Page 3 - iii; C O N T E N T S; Preface; Controlling CSS Access
iii Cisco Content Services Switch Security Configuration Guide OL-5650-02 C O N T E N T S Preface xi Audience xii How to Use This Guide xii Related Documentation xiii Symbols and Conventions xvi Obtaining Documentation xvii Cisco.com xvii Documentation DVD xviii Ordering Documentation xviii Document...
Page 4 - iv; Configuring the Secure Shell Daemon Protocol
Contents iv Cisco Content Services Switch Security Configuration Guide OL-5650-02 Controlling Administrative Access to the CSS 1-10 Enabling Administrative Access to the CSS 1-10 Disabling Administrative Access to the CSS 1-11 Controlling CSS Network Traffic Through Access Control Lists 1-12 ACL Ove...
Page 5 - Configuring the CSS as a Client of a RADIUS Server; Configuring the CSS as a Client of a TACACS+ Server
v Cisco Content Services Switch Security Configuration Guide OL-5650-02 Contents Configuring SSHD in the CSS 2-3 Configuring SSHD Keepalive 2-3 Configuring SSHD Port 2-4 Configuring SSHD Server-Keybits 2-4 Configuring SSHD Version 2-5 Configuring Telnet Access When Using SSHD 2-6 Showing SSHD Config...
Page 6 - Configuring Firewall Load Balancing
Contents vi Cisco Content Services Switch Security Configuration Guide OL-5650-02 Setting the Global TACACS+ Keepalive Frequency 4-7 Defining a TACACS+ Server 4-8 Setting TACACS+ Authorization 4-11 Sending Full CSS Commands to the TACACS+ Server 4-12 Setting TACACS+ Accounting 4-13 Showing TACACS+ S...
Page 7 - vii; F I G U R E S
vii Cisco Content Services Switch Security Configuration Guide OL-5650-02 F I G U R E S Figure 1-1 CSS Directory Access Privileges 1-5 Figure 1-2 ACLs Enabled on the CSS 1-14 Figure 5-1 Example of FWLB 5-9 Figure 5-2 FWLB with VIP/Interface Redundancy Configuration 5-11
Page 8 - viii
Figures viii Cisco Content Services Switch Security Configuration Guide OL-5650-02
Page 9 - ix; T A B L E S
ix Cisco Content Services Switch Security Configuration Guide OL-5650-02 T A B L E S Table 1-1 ACL Configuration Quick Start 1-16 Table 1-2 Clause Command Options 1-21 Table 1-3 Field Descriptions for the show acl Command Output 1-31 Table 1-4 Field Descriptions for the show nql Command Output 1-38 ...
Page 11 - xi
xi Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface This guide provides instructions for configuring the security features of the Cisco 11500 Series Content Services Switches (CSS). Information in this guide applies to all CSS models except where noted . The CSS software...
Page 12 - xii; Audience; How to Use This Guide; Chapter
Preface Audience xii Cisco Content Services Switch Security Configuration Guide OL-5650-02 Audience This guide is intended for the following trained and qualified service personnel who are responsible for configuring the CSS: • Web master • System administrator • System operator How to Use This Guid...
Page 13 - xiii; Related Documentation; Document Title
xiii Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Related Documentation Related Documentation In addition to this guide, the Content Services Switch documentation includes the following publications. Document Title Description Release Note for the Cisco 11500 Series ...
Page 14 - xiv
Preface Related Documentation xiv Cisco Content Services Switch Security Configuration Guide OL-5650-02 Cisco Content Services Switch Administration Guide This guide describes how to perform administrative tasks on the CSS, including upgrading your CSS software and configuring the following: • Loggi...
Page 15 - xv
xv Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Related Documentation Cisco Content Services Switch Content Load-Balancing Configuration Guide This guide describes how to perform CSS content load-balancing configuration tasks, including: • Flow and port mapping • Ser...
Page 16 - xvi; Symbols and Conventions; Bold text
Preface Symbols and Conventions xvi Cisco Content Services Switch Security Configuration Guide OL-5650-02 Symbols and Conventions This guide uses the following symbols and conventions to identify different types of information. Caution A caution means that a specific action you take could cause a lo...
