Network Authentication

This document describes the Remote PHY device network authentication on the Cisco cBR Series Converged Broadband Router.

Finding Feature Information

Your software release may not support all the features that are documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. The Feature Information Table at the end of this document provides information about the documented features and lists the releases in which each feature is supported.

Hardware Compatibility Matrix for Cisco Remote PHY Device


Note

Unless otherwise specified, the hardware components introduced in a given Cisco Remote PHY Device Software Release are supported in all subsequent releases.

Table 1. Hardware Compatibility Matrix for the Cisco 2x2 Remote PHY Device

Cisco HFC Platform

Remote PHY Device

Cisco GS7000 BAU

Cisco 2x2 RPD Software 2.x and Later Releases

Cisco Remote PHY Device 2x2

PID—RPD-2X2=

Information about Network Authentication

RPD must be able to operate in both authenticated and unauthenticated networks. Whether authentication is required for an RPD is determined by the network that it is connected to. In some cases, RPD is located in an untrusted network, and it must connect to devices inside the trusted network, which presents a potential security vulnerability. 802.1x is introduced to provide authentication services to eliminate the potential security issues.

802.1x is a Layer 2 protocol that uses EAP (Extensible Authentication Protocol) to provide authentication services. Following certificates are needed to use the network authentication:

  • Cablelabs Root CA certificate: caRoot.pem

  • CableLabs Device CA Certificate: deviceCA.pem

  • RPD Certificate: rpdCert.pem, private key: rpd.key

  • Cablelabs Service Provider CA Certificate: spCA.pem

  • AAA Server Certificate: aaaCert.pem, private key: aaa.key

How to Enable Network Authentication

This section describes how to enable network authentication for RPD.

Installing Certificates in Radius Server

To install the certificate in Radius server, follow the steps below:

Procedure

Step 1

Combine CA certificate for AAA server.

Example:

cat spCA.pem caRoot.pem > ca_root_srv.pem
Step 2

In freeRadius Server, copy "ca_root_srv.pem", "spCA.pem", "aaaCert.pem" and "aaa.key" to "/etc/freeradius/certs".

Configuring Radius Server

To install the certificate in RPD, follow the steps below:

Procedure

Step 1

Define a new client in /etc/freeradius/clients.conf.

Example:

client rphytest_ng13 {
        ipaddr = 20.5.0.36
        secret = rphytest
        shortname = ng13_switch
        require_message_authenticator = yes
}

The "ipaddr" is the switch's management ip address.
Step 2

In "/etc/freeradius/eap.conf", change the following lines in "tls" to specify the server's private key file and certificate files.

Example:

tls {
      …
        private_key_file = ${certdir}/aaa.key
        certificate_file = ${certdir}/aaaCert.pem
        CA_file = ${cadir}/ca_root_srv.pem
}
Step 3

Start radius in radius sever.

Example:

sudo freeradius

Make sure only one freeradius instance is running.

Configuring Switch

To configure the switch, follow the steps below:


Note

This procedure is for Catalyst 3750 switch, other switch may use different commands.

Procedure

Step 1

Add the following configuration in global configuration mode.

Example:

dot1x system-auth-control   /* enable 802.1x */
aaa new-model
aaa authentication dot1x default group radius
radius-server host 10.79.41.103 auth-port 1812 key rphytest
Step 2

Add the following configuration under interface which connects to RPD.

Example:

authentication port-control auto
dot1x pae authenticator

Verifing Authentication Status

To displays dot1x authentication information for RPD, use the show dot1x command as shown in the following example: 

Router# show dot1x summary
 Interface        Core-id                  EAP_Received     Status
 vbh0             CORE-3415960568          True             UP

Router# show dot1x detail
Interface        Core-id                  EAP_Received        Status           
vbh0             CORE-3415960568          True                UP                
bssid=01:80:c2:00:00:03
freq=0
ssid=
id=0
mode=station
pairwise_cipher=NONE
group_cipher=NONE
key_mgmt=IEEE 802.1X (no WPA)
wpa_state=COMPLETED
ip_address=30.85.40.47
address=00:04:9f:00:03:73
Supplicant PAE state=AUTHENTICATED
suppPortStatus=Authorized
EAP state=SUCCESSselected
Method=13 (EAP-TLS)EAP TLS 
cipher=ECDHE-RSA-AES256-SHA
tls_session_reused=0
eap_session_id=0d53798f5b46014cc92a4ac1151521bae6a14c98f919eb5e8c81a701b7272be7f812e7e5a75881768d74d311795a3b1f0e37bfa7fff7cbc4685d36f216bec59850
uuid=ab722cfb-84dc-5835-a905-edfec20f78c3

Configuring TACACS

Terminal Access Controller Access ControlSystem (TACACS) is a security protocol that provides centralized validation of users who are attempting to gain access to a router or NAS. TACACS+, a more recent version of the original TACACS protocol, provides separate authentication, authorization, and accounting (AAA) services.


Note

  1. RPD can configure eight TACACS servers at the most. Ensure that all configured servers use the same secret key.

  2. If multiple TACACS servers are configured, RPD will try to connect TACACS server in the order in which the servers are configured until the connection is established successfully.

  3. RPD and TACACS server must use the same address family.

SUMMARY STEPS

  1. To enable TACACS+, you need to setup a TACACS server with secret key configured.
  2. Add the TACACS server's IPv4/IPv6 address and key to RPD configuration.
  3. To display the configured TACACS server, use the show tacacs-server command as shown in the following example:
  4. If you might want to delete the server and change the secret key, use the following example:

DETAILED STEPS

  Command or Action Purpose
Step 1

To enable TACACS+, you need to setup a TACACS server with secret key configured. 


Router(config)# tacacs add-server 10.0.0.113
Server '10.0.0.113' is configured on RPD successfully.
Router(config)# tacacs add-key
Please add a secret key:
Please re-enter your secret key:
Add secret key successfully.
Note 
Alternatively, if you are connecting 2x2 RPD through SSH, you would need to enable the CLI which is required to access the TACACS. See the following example:

Welcome admin it is Wed Nov 20 15:30:49 UTC 2019
> enable
# configure terminal
Router(config)# tacacs add-…
Step 2

Add the TACACS server's IPv4/IPv6 address and key to RPD configuration.
Step 3

To display the configured TACACS server, use the show tacacs-server command as shown in the following example: 


Router(config)# show tacacs-server
TACACS server configured:
10.0.0.113
Step 4

If you might want to delete the server and change the secret key, use the following example:

 

Router(config)# tacacs delete-server 10.0.0.112
Delete server '10.0.0.112' successfully.
R-PHY(config)# tacacs change-key
Please change secret key:
Please re-enter your secret key:
Change secret key successfully.