-
Cisco MDS 9000 Family Fabric Manager Configuration Guide, Release 1.3 (from Release 1.3(1) through Release 1.3(6))
-
Index
-
New and Changed Information
-
Preface
-
Product Overview
-
Getting Started with Cisco Fabric Manager
-
Overview of Fabric Manager Components
-
Before You Begin
-
Obtaining and Installing Licenses
-
Initial Configuration
-
Configuring High Availability
-
Software Images
-
Managing Modules
-
Managing System Hardware
-
Configuring and Managing VSANs
-
Configuring Interfaces
-
Configuring Trunking
-
Configuring PortChannels
-
Configuring and Managing Zones
-
Configuring Inter-VSAN Routing
-
Managing FLOGI, Name Server, FDMI, and RSCN Databases
-
Configuring Switch Security
-
Configuring Fabric Security
-
Configuring Port Security
-
Configuring Fibre Channel Routing Services and Protocols
-
Configuring IP Services
-
Configuring FICON
-
Configuring IP Storage
-
Configuring Call Home
-
Configuring Domain Parameters
-
Configuring Traffic Management
-
Configuring System Message Logging
-
Discovering SCSI Targets
-
Monitoring Network Traffic Using SPAN
-
Advanced Features and Concepts
-
Configuring Fabric Configuration Servers
-
Monitoring System Processes and Logs
-
Troubleshooting the Fabric
-
Troubleshooting Fabric Manager Issues
-
Feedback
Table Of Contents
Remote Authentication by AAA Servers
Remote Authentication Guidelines
AAA Service Configuration Options
Configuring RADIUS Authentication
Setting the RADIUS Server Address
Setting the RADIUS Preshared Key
Setting Iterations of the RADIUS Server
Defining Vendor-Specific Attributes
Setting the TACACS+ Server Address
Defining Custom Attributes for Roles
Authentication and Authorization Process
Configuring Role-Based CLI Authorization
Configuring Rules and Features for Each Role
Recovering Administrator Password
Generating an SSH Host Key Pair
Configuring and Creating SNMP User Roles
Viewing SNMP Community and User Information
Editing Common Role Rules (Device Manager Only)
Configuring Switch Security
The authentication, authorization, and accounting (AAA) strategy is used to verify identity of, grant access, and track the actions of remote users in all switches in the Cisco MDS 9000 Family. The Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) provide AAA solutions.
Based on the user ID and password combination provided, switches perform local authentication using a local database or remote authentication using AAA server(s). A global, preshared, secret key authenticates communication between the AAA servers. This secret key can be configured for all AAA server groups or for only a specific AAA server. This kind of authentication provides a central configuration management capability.
This chapter contains the following topics:
•
Authentication and Authorization Process
•
•
Switch Management Security
Management security in any switch in the Cisco MDS 9000 Family is implemented using the Command-line interface (CLI) or Simple Network Management Protocol (SNMP).
SNMP Security
The SNMP agent supports security features for SNMPv1, SNMPv2c, and SNMPv3. Normal SNMP security mechanisms apply to all applications that use SNMP (for example, Cisco MDS 9000 Fabric Manager).
Users and roles configured through the CLI are different from users and roles configured through SNMP. These configurations do not directly correspond with each other. However, you can configure both CLI and SNMP identically, if required.
CLI Security
You can access the CLI using the Console (serial connection), Telnet, or Secure Shell (SSH). For each management path (console or Telnet and SSH), you can configure one or more of the following security control options: local, remote (RADIUS or TACACS+), or none.
•
–
–
•
•
These authentication mechanisms can also be used to configure AAA for the following scenarios:
•
•
Switch AAA Functionalities
Using CLI, you can configure Authentication, Authorization, and Accounting (AAA) switch functionalities on any switch in the Cisco MDS 9000 Family.
This section contains the following topics:
•
•
•
Authentication
Authentication is the process of verifying the identity of the person managing the switch. This identity verification is based on the user ID and password combination provided by the person trying to manage the switch. Cisco MDS 9000 Family switches allow you to perform local authentication (using the lookup database) or remote authentication (using one or more RADIUS or TACACS+ servers).
