User Guide for Cisco Security Manager 4.20

Supported Authorization Types

AAA authorization enables you to limit the services available to an authenticated user. Security Manager supports the following types of authorization:

• Network—Authorizes various types of network connections, such as PPP, SLIP, and ARAP.
• EXEC—Authorizes the launching of EXEC (CLI) sessions.
• Command—Authorizes the use of all EXEC mode commands that are associated with specific privilege levels.

When authorization is enabled, the router uses information retrieved from the user’s profile to configure the user session. The profiles are located either in the local user database or on a security server. Users are granted access to a requested service only if the profile allows it.

Related Topics

• Supported Accounting Types
• Understanding Method Lists
• Defining AAA Services
• AAA on Cisco IOS Routers

Supported Accounting Types

AAA accounting enables you to track the services the users are accessing and the amount of network resources that they are consuming. Security Manager supports the following accounting types:

• Connection—Records information about all outbound connections made from this device, such as Telnet, local-area transport (LAT), TN3270, packet assembler/disassembler (PAD), and rlogin connections.

For example, a RADIUS connection accounting record for an outbound Telnet connection includes such information as the port and IP address of the network access server (NAS), the start and end times of the connection, the identity of the user, and the number of packets that were transmitted during the session.

• EXEC—Records information about user EXEC (CLI) sessions on the devices, including the username, date, start and stop times, and the IP address of the NAS. For dial-in users, the record includes the telephone number from which the call originated.
• Command—Records information about the EXEC commands executed on the device by users with specific privilege levels. Each command accounting record includes a list of the commands executed for that privilege level, the date and time each command was executed, and the name of the user who executed it.

For each accounting type, you can choose whether you want to generate an accounting record at the start and end of each user session or only at the end.

When AAA accounting is enabled, the router sends accounting records of user activity to the TACACS+ or RADIUS security server. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can later be analyzed for network management, client billing, and auditing purposes.

Related Topics

• Supported Accounting Types
• Understanding Method Lists
• Defining AAA Services
• AAA on Cisco IOS Routers

Understanding Method Lists

A method list is a sequential list describing the methods to use to perform a particular AAA function. In Security Manager, you define method lists by selecting AAA server groups, which are reusable objects that typically contain one or more AAA servers running the same protocol, such as RADIUS or TACACS+. Method lists enable you to designate one or more security protocols to be used for each AAA function, thus ensuring a backup system if the initial method fails.

Note Security Manager also contains predefined AAA server group objects for using the enable password or a local database. See Predefined AAA Authentication Server Groups.

For each AAA function, the device initially uses the first method defined in the list. If that method fails to respond, the device selects the next method in the list. This process continues until there is successful communication with a listed method, or all methods defined in the method list are exhausted.

Note The device attempts to communicate with the next listed method only when there is no response from the previous method. If the AAA service fails at any point in this cycle—meaning that the security server or local username database responds by denying the user access or services—the process stops and no other methods are attempted.

Related Topics

• Supported Authorization Types
• Supported Accounting Types
• Defining AAA Services
• AAA on Cisco IOS Routers

Defining AAA Services

To define AAA services on a Cisco IOS router, you must first enable AAA functionality on the router. After you do this, you can define the kind of functionality (authentication, authorization, and accounting) that you want the device to implement. You must define a method list for each function, including lists for each type of authorization and accounting that you enable.

For example, if you want to configure EXEC authorization and command authorization, you must define one method list for EXEC authorization and other method lists for each privilege level on which command authorization is performed.

Note If you use RADIUS for authentication, you must use the same RADIUS server group for authorization as well.

Related Topics

• Understanding Method Lists
• AAA on Cisco IOS Routers
• Understanding AAA Server and Server Group Objects

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > AAA from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > AAA from the Policy Type selector. Select an existing policy or create a new one.

The AAA page is displayed. See AAA Policy Page for a description of the fields on this page.

Step 2 Define which login authentication methods to use on users who access the device:

a. On the Authentication tab (see AAA Page—Authentication Tab), select the Enable Device Login Authentication check box.

b. Enter the names of one or more AAA server group objects (up to four) in the Prioritized Method List field, or click Select select the object from a list or to create a new one. Use the up and down arrows in the object selector to define the order in which the selected server groups should be used.

Note If you select None as a method, it must appear as the last method in the list.

Step 3 (Optional) In the Maximum Number of Attempts field, define the maximum number of unsuccessful authentication attempts to allow before a user is locked out.

Step 4 (Optional) Define which authorization methods to use on users who have been successfully authenticated:

a. Click the Authorization tab on the AAA page. See Table 63-3 for a description of the fields on this tab.

b. Define method lists for one or more of the following types of authorization:

• Network
• EXEC
• Command—Click the Add button to display the Command Authorization dialog box (see Command Authorization Dialog Box). From here, you can select a privilege level and the method list to apply to it.

For more information about these authorization types, see Supported Authorization Types.

Note RADIUS uses the same server for authentication and authorization. Therefore, if you use define a RADIUS method list for authentication, you must define the same method list for authorization.

Step 5 (Optional) Define which accounting methods to use on the activities performed by users:

a. Click the Accounting tab on the AAA page. See Table 63-5 for a description of the fields on this tab.

b. Define method lists for one or more of the following types of accounting:

• Connection
• EXEC
• Command—Click the Add button to display the Command Accounting dialog box (see Command Accounting Dialog Box). From here, you can select a privilege level and the method list to apply to it.

For more information about these accounting types, see Supported Accounting Types.

c. For each accounting type defined above, select a value from the Accounting Process Notices list. This defines when to create an accounting record, at the beginning and end of the user process or only at the end.

d. For each accounting type defined above, select the Enable broadcast to multiple servers check box if you want accounting information sent simultaneously to the first server in each AAA server group defined in the method list.

AAA Page—Authentication Tab

Use the Authentication tab of the AAA page to define the methods used to authenticate users who access the device. Authentication methods are defined in a method list, which define the security protocols to use, such as LDAP, RADIUS, and TACACS+.

Note You can use the method list defined in this policy on the console and VTY lines that are used to communicate with the device. See Console Policy Page and VTY Line Dialog Box—Authentication Tab.

Navigation Path

Go to the AAA Policy Page, then click the Authentication tab.

Related Topics

• Defining AAA Services
• Understanding Method Lists
• AAA Server Group Dialog Box
• Predefined AAA Authentication Server Groups

Field Reference

AAA Page—Authorization Tab

Use the Authorization tab of the AAA page to define the type of authorization services to enable on the device and the methods to use for each type. Security Manager supports the following types of authorization:

• Network—Authorizes various types of network connections, such as PPP.
• EXEC—Authorizes the launching of EXEC sessions.
• Command—Authorizes the use of all EXEC mode commands that are associated with specific privilege levels.

Note You can use the method lists defined in this policy on the console and VTY lines that are used to communicate with the device. See Console Policy Page and VTY Line Dialog Box—Authentication Tab.

Navigation Path

Go to the AAA Policy Page, then click the Authorization tab.

Related Topics

• Defining AAA Services
• Supported Authorization Types
• Understanding Method Lists
• AAA Server Group Dialog Box
• Filtering Tables

Field Reference

Command Authorization Dialog Box

Use the Command Authorization dialog box to define which methods to use when authorizing the EXEC commands that are associated with a given privilege level. This enables you to authorize all commands associated with a specific privilege level, from 0 to 15.

Navigation Path

From the AAA Page—Authorization Tab, click the Add button beneath the Command Authorization table.

