Security and VPN Configuration Guide, Cisco IOS XE 17.x

Contents

* - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - V

Index

*

*** 1 2 3 4 5 6 7 8 9 10

A

AAA (authentication, authorization, and accounting)

accounting

AV pairs 1

broadcasting 1

command type 1

configuring (example) 1

connection type 1

enabling 1

EXEC type 1

interim records 1

method lists (example) 1

methods (table) 1

monitoring 1

network configuration (figure) 1

network type 1

resource type 1

suppress records 1 2 3

system type 1

types 1 2

verifying 1

ARAP authentication

authorized guest logins 1

guest logins 1

line password 1

local password 1

methods (table) 1

TACACS+ 1

authentication

ARAP 1 2

configuring

default, enable 1

double authentication 1 2

login 1 2 3

methods 1

NASI 1 2

network configuration (figure) 1

PPP 1 2

server groups 1

authorization 1

AV pairs 1

configuring 1

configuring (examples) 1 2

for global configuration commands 1 2

network configuration (figure) 1

prerequisites 1

RADIUS 1

reverse telnet 1

server groups 1

TACACS+ 1

types 1

broadcast accounting 1

DNIS 1

enable default authentication, methods (table) 1

login authentication

enable password 1

Kerberos 1

line password 1

local password 1

methods (table) 1

RADIUS 1 2 3 4

TACACS+ 1 2 3 4 5 6

message banners

(examples) 1 2

failed-login banner, configuring 1

login banner, configuring 1

method lists 1

accounting 1

authorization 1 2 3

NASI authentication

enable password 1

line password 1

local password 1

methods 1

TACACS+ 1

POD (packet of disconnect) 1

configuration 1

example 1

PPP authentication 1 2

preauthentication 1

RADIUS

accounting 1

authentication 1

authorization 1

resource accounting 1

configuring 1

resource failure stop accounting 1

configuring 1

server groups

authentication 1

authorization 1

broadcast accounting 1

TACACS+, configuring 1

session MIB 1

configuration 1

example 1

SNMP 1

aaa accounting resource start-stop group command 1

aaa accounting resource stop-failure group command 1

AAA attributes

prerequisites 1

aaa authentication ppp command\

undefined list-name

(caution) 1

AAA double authentication secured by absolute timeout

examples 1

how to apply 1

information about 1

prerequisites 1

restrictions 1

aaa preauth command 1

access class filtering in IPv6 1

access lists

dynamic entries, deleting 1

See also IKE\ 1

access requests

RADIUS attribute 44

configuring 1

RADIUS attribute 8 1

RADIUS attributes

description 1

examples 1

access-enable command 1

access-list (encryption) command 1

access-list (IP extended) command 1

access-list command 1

additional references 1

AH (authentication header) 1

authentication

non-AAA methods 1 2 3

See also IKE, extended authentication\ 1

Authentication Policy for GM Registration 1

B

broadcast accounting 1

C

cautions

access lists 1

lock-and-key 1

ppp, disabling with undefined list-name 1

certificate to ISAKMP profile mapping 1

how to configure 1

certificates 1

CHAP (Challenge Handshake Authentication Protocol)

authentication 1 2

common password 1

delay authentication 1

description 1

enable authentication 1

refuse authentication requests 1

Cisco Group Encrypted Transport VPN

prerequisites 1

restrictions 1

system messages (Appendix I) 1

Cisco IOS Firewall

dynamic access lists 1

CISCO-NHRP-MIB 1

clear access-template command 1

CoA messages 1

Configuring a RADIUS server to reorder on failure 1

Configuring GET VPN GM Authorization 1

Configuring GM Authorization Using PKI 1

Configuring GM Authorization Using Preshared keys 1

Configuring Per VRF on a TACACS+ Server 1

Configuring the IKE Security Association Limit 1

crypto dynamic-map command 1

crypto ipsec transform-set command 1

crypto map command 1

D

Delegated-IPv6-Prefix-Pool 1

DES (Data Encryption Standard) 1

DF Bit Override Functionality with IPsec Tunnels

Additional references 1

Prerequisites 1

Restrictions 1

DH (Diffie-Hellman)

See IKE, DH (Diffie-Hellman) 1

DNIS (Dialed Number Identification Service)