Page 17 - xvii; Obtaining Documentation
xvii Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Obtaining Documentation Courier text indicates text that appears on a command line, including the CLI prompt. Courier bold text indicates commands and text you enter in a command line. Italics text indicates the first...
Page 18 - xviii; Documentation DVD; Documentation Feedback
Preface Documentation Feedback xviii Cisco Content Services Switch Security Configuration Guide OL-5650-02 Documentation DVD Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularl...
Page 19 - xix; Cisco Product Security Overview; Reporting Security Problems in Cisco Products
xix Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Cisco Product Security Overview You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco SystemsAttn: Customer Document Order...
Page 20 - xx; Obtaining Technical Assistance; Cisco Technical Support Website
Preface Obtaining Technical Assistance xx Cisco Content Services Switch Security Configuration Guide OL-5650-02 • Nonemergencies — [email protected] Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive information that you send to Cisco. PSIRT can work...
Page 21 - xxi; Resources; Cisco Product; Cisco Product Identification Tool; Submitting a Service Request
xxi Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Obtaining Technical Assistance Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can r...
Page 22 - xxii; Definitions of Service Request Severity; Obtaining Additional Publications and Information
Preface Obtaining Additional Publications and Information xxii Cisco Content Services Switch Security Configuration Guide OL-5650-02 For a complete list of Cisco TAC contacts, go to this URL: http://www.cisco.com/techsupport/contacts Definitions of Service Request Severity To ensure that all service...
Page 23 - xxiii
xxiii Cisco Content Services Switch Security Configuration Guide OL-5650-02 Preface Obtaining Additional Publications and Information • Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the lates...
Page 24 - xxiv
Preface Obtaining Additional Publications and Information xxiv Cisco Content Services Switch Security Configuration Guide OL-5650-02
Page 26 - admin; password
Chapter 1 Controlling CSS Access Changing the Administrative Username and Password 1-2 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Changing the Administrative Username and Password During the initial log in to the CSS you enter the default user name admin and the default pa...
Page 27 - Creating Usernames and Passwords
1-3 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Creating Usernames and Passwords Creating Usernames and Passwords Logging into the CSS requires a username and password. The CSS supports a maximum of 32 usernames, including the administrator ...
Page 28 - superuser
Chapter 1 Controlling CSS Access Creating Usernames and Passwords 1-4 Cisco Content Services Switch Security Configuration Guide OL-5650-02 • password - Specifies the password is not encrypted. Use this option when you use the CLI to dynamically create users. • password - The password. Enter an unqu...
Page 29 - username; no username
1-5 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Creating Usernames and Passwords • access - Specifies directory access privileges for the username. By default, users have both read- and write-access privileges (B) to all seven directories. E...
Page 30 - Controlling Remote User Access to the CSS; local
Chapter 1 Controlling CSS Access Controlling Remote User Access to the CSS 1-6 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Controlling Remote User Access to the CSS To control access to the CSS, you can configure the CSS to authenticate remote (virtual) or console users. Th...
Page 31 - Configuring Virtual Authentication
1-7 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling Remote User Access to the CSS Configuring Virtual Authentication Virtual authentication allows remote users to log in to the CSS when they are using FTP, Telnet, SSHD, or the Device...
Page 32 - Configuring Console Authentication
Chapter 1 Controlling CSS Access Controlling Remote User Access to the CSS 1-8 Cisco Content Services Switch Security Configuration Guide OL-5650-02 To remove users currently logged in to the CSS, use the disconnect command. To define the TACACS+ server as the primary virtual authentication method, ...
Page 34 - Controlling Administrative Access to the CSS; Enabling Administrative Access to the CSS
Chapter 1 Controlling CSS Access Controlling Administrative Access to the CSS 1-10 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Controlling Administrative Access to the CSS CSS access through a console, FTP, SSH, SNMP, and Telnet is enabled by default. The CSS supports a max...
