the significant fields shown in the display.
show tacacs server-groups
To display information about the TACACS+ server groups that are configured in the system, use the show tacacs server-groups command in EXEC mode.
show tacacs server-groups
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Release 3.2
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.3.0
No modification.
Release 3.4.0
No modification.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show tacacs server-groups command to display information about each configured TACACS+ server group, including the group name, numbers of servers in the group, and a list of servers in the named server group. A global list of all configured TACACS+ servers is also displayed.
Task ID
Examples
The following is sample output from the show tacacs server-groups command:
RP/0/RP0/CPU0:router# show tacacs server-groupsGlobal list of serversServer 12.26.25.61/23456Server 12.26.49.12/12345Server 12.26.49.12/9000Server 12.26.25.61/23432Server 5.5.5.5/23456Server 1.1.1.1/49Server group `tac100' has 1 servers Server 12.26.49.12Table 8 describes the significant fields shown in the display.
Related Commands
show task supported
To display all task IDs available in the system, use the show task supported command in EXEC mode.
show task supported
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show task supported command to display all task IDs available in the system.
Task ID
Examples
The following sample output is from the show task supported command. Task IDs are displayed in alphabetical order.
RP/0/RP0/CPU0:router# show task supportedaaaacladminatmbasic-servicesbcdlbfdbgpbootbundlecdpcefcisco-supportconfig-mgmtconfig-servicescryptodiagdisalloweddriverseigrpext-accessfabricfault-mgrfilesystemfirewallfrhdlchost-serviceshsrpinterfaceinventoryip-servicesipv4ipv6isislogginglptsmonitormpls-ldpmpls-staticmpls-temulticastnetflownetworkospfounipkg-mgmtpos-dptpppqosribriproot-lrroot-systemroute-maproute-policysbcsnmpsonet-sdhstaticsysmgrsystemtransporttty-accesstunneluniversalvlanvrrpRelated Commands
Displays the task maps for selected user groups, local users, or task groups.
Displays task IDs enabled for the currently logged-in user.
show user
To display all user groups and task IDs associated with the currently logged-in user, use the show user command in EXEC mode.
show user [all | authentication | group | tasks]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the show user command to display all user groups and task IDs associated with the currently logged-in user.
Task ID
Examples
The following sample output displays the authentication method parameters from the show user command:
RP/0/RP0/CPU0:router# show user authentication methodlocalThe following sample output displays the groups from the show user command:
RP/0/RP0/CPU0:router# show user group
root-systemThe following sample output displays all the information for the group and tasks from the show user command:
RP/0/RP0/CPU0:router# show user all
