Implementing Secure Converged Wide Area Networks (ISCW)

1. Implementing Secure Converged Wide Area Networks (ISCW)

2. Configuring Role-Based CLI Lesson 6 – Module 5 – ‘Cisco Device Hardening’

3. Module Introduction • The open nature of the Internet makes it increasingly important for businesses to pay attention to the security of their networks. As organisations move more of their business functions to the public network, they need to take precautions to ensure that attackers do not compromise their data, or that the data does not end up being accessed by the wrong people. • Unauthorised network access by an outside hacker or disgruntled employee can wreak havoc with proprietary data, negatively affect company productivity, and stunt the ability to compete. • Unauthorised network access can also harm relationships with customers and business partners who may question the ability of companies to protect their confidential information, as well as lead to potentially damaging and expensive legal actions.

4. Objectives • At the completion of this sixth lesson, you will be able to: • Describe and configure role based CLI on IOS routers • Configure CLI views and ‘Superviews’ • Describe the use of secure configuration files

5. Role-Based CLI Overview • Although users can control CLI access via both privilege levels and enable mode passwords, these functions do not provide the necessary level of detail needed when working with Cisco IOS routers and switches • The Role-Based CLI Access feature allows the administrator to define “views,” which are a set of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS EXEC and configuration mode commands • Views restrict user access to Cisco IOS CLI and configuration information; that is, a view can define what commands are accepted and what configuration information is visible • CLI views provide a more detailed access control capability for network administrators, thereby improving the overall security and accountability of Cisco IOS software

6. Role-Based CLI Overview • As of Cisco IOS Release 12.3(11)T, an interface or a group of interfaces can be assigned to a view, thereby allowing access on the basis of specified interfaces • Access to a view is protected with a password. This protection is similar to the concept used by privilege levels • To simplify the view management, views can be grouped to ‘superviews’ to create large sets of commands and interfaces. • A ‘superview’ encompasses several individual views, resulting in wider administrative privileges.

7. Role-Based CLI Overview • Root view is the highest administrative view • Creating and modifying a view or ‘superview’ is possible only from root view • The difference between root view and privilege Level 15 is that only a root view user can create or modify views and superviews • CLI views require AAA new-model: • This is necessary even with local view authentication • View authentication can be offloaded to an AAA server using the new attribute "cli-view-name" • A maximum of 15 CLI views can exist in addition to the root view

8. Getting Started with Role-Based CLI • Before a view is entered or created, AAA must be enabled via the aaa new-modelcommand. • Next, use the enablecommand with the view parameter to enter the root view. • Use the privilege 15 password, if prompted for authentication (if authentication is configured)

9. Getting Started with Role-Based CLI router# enable [privilege-level] [view [view-name]] • Enter a privilege level or a CLI view. • Use enable command with the view parameter to enter the root view. • Root view requires privilege Level 15 authentication. • The aaa-new model must be enabled. Perth(config)#aaa new-modelPerth(config)#exit Perth#enable view Password: Perth# %PARSER-6-VIEW_SWITCH: successfully set to view 'root'

10. enable Parameters

11. Configuring CLI Views router(config)# parser viewview-name • Creates a view and enters view configuration mode router(config-view)# password 5 encrypted-password commands parser-mode {include | include-exclusive | exclude} [all][interface interface-name | command] • Sets a password to protect access to the view • Adds commands or interfaces to a view Perth(config)#parser view monitor_viewPerth(config-view)#password 5 hErMeNe%GiLdE! Perth(config-view)#commands exec include show version

12. commands Parameters

13. Configuring Superviews router(config)# parser viewview-name • Creates a (super)view and enters the view’s configuration router(config-view)# password 5 encrypted-password viewview-name • Sets a password to protect access to the superview • Adds a CLI view to a superview Perth(config)#parser view monitor_auditPerth(config-view)#password 5 AnA6TaSiA$ Perth(config-view)#view monitor_view Perth(config-view)#view audit_view

14. Configuring Superviews • Superviews have these characteristics: • A CLI view can be shared among multiple superviews • Commands cannot be configured for a superview; that is, you must add commands to the CLI view and add that CLI view to the superview • Users who are logged in to a superview can access all of the commands that are configured for any of the CLI views that are part of the superview • Each superview has a password that is used to switch between superviews or from a CLI view to a superview • If a superview is deleted, all CLI views associated with that superview are not also deleted

15. Role-Based CLI Monitoring • When monitoring role-based CLI, use the command show parser view to display information about the view that the user is currently in. • The option all displays information for all views configured on the router. • The all keyword is available only to root users. However, the all keyword can be configured by a user in root view to be available for users in any CLI view. • To display debug messages for all views, use the debug parser view command in privileged EXEC mode.