Authorization
By default, two roles exist in all switches:
•
•
The two default roles cannot be changed or deleted. You can create additional roles and configure the following options:
•
•
Accounting
Accounting refers to the log that is kept for each management session in a switch. This information may be used to generate reports for troubleshooting purposes and user accountability. Accounting can be implemented locally and remotely.
Remote Authentication by AAA Servers
AAA authentication provides the following advantages over local database authentication:
•
•
•
Remote Authentication Guidelines
When you prefer using remote C servers, follow these guidelines:
•
•
•
•
Server Groups
You can specify remote AAA servers for authentication, authorization and accounting using server groups. A server group consists of remote AAA servers implementing the same AAA protocol. The purpose of a server group is to provide for fail-over servers in case a remote AAA server fails to response. If the first remote server in the group fails to respond, the next remote server in the group is tried until one of the servers sends a response. If all the AAA servers in the server group fails to respond, then that server group option is considered a failure. You can create a server group using the aaa group server command.
If required, you can specify multiple server groups. If the MDS switch encounters errors from the server(s) in the first group, it tries the servers in next server group.
AAA Service Configuration Options
AAA configuration in Cisco MDS switches is service based. You can have separate AAA configurations for following services:
•
•
•
In general, server group, local, and none are the three options that can be specified for any service in an AAA configuration. Each option will be tried in the order specified. If all the methods fail, local is tried
Even if local is not specified as one of the options, it is tried when all other configured options fail.
Configuring RADIUS
Cisco MDS switches use the RADIUS protocol to communicate with remote AAA servers. You can configure multiple RADIUS servers and set timeout and retry counts.
This section defines the RADIUS operation, identifies its network environments, and describes its configuration possibilities.
This section contains the following topics:
•
•
•
•
•
About RADIUS
RADIUS is a distributed client/server system that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco MDS switches and send authentication requests to a central RADIUS server that contains all user authentication and network service access information.
RADIUS is a fully open protocol, distributed in source code format, that can be modified to work with any security system currently available on the market.
You can set the RADIUS server address, the RADIUS preshared key, the RADIUS server time-out interval, iterations of the RADIUS server, define vendor-specific attributes, and display RADIUS server details.
Configuring RADIUS Authentication
To configure RADIUS authentication from the Fabric Manager, choose Security > Radius from the menu tree.
To configure RADIUS authentication from the Device Manager, choose Security > Radius (CLI).
Configuring RADIUS Servers
To configure RADIUS servers, perform the following steps:
Step 1
To configure RADIUS servers from the Fabric Manager, choose Security > Radius from the menu tree and click the Servers tab. You see the Radius information in the Information pane.
Step 2
You see the Create Radius Server dialog box.(In Fabric Manager, you can specify the switches to which the configuration applies.)
Step 3
Setting the RADIUS Server Address
You can add up to 64 RADIUS servers. RADIUS keys are always stored in encrypted form in persistent storage. The running configuration also displays encrypted keys. From Fabric Manager, choose Switches > Security > Radius > Servers to set RADIUS server addresses.
Setting the RADIUS Preshared Key
You need to configure the RADIUS preshared key to authenticate the switch to the RADIUS server. The length of the key is restricted to 65 characters and can include any printable ASCII characters (white spaces are not allowed). You can configure a global key to be used for all RADIUS server configurations on the switch. From Fabric Manager, choose Switches > Security > Radius and click the Defaults tab to override this global key assignment.
Setting Iterations of the RADIUS Server
By default, a switch retries a RADIUS server connection only once. This number can be configured. The maximum is five retries per server. You can revert the retry number to its default. From Fabric Manager, choose Switches > Security > Radius > Defaults.
Defining Vendor-Specific Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific attributes (VSAs) between the network access server and the RADIUS server. The IETF uses attribute 26. VSAs allow vendors to support their own extended attributes that are not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. The Cisco vendor ID is 9, and the supported option is vendor type 1, which is named cisco-avpair. The value is a string with the following format:
protocol : attribute sep value *where
•
•
When you use RADIUS servers to authenticate yourself to a Cisco MDS 9000 Family switch, the RADIUS protocol directs the RADIUS server to return user attributes, like authorization information, along with authentication results. This authorization information is specified through VSAs.