Username: labGroups: root-systemAuthenticated using method localUser lab has the following Task ID(s):Task: aaa : READ WRITE EXECUTE DEBUGTask: acl : READ WRITE EXECUTE DEBUGTask: admin : READ WRITE EXECUTE DEBUGTask: atm : READ WRITE EXECUTE DEBUGTask: basic-services : READ WRITE EXECUTE DEBUGTask: bcdl : READ WRITE EXECUTE DEBUGTask: bfd : READ WRITE EXECUTE DEBUGTask: bgp : READ WRITE EXECUTE DEBUGTask: boot : READ WRITE EXECUTE DEBUGTask: bundle : READ WRITE EXECUTE DEBUGTask: cdp : READ WRITE EXECUTE DEBUGTask: cef : READ WRITE EXECUTE DEBUGTask: config-mgmt : READ WRITE EXECUTE DEBUGTask: config-services : READ WRITE EXECUTE DEBUGTask: crypto : READ WRITE EXECUTE DEBUGTask: diag : READ WRITE EXECUTE DEBUGTask: drivers : READ WRITE EXECUTE DEBUGTask: eigrp : READ WRITE EXECUTE DEBUGTask: ext-access : READ WRITE EXECUTE DEBUGTask: fabric : READ WRITE EXECUTE DEBUGTask: fault-mgr : READ WRITE EXECUTE DEBUGTask: filesystem : READ WRITE EXECUTE DEBUGTask: firewall : READ WRITE EXECUTE DEBUGTask: fr : READ WRITE EXECUTE DEBUGTask: hdlc : READ WRITE EXECUTE DEBUGTask: host-services : READ WRITE EXECUTE DEBUGTask: hsrp : READ WRITE EXECUTE DEBUGTask: interface : READ WRITE EXECUTE DEBUGTask: inventory : READ WRITE EXECUTE DEBUGTask: ip-services : READ WRITE EXECUTE DEBUGTask: ipv4 : READ WRITE EXECUTE DEBUGTask: ipv6 : READ WRITE EXECUTE DEBUGTask: isis : READ WRITE EXECUTE DEBUGTask: logging : READ WRITE EXECUTE DEBUGTask: lpts : READ WRITE EXECUTE DEBUGTask: monitor : READ WRITE EXECUTE DEBUGTask: mpls-ldp : READ WRITE EXECUTE DEBUGTask: mpls-static : READ WRITE EXECUTE DEBUGTask: mpls-te : READ WRITE EXECUTE DEBUGTask: multicast : READ WRITE EXECUTE DEBUGTask: netflow : READ WRITE EXECUTE DEBUGTask: network : READ WRITE EXECUTE DEBUGTask: ospf : READ WRITE EXECUTE DEBUGTask: ouni : READ WRITE EXECUTE DEBUGTask: pkg-mgmt : READ WRITE EXECUTE DEBUGTask: pos-dpt : READ WRITE EXECUTE DEBUGTask: ppp : READ WRITE EXECUTE DEBUGTask: qos : READ WRITE EXECUTE DEBUGTask: rib : READ WRITE EXECUTE DEBUGTask: rip : READ WRITE EXECUTE DEBUGTask: root-lr : READ WRITE EXECUTE DEBUG (reserved)Task: root-system : READ WRITE EXECUTE DEBUG (reserved)Task: route-map : READ WRITE EXECUTE DEBUGTask: route-policy : READ WRITE EXECUTE DEBUGTask: sbc : READ WRITE EXECUTE DEBUGTask: snmp : READ WRITE EXECUTE DEBUGTask: sonet-sdh : READ WRITE EXECUTE DEBUGTask: static : READ WRITE EXECUTE DEBUGTask: sysmgr : READ WRITE EXECUTE DEBUGTask: system : READ WRITE EXECUTE DEBUGTask: transport : READ WRITE EXECUTE DEBUGTask: tty-access : READ WRITE EXECUTE DEBUGTask: tunnel : READ WRITE EXECUTE DEBUGTask: universal : READ WRITE EXECUTE DEBUG (reserved)Task: vlan : READ WRITE EXECUTE DEBUGTask: vrrp : READ WRITE EXECUTE DEBUGThe following sample output displays the tasks and indicates which tasks are reserved from the show user command:
RP/0/RP0/CPU0:router# show user tasksTask: aaa : READ WRITE EXECUTE DEBUGTask: acl : READ WRITE EXECUTE DEBUGTask: admin : READ WRITE EXECUTE DEBUGTask: atm : READ WRITE EXECUTE DEBUGTask: basic-services : READ WRITE EXECUTE DEBUGTask: bcdl : READ WRITE EXECUTE DEBUGTask: bfd : READ WRITE EXECUTE DEBUGTask: bgp : READ WRITE EXECUTE DEBUGTask: boot : READ WRITE EXECUTE DEBUGTask: bundle : READ WRITE EXECUTE DEBUGTask: cdp : READ WRITE EXECUTE DEBUGTask: cef : READ WRITE EXECUTE DEBUGTask: config-mgmt : READ WRITE EXECUTE DEBUGTask: config-services : READ WRITE EXECUTE