Home
Support
Product Support
Routers
Cisco 8000 Series Routers
Configuration Guides

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Releases

Which prerequisites and limits govern authorized intercept deployment?
How does the replay timer preserve approved taps after processor failover?
Why must the mediation device reprovision tables after a failover?

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Which prerequisites and limits govern authorized intercept deployment?
How does the replay timer preserve approved taps after processor failover?
Why must the mediation device reprovision tables after a failover?

Expand all sections

About this content

YANG Data Models for System Security Features

Using YANG Data Models

Trustworthy Systems

Trustworthy systems
Hardware trust
Software trust components
How trustworthiness works
Key security terms for trustworthy systems
TCG-compliant trusted platform module
ECC P256-based Secure Unique Device Identifiers

Maintaining Trust

Steady-state trust

AAA Access Model and Local User Administration

AAA service capabilities
User identities
AAA administrative models
Configure the first router user
Configure a task group

AAA Password Security and Authorization Policies

AAA password types
AAA password security for FIPS compliance
Task-based authorization
AAA method lists
Command accounting methods
Local command authorizations with user accounts
Configuration patterns for AAA services

RADIUS Server Configuration and Secure Transport

RADIUS protocol
RADIUS with DTLS protection
RADIUS with TLS protection
Router-to-RADIUS server communications
RADIUS dead-server detection features
RADIUS server groups
Per-VRF AAA for RADIUS

TACACS+ Services for AAA

Differentiated Services Code Point (DSCP) values for TACACS+ packets
TACACS+ servers
TACACS+ server groups
Per-VRF TACACS+ server groups
TACACS+ operational statistics
TACACS+ with TLS protection

CA Interoperability and Certificate Enrollment

Certification authority interoperability
Certification authority interoperability facts

CA Trust Pools and PKI Certificate Lifecycle

Certificate authority trust pools
PKI certificate expiry notifications
Automatic PKI certificate renewal

Crosswork Trust Insights and Public-Key Systems

How Cisco IOS XR and Crosswork Trust Insights integrate
Ed25519 public-key signatures
Public key-pairs

Keychain Management

Keychains

MACsec using EAP-TLS Authentication

MACsec EAP-TLS authentication sessions

uRPF Source Address Validation

uRPF source validation mechanisms

Type 6 Password Encryption

Type 6 password encryption

Management Plane Protection

Management plane protection features

Secure Shell Fundamentals and Configuration

Secure Shell fundamentals
CiscoSSH
Requirements for Secure Shell
Secure Shell restrictions
Configure an SSH server
NETCONF access controls
Automatic generation of SSH host keys
Configure an SSH client
SSH client authentication order
SSH multichannel connections
Configure an OpenSSH client for multiplexing

Certificate and Public-Key Authentication for SSH

SSH certificate and public-key authentication
X.509v3 certificate authentication
OpenSSH certificate authentication
TACACS+ authorization for OpenSSH certificate users
Public-key authentication for SSH clients
Public-key authentication to SSH servers

SSH Access and Connection Management

SSH access and connection controls
FIDO2 authentication for SSH
SSH authentication attempt limits
Multifactor authentication for SSH
Selective SSH server authentication methods
SSH port forwarding
DSCP marking for SSH packets
SSH server timeouts

FIPS Mode and Cryptographic Services

FIPS mode
FIPS-compliant cryptographic keys
Cryptographic services in FIPS mode
SSH clients and servers in FIPS mode

Implementing Secure Logging

System logging over Transport Layer Security (TLS)
Security template framework for TLS applications
TLS RFC 5289 compliance for security template

802.1X and MAC-Based Port Authentication

Port-based authentication methods
802.1X authentication with MAC Authentication Bypass fallback
RADIUS Change of Authorization for 802.1X and MAB sessions

Device Ownership and Authorized Operations

Trusted ownership and authorized operations
Device ownership
Cisco MASA service
How routers are provisioned using ownership vouchers
Third-party key packages
Consent tokens

Implementing Lawful Intercept

Lawful intercept
LI package installation and removal
SNMPv3 access for lawful intercept
Additional lawful intercept information

EST Protocol for Automated Certificate Provisioning

EST protocol for automated certificate provisioning
EST protocol configuration guidelines and limitations
Certificate types and their uses in the EST protocol
Trust anchor databases and their uses in the EST protocol
EST message types
Configure the EST protocol

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Implementing Lawful Intercept

Updated: September 18, 2026

Describes the prerequisites, installation tasks, configuration tasks, operational behavior, and limitations for implementing lawful intercept.

Use this chapter to understand, install, configure, and operate lawful intercept on supported Cisco IOS XR systems.

Lawful intercept

Explains how lawful intercept uses SNMPv3 provisioning and mediation devices to deliver authorized communication intercepts to law enforcement agencies.

LI package installation and removal

Describes the package security controls and directs you to the installation and removal procedures for LI.

SNMPv3 access for lawful intercept

Groups the procedures that disable SNMP-based lawful intercept, configure inband management-plane protection, and enable the LI SNMP server configuration.

Additional lawful intercept information

Groups reference information about interception mode, data flow, scale, packet interception, filters, encapsulation, and high availability.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.