Users Guide

Conguring an EdgePort...............................................................................................................................................887
Conguring Fast Hellos for Link State Detection.......................................................................................................887
50 Security...................................................................................................................................................889
Role-Based Access Control..........................................................................................................................................889
Overview of RBAC.................................................................................................................................................. 890
User Roles.................................................................................................................................................................892
AAA Authentication and Authorization for Roles................................................................................................ 895
Role Accounting.......................................................................................................................................................898
Display Information About User Roles...................................................................................................................899
AAA Accounting............................................................................................................................................................ 900
Conguration Task List for AAA Accounting........................................................................................................900
AAA Authentication.......................................................................................................................................................902
Conguration Task List for AAA Authentication.................................................................................................. 902
AAA Authorization.........................................................................................................................................................906
Privilege Levels Overview.......................................................................................................................................906
Conguration Task List for Privilege Levels..........................................................................................................906
RADIUS.............................................................................................................................................................................911
RADIUS Authentication and Authorization............................................................................................................ 911
Conguration Task List for RADIUS....................................................................................................................... 912
Support for Change of Authorization and Disconnect Messages packets....................................................... 916
TACACS+........................................................................................................................................................................925
Conguration Task List for TACACS+...................................................................................................................925
TACACS+ Remote Authentication and Authorization......................................................................................... 927
Command Authorization.........................................................................................................................................928
Protection from TCP Tiny and Overlapping Fragment Attacks............................................................................... 928
Enabling SCP and SSH................................................................................................................................................. 928
Using SCP with SSH to Copy a Software Image................................................................................................ 929
Removing the RSA Host Keys and Zeroizing Storage ....................................................................................... 930
Conguring When to Re-generate an SSH Key ..................................................................................................930
Conguring the SSH Server Cipher List................................................................................................................931
Conguring DNS in the SSH Server...................................................................................................................... 931
Conguring the HMAC Algorithm for the SSH Server....................................................................................... 932
Conguring the HMAC Algorithm for the SSH Client.........................................................................................932
Conguring the SSH Server Cipher List...............................................................................................................933
Conguring the SSH Client Cipher List................................................................................................................ 933
Secure Shell Authentication................................................................................................................................... 934
Troubleshooting SSH...............................................................................................................................................936
Telnet............................................................................................................................................................................... 937
VTY Line and Access-Class Conguration..................................................................................................................937
VTY Line Local Authentication and Authorization............................................................................................... 937
VTY Line Remote Authentication and Authorization...........................................................................................938
VTY MAC-SA Filter Support.................................................................................................................................. 938
Two Factor Authentication (2FA)................................................................................................................................ 939
Handling Access-Challenge Message................................................................................................................... 939
Conguring Challenge Response Authentication for SSHv2............................................................................. 939
28
Contents