Page 35 - Disabling Administrative Access to the CSS
1-11 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling Administrative Access to the CSS • no restrict xml - Enables the transfer of XML configuration files to the CSS through unsecure HTTP connections (disabled by default). • no restri...
Page 36 - restrict xml
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-12 Cisco Content Services Switch Security Configuration Guide OL-5650-02 • restrict secure-xml - Disables the transfer of XML configuration files to the CSS through secure HTTPS SSL connections (disabled ...
Page 37 - ACL Overview
1-13 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists • Logging ACL Activity • ACL Example ACL Overview ACLs configured on the CSS provide a basic level of security for accessing your n...
Page 39 - ACL Configuration Quick Start
1-15 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists Enabling ACLs globally affects all traffic on all CSS circuits whether they have ACLs or not. When you enable ACLs, all traffic on ...
Page 40 - Task and Command Example
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-16 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Table 1-1 ACL Configuration Quick Start Task and Command Example 1. Enter global configuration mode. # config (config)# 2. Create a...
Page 41 - Creating an ACL
1-17 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists The following running-config example shows the result of entering the commands in Table 1-1 . !**************************** ACL ***...
Page 42 - acl; Deleting an ACL; no acl
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-18 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Note If a circuit does not have an ACL, the CSS applies an implicit “deny all” clause to this circuit causing the CSS to deny all t...
Page 43 - Configuring Clauses; clause
1-19 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 4. Apply another ACL on the circuit. If you do not apply an ACL on the circuit, the CSS denies traffic on the circuit when you enab...
Page 45 - Parameters
1-21 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists Table 1-2 provides variables and options for the clause command. Bolded syntax defines keywords that you enter on the command line....
Page 48 - sourcegroup; bypass
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-24 Cisco Content Services Switch Security Configuration Guide OL-5650-02 sourcegroup name The source group as the destination for the traffic. Enter the group name. To see a list of source groups, enter: ...
Page 49 - Adding a Clause When ACLs are Globally Enabled; apply circuit; prefer
1-25 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists After you create clauses for an ACL, you can apply the ACL to a circuit. For more information, see the “Applying an ACL to a Circui...
Page 50 - Deleting a Clause; no clause
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-26 Cisco Content Services Switch Security Configuration Guide OL-5650-02 For example, you apply ACL 7 to VLAN1 and then globally enable ACLs on the CSS. At a later time, to add a new clause to ACL 7 and t...
Page 51 - Applying an ACL to a Circuit or DNS Queries
1-27 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists Note When you remove an applied ACL from the circuit, the CSS applies an implicit “deny all” clause to this circuit causing the CSS...
Page 52 - Removing an ACL from Circuits or DNS Queries
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-28 Cisco Content Services Switch Security Configuration Guide OL-5650-02 However, if you configure a CSS with the dns-server command, and the CSS receives a DNS query for a domain name that you configured...
Page 53 - Enabling ACLs on the CSS
1-29 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 2. In ACL mode, remove the ACL from the circuit. (config-acl[7])# remove circuit-(VLAN1) 3. Make any changes to the ACL. If you del...
Page 54 - Disabling ACLs on the CSS; Showing ACLs
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-30 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Use the global configuration acl enable command to enable all ACLs on the CSS. To globally enable all ACLs, enter: (config)# acl en...
Page 55 - DNS Hits; show acl config; show acl; Field
1-31 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists • DNS Hits - Packets that match an ACL clause for DNS flows when an ACL clause is applied to DNS queries. The display includes a DN...
Page 56 - Setting the Show ACL Counters to Zero
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-32 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Setting the Show ACL Counters to Zero Use the zero counts command to reset the content and DNS hit counters in the show acl command...
Page 57 - log enable
1-33 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists To enable logging on an existing ACL clause, use the log enable option for the clause command and enter: (config-acl[7])# clause 1 ...
Page 58 - ACL Example
Chapter 1 Controlling CSS Access Controlling CSS Network Traffic Through Access Control Lists 1-34 Cisco Content Services Switch Security Configuration Guide OL-5650-02 5. Reapply the ACL to the circuit. (config-acl[7])# apply circuit-(VLAN1) 6. In global configuration mode, reenable all ACLs on the...