Related Topics

• Defining AAA Services
• Supported Authorization Types
• Understanding Method Lists

Field Reference

AAA Page—Accounting Tab

Use the Accounting tab of the AAA page to define the type of accounting services to enable on the device and the methods to use for each type. Security Manager supports the following types of accounting:

• Connection—Records information about all outbound connections made from this device.
• EXEC—Records information about user EXEC sessions on the devices, including the username, date, start and stop times, and the IP address.
• Command—Records information about the EXEC commands executed on the device by users with specific privilege levels.

In addition, you use the Accounting page to determine when accounting records should be generated and whether they should be broadcast to more than one AAA server.

Note You can use the method lists defined in this policy on the console and VTY lines that are used to communicate with the device. See Console Policy Page and VTY Line Dialog Box—Authentication Tab.

Navigation Path

Go to the AAA Policy Page, then click the Accounting tab.

Related Topics

• Defining AAA Services
• Supported Accounting Types
• Understanding Method Lists
• AAA Server Group Dialog Box
• Filtering Tables

Field Reference

Command Accounting Dialog Box

Use the Command Accounting dialog box to define which methods to use when recording information about the EXEC commands that are executed for a given privilege level. Each accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the name of the user who executed it.

Navigation Path

From the AAA Page—Accounting Tab, click the Add button beneath the Command Accounting table.

Related Topics

• Defining AAA Services
• Supported Accounting Types
• Understanding Method Lists

Field Reference

Defining Accounts and Credential Policies

This procedure describes how to define a device access policy on a Cisco IOS router. If the username that you configured on the Device Properties page to connect to the router (see Viewing or Changing Device Properties) matches one of the user accounts you defined in this policy, Security Manager updates the device credentials according to your policy definition.

If you change the password for the user defined in the device properties, which Security Manager uses to deploy configurations to the device, or change the enable password, Security Manager uses the existing credentials defined in the device properties to log into the device and deploy changes. After successful deployment, the device properties are then changed to use your new settings. For more information on credentials in device properties, see Device Credentials Page.

Note You can discover encrypted passwords, but any password you enter must be in clear text. If you discover an encrypted password and then modify it, the password is saved as clear text.

Related Topics

• User Accounts and Device Credentials on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Accounts and Credentials from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Accounts and Credentials from the Policy Type selector. Select an existing policy or create a new one.

The Accounts and Credentials page is displayed. See Table 63-7 for a description of the fields on this page.

Step 2 Enter the password for switching to privileged EXEC mode on the router:

a. Select Enable Password or Enable Secret Password. The Enable Secret Password option offers better security than the Enable Password option by storing the password using MD5 encryption. This option is useful in environments in which the password crosses the network or is stored on a TFTP server.

Note After you set an enable secret password, you can switch to an enable password only if the enable secret is disabled or an older version of Cisco IOS software is being used, such as when running an older rxboot image.

b. Enter a password, then enter it again in the Confirm field. The password that you enter must be in clear text. If you are configuring the enable secret password, the password is encrypted on deployment.

Step 3 (Optional) Select the Enable Password Encryption Service check box to encrypt all passwords on the device. This includes, for example, the enable password, username passwords, authentication key passwords, console and VTY line access passwords, and BGP neighbor passwords.

We recommend using this feature to help prevent unauthorized individuals from viewing the passwords in your configuration file.

Note This option does not provide a high level of security and should not be used as a substitute for additional network security measures.

Step 4 To define new user accounts for the router:

a. Click the Add button under the table to display the User Accounts dialog box.

b. Enter the details for the new user. See Table 63-8 for a description of the available fields.

c. Click OK to save your definitions locally on the client and close the dialog box. Your definitions are displayed in the User Accounts table.

Note To edit a user account, select it from the User Accounts table, then click Edit. To remove a user account, select it, then click Delete.

Caution While deleting a user account, Cisco Security Manager times out and deployment fails. To avoid this, you can set up Security Manager to download despite an error. Enable Allow Download on Error in Tools > Administrator > Deployments in the Configuration Manager.

---

User Account Dialog Box

Employ the User Account dialog box to define a username and password combination that can be used by Security Manager to access the router. You can also define the privilege level of the user account, which determines whether you can configure all commands on this router or only a subset of them.

Note Remember—there may be additional user accounts defined on the router using other methods, such as the CLI.

Navigation Path

Go to the Accounts and Credential s Policy Page, then click the Add or Edit button beneath the table.

Related Topics

• Defining Accounts and Credential Policies
• User Accounts and Device Credentials on Cisco IOS Routers
• Understanding FlexConfig Policies and Policy Objects

Field Reference

Bridge-Group Virtual Interfaces

Because bridging takes places at the data link layer and routing takes place at the network layer, they have different protocol configuration models. With IP, for example, bridge group interfaces belong to the same network and have a collective IP network address. In contrast, each routed interface represents a distinct network and has its own IP network address. Integrated routing and bridging uses the concept of a bridge-group virtual interface (BVI) to enable these interfaces to exchange packets for a given protocol. As shown in Figure 63-2, the interface number assigned to the BVI corresponds to the bridge group that the BVI represents. This number serves as the link between the virtual interface and the bridge group.

Figure 63-2 Bridge-Group Virtual Interface

When you enable routing for a given protocol on the BVI, packets coming from a routed interface that are destined for a host in a bridged domain are routed to the BVI and then forwarded to the corresponding bridged interface. All traffic routed to the BVI is forwarded to the corresponding bridge group as bridged traffic. All routable traffic received on a bridged interface is routed to other routed interfaces as if it is coming directly from the BVI.

Note BVI interfaces are configured using the Interfaces policy. See Defining Basic Router Interface Settings. The BVI interface must have a corresponding bridge group with the same number; otherwise, deployment will fail.

Note When the bridge group contains more than two interfaces, add a BVI interface to the group to help prevent unicast flooding, which is a potential security issue.

Related Topics

• Defining Bridge Groups
• Bridging on Cisco IOS Routers

Defining Bridge Groups

You define a bridge group by selecting the L3 interfaces that are part of the bridge group and assigning the group a number. All bridge groups in Security Manager perform integrated routing and bridging on IP traffic only and use the standard Spanning Tree Protocol (IEEE 802.1D).

Note Use CLI commands or FlexConfigs to bridge other protocols, such as AppleTalk or IPX, and to use other spanning tree protocols, such as VLAN-Bridge. Concurrent routing and bridging is not supported.

Related Topics

• Bridging on Cisco IOS Routers
• Bridge-Group Virtual Interfaces

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Bridging from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Bridging from the Policy Type selector. Select an existing policy or create a new one.

The Bridging page is displayed. See Table 63-9 for a description of the fields on this page.

Step 2 Click the Add button under the table to display the Bridge Group dialog box. See Table 63-10 for a description of the fields in this dialog box. From here you can define a bridge group.

Step 3 Enter a number to identify the bridge group.

Step 4 Enter the names of the interfaces and interface roles that are part of the bridge group, or click Select to select an interface role or to create a new one. For more information, see Specifying Interfaces During Policy Definition.

You can select most Layer 3 interfaces, except X.25 and Integrated Services Digital Network (ISDN) bridged interfaces and certain types of logical interfaces (such as loopback, tunnel, null, and BVI). Each interface can be included in only one bridge group.

You can select a LAN subinterface only if the parent interface is configured with Inter-Switch Link (ISL) or 802.1Q encapsulation.