VSA Format
The following VSA protocol options are supported:
•
•
The following attributes are supported:
•
Cisco-AVPair = shell:roles="network-admin vsan-admin"•
Configuring TACACS+
A Cisco MDS switch uses the Terminal Access Controller Access Control System plus (TACACS+) protocol to communicate with remote AAA servers. You can configure multiple TACACS+ servers and set timeout values.
This section contains the following topics:
•
•
About TACACS+
TACACS+ is a client-server protocol which uses TCP (TCP port 49) for transport requirements. All switches in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+ protocol. The addition of TACACS+ support in SAN-OS 1.3(x) enables the following advantages over RADIUS authentication:
•
•
•
•
Advantages of TACACS+
This section provides a brief list of advantages that TACACS+ has over and RADIUS.
•
•
•
•
•
•
•
Enabling TACACS+
By default, the TACACS+ feature is disabled in all switches in the Cisco MDS 9000 Family. You must explicitly enable the TACACS+ feature to access the configuration and verification commands for fabric authentication. When you disable this feature, all related configurations are automatically discarded.
Setting the TACACS+ Server Address
If a secret key is not configured for a configured server, a warning message is issued and the global secret encryption key is automatically used.
Setting the Secret Key
From Fabric Manager, choose Switches > Security > TACACS+ > Defaults to configure global values for the key for all TACACS+ servers.
Secret keys configured for individual servers override the globally configured values.
Setting the Timeout Value
From Fabric Manager, choose Switches > Security > TACACS+ > Defaults to configure global timeout values for all TACACS+ servers.
Timeout values configured for individual servers override the globally configured values.
Defining Custom Attributes for Roles
MDS uses TACACS+ custom attribute for service shell to configure the roles to which a user belongs. TACACS+ attributes are specified as name=value format. The attribute name for this custom attribute is cisco-av-pair. The following example illustrates how to specify roles using this attribute:
cisco-av-pair=shell:roles="network-admin vsan-admin"TACACS+ custom attributes can be defined on an ACS server for various services (for example, shell). MDS requires the TACACS+ custom attribute for service shell to be used for defining roles.
Configuring Server Groups
You can specify one or more remote AAA servers to authenticate users using server groups. All members of a group must belong to the same protocol: either RADIUS or TACACS+. The servers are tried in the same order in which you configure them.
You can configure these server groups at any time but they only take effect when you apply them to a AAA service. From Fabric Manager, choose Switches > Security > AAA > Server Groups.
You can specify one or more remote AAA servers to authenticate users using server groups.
Local AAA
The system maintains the user name and password locally and stores the password information in encrypted form. You are authenticated based on the locally stored user information.
Authentication and Authorization Process
Authentication is the process of verifying the identity of the person managing the switch. This identity verification is based on the user ID and password combination provided by the person trying to manage the switch. The Cisco MDS 9000 Family switches allow you to perform local authentication (using the lookup database) or remote authentication (using one or more RADIUS servers or TACACS+ servers).
The following steps explain the authorization and authentication process. shows a flow chart of the process.
Figure 18-1 Switch Authorization and Authentication Flow
Step 1
Step 2
•
•
•
Step 3
•
•
•
Step 4
Configuring Role-Based CLI Authorization
Switches in the Cisco MDS 9000 Family perform authentication based on roles. Role-based authorization limits access to switch operations by assigning users to roles. This kind of authentication restricts you to management operations based on the roles to which you have been added.
When you execute a command, perform command completion, or obtain context sensitive help, the switch software allows the operation to progress if you have permission to access that command.
Each role can contain multiple users and each user can be part of multiple roles. For example, if role1 users are only allowed to perform configuration commands, and role2 users are only allowed to perform debug commands, then if Joe belongs to both role1 and role2, he can perform configuration as well as debug commands.
If you belong to multiple roles, you can execute a superset of all the commands permitted by these roles. Access to a command takes priority over being denied access to a command. For example, suppose you belong to a TechDocs group and you were denied access to configuration commands. However, you also belong to the engineering group and have access to configuration commands. In this case, you will have access to configuration commands.