DNIS number 1

server groups, selecting 1 2

DNS-Server-IPv6-Address 1

double authentication

access user profile 1

configuring 1 2

operation 1

E

enabling 1

encapsulations, IPSec-supported 1

encrypted nonces

See RSA encrypted nonces 1

encrypted preshared key 1 2 3 4 5

ESP (encapsulating security payload) 1

Example

Group Member 1 1

Group Member 4 1

Group Member 5 1

Key Server 1 1

Key Server 2 1

Key Server and Group Member Case Study 1

Passive SA 1

F

Framed-Interface-Id attribute 1

Framed-IPv6-Prefix attribute 1

Framed-IPv6-Route attribute 1

G

GET VPN GM Authorization 1

GM Authorization Using PKI 1

GM Authorization Using Preshared keys 1

H

how to configure 1

HTTP - source interface selection

source interface for outgoing TCP connections 1

I

ICMP

Host Unreachable message 1

IKE (Internet Key Exchange) security protocol

authentication

methods 1

DH (Diffie-Hellman) 1

mode configuration 1 2

negotiations 1

policies

purpose 1

requirements 1

protocol 1

requirements

policies 1

RSA encrypted nonces method 1

RSA signatures method 1

supported standards 1

Information About Cisco Group Encrypted Transport VPN 1

intercepts

VPN traffic 1

interface command 1

invalid security parameter index recovery

additional references 1

prerequisites 1

restrictions 1

verifying 1

IP

access lists

dynamic, deleting 1

security

See also lock-and-key\ 1

ip access-group command 1

IP multicast routing

MDS

packet statistics, displaying 1

IPoE sessions

lawful intercept support 1

IPSec 1

IPSec (IP Security) VPN monitoring

additional references 1

command reference 1

restrictions 1

IPSec (IPSec network security protocol)

access lists 1

encapsulations supported 1

how it works 1

monitoring 1 2

NAT, configuring 1

network services 1

protocol 1

restrictions 1

SAs

clearing 1

IKE negotiations 1 2

manual negotiations 1

supported standards 1

traffic protected, defining 1

transform sets 1

IPsec and IKE MIB Support for Cisco VRF-Aware IPsec

configuration examples 1

IPSec and quality of service 1

additional references 1

prerequisites 1

restrictions 1

IPsec Anti-Replay Window

Expanding and Disabling 1

IPSec Anti-Replay Window

Expanding and Disabling

configuration examples 1

IPSec dead peer detection periodic message option

additional references 1

prerequisites 1

restrictions 1

IPSec, access lists\ 1

IPSec, crypto access lists[access lists

zzz] 1

IPv6

AAA attributes 1 2

Access Control Lists 1

IPv6 access list 1

IPv6 pool attribute 1

IPv6 prefix# attribute 1

IPv6 route attribute 1

IPv6-Pool attribute 1

ISAKMP 1

K

Kerberos

authentication 1

login 1

PPP 1

configuring

(examples) 1 2

credential forwarding 1

instance mapping 1

KDC (key distribution center) 1

mandatory authentication 1

network access server communication 1

realms 1

SRVTABs files, copying 1

SRVTABs, creating 1

SRVTABs, extracting 1

Encrypted Kerberized Telnet 1

maintaining 1

monitoring 1

operation 1 2

Telnet to router 1

terms (table) 1

L

lawful intercept

VPN-based (per-VRF) 1

lawful intercept support for IPoE sessions 1

restrictions 1

line vty command 1

Lock Out of a Local AAA User Account 1

lock-and-key 1

benefits 1

configuring 1

(examples) 1

prerequisites 1

verification 1

maintenance tasks 1

performance impacts 1

process 1

spoofing, risk of 1

when to use 1

lock-and-key[authentication

zzz] 1

login local command 1

Login Password Retry Lockout 1 2

additional references 1

configuration examples 1

how to configure 1

information about 1

prerequisites 1

restrictions 1

login tacacs command 1

Login-IPv6-Host attribute 1

M

match address command 1 2

MD5 (Message Digest 5) algorithm 1 2

message URL http

//tools.ietf.org/id/draft-wadhwa-gsmp-l2control-configuration-02.txt 1

method lists

AAA

accounting 1

authentication 1

authorization 1 2 3

modes

rate adaptive 1

MS-CHAP (Microsoft Challenge Handshake Authentication Protocol)

feature summary 1

N

NAT, configuring IPSec for 1

nonces

See RSA encrypted nonces 1

O

Oakley key exchange protocol 1

P

PAP (Password Authentication Protocol)

authentication 1 2

description 1

enable authentication 1

outbound authentication 1

refuse authentication request 1

parameterized QoS 1

password command 1

per-VRF lawful intercept 1

PKI integration with AAA server

configuring 1

POD (packet of disconnect)