Step 5 Click OK to save your definitions locally on the client and close the dialog box. The bridge group is displayed in the table on the Bridging page.

Note To edit a bridge group, select it from the Groups table, then click Edit. To remove a bridge group, select it, then click Delete.

Bridge Group Dialog Box

Use the Bridge Group dialog box to define bridge groups on the router. Each bridge group can contain multiple Layer 3 interfaces of various types, including serial interfaces.

Note All bridge groups use the standard Spanning Tree Protocol (IEEE 802.1D). Use CLI commands or FlexConfigs to bridge other protocols, such as AppleTalk or IPX, and to use other spanning tree protocols, such as VLAN-Bridge.

Navigation Path

Go to the Bridging Policy Page, then click the Add or Edit button beneath the table.

Related Topics

• Defining Bridge Groups
• Bridging on Cisco IOS Routers
• Understanding Interface Role Objects

Field Reference

Defining Time Zone and DST Settings

Security Manager enables you to define the time zone in which a Cisco IOS router is located. You can also define the start and end dates for Daylight Saving Time (DST).

Related Topics

• Defining NTP Servers
• Time Zone Settings on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Clock from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Clock from the Policy Type selector. Select an existing policy or create a new one.

The Clock page is displayed. See Table 63-11 for a description of the fields on this page.

Step 2 Select the time zone in which the router is located. Time zones are listed according the number of hours behind or ahead of Greenwich Mean Time (GMT).

Step 3 (Optional) Select the method for determining the start and end dates for DST:

• Set by Date—Select this option when DST starts and ends on fixed dates. Continue with Step 4.
• Set by Day—Select this option when DST starts and ends on days whose specific dates vary from year to year. Continue with Step 5.
• None—Select this option when DST is not used.

Step 4 (When Set by Date is selected) Define the fixed dates when DST starts and ends:

a. Under Start, click the calendar icon, then click the appropriate date.

b. Select the hour and minute from the displayed lists.

c. Repeat steps a and b to configure the end date and time.

Step 5 (When Set by Day is selected) Select the Specify Recurring Time check box if you want to define a DST period other than the default, which is the period used throughout most of the United States.

Step 6 (When Specify Recurring Time is selected) Define the start and end of DST:

a. Under Start, select the month when DST begins.

b. Select the week of the month (1, 2, 3, 4, first, or last).

c. Select the day of the week.

d. Select the hour and minute from the displayed lists. For example, if DST begins at 1:00 a.m. on the last Sunday of each March, select March, last, Sunday, 1, and 00.

e. Repeat Steps a through d to configure the end date and time.

Defining CPU Utilization Settings

You can use Security Manager to modify the following default CPU utilization settings:

• The size of the CPU history table.
• The size of the extended CPU load history table.
• Whether to enable the automatic CPU Hog profiling.

In addition, you can optionally define:

• The CPU utilization level that causes a process to be included in the history table.
• The types of CPU utilization thresholds to enable. For each type of threshold, you can determine the threshold values that trigger notifications.

Related Topics

• CPU Utilization Settings on Cisco IOS Routers
• Logging on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > CPU from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > CPU from the Policy Type selector. Select an existing policy or create a new one.

The CPU page is displayed.

Step 2 (Optional) Define the CPU utilization settings of the router, as required. See Table 63-12 for a description of the available fields.

Defining HTTP Policies

When you define an HTTP policy, you can:

• Enable and disable HTTP and SSL functionality on the router.
• Specify the ports used by each protocol.
• Optionally define a standard, numbered ACL that restricts access to the device using these protocols.

In addition, you can define the methods of AAA authentication and authorization methods to perform on users.

You must use caution when defining an HTTP policy, as your settings may affect communication between Security Manager (as well as other management applications that use these protocols) and the device.

Note As a general rule, Cisco IOS routers that have been discovered by Security Manager already have HTTPS enabled because Security Manager uses SSL as the default protocol for communicating with them. See Setting Up SSL on Cisco IOS Routers.

Before You Begin

• Enable AAA services on the router. See Defining AAA Services.

Related Topics

• HTTP and HTTPS on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > HTTP from the Policy selector, then click the Setup tab in the work area.
• (Policy view) Select Router Platform > Device Admin > Device Access > HTTP from the Policy Type selector. Select an existing policy or create a new one.

The HTTP Setup tab is displayed. See Table 63-13 for a description of the fields on this tab.

Step 2 Select the check boxes to enable HTTP and SSL (HTTPS) server functionality on the router.

Note If SSL is disabled (or if the HTTP policy as a whole is unassigned), Security Manager cannot communicate with the device after deployment unless you change the transport protocol for this device to SSH. This setting can be found in Device Properties. See Managing Device Communication Settings and Certificates.

Tip We recommend that you disable HTTP when SSL is enabled. This is required to ensure only secure connections to the server.

Step 3 (Optional) Modify the default ports used by HTTP (80) and HTTPS (443).

Step 4 (Optional) In the Allow Connection From field, enter the name of the standard, numbered ACL object that specifies which addresses can use HTTP and HTTPS on this device, or click Select to select the ACL object from a list or to create a new one. Use this option to restrict access to these protocols. For more information about creating standard ACL objects, see Creating Standard Access Control List Objects

Note Make sure that the ACL you select permits the Security Manager server; otherwise, communication with the device is lost.

Step 5 (Optional) On the AAA tab, modify the default type of authentication to perform on users who attempt to access the device using HTTP or HTTPS. Options include AAA, Enable Password (default), Local Database, and TACACS.

If you select AAA, continue with Step 6; otherwise, continue with Step 8.

Note The TACACS option applies only to devices using an IOS software version prior to 12.3(8).

See Table 63-14 for a description of the fields on the AAA tab.

Step 6 Select the authentication method to perform on users:

• If you want to use the default AAA login authentication methods defined in the device’s AAA policy (see Defining AAA Services), do not select the Enable Device Login Authentication check box. Continue with Step 7.
• If you want to define a method list especially for this policy, do the following:

a. Select the Enable Device Login Authentication check box.

b. Under Prioritized Method List, enter the names of the AAA server groups to use for authentication, or click Select to select the AAA server groups from a list or to create new ones. Use the up and down arrows in the selector to define the order in which you want to apply these authentication methods.

Note Make sure that Security Manager users are defined on the AAA servers; otherwise communication with the device is lost.

Step 7 Select the authorization method to perform on users who use HTTP or HTTPS to begin an EXEC session:

• If you want to use the default AAA authorization methods defined in the device’s AAA policy, do not select the Enable CLI/EXEC Operations Authorization check box. Continue with Step 8.
• If you want to define a method list especially for this policy, select the Enable CLI/EXEC Operations Authorization check box, then define the method list.

Note If you leave this option deselected, make sure that EXEC authorization is enabled in the router’s AAA policy. Otherwise, you will be unable to connect to the device via HTTP or HTTPS (SSL). This applies to Security Manager as well as other applications, such as SDM. See Defining AAA Services.

Step 8 (Optional) Create command authorization definitions for specific privilege levels:

a. Click the Add button under the Command Authorization Override table. The Command Authorization Override dialog box is displayed. See Table 63-15 for a description of the fields in this dialog box.

b. Configure the command authorization definition as required.

c. Click OK. The dialog box closes and the authorization method is displayed in the Command Authorization Override table.

d. Repeat a. through c. to create additional command authorization definitions.

HTTP Page—Setup Tab

Use the Setup tab of the HTTP page to enable HTTP and HTTP over Secure Socket Layer (HTTP over SSL or HTTPS) on the router. You can optionally limit access to these protocols to the addresses defined in an access control list.

