Home
Support
Product Support
Routers
Cisco 8000 Series Routers
Configuration Guides

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Releases

What role does the FPGA play in the secure boot chain process?
How are software integrity violations handled by the system?
What is the purpose of the platform's public key in image verification?

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

What role does the FPGA play in the secure boot chain process?
How are software integrity violations handled by the system?
What is the purpose of the platform's public key in image verification?

Expand all sections

About this content

YANG Data Models for System Security Features

Using YANG Data Models

Trustworthy Systems

Trustworthy systems
Hardware trust
Software trust components
How trustworthiness works
Key security terms for trustworthy systems
TCG-compliant trusted platform module
ECC P256-based Secure Unique Device Identifiers
Monitor XR shell commands

Maintaining Trust

Steady-state trust

AAA Access Model and Local User Administration

AAA service capabilities
User identities
AAA administrative models
Configure the first router user
Configure a task group

AAA Password Security and Authorization Policies

AAA password types
AAA password security for FIPS compliance
Task-based authorization
AAA method lists
Command accounting methods
Local command authorizations with user accounts
Configuration patterns for AAA services

RADIUS Server Configuration and Secure Transport

RADIUS protocol
RADIUS with DTLS protection
RADIUS with TLS protection
Router-to-RADIUS server communications
RADIUS dead-server detection features
RADIUS server groups
Per-VRF AAA for RADIUS
SSH remote public key authentication using TACACS+

TACACS+ Services for AAA

Differentiated Services Code Point (DSCP) values for TACACS+ packets
TACACS+ servers
TACACS+ server groups
Per-VRF TACACS+ server groups
TACACS+ operational statistics
TACACS+ with TLS protection
SSH remote public key authentication using TACACS+

CA Interoperability and Certificate Enrollment

Certification authority interoperability
Certification authority interoperability facts

CA Trust Pools and PKI Certificate Lifecycle

Certificate authority trust pools
PKI certificate expiry notifications
Automatic PKI certificate renewal

Crosswork Trust Insights and Public-Key Systems

How Cisco IOS XR and Crosswork Trust Insights integrate
Ed25519 public-key signatures
Public key-pairs

Keychain Management

Keychains

MACsec using EAP-TLS Authentication

MACsec EAP-TLS authentication sessions

uRPF Source Address Validation

uRPF source validation mechanisms

Type 6 Password Encryption

Type 6 password encryption

Management Plane Protection

Management plane protection features

Secure Shell Fundamentals and Configuration

Secure Shell fundamentals
CiscoSSH
Requirements for Secure Shell
Secure Shell restrictions
Configure an SSH server
NETCONF access controls
Automatic generation of SSH host keys
Configure an SSH client
SSH client strict host key checks
SSH client authentication order
SSH multichannel connections
Configure an OpenSSH client for multiplexing

Certificate and Public-Key Authentication for SSH

SSH certificate and public-key authentication
X.509v3 certificate authentication
OpenSSH certificate authentication
TACACS+ authorization for OpenSSH certificate users
Public-key authentication for SSH clients
Public-key authentication to SSH servers

SSH Access and Connection Management

SSH access and connection controls
FIDO2 authentication for SSH
SSH authentication attempt limits
Multifactor authentication for SSH
Selective SSH server authentication methods
SSH port forwarding
DSCP marking for SSH packets
SSH server timeouts

FIPS Mode and Cryptographic Services

FIPS mode
FIPS-compliant cryptographic keys
Cryptographic services in FIPS mode
SSH clients and servers in FIPS mode

Implementing Secure Logging

System logging over Transport Layer Security (TLS)
Security template framework for TLS applications
TLS RFC 5289 compliance for security template

802.1X and MAC-Based Port Authentication

Port-based authentication methods
802.1X authentication with MAC Authentication Bypass fallback
RADIUS Change of Authorization for 802.1X and MAB sessions

Device Ownership and Authorized Operations

Trusted ownership and authorized operations
Device ownership
Cisco MASA service
How routers are provisioned using ownership vouchers
Third-party key packages
Consent tokens

Gated shell access

Key features of gated shell access
How gated shell access works
Restrict shell access using a Cisco-signed Consent Token
Unrestrict shell access using a Cisco-signed Consent Token
Restrict shell access using an owner Consent Token
Unrestrict shell access using an owner Consent Token
Terminate a pending Consent Token authorization request
Access a restricted shell

Implementing Lawful Intercept

Lawful intercept
LI package installation and removal
SNMPv3 access for lawful intercept
Additional lawful intercept information

EST Protocol for Automated Certificate Provisioning

EST protocol for automated certificate provisioning
EST protocol configuration guidelines and limitations
Certificate types and their uses in the EST protocol
Trust anchor databases and their uses in the EST protocol
EST message types
Configure the EST protocol

Upgrade CURL libraries for HTTP client

Key benefits for libcurl upgrades
Support and restrictions for libcurl upgrade
How libcurl upgrade works

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Maintaining Trust

Updated: September 18, 2026

Outlines comprehensive measures for maintaining trust in secure systems, including steady-state trust models, SELinux, secure installation, SSD encryption, runtime defenses, boot integrity, secure communications, and integrity verification mechanisms.

Steady-state trust

Describes steady-state trust concepts, encompassing SELinux implementation and policy, secure installation mechanisms such as RPM signature validation, SSD encryption with DM-Crypt and data zeroization, runtime defenses, boot integrity and trust visibility, secure gRPC session practices, and the Integrity Measurement Architecture.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.