See AAA, POD 1

port mapping 1

PPP

enable encapsulation 1

inbound authentication 1

outbound authentication 1

preauthentication, configuring 1

R

RADIUS

accounting 1

attribute-value pairs 1

attributes 1

access requests 1

access requests examples 1

IETF 1

authentication 1

authorization 1

authorization of 1

configuring

attributes, vendor-proprietary 1

attributes, vendor-specific 1

DNIS server group selection 1

NAS port types, displaying 1

queries for IP addresses 1

queries for static routes 1

RADIUS prompt 1

server communication 1

server groups, deadtime for 1

server groups, DNIS selection of 1

login authentication 1 2 3 4

Login-IP-Host 1

operation 1

preauthentication profiles

callback 1

modem management 1

two-way authentication 1

username 1

server groups

deadtime 1

DNIS selection of 1

RADIUS attribute 104

configuration examples 1

how to apply 1

information about 1

prerequisites 1

restrictions 1

troubleshooting the RADIUS profile 1

RADIUS Attribute 5 (NAS-Port) Format Specified on a Per-Server Group Level 1

configuration examples 1

how to configure 1

information about 1

prerequisites 1

RADIUS attributes

described in RFC 3162 1

RADIUS NAS-IP-Address attribute configurability

additional references 1 2

command reference 1

configuration examples 1

how to configure 1

information about 1

RADIUS server on failure

examples 1

RADIUS server reorder on failure

additional references 1

configuring a RADIUS server to reorder on failure 1

how the RADIUS server reorder on Fail Works 1

monitoring 1

prerequisites 1

RADIUS server failure 1

when RADIUS servers are dead 1

RADIUS server reorder on failurel

restrictions 1

radius-server attribute 44 include-in-access-req command 1

radius-server attribute 8 include-in-access-req command 1

Rekey Functionality in Protocol Independent Multicast-Sparse Mode 1

restrictions 1

restrictions for lawful intercept support for IPoE sessions 1

Reverse Route Injection 1

how to configure 1

information about 1

restrictions 1

Reverse SSH

additional references 1

configuration examples 1

RFC 1334, PPP Authentication Protocols 1

RFC 1829, The ESP DES-CBC Transform 1

RFC 1994, PPP CHAP 1

RFC 5176 Compliance 1 2

RFC-2677 1

RSA (Rivest, Shamir, and Adelman) encrypted nonces 1

requirements 1

RSA (Rivest, Shamir, and Adelman) signatures 1

requirements

IKE configuration 1

S

SAs (security associations)

IKE established crypto map entries, creating 1

scalability, configuring (example) 1

Secure Copy

configuration examples 1

glossary 1

how to configure 1

information about 1

prerequisites 1

Secure Shell Version 2 1

how to configure 1

monitoring and maintaining 1

verifying using the show ip ssh command 1

server groups

AAA, authentication 1

AAA, authorization 1

deadtime, configuring 1

TACACS+, configuring 1

server groups, AAA

broadcast accounting 1

set peer command 1 2

set pfs command 1

set security-association level per-host command 1

set security-association lifetime command 1 2

set transform-set command 1 2

SHA (Secure Hash Algorithm) 1

show access-lists command 1

Skeme key exchange protocol 1

source interface selection for outgoing traffic with Certificate Authority

certificates that identify an entity 1

configuring 1

example 1

troubleshooting 1

standards

IKE, supported by 1

static 1

T

TACACS+

accounting 1

attribute-value pairs

See AV pairs 1

authentication

login 1 2 3 4 5 6

NASI 1

authorization 1

AV pairs 1 2 3

accounting 1

configuring

(examples) 1

authentication 1

authentication key 1

DNIS, server group selection 1

server groups 1

server host 1

login input time, configuring 1

operation 1

overview 1

server groups 1

DNIS selection 1

TCP Intercept 1

tracebacks 1

U

username command 1

V

vendor-specific attributes (VSAs) 1 2

Verifying NHRP MIB Status 1

Example 1

VPN-based lawful intercept 1

VRF-Aware NHRP MIB Configuration

Example 1

VSAs 1 2