Note As a general rule, Cisco IOS routers that have been discovered by Security Manager already have HTTPS enabled because Security Manager uses SSL as the default protocol for communicating with them. See Setting Up SSL on Cisco IOS Routers.

Navigation Path

Go to the HTTP Policy Page, then click the Setup tab.

Related Topics

• HTTP Page—AAA Tab
• HTTP and HTTPS on Cisco IOS Routers

Field Reference

HTTP Page—AAA Tab

Use the AAA tab of the HTTP page to define the authentication and authorization methods to perform on users who attempt to access the router using HTTP or HTTPS.

Navigation Path

Go to the HTTP Policy Page, then click the AAA tab.

Related Topics

• HTTP Page—Setup Tab
• HTTP and HTTPS on Cisco IOS Routers
• Filtering Tables

Field Reference

Command Authorization Override Dialog Box

Use the Command Authorization Override dialog box to define which methods to use when authorizing the EXEC commands that are associated with a given privilege. This enables you to authorize all commands associated with a specific privilege level, from 0 to 15.

Navigation Path

From the HTTP Page—AAA Tab, click the Add button beneath the Command Authorization Override table.

Related Topics

• HTTP Policy Page
• AAA Policy Page

Field Reference

Defining Console Port Setup Parameters

The console port on a router is generally used for local system access by an administrator with physical access to the device. By default, the console port is set up as follows:

• All permitted users have privileged access to the router, including all configuration commands (privilege level 15).
• The line is disconnected after 10 minutes without user input.
• Incoming connections are not permitted.
• Outgoing connections support Telnet only.

In addition to modifying any of the default settings, you can optionally define the following settings:

• The password for accessing the console.
• Whether to disable all EXEC sessions on the console.
• Incoming and outgoing ACLs that restrict the connections that are permitted on the console.
• Whether VRF connections are permitted on the console.

Related Topics

• Line Access on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > Line Access > Console from the Policy selector, then click the Setup tab in the work area.
• (Policy view) Select Router Platform > Device Admin > Device Access > Line Access > Console from the Policy Type selector. Select an existing policy or create a new one, and then click the Setup tab.

The Console Setup tab is displayed. See Table 63-16 for a description of the fields on this tab.

Step 2 (Optional) Enter the password for accessing the console port, then enter it again in the Confirm field.

Step 3 (Optional) Modify the default (15) granted to users of the console port. See Console Page—Authorization Tab.

Step 4 (Optional) Select the Disable all the EXEC sessions to the router via this line check box to prevent any incoming connections via the console.

Note Selecting this option blocks all access to the device via the console port.

Step 5 (Optional) Modify the default timeout after which the line is disconnected if no user input is detected.

Note Setting this value to 0 disables the timeout. Disabling the timeout could compromise the security of your network.

Step 6 (Optional) Specify which protocols can be used for outbound connections on the console port:

• All—All supported protocols are permitted.
• None—No protocols are permitted.
• Protocol—Enables one or more of the following protocols: SSH, Telnet, and rlogin.

Note You must configure AAA authentication on devices where the console port permits the SSH and rlogin protocols. See Defining Console Port AAA Settings.

Step 7 (Optional) Enter the names of ACLs that restrict incoming and outgoing connections between the device and the addresses in these lists, or click Select to select the ACL object or to create a new one. At the top of the selector, in the Type field, select the ACL type as either Standard or Extended.

Step 8 (Optional) Click the AAA tab to define authentication, authorization, and accounting settings for the console port. See Defining Console Port AAA Settings.

Defining Console Port AAA Settings

By default, authentication, authorization, and accounting are not performed on the console port. When you configure one or more of these access control options, you can either make use of the default method lists defined in the device’s AAA policy or define a custom method list containing one or more AAA methods.

Related Topics

• Defining Console Port Setup Parameters
• Line Access on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > Line Access > Console from the Policy selector, then click the Authentication tab in the work area.
• (Policy view) Select Router Platform > Device Admin > Device Access > Line Access > Console from the Policy Type selector. Select an existing policy or create a new one, and then click the Authentication tab.

The Console Authentication tab is displayed.

Step 2 (Optional) Select the authentication method to perform on users who attempt to access the console line.

See Table 63-17 for a description of the fields on the Authentication tab.

Note If you select local authentication, preview the full configuration before deployment to make sure that the aaa new-model command is not configured by another policy (for example, by configuring a method list in the AAA policy) or is already configured on the device itself.

Step 3 (Optional) On the Authorization tab, select the authorization method to perform on users who access the console line and begin an EXEC session.

See Table 63-18 for a description of the fields on the Authorization tab.

Note RADIUS uses the same server for authentication and authorization. Therefore, if you use define a RADIUS method list for authentication, you must define the same method list for authorization.

Step 4 (Optional) Create command authorization definitions for specific privilege levels:

a. Click the Add button under the Commands Authorization table. The Command Authorization dialog box is displayed. See Table 63-26 for details.

b. Configure the command authorization definition as required.

c. Click OK. The dialog box closes and the authorization method is displayed in the Commands Authorization table.

d. Repeat a. through c. to create additional command authorization definitions.

Step 5 (Optional) On the Accounting tab, select the EXEC and connection accounting methods to perform on users who access the console line.

See Table 63-19 for a description of the fields on this tab.

Step 6 (Optional) Create command accounting definitions for specific privilege levels:

a. Click the Add button under the Commands Accounting table. The Command Accounting Dialog Box—Line Access is displayed.

b. Configure the command accounting definition as required.

c. Click OK. The dialog box closes and the accounting method is displayed in the Commands Accounting table.

d. Repeat a. through c. to create additional command accounting definitions.

Defining VTY Line Setup Parameters

All Cisco IOS routers are configured by default with five VTY lines (labeled 0-4) that have the following settings:

• All permitted users have privileged access to the router, including all configuration commands (privilege level 15).
• VTY lines are disconnected after 10 minutes without user input.
• Incoming connections are not permitted.
• Outgoing connections support Telnet only.

You can use Security Manager to modify the default settings on these five VTY lines or to configure additional lines (up to a maximum of 16). In addition, you can optionally configure the following settings on each line:

• The password for accessing the line.
• Whether to disable all EXEC sessions on the line.
• Incoming and outgoing ACLs that restrict the connections that are permitted on the line.
• Whether VRF connections are permitted on the line.

Defining Groups of VTY Lines

You can configure multiple VTY lines as a contiguous group, which enables you to define identical settings for all the lines in the group with one procedure. All the lines within the group must fall within one of two ranges, 0-4 or 6-15. The group cannot overlap these two ranges.

The rules for configuring VTY line 5 are as follows. Line 5 can be part of the same definition as lines 0-4 only when there are no lines configured above line 5. If there are lines configured above line 5, you cannot include line 5 in the definition for lines 0-4, even if their configurations are the same. Line 5 can be included in the definition of the lines above line 5 if their configurations are the same.

For example, if lines 0-5 all share one configuration and lines 6-9 have a different configuration, you need to create three definitions—one definition for lines 0-4, a second definition for line 5, and a third definition for lines 6-9.

Note When you configure VTY lines, bear in mind that users are assigned a line at random when they connect to the device.

Note You can create only one definition per VTY line. An error is displayed if you create a VTY line definition that overlaps an existing definition.