DEBUGTask: crypto : READ WRITE EXECUTE DEBUGTask: diag : READ WRITE EXECUTE DEBUGTask: drivers : READ WRITE EXECUTE DEBUGTask: eigrp : READ WRITE EXECUTE DEBUGTask: ext-access : READ WRITE EXECUTE DEBUGTask: fabric : READ WRITE EXECUTE DEBUGTask: fault-mgr : READ WRITE EXECUTE DEBUGTask: filesystem : READ WRITE EXECUTE DEBUGTask: firewall : READ WRITE EXECUTE DEBUGTask: fr : READ WRITE EXECUTE DEBUGTask: hdlc : READ WRITE EXECUTE DEBUGTask: host-services : READ WRITE EXECUTE DEBUGTask: hsrp : READ WRITE EXECUTE DEBUGTask: interface : READ WRITE EXECUTE DEBUGTask: inventory : READ WRITE EXECUTE DEBUGTask: ip-services : READ WRITE EXECUTE DEBUGTask: ipv4 : READ WRITE EXECUTE DEBUGTask: ipv6 : READ WRITE EXECUTE DEBUGTask: isis : READ WRITE EXECUTE DEBUGTask: logging : READ WRITE EXECUTE DEBUGTask: lpts : READ WRITE EXECUTE DEBUGTask: monitor : READ WRITE EXECUTE DEBUGTask: mpls-ldp : READ WRITE EXECUTE DEBUGTask: mpls-static : READ WRITE EXECUTE DEBUGTask: mpls-te : READ WRITE EXECUTE DEBUGTask: multicast : READ WRITE EXECUTE DEBUGTask: netflow : READ WRITE EXECUTE DEBUGTask: network : READ WRITE EXECUTE DEBUGTask: ospf : READ WRITE EXECUTE DEBUGTask: ouni : READ WRITE EXECUTE DEBUGTask: pkg-mgmt : READ WRITE EXECUTE DEBUGTask: pos-dpt : READ WRITE EXECUTE DEBUGTask: ppp : READ WRITE EXECUTE DEBUGTask: qos : READ WRITE EXECUTE DEBUGTask: rib : READ WRITE EXECUTE DEBUGTask: rip : READ WRITE EXECUTE DEBUGTask: root-lr : READ WRITE EXECUTE DEBUG (reserved)Task: root-system : READ WRITE EXECUTE DEBUG (reserved)Task: route-map : READ WRITE EXECUTE DEBUGTask: route-policy : READ WRITE EXECUTE DEBUGTask: sbc : READ WRITE EXECUTE DEBUGTask: snmp : READ WRITE EXECUTE DEBUGTask: sonet-sdh : READ WRITE EXECUTE DEBUGTask: static : READ WRITE EXECUTE DEBUGTask: sysmgr : READ WRITE EXECUTE DEBUGTask: system : READ WRITE EXECUTE DEBUGTask: transport : READ WRITE EXECUTE DEBUGTask: tty-access : READ WRITE EXECUTE DEBUGTask: tunnel : READ WRITE EXECUTE DEBUGTask: universal : READ WRITE EXECUTE DEBUG (reserved)Task: vlan : READ WRITE EXECUTE DEBUGTask: vrrp : READ WRITE EXECUTE DEBUGRelated Commands
Displays the task maps for selected user groups, local users, or task groups.
Displays all task IDs defined in the system.
tacacs-server host
To specify a TACACS+ host server, use the tacacs-server host command in global configuration mode. To delete the specified name or address, use the no form of this command.
tacacs-server host host-name [port port-number] [timeout seconds] [key [0 | 7] auth-key] single-connection
no tacacs-server host host-name [port port-number]
Syntax Description
Defaults
No TACACS+ host is specified.
The port keyword, if not specified, defaults to the standard port 49.
The timeout keyword, if not specified, defaults to 5 seconds.Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The key keyword must be entered last because it uses a line (text with breaks) rather than a string (text only, with no breaks). Any text and line breaks up to the time the user presses Enter can be used as part of the key.
You can use multiple tacacs-server host commands to specify additional hosts. Cisco IOS XR software searches for hosts in the order in which you specify them.