Page 59 - Configuring Network Qualifier Lists for ACLs; nql
1-35 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Configuring Network Qualifier Lists for ACLs !**************************** ACL *************************** acl 1 clause 20 permit any 172.16.107.0 255.255.255.0 destination 172.16.107.15 claus...
Page 60 - no nql; Describing an NQL; Adding Networks to an NQL; ip address; log
Chapter 1 Controlling CSS Access Configuring Network Qualifier Lists for ACLs 1-36 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Creating an NQL Enter the name of the new NQL you want to create or an existing NQL. Enter the name as an unquoted text string with no spaces and a...
Page 61 - no ip address
1-37 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 1 Controlling CSS Access Configuring Network Qualifier Lists for ACLs The variables and options are: • ip_address - The destination network address. Enter the IP address in dotted-decimal notation (for example, 192.16...
Page 62 - Adding an NQL to an ACL Clause; Showing NQL Configurations; show nql
Chapter 1 Controlling CSS Access Configuring Network Qualifier Lists for ACLs 1-38 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Adding an NQL to an ACL Clause To add an NQL to an ACL clause: 1. Create the ACL. For example, enter: (config)# acl 10 2. Define the clause, includ...
Page 64 - Enabling SSH
Chapter 2 Configuring the Secure Shell Daemon Protocol Enabling SSH 2-2 Cisco Content Services Switch Security Configuration Guide OL-5650-02 This chapter contains the following major sections: • Enabling SSH • Configuring SSH Access • Configuring SSHD in the CSS • Configuring Telnet Access When Usi...
Page 65 - Configuring SSH Access; Configuring SSHD in the CSS; Configuring SSHD Keepalive
2-3 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 2 Configuring the Secure Shell Daemon Protocol Configuring SSH Access Configuring SSH Access SSH access to the CSS is enabled by default through the no restrict ssh command. You can verify the SSH access selection in t...
Page 66 - Configuring SSHD Port; sshd port; Configuring SSHD Server-Keybits; sshd
Chapter 2 Configuring the Secure Shell Daemon Protocol Configuring SSHD in the CSS 2-4 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Use the sshd keepalive command to enable SSHD keepalive. SSHD keepalive is enabled by default. To enable sending SSHD keepalives to the client,...
Page 67 - Configuring SSHD Version; sshd version
2-5 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 2 Configuring the Secure Shell Daemon Protocol Configuring SSHD in the CSS Note The valid range for this command is 512 to 1024. However, to maintain backward compatibility with version 5.00, the CSS allows you to ente...
Page 68 - Configuring Telnet Access When Using SSHD; Showing SSHD Configurations; show sshd; show sshd config
Chapter 2 Configuring the Secure Shell Daemon Protocol Configuring Telnet Access When Using SSHD 2-6 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Configuring Telnet Access When Using SSHD By default, Telnet access to the CSS is enabled. When you use SSHD, you can disable non...
Page 72 - virtual authentication; console authentication
Chapter 3 Configuring the CSS as a Client of a RADIUS Server 3-2 Cisco Content Services Switch Security Configuration Guide OL-5650-02 In a configuration where both a primary RADIUS server and a secondary RADIUS server are specified, and one or both of the RADIUS servers become unreachable, the CSS ...
Page 73 - radius-server secondary
3-3 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 3 Configuring the CSS as a Client of a RADIUS Server RADIUS Configuration Quick Start RADIUS Configuration Quick Start Table 3-1 provides a quick overview of the steps required to configure the RADIUS feature on a CSS....
Page 74 - Configuring a RADIUS Server for Use with the CSS; show radius
Chapter 3 Configuring the CSS as a Client of a RADIUS Server Configuring a RADIUS Server for Use with the CSS 3-4 Cisco Content Services Switch Security Configuration Guide OL-5650-02 The following running-configuration example shows the results of entering the commands in Table 3-1 . !*************...