Note If you use Security Manager to configure the default VTY lines (0-4), your definition overrides the default settings on the device. If you later delete this definition from Security Manager, the input protocol settings are retained and the other default settings are restored. This ensures that you always have VTY lines available for remote access to the device.

Note You can use the CLI or FlexConfigs to configure additional VTY lines on devices that support more than 16 lines.

Related Topics

• Line Access on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > Line Access > VTY from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Device Access > Line Access > VTY from the Policy Type selector. Select an existing policy or create a new one.

The VTY page is displayed. See Table 63-20 for a description of the fields on this page.

Step 2 Click the Add button beneath the Lines table, or select a line definition and then click the Edit button. The Setup tab of the VTY Lines dialog box is displayed. See Table 63-21 for a description of the fields on this tab.

Step 3 Enter the relative line number of the VTY line. If you are configuring a group of VTY lines, enter the first and last numbers of the group in the fields provided.

Step 4 (Optional) Enter the password for accessing the console line, then enter it again in the Confirm field.

Step 5 (Optional) Modify the default Privilege (15) granted to users of this VTY line (or group of lines).

Step 6 (Optional) Select the Disable all the EXEC sessions to the router via this line check box to prevent any incoming connections over this VTY line (or group of lines).

Step 7 (Optional) Modify the default timeout after which the line is disconnected if no user input is detected.

Note Setting this value to 0 to disables the timeout. Disabling the timeout could cause abandoned sessions to block available VTY lines. It can also compromise the security of your network.

Step 8 (Optional) Specify which protocols can be used for inbound and outbound connections on this VTY line (or group of lines):

• All—All supported protocols are permitted.
• None—No protocols are permitted.
• Protocol—Enables one or more of the following protocols: SSH, Telnet, and rlogin.

Caution Setting the inbound connections setting to None might prevent Security Manager from connecting to the device after deployment.

---

Note You must configure AAA authentication when the VTY line permits the SSH and rlogin protocols. See Defining VTY Line AAA Settings.

Step 9 (Optional) Enter the names of ACLs that restrict incoming and outgoing connections between the device and the addresses in these lists, or click Select to select an ACL object from a list or to create a new one. You can choose from standard or extended ACLs.

Tip Defining an inbound ACL is a good way to reserve a VTY line for administrative access only.

Step 10 (Optional) Click the AAA tab to define authentication, authorization, and accounting settings for this VTY line (or group of lines). See Defining VTY Line AAA Settings.

Step 11 Click OK to save your definitions locally on the client and close the dialog box. Your definitions are displayed in the Lines table.

Note To remove a VTY line definition, select it, then click Delete. If you delete a VTY line from an IOS device, any subsequent lines are also deleted. For example, if the device contains lines 0-9 and you delete line 5, lines 6-9 are deleted as well. If you delete the definition for lines 0-4 from Security Manager, the router retains the inbound protocol definition and restores the other default settings for these lines on the device. This ensures that five VTY lines are always available.

Defining VTY Line AAA Settings

By default, authentication, authorization, and accounting are not performed on VTY lines. When you configure one or more of these access control options, you can either make use of the default method lists defined in the device’s AAA policy or define a custom method list containing one or more AAA methods.

Before You Begin

• Define the basic parameters of the VTY line or group of VTY lines. See Defining VTY Line Setup Parameters.

Related Topics

• Defining VTY Line Setup Parameters
• Line Access on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > Line Access > VTY from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Device Access > Line Access > VTY from the Policy Type selector. Select an existing policy or create a new one.

The VTY page is displayed. See Table 63-20 for a description of the fields on this page.

Step 2 Select a VTY line definition in the Lines tables, click the Edit button to display the VTY Line dialog box, then click the Authentication tab.

Step 3 (Optional) Select the authentication method to perform on users who attempt to access the VTY line.

See Table 63-23 for a description of the fields on this tab.

Note If you select local authentication, preview the full configuration before deployment to make sure that the aaa new-model command is not configured by another policy (for example, by configuring a method list in the AAA policy) or is already configured on the device itself.

Step 4 (Optional) On the Authorization tab, select the authorization method to perform on users who access the VTY line and begin an EXEC session.

See Table 63-24 for a description of the fields on the Authorization tab.

Note RADIUS uses the same server for authentication and authorization. Therefore, if you use define a RADIUS method list for authentication, you must define the same method list for authorization.

Step 5 (Optional) Create command authorization definitions for specific privilege levels:

a. Click the Add button under the Commands Authorization table. The Command Authorization Dialog Box—Line Access is displayed.

b. Configure the command authorization definition as required.

c. Click OK. The dialog box closes and the authorization method is displayed in the Commands Authorization table.

d. Repeat a. through c. to create additional command authorization definitions.

Step 6 (Optional) On the Accounting tab, select the EXEC and connection accounting methods to perform on users who attempt to access the VTY line.

See Table 63-25 for a description of the fields on the Accounting tab.

Step 7 (Optional) Create command accounting definitions for specific privilege levels:

a. Click the Add button under the Commands Accounting table. The Command Accounting Dialog Box—Line Access is displayed.

b. Configure the command accounting definition as required.

c. Click OK. The dialog box closes and the accounting method is displayed in the Commands Accounting table.

d. Repeat a. through c. to create additional command accounting definitions.

Console Page—Setup Tab

Use the Setup tab of the Console page to define the basic parameters of the console port. This includes the password for accessing the port, the privilege level assigned to users, the protocols that are permitted, and the ACLs that limit access.

Navigation Path

Go to the Console Policy Page, then click the Setup tab.

Related Topics

• Console Page—Authentication Tab
• Console Page—Authorization Tab
• Console Page—Accounting Tab
• VTY Line Dialog Box—Setup Tab

Field Reference

Console Page—Authentication Tab

Use the Authentication tab of the Console page to define the AAA authentication methods to perform on users who attempt to access the console port.

Navigation Path

Go to the Console Policy Page, then click the Authentication tab.

Related Topics

• Console Page—Setup Tab
• Console Page—Authorization Tab
• Console Page—Accounting Tab
• VTY Line Dialog Box—Authentication Tab

Field Reference

Console Page—Authorization Tab

Use the Authorization tab of the Console page to define the EXEC and command authorization methods to perform on users who access the console port.

Note You must enable AAA services on the router to use this feature; otherwise, deployment will fail. See Defining AAA Services.

Navigation Path

Go to the Console Policy Page, then click the Authorization tab.

Related Topics

• Console Page—Setup Tab
• Console Page—Authentication Tab
• Console Page—Accounting Tab
• VTY Line Dialog Box—Authorization Tab
• Filtering Tables

Field Reference

Console Page—Accounting Tab

Use the Accounting tab of the Console page to define the EXEC, connection, and command accounting methods to perform on users who access the console port.

Note You must enable AAA services on the router to use this feature; otherwise, deployment will fail. See Defining AAA Services.

Navigation Path

Go to the Console Policy Page, then click the Accounting tab.

Related Topics

• Console Page—Setup Tab
• Console Page—Authentication Tab
• Console Page—Authorization Tab
• VTY Line Dialog Box—Accounting Tab
• Filtering Tables

Field Reference

VTY Line Dialog Box

Use the VTY Line dialog box to configure one or more VTY lines (up to 16) that enable remote users to access the router. When you configure a VTY line, you can define the type of authentication and authorization to perform on users who access the lines.

Navigation Path

Go to the VTY Policy Page, then click the Add or Edit button beneath the table.