Task ID
Examples
The following example shows how to specify a TACACS+ host with the IP address 209.165.200.226:
RP/0/RP0/CPU0:router(config)# tacacs-server host 209.165.200.226RP/0/RP0/CPU0:router(config-tacacs-host)#The following example shows that the default values from the tacacs-server host command are displayed from the show run command:
RP/0/RP0/CPU0:router# show run
Building configuration...!! Last configuration change at 13:51:56 UTC Mon Nov 14 2005 by lab!tacacs-server host 209.165.200.226 port 49timeout 5!The following example shows how to specify that the router consult the TACACS+ server host named host1 on port number 51. The timeout value for requests on this connection is 30 seconds; the encryption key is a_secret.
RP/0/RP0/CPU0:router(config)# tacacs-server host host1 port 51 timeout 30 key a_secretRelated Commands
tacacs-server key
To set the authentication encryption key used for all TACACS+ communications between the HF and the TACACS+ daemon, use the tacacs-server key command in global configuration mode. To disable the key, use the no form of this command.
tacacs-server key key-name
no tacacs-server key
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The key name entered must match the key used on the TACACS+ daemon. All leading spaces are ignored; spaces within and after the key are not. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
The TACACS server key is used only if no key is configured for an individual TACACS server. Keys configured for an individual TACACS server always override this global key configuration.
Task ID
Examples
The following example sets the authentication and encryption key to key1:
RP/0/RP0/CPU0:router(config)# tacacs-server key key1Related Commands
tacacs-server timeout
To set the interval that the server waits for a server host to reply, use the tacacs-server timeout command in global configuration mode. To restore the default, use the no form of this command.
tacacs-server timeout seconds
no tacacs-server timeout
Syntax Description
Defaults
seconds: 5 seconds
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the tacacs-server timeout command to set the interval that the server waits for a server host to reply.
The TACACS+ server timeout is used only if no timeout is configured for an individual TACACS+ server. Timeout intervals configured for an individual TACACS+ server always override this global timeout configuration.
Task ID
Examples
The following example shows the interval timer being changed to 10 seconds:
RP/0/RP0/CPU0:router(config)# tacacs-server timeout 10Related Commands
tacacs source-interface
To specify the source IP address of a selected interface for all outgoing TACACS+ packets, use the tacacs source-interface command in global configuration mode. To disable use of the specified interface IP address, use the no form of this command.
tacacs source-interface type instance
no tacacs source-interface type instance
Syntax Description
Defaults
If a specific source interface is not configured, or the interface is down or does not have an IP address configured, the system selects an IP address.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the tacacs source-interface command to set the IP address of the specified interface for all outgoing TACACS+ packets. This address is used as long as the interface is in the up state. In this way, the TACACS+ server can use one IP address entry associated with the network access client instead of maintaining a list of all IP addresses.
This command is especially useful in cases where the router has many interfaces and you want to ensure that all TACACS+ packets from a particular router have the same IP address.
When the specified interface does not have an IP address or is in a down state, TACACS+ behaves as if no source interface configuration is used.
Task ID
Examples
The following example shows how to set the IP address of the specified POS interface for all outgoing TACACS+ packets:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# tacacs source-interface POS 0/1/0/1Related Commands
task
To add a task ID to a task group, use the task command in task group configuration mode. To remove a task ID from a task group, use the no form of this command.
task {read | write | execute | debug} taskid-name
no task {read | write | execute | debug} taskid-name
Syntax Description
Defaults
No task IDs are assigned to a newly created task group.
Command Modes
Task group configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the task command in task group configuration mode. To access task group configuration mode, use the taskgroup command in global configuration mode.
Task ID
Examples
The following example shows how to enable execute privileges for the config-services task ID and associate that task ID with the task group named taskgroup1:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# taskgroup taskgroup1RP/0/RP0/CPU0:router(config-tg)# task execute config-servicesRelated Commands
taskgroup
To configure a task group to be associated with a set of task IDs, and to enter task group configuration mode, use the taskgroup command in global configuration mode. To delete a task group, use the no form of this command.
taskgroup taskgroup-name [description string | task {read | write | execute | debug}
taskid-name | inherit taskgroup taskgroup-name]no taskgroup taskgroup-name
Syntax Description
Defaults
Five predefined user groups are available by default.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task groups are configured with a set of task IDs for each action type. Deleting a task group that is still referenced in the system results in a warning and rejection of the deletion.