Tip
Configuring Rules and Features for Each Role
A rule specifies operations that can be performed by a specific role. Each rule consists of a command type (for example, config, clear, show, exec, debug), and an optional feature name (for example, FSPF, zone, VSAN, fcping, interface).
Configuring the VSAN Policy
Configuring the VSAN policy requires the ENTERPRISE_PKG license.
You can configure a role so that it only allows commands to be performed for a selected set of VSANs. By default, the VSAN policy for any role is permit. In other words, the role can perform commands configured by the rule in all VSANs. In order to selectively allow VSANs for a role, the VSAN policy needs to be set to deny and then the appropriate VSANs need to be permitted.
Users configured in roles where the VSAN policy set to deny cannot modify configuration for E ports. They can only modify configuration for F or FL ports (depending on whether the configured rules allow such configuration to be made). This is to prevent such users from modifying configurations that may impact the core topology of the fabric.
Tip
Users belonging to roles in which the VSAN policy is set to deny are referred to as VSAN-restricted users. These users cannot perform the following functions that require the startup configuration to be viewed or modified:
•
•
•
•
•
For information on these commands, refer to the Cisco MDS 9000 Family Command Reference.
Recovering Administrator Password
An administrator can recover a password from a local console connection.
The password recovery procedure must be performed on the supervisor module that becomes the active supervisor module after the recovery procedure is completed. To ensure the other supervisor module does not become the active module, you have two options:
Password recovery is not possible from a Telnet or SSH session.
To recover a administrator password, refer to the Cisco MDS 9000 Family Command Reference.
Configuring SSH Services
The Telnet service is enabled by default on all Cisco MDS 9000 Family switches. Before enabling the SSH service, generate a host key pair.
Enabling SSH Service
By default, the SSH service is disabled.
Generating an SSH Host Key Pair
Be sure to have an SSH host key pair with the appropriate version before enabling the SSH service. The SSH service accepts three types of key pairs for use by SSH versions 1 and 2. Generate the SSH host key pair according to the SSH client version used. The number of bits specified for each key pair ranges from 768 to 2048.
•
•
•
Using the force Option
If the SSH key pair option is already generated for the required version, use the force option to overwrite the previously generated key pair.
About SNMP Security
SNMP is an application layer protocol that facilitates the exchange of management information between network devices. In all Cisco MDS 9000 Family switches, three SNMP versions are available: SNMPv1, SNMPv2c, and SNMPv3. (See Figure 18-2.)
Figure 18-2 SNMP Security
Users and roles configured through the CLI are different from users and roles configured through SNMP. These configurations do not directly correspond with each other. However, you can configure both CLI and SNMP identically, if required. See the "Creating Common Roles" section for additional information.
SNMP users are different from CLI users. SNMP users also have role-based authentication for roles and authorization purposes.
SNMP Version 1 and Version 2c
SNMPv1 and SNMPv2c use a community string match for user authentication. Community strings provided a weak form of access control in earlier versions of SNMP. SNMPv3 provides much improved access control using strong authentication and should be preferred over SNMPv1 and SNMPv2c wherever it is supported.
Adding a Community String
To add a community string, follows these steps:
Step 1
From Device Manager, choose SNMP > Security and click the Communities tab.
Step 2
The Create Community string dialog box displays. (The dialog box from Fabric Manager also provides check boxes to specify one or more switches.)
Step 3
Step 4
Step 5
Deleting a Community String
To delete a community string, follows these steps:
Step 1
From Device Manager, choose SNMP > Security and click the Communities tab.
Step 2
Step 3
SNMP Version 3
SNMPv3 is an interoperable standards-based protocol for network management. SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over the network. The security features provided in SNMPv3 are:
•
•
•
SNMPv3 provides for both security models and security levels. A security model is an authentication strategy that is set up for a user and the role in which the user resides. A security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is employed when handling an SNMP packet.
Adding SNMP Users
To add SNMP users, follows these steps:
Step 1
From Device Manager, choose SNMP > Security and click the Users tab.
Step 2
The Create Users dialog box displays. (The dialog box from Fabric Manager also provides check boxes to specify one or more switches.)
Step 3
Step 4
Step 5
Step 6
Enter the authentication password in the Clone Password field to use the same password. Enter a new password twice in the New Password and Confirm Password fields.