Related Topics

• Line Access on Cisco IOS Routers
• Console Policy Page

Field Reference

VTY Line Dialog Box—Setup Tab

Use the Setup tab of the VTY Line dialog box to define the basic parameters of the VTY line. This includes the password for accessing the line, the privilege level assigned to users, the protocols that are permitted on the line, and the ACLs that limit access.

Navigation Path

Go to the VTY Line Dialog Box, then click the Setup tab.

Related Topics

• Defining VTY Line Setup Parameters
• VTY Line Dialog Box—Authentication Tab
• VTY Line Dialog Box—Authorization Tab
• VTY Line Dialog Box—Accounting Tab
• Console Page—Setup Tab

Field Reference

VTY Line Dialog Box—Authentication Tab

Use the Authentication tab of the VTY Line dialog box to define the authentication methods to perform on users who attempt to access the selected VTY line or group of lines.

Navigation Path

Go to the VTY Line Dialog Box, then click the Authentication tab.

Related Topics

• Defining VTY Line AAA Settings
• VTY Line Dialog Box—Setup Tab
• VTY Line Dialog Box—Authorization Tab
• VTY Line Dialog Box—Accounting Tab
• Console Page—Authentication Tab

Field Reference

VTY Line Dialog Box—Authorization Tab

Use the Authorization tab of the VTY Line dialog box to define the EXEC and command authorization methods to perform on users who access the selected VTY line or group of lines.

Note You must enable AAA services on the router to use this feature; otherwise, deployment will fail. See Defining AAA Services.

Navigation Path

Go to the VTY Line Dialog Box, then click the Authorization tab.

Related Topics

• Defining VTY Line AAA Settings
• VTY Line Dialog Box—Setup Tab
• VTY Line Dialog Box—Authentication Tab
• VTY Line Dialog Box—Accounting Tab
• Console Page—Authentication Tab
• Filtering Tables

Field Reference

VTY Line Dialog Box—Accounting Tab

Use the Accounting tab of the VTY Line dialog box to define the EXEC, connection, and command accounting methods to perform on users who access the selected VTY line or group of lines.

Note You must enable AAA services on the router to use this feature; otherwise, deployment will fail. See Defining AAA Services.

Navigation Path

Go to the VTY Line Dialog Box, then click the Accounting tab.

Related Topics

• Defining VTY Line AAA Settings
• VTY Line Dialog Box—Setup Tab
• VTY Line Dialog Box—Authentication Tab
• Console Page—Accounting Tab
• Filtering Tables

Field Reference

Command Authorization Dialog Box—Line Access

Use the Command Authorization dialog box to define which methods to use when authorizing the EXEC commands that are associated with a given privilege. This enables you to authorize all commands associated with a specific privilege level, from 0 to 15.

Navigation Path

From the Console Page—Authorization Tab or the VTY Line Dialog Box—Authorization Tab, click the Add button beneath the Command Authorization table.

Related Topics

• Console Policy Page
• VTY Policy Page

Field Reference

Command Accounting Dialog Box—Line Access

Use the Command Accounting dialog box to define which methods to use when recording information about the EXEC commands that are executed for a given privilege. Each accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the name of the user who executed it.

Navigation Path

From the Console Page—Accounting Tab or the VTY Line Dialog Box—Accounting Tab, click the Add button beneath the Command Accounting table.

Related Topics

• Console Policy Page
• VTY Policy Page

Field Reference

Defining Optional SSH Settings

SSH is configured by default with the following settings:

• Both SSH version 1 and SSH version 2 are supported.
• The negotiation phase is terminated if not completed successfully after 120 seconds.
• The router tries 3 times to authenticate SSH clients before disconnecting.

You can use Security Manager to modify these default settings and optionally configure the following settings:

• The source interface for SSH packets.
• The name of the RSA key pair to use.
• Whether to regenerate the key during the next deployment.

Before You Begin

• Make sure that SSH is enabled on the router. See Chapter 2, “Preparing Devices for Management”.
• Make sure that the VTY lines on the router allow inbound SSH traffic. See Defining VTY Line Setup Parameters.
• Make sure that a hostname and domain name are configured on the router (unless you plan to use a different RSA key pair). You can use the CLI or the Hostname policy in Security Manager for this purpose. See Hostnames and Domain Names on Cisco IOS Routers.

Related Topics

• Optional SSH Settings on Cisco IOS Routers
• Setting Up SSH

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > Secure Shell from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Device Access > Secure Shell from the Policy Type selector. Select an existing policy or create a new one.

The Secure Shell page is displayed. See Table 63-28 for a description of the fields on this page.

Step 2 (Optional) Modify the following default settings:

a. The version of SSH to support.

b. The timeout for completing the negotiation phase of the SSH connection.

c. The number of times to attempt authentication of the SSH client.

Step 3 (Optional) In the Source Interface field, enter the name of the interface or interface role whose address should be used as the source interface for all SSH packets sent to SSH clients, or click Select to select an interface role object from a list or to create a new one. The source interface must have an IP address.

If you do not enter a value in this field, the address of the closest interface to the destination is used.

Step 4 (Optional) Enter the name of the RSA key pair to use for SSH connections. If you do not enter a value in this field, the router uses the key pair that is based on the hostname and domain name.

Tip Use the CLI command show crypto key mypubkey rsa to display the names and values of each key pair configured on the device.

Step 5 (Optional) Select the Regenerate Key During Deployment check box if you want the router to regenerate the RSA key pair used for SSH. This option is useful if you believe that the secrecy of the keys might be compromised. Enter the size of the modulus to use to regenerate the keys.

Note You must remember to return to this policy after deployment to deselect the check box. If you do not do this, a new key is generated during each deployment.

Note This option requires interaction with the device during deployment. Therefore, you should use it only when deploying to live devices, not when deploying to a file.

Note A key pair must already exist on the device before you select this option; otherwise, deployment will fail. (This will typically be the case, since IOS routers must have SSH enabled to be added to Security Manager.)

Defining SNMP Agent Properties

When you define the properties of the SNMP agent, you must define the community string and community string type, as well as the address and properties of the SNMP host that receives the traps.

SNMP community strings are embedded passwords to MIBs, which store data about the router’s operation and are meant to be available to authenticated remote users. Two types of community strings exist: “public” community strings, which provide read-only access to all objects in the MIB (except community strings themselves), and “private” community strings, which provide read-write access to all objects in the MIB (except community strings).

SNMP hosts receive the traps generated by the router. You must define the address, password, and port number for accessing the SNMP host, as well as the SNMP version being used. Security Manager supports SNMP version 1, version 2c (also called “community-based SNMP”) and version 3, which offers authentication and encryption.

Related Topics

• SNMP on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Device Access > SNMP from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Device Access > SNMP from the Policy Type selector. Select an existing policy or create a new one.

The SNMP page is displayed. See Table 63-29 for a description of the fields on this page.

Step 2 Define the community string needed to access the MIB:

a. Under Permissions, click Add to display the Permission dialog box.

b. Define the string. See Table 63-30 for a description of the available fields.

c. Click OK to save your definitions locally on the client and close the dialog box. Your definitions are displayed in the Permissions table.

Note A warning is displayed if you attempt to edit or delete a community string that is in use by an SNMP host. If you continue with the operation, the device creates a private, read-only string that matches the definition for the host in the Trap Receiver table.

Step 3 Define the SNMP host that receives the traps generated by the SNMP agent:

a. Under Trap Receiver, click Add to display the Trap Receiver dialog box.

b. Define the host. See Table 63-31 for a description of the available fields.

c. Click OK to save your definitions locally on the client and close the dialog box. Your definitions are displayed in the Trap Receiver table.