16. Role-Based CLI Monitoring router# show parserview [all] • Displays the current view name • The option all: • Displays all CLI views configured on the router • Is by default available only to root users • Can be added to other CLI views router# debug parser view • Displays debug messages for all views

17. Role-Based CLI Configuration Example • In the next three slides the CLI view first is created and configured to include the commands show version,configure terminal, and all commands starting with show ip • Next, the administrator will verify the configuration by entering and viewing the available commands • When a user enters the CLI view, an indication message appears. Apart from the commands enable and exit that are available in all views, the only two commands that are visible in the CLI view are configure and show. The slide shows a sample output of the enable command • To further verify the view configuration, the user looks at the available options of the show command. The available options include parser, which is always available, and the configured keywords ip and version • Next, the user verifies that all sub-options of the showip command are available in the view as shown in last slide in this group

18. Role-Based CLI Configuration Example Perth(config)#aaa new-model Perth(config)#exit Perth#enable view %PARSER-6-VIEW_SWITCH: successfully set to view ‘root’. Perth#configure terminal Perth(config)#parser view first %PARSER-6-VIEW_CREATED:view ‘first’successfully created. Perth(config-view)#secret 5 firstpass Perth(config-view)#command exec include show version Perth(config-view)#command exec include configure terminal Perth(config-view)#command exec include all show ip Perth(config-view)#exit

19. Role-Based CLI Verification enable and show Commands Perth>enable view first Password: %PARSER-6-VIEW_SWITCH:successfully set to view 'first'. Perth#? Exec commands: configureEnter configuration mode enableTurn on privileged commands exitExit from the EXEC showShow running system information Perth#show ?ipIP information parserDisplay parser information versionSystem hardware and software status

20. Role-Based CLI Verification show ip Command Perth#show ip ?access-lists List IP access lists accounting The active IP accounting database aliases IP alias table arpIP ARP table as-path-access-listList AS path access lists bgpBGP information cache IP fast-switching route cache casa Display casa information cef Cisco Express Forwarding community-listList community-list dfp DFP information dhcp Show items in the DHCP database drp --More--

21. Cisco IOS Resilient Configuration Feature • Traditional risk that the configuration and the image are erased after a router compromise: • Availability threat (downtime) • Need to secure the primary bootset (configuration file and the running image) • Also known as the Cisco IOS Resilient Configuration feature • Speeds up the recovery process • Files must be stored locally • Feature can be disabled through a console session

22. Securing Configuration Files router(config)# secure boot-image • Enables Cisco IOS image resilience router(config)# secure boot-config • Stores a secure copy of the primary bootset in persistent storage router# show secure bootset • Displays the status of configuration resilience and the primary bootset filename Perth(config)#secure boot-imagePerth(config)#secure boot-config

23. Cisco IOS Resilient Configuration Feature Verification Perth#show secure bootset IOS resilience router id JMX0704L5GH IOS image resilience version 12.3 activated at 08:16:51 UTC Sun Jun 16 2005 Secure archive slot0:c3745-js2-mz type is image (elf) []    file size is 25469248 bytes, run size is 25634900 bytes    Runnable image, entry point 0x80008000, run from ram IOS configuration resilience version 12.3 activated at 08:17:02 UTC Sun Jun 16 2002 Secure archive slot0:.runcfg-20020616-081702.ar type is config configuration archive size 1059 bytes

24. Secure Configuration Files Recovery rommon 1 > dir [filesystem:] boot [partition-number:][filename] • Lists the contents of the device with secure bootset • Boots up the router using the secure bootset image router(config)# secure boot-config [restorefilename] • Restores the secure configuration to a filename rommon 1 >dir slot0: rommon 2 >boot slot0:c3745-js2-mz .... Router(config)#secure boot-config restore slot0:rescue Router#copy slot0:rescue running-config