Page 75 - Configuring Authentication Settings; Administrative
3-5 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 3 Configuring the CSS as a Client of a RADIUS Server Configuring a RADIUS Server for Use with the CSS Configuring Authentication Settings To configure the authentication settings on Cisco Secure ACS, go to the Network ...
Page 76 - Specifying a Primary RADIUS Server
Chapter 3 Configuring the CSS as a Client of a RADIUS Server Specifying a Primary RADIUS Server 3-6 Cisco Content Services Switch Security Configuration Guide OL-5650-02 To add a user to a group, go to the User Setup section of the Cisco Secure ACS HTML interface: • On the User Setup Select page, sp...
Page 77 - Specifying a Secondary RADIUS Server; secondary
3-7 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 3 Configuring the CSS as a Client of a RADIUS Server Specifying a Secondary RADIUS Server To remove a primary RADIUS server, enter: (config)# no radius-server primary Specifying a Secondary RADIUS Server The CSS direct...
Page 78 - Configuring the RADIUS Server Timeouts; radius-server timeout; Configuring the RADIUS Server Retransmits; radius-server retransmit
Chapter 3 Configuring the CSS as a Client of a RADIUS Server Configuring the RADIUS Server Timeouts 3-8 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Configuring the RADIUS Server Timeouts By default, the CSS waits 10 seconds for the RADIUS server (primary or secondary) to re...
Page 79 - Configuring the RADIUS Server Dead-Time
3-9 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 3 Configuring the CSS as a Client of a RADIUS Server Configuring the RADIUS Server Dead-Time To reset the RADIUS server retransmit request to the default of 3 retransmissions, enter: (config)# no radius-server retransm...
Page 80 - show radius config
Chapter 3 Configuring the CSS as a Client of a RADIUS Server Showing RADIUS Server Configuration Information 3-10 Cisco Content Services Switch Security Configuration Guide OL-5650-02 To view the authentication statistics for a RADIUS secondary server, enter: (config)# show radius statistics seconda...
Page 81 - show radius statistics
3-11 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 3 Configuring the CSS as a Client of a RADIUS Server Showing RADIUS Server Configuration Information Table 3-3 describes the fields in the show radius statistics output. Table 3-3 Field Descriptions for the show radiu...
Page 86 - Configuring Authorization Settings
Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Configuring TACACS+ Server User Accounts for Use with the CSS 4-4 Cisco Content Services Switch Security Configuration Guide OL-5650-02 • Key - Enter the shared secret that the CSS and Cisco Secure ACS use to authenticate transactions. Fo...
Page 87 - Configuring Global TACACS+ Attributes
4-5 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Configuring Global TACACS+ Attributes 4. Proceed next to Unmatched Commands, either permit or deny execution of the privilege command: • For a user that has SuperUs...
Page 88 - virtual; console; tacacs-server timeout
Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Configuring Global TACACS+ Attributes 4-6 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Note The timeout, encryption key, or keepalive frequency that you define when you configure a TACACS+ server overrides the glo...
Page 89 - Defining a Global Encryption Key; Setting the Global TACACS+ Keepalive Frequency
4-7 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Configuring Global TACACS+ Attributes Defining a Global Encryption Key The CSS allows you to define a global encryption key for communications with all configured T...
Page 90 - frequency; tacacs-server frequency; Defining a TACACS+ Server
Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Defining a TACACS+ Server 4-8 Cisco Content Services Switch Security Configuration Guide OL-5650-02 When it sends a keepalive to the TACACS+ server, the CSS attempts to use a persistent connection with the server. If the server is not con...
Page 91 - primary
4-9 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Defining a TACACS+ Server Note For general guidelines on the recommended setup of a TACACS+ server (the Cisco Secure Access Control Server in this example), see the...
Page 93 - Setting TACACS+ Authorization
4-11 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Setting TACACS+ Authorization Setting TACACS+ Authorization TACACS+ authorization allows the TACACS+ server to control specific CSS commands that the user can exec...