Step 4 Under SNMP Server Properties, enter the location and contact information for the administrator responsible for routers configured with this SNMP policy.

This definition, which is text-only and does not affect the operation of the router, provides useful information to the manager of the SNMP host when the manager investigates a particular trap.

Step 5 Click Configure Traps to display the SNMP Traps dialog box, which is used to select which traps to enable on the router. For more information, see Enabling SNMP Traps.

Enabling SNMP Traps

The router immediately sends notifications, also called SNMP traps, to the designated SNMP host (management station) when a defined condition occurs, such as a link up, link down, or a syslog event.

To enable SNMP traps, select the check box next to each relevant trap. Certain check boxes activate multiple, related traps.

Note Each trap that you enable consumes system resources. To lessen the impact on system performance, select only those traps that you need for network monitoring.

Related Topics

• SNMP on Cisco IOS Routers

Step 1 Open the SNMP page for defining SNMP server policies on Cisco IOS routers, as described in Defining SNMP Agent Properties.

Step 2 On the SNMP page, click Configure Traps. The SNMP Traps dialog box is displayed.

Step 3 Select the check box next to each type of trap to enable. The traps are divided into the following four categories:

• Standard SNMP traps (for example, Authentication, Cold Start, and Warm Start).
• ISAKMP traps (related to Phase 1 of the IPsec process).
• IPsec traps (related to Phase 2 of the IPsec process).
• Other traps (includes syslog messages, protocol-related notifications, and CPU usage warnings).

See Table 63-32 for a description of the available traps.

Note You must add command-line interface (CLI) commands to fully implement the IP multicast and CPU traps. One method available for entering these commands is by using FlexConfigs. See Chapter 7, “Managing FlexConfigs”.

Tip Click Select All to enable all traps displayed in the dialog box or Deselect All to disable all the traps.

Step 4 Click OK to save your definitions locally on the client and close the dialog box.

Tip To configure SNMP traps not included in this dialog box, define a FlexConfig. See Chapter 7, “Managing FlexConfigs” for more information.

Permission Dialog Box

Use the Permission dialog box to define the community string and string type required by the SNMP policy. The community string is an embedded password for accessing the Management Information Base (MIB) that stores operational data about the router.

Navigation Path

Go to SNMP Policy Page, then click the Add or Edit button beneath the Permissions table.

Related Topics

• SNMP Policy Page
• Trap Receiver Dialog Box
• SNMP Traps Dialog Box
• Defining SNMP Agent Properties
• SNMP on Cisco IOS Routers

Field Reference

Trap Receiver Dialog Box

Use the Trap Receiver dialog box to define the SNMP hosts that receive traps generated by the router. This includes defining the version of SNMP to use.

Navigation Path

Go to the SNMP Policy Page, then click the Add or Edit button beneath the Trap Receiver table.

Related Topics

• SNMP Policy Page
• Permission Dialog Box
• SNMP Traps Dialog Box
• Defining SNMP Agent Properties
• SNMP on Cisco IOS Routers

Field Reference

SNMP Traps Dialog Box

Use the SNMP Traps dialog box to select the events in the router that should generate SNMP traps. To lessen possible degradation of system performance, select only those traps that are needed for network monitoring purposes.

Tip You can configure SNMP traps not included in this dialog box by defining FlexConfigs. For more information, see Understanding FlexConfig Policies and Policy Objects.

Navigation Path

Go to the SNMP Policy Page, then click Configure Traps.

Related Topics

• SNMP Policy Page
• Permission Dialog Box
• Trap Receiver Dialog Box
• Enabling SNMP Traps
• SNMP on Cisco IOS Routers

Field Reference

Defining DNS Policies

When you define a DNS policy in Security Manager, you can specify the remote DNS servers used by the router for hostname-to-address translations. In addition, you can define a static host table that contains local translations used exclusively by this device. Having selected addresses in this type of cache can speed the translation process by eliminating the need to query the DNS servers.

Related Topics

• DNS on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > DNS from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > DNS from the Policy Type selector. Select an existing policy or create a new one.

The DNS page is displayed. See Table 63-33 for a description of the fields on this page.

Step 2 In the Servers field, enter the addresses of the DNS servers (up to 6) that can perform hostname-to-address translations for the router. You can use a combination of addresses and network/host objects, or click Select to display a selector. For more information, see Specifying IP Addresses During Policy Definition.

Tip If the network you want is not listed in the selector, click the Create button or the Edit button in the selector to display the Add or Edit Network/Host Dialog Box. From here you can create a network/host object to use in the policy.

Step 3 (Optional) In the Hosts field, enter the static host mappings that you want to define in the router’s host table:

a. Click Add to display the IP Host Dialog Box.

b. Enter the hostname to translate.

c. Enter up to three addresses or network/host objects, or click Select to display a selector. These are the addresses to which the router translates the hostname.

d. Click OK. The mapping is displayed in the Hosts field on the DNS page.

e. Repeat a. through d. to add more hosts to the host table.

Note To edit a host mapping, select the definition from the Hosts field, then click Edit. To remove a host mapping, select it, then click Delete.

Step 4 (Optional) Deselect the Domain Lookup check box to disable DNS functionality on the router.

IP Host Dialog Box

Use the IP Host dialog box to configure the host table on the router. This is the table of static, local mappings that the router uses to translate hostnames to IP addresses. If the router does not find the required entry in the host table, it queries the DNS servers that are defined on the DNS page.

Navigation Path

Go to the DNS Policy Page, then click Add under Hosts.

Related Topics

• DNS on Cisco IOS Routers

Field Reference

Defining Hostname Policies

When you define a hostname policy, Security Manager updates the hostname and domain name fields in the Device Properties dialog box after deployment. See Viewing or Changing Device Properties.

Related Topics

• Hostnames and Domain Names on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Hostname from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Hostname from the Policy Type selector. Select an existing policy or create a new one.

The Hostname page is displayed. See Table 63-35 for a description of the fields on this page.

Step 2 Enter the hostname for the router. Names must start with a letter, end with a letter or digit, and include only letters, digits, and hyphens. The maximum length is 63 characters.

Step 3 Enter the domain name for the router. The router uses this domain name for RSA key generation and in policies when you do not enter the fully-qualified domain name.

Defining Router Memory Settings

You can use Security Manager to modify the following default memory settings:

• The number of hours that the router maintains the log of memory consumption.
• Whether to enable the Memory Allocation Lite feature.
• The amount of memory to reserve for critical system log messages.

In addition, you can define:

• The lower thresholds for processor and I/O memory. Log messages are sent when available memory drops below these thresholds.
• The types of sanity checks to perform.

Related Topics

• Memory Settings on Cisco IOS Routers
• Logging on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Memory from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Memory from the Policy Type selector. Select an existing policy or create a new one.

The Memory page is displayed.

Step 2 (Optional) Define the memory settings of the router, as required. See Table 63-36 for a description of the available fields.

Contents of Bootstrap Configuration

The bootstrap configuration provided by SDP typically does the following:

• Sets the petitioner’s hostname.
• Synchronizes the petitioner’s system clock with the registrar.
• Sets the petitioner’s trustpoint.
• Sets the petitioner’s authentication and authorization mechanism.
• Pushes the CA certificate.
• Enrolls the petitioner with the PKI server.
• Sets other VPN configurations, such as the configuration required to establish a management tunnel.
• Sets Cisco Networking Services (CNS) configuration.
• Sets the petitioner’s DHCP pool.