Step 7
Deleting SNMP Users
To delete SNMP users, follows these steps:
Step 1
From Device Manager, choose SNMP > Security and click the Users tab.
Step 2
Step 3
Configuring and Creating SNMP User Roles
To configure users roles, choose Security > SNMP from Device Manager, and click the Roles tab.
To create a new role, follow these steps:
Step 1
Step 2
Step 3
•
•
Step 4
Step 5
Step 6
Viewing SNMP Community and User Information
To view information about SNMP users, roles, and communities from Fabric Manager, choose Security > SNMP from the Physical pane menu tree and click the Users, Roles, or Communities tab. You see the list of SNMP users, roles, or communities in the Information pane.
To view this information from the Device Manager, choose Security > SNMP. The SNMP dialog box displays.
Group-Based SNMP Access
Because group is a standard SNMP term used industry-wide, we refer to role(s) as group(s) in this SNMP section.
SNMP access rights are organized by groups. Each group in SNMP is similar to a role through the CLI. Each group is defined with three accesses: read access, write access, and notification access. Each access can be enabled or disabled within each group.
You can begin communicating with the agent once the your user name is created, your roles are set up by your administrator, and you are added to the roles.
Users configured through the CLI are different from users configured through SNMP. These configurations do not directly correspond with each other. However, you can configure both CLI and SNMP identically, if required.
Configuring Common Roles
From Release 1.2(x), CLI and SNMP in all switches in the Cisco MDS 9000 Family use common roles. You can use SNMP to modify a role that was created using CLI and vice versa.
Figure 18-3 Common Roles
Each role in SNMP is the same as a role created or modified through the CLI. Common Roles allow you to use a set of rules to set the scope of VSAN security. Each role can be restricted to one or more VSANs as required.
You can create new roles or modify existing roles using SNMP or the CLI.
To configure Common Roles from the Device Manager, choose Common Roles from the Security menu. You can then access the Rules dialog box to configure the set of rules. To configure Common Roles from Fabric Manager, choose Security > SNMP and click the Roles tab in the Information pane. Fabric Manager uses a default rules set for roles; therefore, no Rules dialog box is displayed.
See the "Creating Common Roles" section for additional information.
Creating and Modifying Users
You can create users or modify existing users using SNMP or the CLI.
•
You must explicitly configure password(s) for SNMP users. The SNMP user passwords are not generated as the part of the configuration file as they are not portable across devices. The password is limited to a minimum of 8 characters and a maximum of 64 characters.
An SNMP user must be created on each switch to which the user requires access. If the user is managing 10 switches, each of the 10 switches must have the SNMP user defined.
•
By default, only two roles are available in a Cisco MDS 9000 Family switch—network-operator and network-admin. You can also use any role that is configured in the Common Roles database.
Creating Common Roles
To create a common role in Fabric Manager, perform the following steps:
Step 1
Step 2
The Roles -> Create dialog box displays.
Step 3
Step 4
Step 5
Step 6
If you check the check box, your role will have read, write, and create permission. If you do not check the check box, your role will have read-only permission.
Step 7
Step 8
Step 9
To create a common role in Device Manager, perform the following steps:
Step 1
Step 2
The Create Common Roles dialog box displays.
Step 3
Step 4
Step 5
Step 6
Step 7
The Rules dialog may take a few minutes to display.
Step 8
Editing Common Role Rules (Device Manager Only)
To edit the rules for a common role, perform the following steps:
Step 1
The Common Roles dialog box displays.
Step 2
Step 3
The Rules dialog may take a few minutes to display.
Step 4
Step 5
Step 6
Deleting Common Roles
To delete a common role, perform the following steps:
Step 1
From Fabric Manager, choose Security > SNMP from the Physical pane menu tree, and click the Roles tab in the Information pane.
Step 2
Step 3
Assigning Users to Roles
Once the user and the role are created, the administrator should configure an entry in the vacmSecurityToGroupTable to add the configured user to a configured role.
•
•
Default Security Settings
Table 18-1 lists the default settings for all security features in any switch.
Restricting Switch Access
You can restrict access to a Cisco MDS 9000 Family switch using IP Access Control Lists (IP-ACLs).
