Trustworthy Systems Guide

Feature history for consent token

This table provides release and platform support information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.


Release	Feature name and description	Supported platform
Cisco IOS XE 17.18.1	Consent Token: This feature authenticates the network administrator of an organization to access the system shell with mutual consent from the network administrator and Cisco TAC.	Cisco C9350 Series Smart Switches Cisco C9610 Series Smart Switches

Consent Token

How consent token authorization works

Summary

When you request access to system shell, you need to be authorized. You must first run the command to generate a challenge using the Consent Token feature on your device. The device outputs a unique challenge. You must then copy this challenge string and send it to a Cisco Authorized Personnel by email or instant message.

The Cisco Authorized Personnel processes the unique challenge string and generates a unique response. The Cisco Authorized Personnel copies this response string and sends it to you through email or Instant Message.

You must then input this response string into your device. If the challenge-response pair matches, you are authorized to access the system shell. If not, an error is displayed and you are required to repeat the authentication process.

Once you gain access to system shell, collect the debug information that Cisco TAC needs. After you finish accessing the system shell, end the session and continue debugging.

Workflow

Generate a challenge to request access to system shell for the specified time period.
Send the challenge string to a Cisco Authorized Personnel.
Input the response string onto your device.
Terminate the session.

Consent token authorization process for system shell access

Procedure

Step 1	Send a request for a challenge using the request consent-token generate-challenge shell-access `time-validity-slot` command. Example: `Device# request consent-token generate-challenge shell-access auth-timeout 900 zSSdrAAAAQEBAAQAAAABAgAEAAAAAAMACH86csUhmDl0BAAQ0Fvd7CxqRYUeoD7B4AwW7QUABAAAAG8GAAhDVEFfREVNTwcAGENUQV9ERU1PX0NUQV9TSUdOSU5HX0tFWQgAC0M5ODAwLUNMLUs5CQALOVpQUEVESE5KRkI= Device# *Jan 18 02:47:06.733: %CTOKEN-6-AUTH_UPDATE: Consent Token Update (challenge generation attempt: Shell access 0).` `time-validity-slot` : The duration in minutes for which you are requesting access to system shell. In this example, the session expires after 900 minutes. The device generates a unique challenge in base-64 format.
Step 2	Send the challenge string generated by the device to a Cisco Authorized Personnel through email or instant message. A Cisco Authorized Personnel processes the unique challenge string and generates a response. The response is also a base-64 string that is unique. The Cisco Authorized Personnel copies this response string and sends it to you through email or Instant Message.
Step 3	Input the response string sent to you by the Cisco Authorized Personnel using the request consent-token accept-response shell-access `response-string` command. Example: Device# request consent-token accept-response shell-access lR1y2AAUKFcAAAABAAABYlVDZ2d6MnkxL3JxTTJSSC9FZE5aWnRSa1FteS9POWZqRUNlTk1LL3VoUWxTc0FsOHl5OW5vckQ4YWVOelpZZGYNCkNpWHY0b1B4Q000UGs1M2ZEMUpoazBCUkYyM3FML1A2ckVjM3paR05wdHcvck95UVduYUVuTnA5bnhIZ09CNE0NCjBmVjh4b3I4TzE3aHNMaU1JeDQ3YWtkdE9Xb0JhTmlzMVRweFBVZE93QUxvZDVEbmo4UEtiR01VVUM5b3lZWXQNCjFIRnJPbXczcmpsZTJHUnIxOWJUNkZLTWlpZ0ZmbENVRWo4K2xoaXgxS0ZtdDVPcDBYczVPSU43L0dSK1pGTnoNCmYxTUtjaW1OWDhWTTNLQ0ZWNURHU3pIenF1UFBxZVNDU0xLNkhXUTFROTlFMXJVakdlZ1NqTWxnNFlySkJYL0wNCnpaTDVVRnVFdWpRWDdDUThIdkVPM1E9PQ== % Consent token authorization success Jan 18 02:51:37.807: %CTOKEN-6-AUTH_UPDATE: Consent Token Update (authentication success: Shell access 0). Device# request platform software system shell Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y Device# Jan 18 02:56:59.714: %CTOKEN-6-AUTH_UPDATE: Consent Token Update (authorization for Shell access 0 will expire in 10 min). If the challenge-response pair match, you are authorized to access system shell. If the challenge-response pair does not match, an error is displayed. Repeat steps 1 to 3 to try again. After you are authorized, you can access system shell for the requested time-slot. The device notifies you when ten minutes remain in the authorization session.
Step 4	When you finish accessing system shell, you can end the session using the request consent-token terminate-auth command. You can also force-terminate the session before the authorization timeout using this command. The session also gets terminated automatically when the requested time slot expires. Example: `Device# request consent-token terminate-auth % Consent token authorization termination success Device# *Jan 18 23:33:02.937: %CTOKEN-6-AUTH_UPDATE: Consent Token Update (terminate authentication: Shell access 0). Device#`

Bias-Free Language

Book Title

Consent Token

Results

Chapter: Consent Token

Consent Token

Example:

Example:

Example:

Was this Document Helpful?

Contact Cisco