Related Topics

• Secure Device Provisioning Workflow
• Secure Device Provisioning on Cisco IOS Routers

Secure Device Provisioning Workflow

The following illustrates the steps required to use SDP to register a remote-site device in a secure network:

1. Unpack the router and connect the power, LAN, and WAN cables.

2. Turn on a computer (introducer) that is assigned an IP address from the DHCP server on the router, open a web browser, and go to the petitioner URL (http://device/ezsdd/welcome) on the router. The router responds with a registration page (also called the local login dialog box).

3. Enter the username and password, then click OK. On the welcome page, enter the URL for the registrar. The following actions occur:

a. The browser opens an HTTPS-secured session to the central-site registrar, which verifies the username with the AAA server and returns the appropriate bootstrap configuration to the browser.

b. The browser feeds the bootstrap configuration to the remote-site router, configuring PKI trustpoint enrollment and IPsec VPN connectivity, and provisioning system attributes and other information.

c. You are notified that bootstrap configuration is complete.

Related Topics

– Contents of Bootstrap Configuration

– Secure Device Provisioning on Cisco IOS Routers

Defining Secure Device Provisioning Policies

The petitioner component is automatically enabled on all Cisco IOS routers. The SDP policy in Security Manager enables the registrar. To define an SDP policy you must define:

• The AAA server group containing the AAA server that the registrar uses to authenticate and authorize the introducer.
• The CA server to which the petitioner enrolls during the bootstrap process.
• The location of the introduction page that is displayed after authorization was performed.
• The location of the bootstrap configuration to be provided to the petitioner.

Related Topics

• Secure Device Provisioning Workflow
• Configuring a AAA Server Group for Administrative Introducers
• Secure Device Provisioning on Cisco IOS Routers

Step 1 Do one of the following:

• (Device view) Select Platform > Device Admin > Secure Device Provisioning from the Policy selector.
• (Policy view) Select Router Platform > Device Admin > Secure Device Provisioning from the Policy Type selector. Select an existing policy or create a new one.

The Secure Device Provisioning page is displayed. See Table 63-37 for a description of the fields on this page.

Step 2 Under Introducer Authentication, enter the name of the AAA server group containing the relevant AAA server, or click Select to select it from a list or to create a new object.

The selected AAA server determines whether the username and password supplied by the introducer represent an authorized user. The AAA server must use TACACS+, RADIUS, or be local.

Note Each AAA server in the selected group must be configured to communicate with an interface that exists on the router; otherwise, validation fails. If you want to configure a different AAA server group for authenticating and authorizing administrative introducers, see Configuring a AAA Server Group for Administrative Introducers.

Step 3 Under Petitioner Authentication, define the CA server that authenticates the identity of the petitioner by doing one of the following:

• Select Local CA Server, then enter the local CA name in the field provided. If you have already configured the CA server locally on the registrar, a trustpoint is generated automatically.

Note If you have not configured the router as the CA server, enter the command Crypto pki server [name] using the CLI or FlexConfigs. This command is mandatory when you deploy an SDP policy configured with a local CA server.

• Select Remote CA Server, then enter the name of a PKI enrollment object, or click Select to select it from a list or to create a new object.

The PKI enrollment object defines the external CA server used in the SDP policy.

Step 4 Select the source of the introduction page that is displayed after you log in to the registrar. The introduction page indicates whether authorization was successfully completed and contains a button for completing the process of obtaining the bootstrap configuration.

If you do not select the default welcome page, you must enter the URL required to access a different welcome page that you prepared elsewhere.

Step 5 Select the source of the bootstrap configuration provided to the petitioner to implement its first-time configuration:

• If the source of the bootstrap configuration is a non-Security Manager URL, enter the URL and also the username and password for accessing the URL, if required.
• If the source of the configuration file is a Security Manager URL:

– Enter the name of a FlexConfig, or click Select to select it from a list or to create a new object. The FlexConfig contains the device commands required to retrieve the appropriate bootstrap configuration. For more information, see Add or Edit FlexConfig Dialog Box.

– Enter the device name formula required by the FlexConfig to derive the device name of the petitioner from the username submitted by the introducer. (The two names typically have a fixed relationship.) The default formula is $n, which uses the introducer name to determine the device name.

The device name determines which bootstrap configuration the petitioner should receive. The resulting URL contains the name of the FlexConfig you selected, as well as the parameters and formula you defined.

– Enter a username and password for accessing the Security Manager server containing the FlexConfig. The password can contain alphanumeric characters, but cannot consist of a single digit.

Configuring a AAA Server Group for Administrative Introducers

Administrative introducers are administrators or management systems that introduce many devices to the PKI network. You can configure a AAA server group for authenticating and authorizing administrative introducers by appending the following FlexConfig to the configuration of the router:

This FlexConfig serves two functions—it configures the AAA server group to use and it associates this server group with the SDP crypto.

For more information about administrative introducers, see Administrative Secure Device Provisioning Introducer on Cisco.com at this URL: http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtadintr.html

Related Topics

• Secure Device Provisioning on Cisco IOS Routers
• Defining Secure Device Provisioning Policies
• Understanding FlexConfig Policies and Policy Objects

Understanding DHCP Database Agents

A DHCP database agent is any external host—for example, an FTP, TFTP, or RCP server—that stores the DHCP bindings database. You can include one or more DHCP database agents in each DHCP policy, as well as configure the interval between database updates to the agent.

Note If you configure an external DHCP database agent, it is not necessary to define IP address pools, but you may do so. For more information about IP address pools, see Defining DHCP Address Pools.

Related Topics

• Understanding DHCP Relay Agents
• Understanding DHCP Option 82
• Understanding Secured ARP
• Defining DHCP Policies
• DHCP on Cisco IOS Routers

Understanding DHCP Relay Agents

A DHCP relay agent is any host that forwards DHCP packets between clients and servers when they do not reside on the same physical subnet. Relay agents receive DHCP messages and then generate a new DHCP message to send on another interface. You can configure a reforwarding policy that determines what the DHCP relay agent should do if a forwarded message already contains relay information.

DHCP relay options in Security Manager include:

• Drop—The relay agent discards messages with existing relay information if Option 82 information is also present.
• Keep—The relay agent retains existing relay information.
• Replace—The relay agent overwrites existing information with its own relay information.

For example, you can have the DHCP relay agent replace the forwarded message with a new relay message. Additionally, you can choose whether to have the relay agent check the validity of relay information contained within forwarded BOOTREPLY messages.

Related Topics

• Understanding DHCP Database Agents
• Understanding DHCP Option 82
• Understanding Secured ARP
• Defining DHCP Policies
• DHCP on Cisco IOS Routers

Understanding DHCP Option 82

DHCP option 82 enables the DHCP relay agent to include information about itself and its attached client when it forwards requests from a DHCP client to a DHCP server. The DHCP server can use this information to assign IP addresses, perform access control, and set quality of service (QoS) and security policies for each of its subscribers. When the DHCP option 82 feature is enabled, a subscriber is identified by the switch port through which it connects to the networks, instead of by its MAC address. Multiple hosts on the subscriber LAN can be connected to the same port on the access switch and are uniquely identified. Option 82 also enhances security on access switches by providing the ability to use a user’s IP address to locate the port on which a user is attached.

Related Topics

• Understanding DHCP Database Agents
• Understanding DHCP Relay Agents
• Understanding Secured ARP
• Defining DHCP Policies
• DHCP on Cisco IOS Routers