From global configuration mode, you can display all the configured task groups. However, you cannot display all the configured task groups in taskgroup configuration mode.
Entering the taskgroup command with no keywords or arguments enters task group configuration mode, in which you can use the description, inherit, show, and task commands.
Task ID
Examples
The following example assigns read bgp permission to the task group named alpha:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# taskgroup alphaRP/0/RP0/CPU0:router(config-tg)# task read bgpRelated Commands
Creates a task group description in task configuration mode.
Adds a task ID to a task group.
timeout (RADIUS)
To specify the number of seconds the router waits for the RADIUS server to reply before retransmitting, use the timeout command in RADIUS server-group private configuration mode.
timeout seconds
no timeout seconds
Syntax Description
seconds
The seconds argument specifies the timeout value in seconds. The range is from 1 to 1000. If no timeout is specified, the global value is used.
Defaults
The default value is 5 seconds.
Command Modes
RADIUS server-group private configuration
Command History
Release 3.4.0
This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Task ID
Examples
The following example shows how to set the number of seconds for the timeout value:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# aaa group server radius group1RP/0/RP0/CPU0:router(config-sg-radius)# server-private 10.1.1.1 auth-port 300RP/0/RP0/CPU0:router(config-sg-radius-private)# timeout 500Related Commands
timeout login response
To set the interval that the server waits for a reply to a login, use the timeout login response command in line configuration mode. To restore the default, use the no form of this command.
timeout login response seconds
no timeout login response seconds
Syntax Description
Defaults
seconds: 30 seconds
Command Modes
Line configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the timeout login response command in line configuration mode to set the timeout value. This timeout value applies to all terminal lines to which the entered line template is applied. This timeout value can also be applied to line console. After the timeout value has expired, the user is prompted again. The retry is allowed three times.
Task ID
Examples
The following example shows how to change the interval timer to 20 seconds:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# line template alphaRP/0/RP0/CPU0:router(config-line)# timeout login response 20Related Commands
usergroup
To configure a user group and associate it with a set of task groups, and to enter user group configuration mode, use the usergroup command in global configuration mode. To delete a user group, or to delete a task-group association with the specified user group, use the no form of this command.
usergroup usergroup-name [description string | taskgroup taskgroup-name | inherit usergroup usergroup-name]
no usergroup usergroup-name [description string | taskgroup taskgroup-name | inherit usergroup usergroup-name]
Syntax Description
Defaults
Five predefined user groups are available by default.
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
User groups are configured with the command parameters for a set of users, such as task groups. You can remove specific user groups by using the no form of the usergroup command. You can remove the user group itself by using the no form of the command without giving any parameters. Deleting a user group that is still referenced in the system results in a warning and a rejection of the deletion.
Use the inherit usergroup command to copy permissions from other user groups. The user group is inherited by the parent group and forms a union of all task IDs specified in those groups. Cyclic inclusions are detected and rejected. User groups cannot inherit properties from predefined groups, such as root-system and owner-sdr.
From global configuration mode, you can display all the configured user groups. However, you cannot display all the configured user groups in usergroup configuration mode.
Task ID
Examples
The following example shows how to add permissions from the user group beta to the user group alpha:
RP/0/RP0/CPU0:router# configureRP/0/RP0/CPU0:router(config)# usergroup alphaRP/0/RP0/CPU0:router(config-ug)# inherit usergroup betaRelated Commands
username
To configure a new user with a username, establish a password, and grant permissions for the user, and to enter username configuration mode, use the username command in global configuration or administration configuration modes. To delete a user from the database, use the no form of this command.
username user-name [password {0 | 7} password | secret {0 | 5} password | group usergroup-name]
no username user-name [password {0 | 7} password | secret {0 | 5} password | group usergroup-name]
Syntax Description