Page 94 - Sending Full CSS Commands to the TACACS+ Server
Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Sending Full CSS Commands to the TACACS+ Server 4-12 Cisco Content Services Switch Security Configuration Guide OL-5650-02 In releases prior to 7.30.1.05, if you transitioned from one CLI mode to another (for example, from config mode to ...
Page 95 - Setting TACACS+ Accounting
4-13 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Setting TACACS+ Accounting To reenable the CSS to send the full command syntax, use the tacacs-server send-full-command command. For example: #(config) tacacs-serv...
Page 96 - Showing TACACS+ Server Configuration Information
Chapter 4 Configuring the CSS as a Client of a TACACS+ Server Showing TACACS+ Server Configuration Information 4-14 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Showing TACACS+ Server Configuration Information Use the show tacacs-server command to display the TACACS+ server ...
Page 100 - Overview of FWLB
Chapter 5 Configuring Firewall Load Balancing Overview of FWLB 5-2 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Overview of FWLB FWLB enables you to configure a maximum of 15 firewalls per CSS. Configuring multiple firewalls can overcome performance limitations and remove th...
Page 101 - Firewall Synchronization; Configuring FWLB
5-3 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Configuring FWLB Firewall Synchronization Firewall solutions providing Stateful Inspection, such as Check Point ™ FireWall-1 ® , create and maintain virtual state for all connectio...
Page 102 - ip firewall; Configuring a Keepalive Timeout for a Firewall
Chapter 5 Configuring Firewall Load Balancing Configuring FWLB 5-4 Cisco Content Services Switch Security Configuration Guide OL-5650-02 You must define firewall parameters for each path through the firewalls on both local and remote CSSs. Use the ip firewall command to define firewall parameters. T...
Page 103 - Configuring an IP Static Route for a Firewall
5-5 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Configuring FWLB Use the ip firewall timeout number command to specify the number of seconds the CSS will wait to receive a keepalive message from the remote CSS before declaring t...
Page 104 - Configuring OSPF to Advertise Firewall Routes; ospf; Enter a; tag
Chapter 5 Configuring Firewall Load Balancing Configuring FWLB 5-6 Cisco Content Services Switch Security Configuration Guide OL-5650-02 • index - An existing index number for the firewall route. For information on configuring a firewall index, see the ip firewall command. • distance - The optional ...
Page 105 - Configuring RIP to Advertise Firewall Routes; rip; Example of FWLB Static Route Configuration
5-7 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Configuring FWLB To stop advertising firewall routes, enter: (config)# no ospf redistribute firewall Configuring RIP to Advertise Firewall Routes To advertise firewall routes from ...
Page 111 - Example of Firewall and Route Configurations; ip
5-13 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Configuring FWLB with VIP and Virtual Interface Redundancy Example of Firewall and Route Configurations The following ip firewall and ip route example configurations are valid for...
Page 113 - Displaying Firewall Flow Summaries; show flows
5-15 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Displaying Firewall Flow Summaries Displaying Firewall Flow Summaries Use the show flows command to display the flow summary for a source IP address, or for a specific source addr...
Page 114 - Displaying Firewall IP Routes; show; show ip routes firewall
Chapter 5 Configuring Firewall Load Balancing Displaying Firewall IP Routes 5-16 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Table 5-1 describes the fields in the show flows output. Displaying Firewall IP Routes Use the show ip routes firewall command to display all static ...
Page 115 - Displaying Firewall IP Information; show ip routes
5-17 Cisco Content Services Switch Security Configuration Guide OL-5650-02 Chapter 5 Configuring Firewall Load Balancing Displaying Firewall IP Information Displaying Firewall IP Information Use the show ip firewall command to display the configured values of the IP firewall keepalive timeout and th...
Page 117 - I N D E X
IN-1 Cisco Content Services Switch Security Configuration Guide OL-5650-02 I N D E X A Access Control Lists. See ACLs ACLs adding an NQL to a clause 1-38 applying to a circuit 1-27 clause number 1-19 configuration example 1-34 configuring 1-15 configuring clauses 1-19 creating 1-17 definition 1-13 d...
