1. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 1 Implementing Secure Converged Wide Area Networks (ISCW)

2. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 2 Lesson 6 – Module 5 – ‘Cisco Device Hardening’ Configuring Role- Based CLI

3. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 3 Module Introduction  The open nature of the Internet makes it increasingly important for businesses to pay attention to the security of their networks. As organisations move more of their business functions to the public network, they need to take precautions to ensure that attackers do not compromise their data, or that the data does not end up being accessed by the wrong people.  Unauthorised network access by an outside hacker or disgruntled employee can wreak havoc with proprietary data, negatively affect company productivity, and stunt the ability to compete.  Unauthorised network access can also harm relationships with customers and business partners who may question the ability of companies to protect their confidential information, as well as lead to potentially damaging and expensive legal actions.

4. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 4 Objectives  At the completion of this sixth lesson, you will be able to: Describe and configure role based CLI on IOS routers Configure CLI views and ‘Superviews’ Describe the use of secure configuration files

5. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 5 Role-Based CLI Overview  Although users can control CLI access via both privilege levels and enable mode passwords, these functions do not provide the necessary level of detail needed when working with Cisco IOS routers and switches  The Role-Based CLI Access feature allows the administrator to define “views,” which are a set of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS EXEC and configuration mode commands Views restrict user access to Cisco IOS CLI and configuration information; that is, a view can define what commands are accepted and what configuration information is visible CLI views provide a more detailed access control capability for network administrators, thereby improving the overall security and accountability of Cisco IOS software

6. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 6 Role-Based CLI Overview  As of Cisco IOS Release 12.3(11)T, an interface or a group of interfaces can be assigned to a view, thereby allowing access on the basis of specified interfaces  Access to a view is protected with a password. This protection is similar to the concept used by privilege levels  To simplify the view management, views can be grouped to ‘superviews’ to create large sets of commands and interfaces. A ‘superview’ encompasses several individual views, resulting in wider administrative privileges.

7. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 7 Role-Based CLI Overview  Root view is the highest administrative view  Creating and modifying a view or ‘superview’ is possible only from root view  The difference between root view and privilege Level 15 is that only a root view user can create or modify views and superviews  CLI views require AAA new-model: This is necessary even with local view authentication View authentication can be offloaded to an AAA server using the new attribute "cli-view-name"  A maximum of 15 CLI views can exist in addition to the root view

8. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 8 Getting Started with Role-Based CLI  Before a view is entered or created, AAA must be enabled via the aaa new-model command.  Next, use the enable command with the view parameter to enter the root view.  Use the privilege 15 password, if prompted for authentication (if authentication is configured)

9. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 9 Getting Started with Role-Based CLI router# enable [privilege-level] [view [view-name]] Enter a privilege level or a CLI view. Use enable command with the view parameter to enter the root view. Root view requires privilege Level 15 authentication. The aaa-new model must be enabled. Perth(config)#aaa new-model Perth(config)#exit Perth#enable view Password: Perth# %PARSER-6-VIEW_SWITCH: successfully set to view 'root'

10. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 10 enable Parameters ParameterDescription privilege-level (Optional) Sets the privilege level at which to log in. view (Optional) Enters root view, which enables users to configure CLI views. This keyword is required if you want to configure a CLI view. view-name (Optional) Enters or exits a specified CLI view. This keyword can be used to switch from one CLI view to another CLI view.

11. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 11 Configuring CLI Views router(config)# Creates a view and enters view configuration mode Perth(config)#parser view monitor_view Perth(config-view)#password 5 hErMeNe%GiLdE! Perth(config-view)#commands exec include show version parser view view-name router(config-view)# password 5 encrypted-password commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command] Sets a password to protect access to the view Adds commands or interfaces to a view

12. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 12 commands Parameters ParameterDescription parser-mode Specifies the mode that the specified command exists in include Adds a command or an interface to the view and allows the same command or interface to be added to an additional view include-exclusive Adds a command or an interface to the view and excludes the same command or interface from being added to all other views exclude Excludes a command or an interface from the view; that is, customers cannot access a command or an interface all (Optional) Specifies a “wildcard” that allows every command in a specified configuration mode that begins with the same keyword or every subinterface for a specified interface to be part of the view interface interface-name (Optional) Specifies an interface that is added to the view command (Optional) Specifies a command that is added to the view

13. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 13 Configuring Superviews router(config)# Creates a (super)view and enters the view’s configuration Perth(config)#parser view monitor_audit Perth(config-view)#password 5 AnA6TaSiA$ Perth(config-view)#view monitor_view Perth(config-view)#view audit_view parser view view-name router(config-view)# password 5 encrypted-password view view-name Sets a password to protect access to the superview Adds a CLI view to a superview

14. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 14 Configuring Superviews  Superviews have these characteristics: A CLI view can be shared among multiple superviews Commands cannot be configured for a superview; that is, you must add commands to the CLI view and add that CLI view to the superview Users who are logged in to a superview can access all of the commands that are configured for any of the CLI views that are part of the superview Each superview has a password that is used to switch between superviews or from a CLI view to a superview If a superview is deleted, all CLI views associated with that superview are not also deleted

15. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 15 Role-Based CLI Monitoring  When monitoring role-based CLI, use the command show parser view to display information about the view that the user is currently in.  The option all displays information for all views configured on the router.  The all keyword is available only to root users. However, the all keyword can be configured by a user in root view to be available for users in any CLI view.  To display debug messages for all views, use the debug parser view command in privileged EXEC mode.

16. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 16 Role-Based CLI Monitoring router# Displays the current view name The option all: –Displays all CLI views configured on the router –Is by default available only to root users –Can be added to other CLI views show parser view [all] router# debug parser view Displays debug messages for all views

17. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 17 Role-Based CLI Configuration Example  In the next three slides the CLI view first is created and configured to include the commands show version, configure terminal, and all commands starting with show ip  Next, the administrator will verify the configuration by entering and viewing the available commands  When a user enters the CLI view, an indication message appears. Apart from the commands enable and exit that are available in all views, the only two commands that are visible in the CLI view are configure and show. The slide shows a sample output of the enable command  To further verify the view configuration, the user looks at the available options of the show command. The available options include parser, which is always available, and the configured keywords ip and version  Next, the user verifies that all sub-options of the show ip command are available in the view as shown in last slide in this group

18. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 18 Role-Based CLI Configuration Example Perth(config)#aaa new-model Perth(config)#exit Perth#enable view %PARSER-6-VIEW_SWITCH: successfully set to view ‘root’. Perth#configure terminal Perth(config)#parser view first %PARSER-6-VIEW_CREATED:view ‘first’ successfully created. Perth(config-view)#secret 5 firstpass Perth(config-view)#command exec include show version Perth(config-view)#command exec include configure terminal Perth(config-view)#command exec include all show ip Perth(config-view)#exit

19. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 19 Role-Based CLI Verification enable and show Commands Perth>enable view first Password: %PARSER-6-VIEW_SWITCH:successfully set to view 'first'. Perth#? Exec commands: configure Enter configuration mode enable Turn on privileged commands exit Exit from the EXEC show Show running system information Perth#show ? ip IP information parser Display parser information version System hardware and software status

20. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 20 Role-Based CLI Verification show ip Command Perth#show ip ? access-lists List IP access lists accounting The active IP accounting database aliases IP alias table arp IP ARP table as-path-access-list List AS path access lists bgp BGP information cache IP fast-switching route cache casa Display casa information cef Cisco Express Forwarding community-list List community-list dfp DFP information dhcp Show items in the DHCP database drp --More--

21. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 21 Cisco IOS Resilient Configuration Feature  Traditional risk that the configuration and the image are erased after a router compromise:  Availability threat (downtime)  Need to secure the primary bootset (configuration file and the running image)  Also known as the Cisco IOS Resilient Configuration feature  Speeds up the recovery process  Files must be stored locally  Feature can be disabled through a console session

22. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 22 Securing Configuration Files router(config)# Enables Cisco IOS image resilience Perth(config)#secure boot-image Perth(config)#secure boot-config secure boot-image router(config)# secure boot-config Stores a secure copy of the primary bootset in persistent storage router# Displays the status of configuration resilience and the primary bootset filename show secure bootset

23. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 23 Cisco IOS Resilient Configuration Feature Verification Perth#show secure bootset IOS resilience router id JMX0704L5GH IOS image resilience version 12.3 activated at 08:16:51 UTC Sun Jun 16 2005 Secure archive slot0:c3745-js2-mz type is image (elf) [] file size is 25469248 bytes, run size is 25634900 bytes Runnable image, entry point 0x80008000, run from ram IOS configuration resilience version 12.3 activated at 08:17:02 UTC Sun Jun 16 2002 Secure archive slot0:.runcfg-20020616-081702.ar type is config configuration archive size 1059 bytes

24. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 24 Secure Configuration Files Recovery rommon 1 > Lists the contents of the device with secure bootset Boots up the router using the secure bootset image rommon 1 >dir slot0: rommon 2 >boot slot0:c3745-js2-mz.... Router(config)#secure boot-config restore slot0:rescue Router#copy slot0:rescue running-config dir [filesystem:] boot [partition-number:][filename] router(config)# Restores the secure configuration to a filename secure boot-config [restore filename]

25. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod5_L6 25