GUI Administration Guide for Cisco Unified SIP Proxy Release 10.2

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book

Results

Updated:
August 27, 2020

Chapter: Configuring Authentication, Authorization, and Accounting

Configuring Authentication, Authorization, and Accounting

Configuring the AAA Authentication Server

The two procedures for configuring AAA authentication consist of:

About the Authentication Order

The AAA policy specifies the failover functionality that you can optionally configure for the authentication server. You can use these two types of failover functionality separately or in combination:

  • Authentication failover

  • Unreachable failover

About Authentication Failover

The authentication failover feature enables you to optionally use a remote RADIUS server for user login authentication, in addition to the local database. The procedure in this section configures the order in which authentication is resolved. You can configure authentication to use:

  • The local database only

  • The remote server only

  • The local database first, then the remote server

  • The remote server first, then the local database

When using both local and remote authentication, you can also configure whether you want the user attributes that are retrieved from a remote RADIUS AAA server to be merged with the attributes found in the local user database for the same username.


Note

When using AAA authentication, a user configured only on the remote radius server (and not on the local Cisco Unified SIP Proxy user database) will have low privilege levels and limited GUI access upon logging into Cisco Unified SIP Proxy. To enable higher privilege levels for this user, configure a local user with the same username as that on the Radius server, and assign the appropriate authorization levels. For detailed information, see the Application Note on AAA based authentication.

The authentication failover feature has the following limitations:

  • Authentication with a RADIUS server is available only when accessing the GUI or CLI interface and requires only a user ID and password.

  • Login information is not synchronized between the local system and the remote server. Therefore:

    • Any security features such, as password expiration, must be configured separately for Cisco Unified SIP Proxy and the RADIUS server.

    • Cisco Unified SIP Proxy users are not prompted when security events, such as password expiration or account lockout, occur on the RADIUS server.

    • RADIUS server users are not prompted when security events, such as password expiration or account lockout, occur on Cisco Unified SIP Proxy.

About Unreachable Failover

The Unreachable Failover feature is used only with RADIUS servers. This feature enables you to configure up to two addresses that can be used to access RADIUS servers.

As Cisco Unified SIP Proxy attempts to authenticate a user with the RADIUS servers, the system sends messages to users to notify them when a RADIUS server either cannot be reached or fails to authenticate the user.

Example of Authentication Sequence

In this example, authentication is performed by the remote server first, then by the local database. Also, two addresses are configured for the remote RADIUS server.

This sequence of events could occur during authentication for this example:

  1. Cisco Unified SIP Proxy tries to contact the first remote RADIUS server.

  2. If the first RADIUS server does not respond or does not accept the authentication credentials of the user, Cisco Unified SIP Proxy tries to contact the second remote RADIUS server.

  3. If the second RADIUS server does not respond or does not accept the authentication credentials of the user, the user receives the appropriate error message and Cisco Unified SIP Proxy tries to contact the local database.

  4. If the local database does not accept the authentication credentials of the user, the user receives an error message.

Configuring Connection Parameters for the AAA Authentication Server

SUMMARY STEPS

  1. Choose Configure > AAA > Authentication.
  2. Enter the following information in the appropriate fields for the primary server, and optionally, for the secondary server:
  3. Click Apply.
  4. Click OK to save your changes.

DETAILED STEPS

Step 1

Choose Configure > AAA > Authentication.

The system displays the AAA Authentication Server Configuration page.

Step 2

Enter the following information in the appropriate fields for the primary server, and optionally, for the secondary server:

  • Server IP address or DNS name

  • Port number used

  • Cryptographic shared secret and security credentials

  • Authentication order

  • Number of login retries

  • Length of login timeout

  • Hostname

  • Port

  • Password

Step 3

Click Apply.

Step 4

Click OK to save your changes.

Specifying the Policy that Controls the Behavior of Authentication and Authorization

Use this procedure to configure the information used to log into the authentication server.

SUMMARY STEPS

  1. Choose Configure > AAA > Authorization.
  2. Select or deselect whether you want to merge the attributes of the remote AAA server with the attributes in the local database.
  3. Click Apply.
  4. Click OK to save your changes.

DETAILED STEPS

Step 1

Choose Configure > AAA > Authorization.

The system displays the Configure AAA Authorization Server Configuration window page.

Step 2

Select or deselect whether you want to merge the attributes of the remote AAA server with the attributes in the local database.

Step 3

Click Apply.

Step 4

Click OK to save your changes.

Configure AAA Accounting Server

You can configure up to two AAA accounting servers. Automatic failover functionality is provided if you have two accounting servers configured. If the first server is unreachable, the accounting information is sent to the second server. If both accounting servers are unreachable, accounting records are cached until a server becomes available. If a server cannot be reached before the cache is full, the oldest accounting packets are dropped to make room for the new packets.

Because the configuration of the AAA accounting server is completely independent of the AAA authentication server, you can configure the AAA accounting server to be on the same or different machine from the AAA authentication server.

If you use a syslog server, it is not affected by the AAA configuration and continues to use the existing user interfaces. When the RADIUS server sends AAA accounting information to a syslog server, it is normalized into a single string before being recorded. If no syslog server is defined, the AAA accounting logs are recorded by the syslog server running locally on Cisco Unified SIP Proxy.


Note

Only RADIUS servers are supported.

AAA Accounting Event Logging

AAA accounting logs contain information that enables you to easily:

  • Audit configuration changes.

  • Maintain security.

  • Accurately allocate resources.

  • Determine who should be billed for the use of resources.

You can configure AAA accounting to log the following types of events:

  • Logins—All forms of system access, including access to the CLI and GUI, when a login is required.

  • Logouts—All forms of system access, including access to the CLI and GUI, when a login is required before logout.

  • Failed logins—Failed login attempts for all forms of system access, including access to the CLI and GUI, when a login is required.

  • Configuration mode commands—Any changes made to the Cisco Unified SIP Proxy configuration using any interface such as CLI and GUI.

  • EXEC mode commands—Any commands entered in Cisco Unified SIP Proxy EXEC mode using any interface such as CLI and GUI.

  • System startups—System startups, which include information about the system’s software version, installed licenses, installed packages, installed languages, and so on.

  • System shutdowns—System shutdowns, which include information about the system’s software version, installed licenses, installed packages, installed languages, and so on.

Log Name

Description

login

All forms of system access when a login is required.

logout

All forms of system access when a login is required before logout.

login-fail

Failed login attempts for all forms of system access when a login is required.

config-commands

Any changes made to the system configuration using any interface.

exec-commands

Any commands entered in EXEC mode using any interface.

system-startup

System startups, which include information about the system’s software version, installed licenses, installed packages, installed languages, and so on.

system-shutdown

System shutdowns, which include information about the system’s software version, installed licenses, installed packages, installed languages, and so on.

In addition to information specific to the type of action performed, the accounting logs also indicate the following:

  • User that authored the action

  • Time when the action was executed

  • Time when the accounting record was sent to the server


    Note

    Account logging is not performed during the system power-up playback of the startup configuration. When the system boots up, the startup-config commands are not recorded.

Configuring the AAA Accounting Server

Use this procedure to configure the information used to log into the accounting server.

SUMMARY STEPS

  1. Choose Configure > AAA > Accounting.
  2. Click Accounting Enabled.
  3. Enter the following information in the appropriate field for the primary server, and optionally, for the secondary server:
  4. Click Apply.
  5. Click OK to save your changes.

DETAILED STEPS

Step 1

Choose Configure > AAA > Accounting.

The AAA Accounting Server Configuration window appears.

Step 2

Click Accounting Enabled.

Step 3

Enter the following information in the appropriate field for the primary server, and optionally, for the secondary server:

  • Server IP address or DNS name

  • Port number used

  • Cryptographic shared secret and security credentials

  • Number of login retries

  • Length of login timeout

Step 4

Click Apply.

Step 5

Click OK to save your changes.

Configuring Accounting Event Logging

Use this procedure to configure which event types to log for AAA accounting.

SUMMARY STEPS

  1. Choose Configure > AAA > Accounting.
  2. Select the log events that you want to include in the log and deselect those you do not want to include.
  3. Click Apply to save your changes.

DETAILED STEPS

Step 1

Choose Configure > AAA > Accounting.

The system displays the Accounting Server Configuration window.

Step 2

Select the log events that you want to include in the log and deselect those you do not want to include.

Step 3

Click Apply to save your changes.

Configuring the AAA Accounting Server and Event Logging

Use this procedure to configure the information used to log into the accounting server.

SUMMARY STEPS

  1. Choose Configure > AAA > Accounting.
  2. Enter the following information in the appropriate fields:
  3. Select the log events to include in the log and deselect those to not include.
  4. Click Apply.
  5. Click OK to save your changes.

DETAILED STEPS

Step 1

Choose Configure > AAA > Accounting.

The system displays the Configure AAA Accounting page.

Step 2

Enter the following information in the appropriate fields:

  • If accounting is enabled

  • Number of login retries

  • Length of login timeout, in seconds

  • Server IP address or DNS name for the primary server

  • Port number used for the primary server

  • Password for the primary server

  • Server IP address or DNS name for the secondary server

  • Port number used for the secondary server

  • Password for the secondary server

Step 3

Select the log events to include in the log and deselect those to not include.

Step 4

Click Apply.

Step 5

Click OK to save your changes.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco