Managing the System

This chapter describes the basic tasks that you can do to manage the general system (or nonprotocol-specific) features. Our system management features are supported via the Simple Network Management Protocol (SNMP). This chapter describes the tasks needed to configure SNMP support on the access server. A part of SNMP is the Management Information Base (MIB). MIBs provide variables that can be set or read to change parameters or provide information on network devices and interfaces. We support several MIBs, including the Internet standard MIB II, and also provide the Cisco MIB. For information on the Cisco MIB, see the Cisco Management Information Base (MIB) User Quick Reference publication.

Cisco Systems also provides CiscoWorks, a feature-rich network management application suite that is integrated with Sun Microsystems' SunNet Manager product running on a Sun SPARC station platform. CiscoWorks provides a menu-driven graphical user interface and supports all five areas of network management. (See the next section, "Understanding System Management," for details.) With CiscoWorks, you can create network maps and set up automated network performance monitors and fault tests, such as pinpointing connectivity problems. Test results can be displayed in several graph formats. Refer to CiscoWorks online help for information on how to use CiscoWorks on a Sun SPARC station. See the CiscoWorks Installation and Reference Guide for installation and reference information.

In addition to CiscoWorks for the Sun SPARC station platform, Cisco Systems provides CiscoWorks for Windows 1.0. CiscoWorks for Windows 1.0 incorporates the features of the Cisco Configuration Builder, which was based on an MS-Windows graphical user interface. CiscoWorks for Windows 1.0 replaces the Cisco Configuration Builder, previously provided for configuring Cisco routers. For information on how to use CiscoWorks for Windows 1.0, refer to the online help provided with the product and the CiscoWorks for Windows Getting Started Guide publication.

For a list of recommended books on network management, refer to the appendix "References and Recommended Reading" in the Access and Communication Servers Command Reference publication.

For a complete description of the commands mentioned in this chapter, refer to the "System Management Commands" chapter of the Access and Communication Servers Command Reference publication.

Understanding System Management

This chapter describes how to manage the access server and its performance on the network. In general, system or network management falls into the categories described in the following sections:

• Configuration Management

The configuration of network devices determines the network's behavior. To manage device configurations, you need to list and compare configuration files on running devices, store configuration files on network servers for shared access, and perform software installations and upgrades. These configuration management tasks are described in the "Loading System Images and Configuration Files" chapter.

Other configuration management tasks include naming the access server, setting access server time services, and configuring SNMP support. These tasks are described in this chapter.

• Security Management

To manage security on the network, you need to restrict access to the system. You can do so on several different levels:

• Assign passwords (and encrypt them) to restrict access to access server terminal lines, login connections, or privileged EXEC mode.

• Establish one of three versions of Terminal Access Controller Access Control System (TACACS) protection for network servers that have shared access: TACACS, Extended TACACS, or TACACS+, which is coupled with the Authentication, Authorization, and Accounting (AAA) model.

• Restrict login connections to specific users with a username authentication system.

• Control access on serial interfaces with Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP).

• Create access lists to filter traffic to and from specific destinations. Subsequent chapters that describe the routing protocols in detail define access lists. This section provides general guidelines for creating access lists.

• Create security labels for Internet Protocol (IP) datagrams using the Internet Protocol Security Option (IPSO), as described in the "Configuring IP" chapter.

• Fault Management

To manage network faults, you need to discover, isolate, and fix the problems. You can discover problems with the system's monitoring commands, isolate problems with the system's test commands, and resolve problems with other commands, including debug.

This section introduces basic fault management commands. For detailed troubleshooting procedures and a variety of scenarios, see the Troubleshooting Internetworking Systems publication. For complete details on all debug commands, see the Debug Command Reference publication.

• System Performance Management

To manage system performance, you need to monitor and determine response time, error rates, and availability. Once these factors are determined, you can perform load balancing and modify system parameters to enhance performance. For example, priority queuing allows you to prioritize traffic order. You can configure fast and autonomous switching to improve network throughput, as described in the "Configuring Interfaces" chapter of this manual.

See the Internetwork Design Guide for additional information.

• Accounting Management

Accounting management allows you to track both individual and group usage of network resources. You can then reallocate resources as needed. For example, you can change the system timers and configure TCP keepalives. See also the IP accounting feature in the "Configuring IP" chapter of this manual. Additionally, the AAA/TACACS+ aaa accounting command allows you to set start/stop accounting for any or all of the listed functions for this command.

See "System Management Examples" at the end of this chapter.

Configuration Management

You can complete any of the tasks in the following sections to perform configuration management functions:

• Customize the Access Server Prompt

• Set the Access Server Name

• Create and Monitor Command Aliases

• Set the Interval for Load Data

• Set the Access Server Time Services

• Monitor Time Services

• Configure Synchronization of Logging Messages

• Configure SNMP Support

• Configure the Cisco Discovery Protocol

Other configuration management tasks are described in the chapter entitled "Loading System Images and Configuration Files."

Customize the Access Server Prompt

By default, the access server prompt consists of the access server name followed by an angle bracket (>) for EXEC mode, a pound sign (#) for privileged EXEC mode, or the abbreviation "config" enclosed in parenthesis (config) for configuration mode. To customize your access server prompt, perform the following tasks in global configuration mode:

Set the Access Server Name

One of the first basic tasks is to name your access server. The name of the access server is considered the host name and is the name that is displayed by the system prompt. If no name is configured, the system default access server name is Router, and the default access server name is cs. You can name the server while in global configuration mode as follows:

Create and Monitor Command Aliases

You can create aliases for commonly used or complex commands. Use word substitutions or abbreviations to tailor command syntax for you and your user community.

To create and display command aliases, perform the tasks in the following sections:

• Create a Command Alias

• Display Command Aliases

Create a Command Alias

To create a command alias, perform the following task in global configuration mode:

Display Command Aliases

To display alias names and the original command syntax, perform the following task in EXEC mode:

Set the Interval for Load Data

You can change the length of time that a set of data is used for computing load statistics. By decreasing the load interval, dial backup and other decisions are based on an average that is computed over a shorter length of time and is more responsive to bursts of traffic.

To change this period, perform the following task in interface configuration mode:

Set the Access Server Time Services

All of our access server products provide an array of time-of-day services. These services allow the products to accurately keep track of the current time and date, to synchronize multiple products to the same time, and to provide time services to other systems.

The heart of the time service is the system clock. This clock runs from the moment the system starts up and keeps track of the current date and time. The system clock can be set from a number of sources, and in turn can be used to distribute the current time through various mechanisms to other systems. When the system is initialized, the system clock is set to midnight on March 1, 1993. The system clock can then be set from the following sources:

Configure NTP

The Network Time Protocol (NTP) is a protocol designed to time-synchronize a network of machines. NTP runs over UDP, which in turn runs over IP. NTP is documented in RFC 1305.

An NTP network usually gets its time from an authoritative time source, such as a radio clock or an atomic clock attached to a time server. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two machines to within a millisecond of one another.

NTP uses the concept of a "stratum" to describe how many NTP "hops" away a machine is from an authoritative time source. A "stratum 1" time server has a radio or atomic clock directly attached, a "stratum 2" time server receives its time via NTP from a "stratum 1" time server, and so on. A machine running NTP will automatically choose as its time source the machine with the lowest stratum number that it is configured to communicate with via NTP. This strategy effectively builds a self-organizing tree of NTP speakers.

The time kept on a machine is a critical resource. Therefore, we strongly recommend that you use the security features of NTP to avoid the accidental or malicious setting of incorrect time. Two mechanisms are available: an access list-based restriction scheme and an encrypted authentication mechanism.

Configure NTP Authentication

You can authenticate the associations with other systems for security purposes. You must enable the NTP authentication feature, then define each of the authentication keys. Each key has a key number, a type, and a value. Currently the only key type supported is md5. Finally, define a list of trusted authentication keys. If a key is trusted, then this system will be willing to synchronize to a system that uses this key in its NTP packets.

Configure NTP Associations

Configure NTP Broadcast Service

The system can either send broadcast packets or listen to them on an interface-by-interface basis. The estimated round-trip delay for broadcast packets can also be configured.

Perform the following task in global configuration mode to adjust the NTP broadcast delay period:

To configure your system to either send or receive NTP broadcast packets, perform the following tasks in interface configuration mode:

Configure NTP Access Restrictions

You can control NTP access on two levels by completing the following steps:

Step 1 Create an access group and assign a basic IP access list to it.

Step 2 Disable NTP services on a special interface.

To control access to NTP services, you can create an NTP access group and apply a basic IP access list to it. To do so, perform the following task in global configuration mode:

Configure the Source IP Address for NTP Packets

When the system sends an NTP packet, the source IP address is normally set to the address of the interface through which the NTP packet is sent. Perform the following task in global configuration mode if you want to configure a specific interface from which the IP source address will be taken:

The interface will be used for the source address for all packets sent to all destinations. If a source address is to be used for a specific association, use the source keyword with the ntp peer or ntp server command shown earlier in this chapter.

Configure the System as an Authoritative NTP Server

Perform the following task in global configuration mode if you want the system to be an authoritative NTP server, even if the system is not synchronized to an outside time source:

Task	Command
Make the system an authoritative NTP server.	ntp master [stratum]

 
Caution Use this command with extreme caution. It is very easy to override valid time sources using this command, especially if a low stratum number is configured. Configuring multiple machines in the same network with the ntp master command can cause instability in timekeeping if the machines do not agree on the time.

Configure Time and Date Manually

If no other source of time is available, you can manually configure the current time and date after the system is restarted. The time will remain accurate until the next system restart. We recommend that you use manual configuration only as a last resort.

• Configure the time zone.

• Configure summer time (daylight saving time) if applicable.

• Set the system clock (if no other time source is available).

Configure the Time Zone

Configure Summer Time

To configure summer time (daylight saving time) in areas where it starts and ends on a particular day of the week each year, perform the following task in global configuration mode:

If summer time in your area does not follow this pattern, you can configure the exact date and time of the next summer time events by performing one of the following tasks in global configuration mode:

Set the System Clock

If you have an outside source on the network that provides time services (such as an NTP server or VINES time service), you do not need to manually set the system clock.

However, if you have do not have any time service source, complete one of the following tasks in EXEC mode to set the system clock:

Monitor Time Services

You can monitor clock and NTP EXEC services by completing the following tasks in EXEC mode:

Enable Minor TCP/IP Services

You can access common TCP/IP services available from hosts on the network by performing the following task in global configuration mode:

Configure Synchronization of Logging Messages

You can configure the system to synchronize unsolicited messages and debug output with solicited access server output and prompts for a specific line. You can identify the types of messages to be output asynchronously based on the level of severity. You can also determine the maximum number of buffers for storing asynchronous messages for the terminal after which messages are dropped.

Configure SNMP Support

The Simple Network Management Protocol (SNMP) system consists of three parts: an SNMP manager, an SNMP agent, and a Management Information Base (MIB). SNMP is an application-layer protocol that allows SNMP manager and agent stations to communicate. SNMP provides a message format for sending information between an SNMP manager and an SNMP agent. The SNMP manager can be part of a Network Management System (NMS), such as CiscoWorks.

The SNMP agent contains MIB variables whose values the SNMP manager can request or change. A manager can get a value from an agent or store a value into that agent. The agent gathers data from the MIB, the repository for information about device parameters and network data. The agent can also respond to a manager's requests to get or set data.

Figure 5-1 illustrates the communications relationship between the SNMP manager and agent. It shows that a manager can send the agent requests to get and set MIB values. The agent can respond to these requests. Independent of this interaction, the agent can send unsolicited traps to the manager notifying the manager of network conditions.

We support the SNMP Version 1 protocol, referred to as SNMPv1, and the SNMP Version 2 protocol, referred to as SNMPv2. Our implementation of SNMP supports all MIB II variables (as described in RFC 1213) and SNMP traps (as described in RFC 1215). We also support the definition of management information described in RFCs 1155, 1157, and 1213, and supports some or all variables in the MIBs described in the following RFCs: 1156, 1212, 1231, 1243, 1253, 1285, 1286, 1315, 1381, 1382, 1398, 1447, 1450, 1512, 1516, and 1285 (FDDI).

• Configure for Both SNMP v.2 and SNMP v.1

• Configure SNMP v.2 Support

• Configure SNMP v.1 Support

To configure the relationship between the agent and the manager on the access server, you need to know the version of the SNMP protocol that the management station supports. An agent can communicate with multiple managers; for this reason, you can configure the access server to support communications with one management station using the SNMP v.1 protocol and another using the SNMP v.2 protocol.

Configure for Both SNMP v.2 and SNMP v.1

You can perform the following tasks to configure support for both SNMP v.2 and SNMP v.1 on the access server:

• Enable the SNMP Agent Shutdown Mechanism

• Establish the Contact, Location, and Serial Number of the SNMP Agent

• Define the Maximum SNMP Packet Size

• Monitor SNMP Status

• Disable the SNMP Agent

Enable the SNMP Agent Shutdown Mechanism

Establish the Contact, Location, and Serial Number of the SNMP Agent

Define the Maximum SNMP Packet Size

Monitor SNMP Status

Disable the SNMP Agent

Generate a Downward-Compatible Configuration

In Cisco IOS Release 10.3, the IP access list formats changed. If you decide to downgrade from Release 11.0 to Release 10.2, you can configure the software to try to regenerate a configuration in the format of Release 10.2, thereby saving time and making your IP access lists compatible with the software.

To have the software try to regenerate a configuration in the format prior to Release 10.3, perform the following task in global configuration mode:

Configure SNMP v.2 Support

SNMP v.2 security requires that you create an access policy that defines the relationship between a manager and the agent. For each management station that the agent communicates with, you must create a separate access policy. Creating an access policy is a multiple-task process:

Figure 5-2 shows the information exchanged between the manager and the agent. The top arrow, leading from the manager to the agent, shows the types of requests the manager can send to the agent. The bottom arrow, leading from the agent to the manager, shows the kind of information that the agent can send to the manager. Note that the agent sends trap messages to the manager in response to certain network conditions; trap messages are unsolicited and are not related to the request/response communication exchange between the manager and the agent that occurs in relation to MIB variables. For any given manager and agent relationship, the privileges defined in the access policy constrain communications to a specific set of operations.

You must create access policies for each new agent that is installed. You also must create access policies on an agent when new management stations with which the agent will communicate are installed. Moreover, every time a network address changes on a management station, you must reconfigure the access policy to reflect the new information for the management station.

Configure an SNMP View Record

To create or update an SNMP view record, perform the following task in global configuration mode:

Configure an SNMP Context Record

To create or update an SNMP context record, perform the following task in global configuration mode:

To remove a context entry, use the no snmp-server context command. Specify only the name of the context. The name identifies the context to be deleted.

Configure an SNMP v.2 Party Record

To create or update an SNMP v.2 party record, perform the following task in global configuration mode:

Configure an SNMP v.2 Access Policy

To define or modify an SNMP v.2 access policy, perform the following task in global configuration mode:

To remove an SNMP v.2 access-policy, use the no snmp-server access-policy command.

Configure an SNMP v.2 Simplified Security Context Record

To create or update a simplified security context record, perform the following task in global configuration mode:

To remove a simplified security context record, use the no snmp-server userid command.

Define SNMP v.2 Trap Operations

To define the recipient of the trap message, you configure a party record for the manager, including the protocol address, and specify the party record as the destination party for the snmp-server access policy command. To define traps for the agent to send to the manager, perform one or more of the following tasks in global configuration mode:

Configure SNMP v.1 Support

If the manager supports only the SNMP v.1 protocol, you must configure the relationship between the manager and the agent using SNMP v.1 support. You can use either of two methods to configure access to the agent. There are trade-offs involved in choosing one method over the other. The methods differ in the following ways:

• Using the snmp-server community command, you specify a string, and, optionally, an access list. The string is used as a password. The access list identifies the IP addresses of systems on which SNMP v.1 managers reside that may use the community string to gain access to the SNMP v.1 agent. You cannot restrict the MIB view using this method.

• Using an access policy, you can specify a password-like string and you can impose a restricted MIB view, but you cannot specify an access list to identify the IP addresses of managers that may access the agent. An SNMP v.1 access policy is similar to an SNMP v.2 access policy.

You can perform the following tasks to configure support for SNMP v.1 on the access server:

• Configure access control for an SNMP v.1 community.

• Configure a view to be used for a context record.

• Configure a context to be used for a party record.

• Configure an SNMP v.1 party record to be used for an access policy.

• Configure an SNMP v.1 access policy.

• Define SNMP v.1 trap operations.

These tasks are described in the following sections.

Configure Access Control for an SNMP v.1 Community

You can configure a community string, which acts like a password, to permit access to the agent on the access server. Optionally, you can associate a list of IP addresses with that community string to permit only managers with these IP addresses to use the string.

Configure an SNMP View Record

To create or update an SNMP view record, perform the following task in global configuration mode:

Configure an SNMP Context Record

To create or update an SNMP context record, perform the following task in global configuration mode:

To remove a context entry, use the no snmp-server context command. Specify only the name of the context. The name identifies the context to be deleted.

Configure a Party Record

To create or update an SNMP v.1 party record to be used in an access policy, perform the following task in global configuration mode:

Configure an SNMP Access Policy

To configure an access policy, you specify the SNMP v.1 proxy for which you configured the party record as both the destination party and the source party. To configure an access policy, perform the following task in global configuration mode:

Define SNMP Trap Operations for SNMP v.1

Configure the Cisco Discovery Protocol

The Cisco Discovery Protocol (CDP) is a media- and protocol-independent protocol that runs on all Cisco-manufactured equipment including routers, bridges, access servers, and switches. With CDP, network management applications can learn the device type and the SNMP- agent address of neighboring devices. This enables applications to send SNMP queries to neighboring devices.

CDP runs on all media that support SNAP, including LAN, Frame Relay, and ATM media. CDP runs over the data link layer only. Therefore, two systems that support different network layer protocols can learn about each other.

Each device configured for CDP sends periodic messages to a multicast address. Each device advertises at least one address at which it can receive SNMP messages. The advertisements also contain time-to-live, or holdtime, information, which indicates the length of time a receiving device should hold CDP information before discarding it.

There is a CDP MIB for the management of CDP on Cisco devices.

CDP Configuration Task List

CDP is enabled on your access server by default, which means the access server will send CDP packets. You can perform the tasks in the following sections to configure CDP:

• Enable CDP on an Interface

• Set CDP Transmission Timer and Hold Time

• Disable CDP for the Access Server

• Monitor and Maintain CDP

Enable CDP on an Interface

Although CDP is enabled by default on the access server, you must enable it on each interface in order to receive CDP information. To enable CDP on an interface, perform the following task in interface configuration mode:

Set CDP Transmission Timer and Hold Time

To set the frequency of CDP transmissions and the hold time for CDP packets, perform the following tasks in global configuration mode:

Disable CDP for the Access Server

CDP is enabled on an access server by default. To disable CDP on an access server and reenable it, perform the following task in global configuration mode:

Monitor and Maintain CDP

To monitor and maintain CDP on your device, perform the following tasks in privileged EXEC mode:

Security Management

To set up security features, you need to identify sensitive information, find the network access points to that information, secure these access points, and maintain the secure access points.

The following sections describe the optional tasks you can use to control access to the system:

• Establish Password Protection

• Configure Multiple Privilege Levels

• Disable Password Protection

• Recover a Lost Enable Password

• Recover a Lost Line Password

• Create Access Lists

• Establish Terminal Access Control

• Enable CHAP

• Enable PAP

• Enable IP Accounting and Display IP Access Violations

Other chapters in this guide provide information on protocol-specific security features. The Configuring Interfaces" chapter provides additional information on the CHAP and PAP authentication features. Another example is the IP Security Option (IPSO) feature described in the chapter entitled "Configuring IP." Finally, see the separate protocol chapters for information about how to create access lists.

Establish Password Protection

Complete the tasks in the following sections to establish password protection:

• Protect Access to Terminal Lines

• Encrypt Enable Passwords

• Protect Passwords with Enable Secret

Protect Access to Terminal Lines

You can provide access control on a terminal line by entering the password and establishing password checking. To do so, perform the following tasks in line configuration mode:

The password checker is case sensitive and can include spaces. The password Secret is different than the password secret, for example, and the password two words is an acceptable password.

Encrypt Enable Passwords

Because protocol analyzers can examine packets, you can increase access security to your access server by configuring it to encrypt passwords. Encryption prevents the password from being read in the configuration file with the show configuration EXEC command or with a protocol analyzer.

Protect Passwords with Enable Secret

To provide an additional layer of security, particularly for passwords that cross the network or are stored on a TFTP server, you can use either enable password or enable secret. Both commands accomplish the same thing; that is, they let you establish an encrypted password that users must type to enter enable mode (the default), or any privilege level you specify.

You should use enable secret, however, because it is the newer command and uses an improved encryption algorithm. You would use enable password only if you boot an older image of the IOS or you boot older boot roms that don't recognize enable secret. In that case enable password would be the only form of password protection available to you.

If you configure enable secret, it is used instead of enable password, not in addition to it .

To configure the router to require an enable password, perform one of the following tasks in global configuration mode:

Use this command with the level option to define a password for a specific privilege level. Once the level and the password are specified, give the password to the users you want to have access at this level. Use the privilege level configuration command to specify commands accessible at various level.

If you have service password-encryption set, the password you enter is encrypted. When the router displays it for you later, it will be displayed in the encrypted form.

If you specify an ecncyption type, you must provide an encrypted password--this would be an encrypted password you copy from another router configuration.

You cannot recover a lost encrypted password. You must clear NVRAM and set a new password. See the section "Recover a Lost Enable Password" or the section "Recover a Lost Line Password" if you have lost or forgotten your password.

Configure Multiple Privilege Levels

By default, the access server has two levels of password security, user level and privileged, or enabled, level. You can configure up to 16 hierarchical levels of security on an access server. By configuring multiple passwords, you can allow different sets of users to have access to specified commands.

For example, if you want the configure command to be available to a more restricted set of users than the clear line command, you can assign level 2 security to the clear line command and distribute the level 2 password fairly widely, and assign level 3 security to the configure command and distribute the password to level 3 commands to fewer users.

To configure additional levels of security, perform the tasks in the following sections:

• Set the Privilege Level for a Command

• Change the Default Privilege Level for Lines

• Display Current Privilege Levels

Set the Privilege Level for a Command

To set the privilege level for a command, perform the following task in global configuration mode:

Change the Default Privilege Level for Lines

To change the default privilege level for a given line or a group of lines, perform the following task in line configuration mode:

Display Current Privilege Levels

To display your level of privilege based on the password you used, perform the following task in EXEC mode:

Disable Password Protection

You can disable line password verification by disabling password checking. To do so, perform the following task in line configuration mode:

Recover a Lost Enable Password

On access servers equipped with nonvolatile memory, you can accidentally lock yourself out if you forget the enable password. The process to recover a lost enable password depends upon on the type of access server platform you have.

ASM-CS and Cisco 2500

To recover a lost, non-encrypted enable password on an ASM-CS or a Cisco 2500 access server, follow these steps:

Step 1 Turn the access server power off, then on again.

Step 2 Press the Break key within the first 60 seconds after power cycle. This will put the access server in the ROM monitor mode indicated by the prompt ">".

Step 3 Enter the o command to display the configuration register value. Make a note of the value; you will need it in a later step of this procedure:

> o

Step 4 From the ROM monitor prompt, type o/r. This will put the value 0x141 into the configuration register.

> o/r

Step 5 Initialize and boot the access server:

> i

Step 6 Answer NO to all the SETUP questions. You should see the following prompt:

Router(boot)>

Step 7 Enter privileged mode by entering the enable command. No password is required and the prompt will change to router(boot)#.

Router(boot)> enable
Router(boot)#

Step 8 Use the show startup-config command to see the enable password:

Router(boot)# show startup-config

Step 9 Restore the configuration register to its original value (as recorded in step 3) using the configuration command:

Router(boot)# config-register 0xoriginal values

Step 10 Reload and boot the access server using the reload command:

Router(boot)# reload

Recover a Lost Line Password

On access servers equipped with nonvolatile memory, you can accidentally lock yourself out if you enable password checking on the console terminal line and then forget the line password.

To recover a lost line password, force the server into factory diagnostic mode and then follow these steps:

Step 1 Force the server into factory diagnostic mode.

See the hardware installation and maintenance publication for your product for specific information about configuring the processor configuration register for factory diagnostic mode. Table 5-1 summarizes the hardware or software settings required by various products to set factory diagnostic mode.

Step 2 You will be asked if you want to set the manufacturers' addresses. Respond by typing Yes. You will then see the following prompt:

TEST-SYSTEM>

Step 3 Enter the enable command to get the privileged prompt:

TEST-SYSTEM> enable

Step 4 Enter the show startup-config command to review the system configuration and find the password. Do not change anything in the factory diagnostic mode.

TEST-SYSTEM# show startup-config

Step 5 To resume normal operation, restart the server and/or reset the configuration register.

Step 6 Log into the server with the password that was shown in the configuration file.

Create Access Lists

This section summarizes the protocols that use access lists. The general guidelines for access lists vary from protocol to protocol. See the appropriate chapter in this guide for detailed task information on each protocol-specific access list. To control SNMP access, see "Security Management" earlier in this chapter. Also refer to the appropriate protocol-specific chapters of this publication.

Table 5-2 provides the protocols that have access lists specified by numbers and provides the corresponding numerical ranges.

Establish Terminal Access Control

You can configure the access server to use one of three special TCP/IP protocols related to Terminal Access Controller Access Control System: regular TACACS, Extended TACACS, and AAA/TACACS+. TACACS services are provided by and maintained in a database on a TACACS server running on a workstation. You must have access to and configure a TACACS server before configuring the TACACS features described in this publication on your Cisco device. Our basic TACACS support is modeled after the original Defense Data Network (DDN) application.

A comparative description of the supported versions follows. Table 5-3 gives a comparison of the versions by commands.

• TACACS--Provides password checking, authentication, and notification of user actions for security and accounting purposes.

• Extended TACACS--Provides information about protocol translator and access server use. This information is used in UNIX auditing trails and accounting files.

• AAA/TACACS+--Provides more detailed accounting information as well as more administrative control of authentication and authorization processes.

You can establish TACACS-style password protection on both user and privileged levels of the system EXEC.

Enable TACACS and Extended TACACS

The following sections describe the features available with TACACS and Extended TACACS. The Extended TACACS software is available using FTP (see the README file in the ftp.cisco.com directory).

• Set TACACS Password Protection at the User Level

• Disable Password Checking at the User Level

• Set Optional Password Verification

• Set TACACS Password Protection at the Privileged Level

• Disable Password Checking at the Privileged Level

• Set Notification of User Actions

• Set Authentication of User Actions

• Establish the TACACS Server Host and Response Times

• Set Limits on Login Attempts

• Enable the Extended TACACS Mode

• Enable TACACS for PPP Protocol Authentication

Set TACACS Password Protection at the User Level

Disable Password Checking at the User Level

Set Optional Password Verification

Set TACACS Password Protection at the Privileged Level

You can set the TACACS protocol to determine whether a user can access the privileged EXEC level. To do so, perform the following task in global configuration mode:

Task	Command
Set the TACACS-style user ID and password-checking mechanism at the privileged EXEC level.	enable use-tacacs

When you set TACACS password protection at the privileged EXEC level, the EXEC enable command will ask for both a new username and a password. This information is then passed to the TACACS server for authentication. If you are using the extended TACACS, it will also pass any existing UNIX user identification code to the server.

 
Caution If you use the enable use-tacacs command, you must also specify tacacs-server authenticate enable; otherwise, you will be locked out of the access server.

---

Note When used without extended TACACS, this task allows anyone with a valid username and password to access the privileged command level, creating a potential security problem. This is because the TACACS query resulting from entering the enable command is indistinguishable from an attempt to log in without extended TACACS.

---

Disable Password Checking at the Privileged Level

Set Notification of User Actions

Set Authentication of User Actions

Establish the TACACS Server Host and Response Times

Set Limits on Login Attempts

Specify the Amount of Time for Login Input

Enable the Extended TACACS Mode

Enable TACACS for PPP Protocol Authentication

For more information on PPP, refer to the "Configuring Interfaces" chapter later in this publication. For examples of enabling TACACS for PPP protocol authentication, see the section "System Management Examples."

Enable Standard TACACS for ARA Protocol Authentication

You can use the Standard TACACS protocol for authentication within AppleTalk Remote Access (ARA) protocol sessions. To do so, perform the following task starting in line configuration mode:

By using the optional during-login argument with the autoselect command, you can display the username or password promp without pressing the Return key. While the Username or Password name is being presented, you can choose to answer these prompts or to start sending packets from an autoselected protocol.

The remote user logs in through ARA as follows:

Step 1 When prompted for username by the ARA application, the remote user enters username*password and presses Return.

Step 2 When prompted for password by the ARA application, the remote user enters arap and presses Return.

For more information on the ARA protocol, refer to the "Configuring an AppleTalk Remote Access Server" chapter later in this publication. For examples of enabling TACACS for ARA protocol authentication, see the section "System Management Examples."

Enable Extended TACACS for ARA Protocol Authentication

You can use the Extended TACACS protocol for authentication within AppleTalk Remote Access (ARA) protocol sessions. The Extended TACACS server software is available using FTP (see the README file in the ftp.cisco.com directory).

After installing an Extended TACACS server with ARA support, perform the following task in line configuration mode on each line:

By using the optional during-login argument with the autoselect command, you can display the username or password prompt without pressing the Return key. While the Username or Password name is being presented, you can choose to answer these prompts or to start sending packets from an autoselected protocol.

For more information on the ARA protocol, refer to the "Configuring an AppleTalk Remote Access Server" chapter later in this publication. For examples of enabling TACACS for ARA protocol authentication, see the section "System Management Examples".

Configure AAA/TACACS+

AAA/TACACS+ combines original and enhanced functionality from previous versions of TACACS as well incorporating a new model of control called AAA (Authentication, Authorization, and Accounting). The resulting benefits are more accurate accounting information and improved remote access functionality.

• Authentication--provides complete server control of authentication through login and password query, challenge/response, messaging support, and encryption using MD5.

• Authorization--provides remote access control, including one-time authorization, authorization for each service, per-user account list and profile, user group support, support of IP, IPX, ARA, and Telnet. Additionally, you can create access or command permissions and restrictions.

• Accounting--collects and sends the TACACS server information used for billing, auditing, and reporting. These functions are discussed in the "System Management Examples" section later in this chapter.

TACACS+ also provides an API (Application Programming Interface) that allows the protocol to be integrated into existing standard databases.

You will need a server running TACACS software to use the AAA/TACACS+ functionality on your access server. You can obtain this software free of charge from Cisco or purchase software from a third-party vendor.

The following sections describe the features available in AAA/TACACS+:

• Enable AAA/TACACS+ and Set Authentication Key

• Enable Authentication for ARA

• Enable TACACS+ Password Protection at the Privileged Level

• Enable Authentication for Login

• Enable an Authentication Override

• Enable Authentication for PPP

• Restrict Network Access

• Specify TACACS+ Authorization for EXEC Access and Network Services

• Start TACACS+ Accounting

• TACACS+ AV Pairs

Additionally, the following features from the previous versions of TACACS are also available in TACACS+. Refer to the section "Enable TACACS and Extended TACACS."

• Establish the TACACS Server Host and Response Times

• Set Limits on Login Attempts

Enable AAA/TACACS+ and Set Authentication Key

Enable Authentication for ARA

The following table lists the supported login authentication methods.

aaa authentication arap default if-needed none

aaa authentication arap MIS-access if-needed none

aaa authentication arap default guest radius

aaa authentication arap default auth-guest radius

aaa authentication arap default local

For information about adding users to the local username database, refer to the "Establish Username Authentication" section in this chapter.

Use the aaa authentication arap command with the method keyword line to specify the line password as the authentication method. For example, to specify the line password as the method of ARA user authentication when no other method list has been defined, enter:

aaa authentication arap default line

Before you can use a line password as the ARA authentication method, you need to define a line password. For more information about defining line passwords, refer to the "Configure Line Password Protection" section in this chapter.

Use the aaa authentication arap command with the radius method keyword to specify RADIUS as the ARA authentication method. For example, to specify RADIUS as the method of ARA user authentication when no other method list has been defined, enter:

aaa authentication arap default radius

Before you can use RADIUS as the ARA authentication method, you need to enable communication with the RADIUS security server. For more information about establishing communication with a RADIUS server, refer to the "Configuring RADIUS" chapter.

Use the aaa authentication arap command with the tacacs+ method keyword to specify TACACS+ as the ARA authentication method. For example, to specify TACACS+ as the method of ARA user authentication when no other method list has been defined, enter:

aaa authentication arap default tacacs+

Before you can use TACACS+ as the ARA authentication method, you need to enable communication with the TACACS+ security server. For more information about establishing communication with a TACACS+ server, refer to the "Configuring TACACS+" chapter.

Enable TACACS+ Password Protection at the Privileged Level

Enable Authentication for Login

Enable an Authentication Override

Enable Authentication for PPP

Restrict Network Access

Refer to "Restrict Network Access Examples" for an example of the aaa authorization command, and for an example of how to use address pooling with this command.

Specify TACACS+ Authorization for EXEC Access and Network Services

You use the aaa authorization command with the tacacs+ keyword to set parameters that restrict a user's network access.

For an example of how to specify TACACS+ authorization, see the "TACACS+ Authorization Example" section at the end of this chapter.

Start TACACS+ Accounting

You use the aaa accounting command with the tacacs+ keyword to turn on TACACS+ accounting for each Cisco IOS privilege level, and network services.

TACACS+ AV Pairs

Table 1 lists the supported TACACS+ AV pairs.

Table 2 lists the supported TACACS+ accounting AV pairs.

Enable CHAP

Access control using Challenge Handshake Authentication Protocol (CHAP) is available on all serial interfaces that use PPP encapsulation. The authentication feature reduces the risk of security violations on your access server.

Enable PAP

Access control using the Password Authentication Protocol (PAP) is available on all serial interfaces that use PPP encapsulation. The authentication feature reduces the risk of security violations on your access server.

Enable IP Accounting and Display IP Access Violations

In addition to providing basic IP accounting functions, our IP accounting support provides information identifying IP traffic that fails IP access lists. Identifying IP source addresses that violate IP access lists alerts you to possible attempts to breach security. The data also indicates that you should verify IP access list configurations.

To display IP access violations for a specific IP accounting database, perform the following task in EXEC mode:

Fault Management

To perform general fault management, complete the tasks in the following sections:

• Display System Information

• Test Network Connectivity

• Limit TCP Transactions

• Convert Line Numbers from Octal to Decimal

• Log System Error Messages

• Enable Debug Operations

Most chapters in this guide include fault management tasks in a monitoring and maintaining section. For example, the chapter "Configuring Interfaces" provides a section on interface loopback testing. Another example is the information on Internet Control Messages Protocol (ICMP) support described in the chapter "Configuring IP."

Display System Information

To provide information about system processes, the software includes an extensive list of EXEC commands that begin with the word show, which, when executed, display detailed tables of system information. Perform the following tasks in EXEC mode to display the information described:

Look for specific show commands in the tables of configuration tasks found throughout the chapters in this guide. See the Access and Communication Servers Command Reference publication for detailed descriptions of the commands.

Test Network Connectivity

Complete the tasks in the following sections to test basic network connectivity:

• Set Up the TCP Keepalive Packet Service

• Test Connections with the Ping Command

• Trace Packet Routes

Set Up the TCP Keepalive Packet Service

The TCP keepalive capability allows an access server to detect when the host with which it is communicating experiences a system failure, even if data stops being transmitted (in either direction). This is most useful on incoming connections. For example, if a host failure occurs while talking to a printer, the access server might never notice, since the printer does not generate any traffic in the opposite direction. If keepalives are enabled, they are sent once every minute on otherwise idle connections. If five minutes pass and no keepalives are detected, the connection is closed. The connection will also be closed if the host replies to a keepalive packet with a reset packet. This will happen if the host crashes and comes back up again.

To set up the TCP keepalive packet service, perform the following task in global configuration mode:

Test Connections with the Ping Command

As an aid to diagnosing basic network connectivity, many network protocols support an echo protocol. The protocol involves sending a special datagram to the destination host, then waiting for a reply datagram from that host. Results from this echo protocol can help in evaluating the path-to-host reliability, delays over the path, and whether the host can be reached or is functioning.

Trace Packet Routes

You can discover the routes that packets will actually take when traveling to their destinations. To do so, perform the following task in EXEC mode:

Limit TCP Transactions

When using a standard TCP implementation to send keystrokes between machines, TCP tends to send one packet for each keystroke typed. On larger networks, many small packets use up bandwidth and contribute to congestion.

John Nagle's algorithm (RFC-896) helps alleviate the small-packet problem in TCP. In general, it works this way: The first character typed after connection establishment is sent in a single packet, but TCP holds any additional characters typed until the receiver acknowledges the previous packet. Then the second, larger packet is sent, and additional typed characters are saved until the acknowledgment comes back. The effect is to accumulate characters into larger chunks, and pace them out to the network at a rate matching the round-trip time of the given connection. This method is usually a good for all TCP-based traffic. However, do not enable the Nagle slow packet avoidance algorithm if you have XRemote users on X Window sessions.

By default, the Nagle algorithm is not enabled. To invoke the Nagle algorithm and thereby reduce TCP transactions, perform the following task in global configuration mode:

Convert Line Numbers from Octal to Decimal

You can convert the line numbers on the ASM-CS access server from their default octal values to decimal values.

To convert ASM-CS octal line numbers to decimal numbers, perform the following task in global configuration mode:

Log System Error Messages

By default, the network servers send the output from debug EXEC command and system error messages to the console terminal. You can redirect these messages, as well as output from asynchronous events such as interface transition, to other destinations. These destinations include virtual terminals, internal buffers, and UNIX hosts running a syslog server; the syslog format is compatible with 4.3 BSD UNIX.

%LINK-5-BOOTP: Ethernet0 address 172.30.160.24, resolved by 172.30.1.111
%LINK-5-RARP: Ethernet0 address 172.30.160.24, resolved by 172.30.1.111
%LINK-5-SLARP: Ethernet0 address 172.30.160.24, resolved by 172.30.1.111

Warning: NVRAM device not found
Warning: NVRAM invalid, possibly due to erase startup-config

Log Errors to a UNIX Syslog Daemon

To set up the syslog daemon on a 4.3 BSD UNIX system, include a line such as the following in the file /etc/syslog.conf:

local7.debugging /usr/adm/logs/cisco.log

The local7 keyword specifies the logging facility to be used; see Table 5-5 for a list of other keywords. The debugging keyword specifies the syslog level; see Table 5-4 for a list of other keywords.

The syslog daemon sends messages at this level or a more severe level to the file specified in the next field. The file must already exist, and the syslog daemon must have permission to write to it.

Enable Message Logging

To enable message logging, perform the following task in global configuration mode:

Set the Error Message Display Device

By default, error messages are directed to the system console. To direct messages to other devices, perform one of the following tasks in global configuration mode:

The internal buffer is circular, so when you copy logging messages to an internal buffer instead of writing them to the console terminal, newer messages overwrite older messages. To display the messages that are logged in the buffer, use the show logging EXEC command. The first message displayed is the oldest message in the buffer.

The EXEC command terminal monitor locally accomplishes the task of displaying the system error messages to a nonconsole terminal.

Define the Error Message Severity Level and Facilities

You can limit messages displayed to the selected device by specifying the severity level of the error message. To do so, perform one of the following tasks in global configuration mode:

The logging console command limits the logging messages displayed on the console terminal to messages with a level number at or below the specified severity level, which is specified by the level argument. Table 5-4 lists the error message level keywords and corresponding UNIX syslog definitions in order from the most severe level to the least severe level.

To display logging messages on a terminal, use the terminal monitor EXEC command.

Current software generates four categories of error messages:

Define the Syslog Facility

You can also configure the syslog facility in which error messages are sent by performing the following task in global configuration mode:

Table 5-5 lists the logging facility types and their descriptions.

Enable Timestamps on Log Messages

By default, log messages are not timestamped. You can enable timestamping of log messages by performing the following task in global configuration mode:

Enable Debug Operations

Your access server includes hardware and software to aid in tracking down problems with the access server or with other hosts on the network. The privileged debug EXEC commands start the console display of several classes of network events. The following tasks describe in general the system debug message feature. Refer to the Debug Command Reference publication for all information regarding debug commands. Also refer to the Troubleshooting Internetworking Systems publication.

You can configure timestamping of system debug messages. Timestamping enhances real-time debugging by providing the relative timing of logged events. This information is especially useful when customers send debugging output to your technical support personnel for assistance. To enable timestamping of system debug messages, perform the following task in global configuration mode:

Normally, the messages are displayed only on the console terminal. See the section "Set the Error Message Display Device" earlier in this chapter to change the output device.

System Performance Management

The following sections describe how to manage general system performance:

• Configure Switching and Scheduling Priorities

• Establish Queuing Strategies

• Modify the System Buffer Size

• Delay EXEC Startup

• Handle Idle Telnet Connections

In addition, most chapters in this guide include performance tasks specific to the chapter content, and the Internetworking Design Guide includes detailed information on performance issues that arise when designing a network.

Configure Switching and Scheduling Priorities

The normal operation of the network server allows the switching operations to use as much of the central processor as is required. If the network is running unusually heavy loads that do not allow the processor the time to handle the routing protocols, you might need to give priority to the system process scheduler. To do so, perform the following task in global configuration mode:

By default, a Route Switch Processor (RSP) spends 4000 microseconds switching packets at interrupt level and then 200 microseconds running processes. To change these scheduling priorities, perform the following task in global configuration mode:

Establish Queuing Strategies

There are four possible queuing algorithms in an access server: first-come-first-serve (FCFS), weighted fair queuing, priority queuing, and custom queuing. For serial interfaces at E1 (2.048 MBPS) and below, weighted fair queuing is used by default. When no other queuing strategies are configured, all other interfaces use FCFS by default.

You can configure an access server to support the following three types of queuing strategies for prioritizing network traffic:

• Weighted Fair Queuing

• Priority Queuing

• Custom Queuing

You can configure weighted fair queuing, priority queuing, and custom queuing, but you can assign only one queue type--a fair queue, a priority group, or a custom queue--to an interface.

Weighted Fair Queuing

When enabled for an interface, weighted fair queuing provides traffic priority management that automatically sorts among individual traffic streams without requiring that you first define access lists.

Weighted fair queuing can manage duplex data streams, such as those between pairs of applications, and simplex data streams such as voice or video. From the perspective of weighted fair queuing, there are two categories of data streams: high-bandwidth sessions and low-bandwidth sessions. Low-bandwidth traffic has effective priority over high-bandwidth traffic, and high-bandwidth traffic shares the transmission service proportionally according to assigned weights.

Priority Queuing

Priority output queuing is a mechanism that allows the administrator to set priorities on the type of traffic passing through the network. Packets are classified according to various criteria, including protocol and subprotocol type, and then queued on one of four output queues (high, medium, normal, and low).

When the server is ready to transmit a packet, it scans the priority queues in order, from highest to lowest, to find the highest-priority packet. After that packet is completely transmitted, the server scans the priority queues again. If a priority output queue fills up, packets will be dropped and, for IP, quench indications will be sent to the original transmitter.

The four priority queues--high, medium, normal, and low--are listed in order from highest to lowest priority. Keepalives sourced by the network server are always assigned to the high-priority queue; all other management traffic (such as IGRP updates) must be configured. Packets that are not classified by the priority list mechanism are assigned to the normal queue.

Custom Queuing

Priority queuing introduces a fairness problem in that packets classified to lower-priority queues might not get serviced in a timely manner or at all, depending upon the bandwidth used by packets sent from the higher-priority output queues.

With custom queuing, a "weighted fair" queuing strategy is implemented for the processing of interface output queues. You can control the percentage of an interface's available bandwidth that is used by a particular kind of traffic. When custom queuing is enabled on an interface, the system maintains 11 output queues for that interface that can be used to modify queuing behavior.

Queuing Task List

You can set up weighted fair queuing, priority queuing, and custom queuing on your network, but you can assign only one of the three to an interface.

You can perform any of the priority-setting tasks in the following sections, depending upon the needs of your network:

• Set Fair Queuing for an Interface

• Set Priority by Protocol Type

• Assign a Default Priority

• Set Priority by Interface Type

• Specify the Maximum Packets and Bytes in the Priority Queues

• Assign a Priority Group or a Custom Queue to an Interface

• Monitor the Priority and Custom Queuing Lists

Set Fair Queuing for an Interface

To enable weighted fair queuing for an interface and set the congestion threshold after which messages for high-bandwidth conversations are dropped, perform the following task in interface configuration mode after specifying the interface:

To disable weighted fair queuing for an interface, use the no fair-queue command. Fair queuing is automatically disabled if either autonomous or SSE switching is enabled.

Set Priority by Protocol Type

You can establish queuing priorities based upon the protocol type by performing the following task in global configuration mode. All Cisco-supported protocols are allowed.

Assign a Default Priority

You can assign a queue for those packets that did not match any other rule in the list. To do so, perform one of the following tasks in global configuration mode:

Set Priority by Interface Type

You can establish queuing priorities on packets entering from a specific interface by performing one of the following tasks in global configuration mode:

Specify the Maximum Packets and Bytes in the Priority Queues

You can specify the maximum number of packets that might be waiting in each of the priority queues. To do so, perform one of the following tasks in global configuration mode:

Assign a Priority Group or a Custom Queue to an Interface

You can assign a priority list number to an interface. Only one list can be assigned per interface. To assign a priority group or custom queue to an interface, perform one of the following tasks in interface configuration mode:

Monitor the Priority and Custom Queuing Lists

You can display information about the input and output queues when priority queuing is enabled on an interface. To do so, perform one of the following tasks in EXEC mode:

If you enter the show queueing command without any keywords, the access server displays status on both custom and priority queue lists.

Modify the System Buffer Size

You can adjust initial buffer pool settings and the limits at which temporary buffers are created and destroyed. To do so, perform the following tasks in global configuration mode:

During normal system operation, there are two sets of buffer pools: public and interface.

• The public pools grow and shrink based upon demand. Some public pools are temporary and are created and destroyed as needed. Other public pools are permanently allocated and cannot be destroyed. The public buffer pools are small, middle, big, large, very large, and huge.

• Interface pools are static, that is, they are all permanent. There is one interface pool for each interface in the router. For example, on a Cisco 4000 1E 4T configuration, there is one Ethernet buffer pool and 4 serial buffer pools. In the buffers command, the type and number arguments control the interface pools.

See the section "Buffer Modification Examples" at the end of this chapter.

The server has one pool of queuing elements and six public pools of packet buffers of different sizes. For each pool, the server keeps count of the number of buffers outstanding, the number of buffers in the free list, and the maximum number of buffers allowed in the free list. To display statistics about the buffer pool on the system, perform the following task in EXEC mode:

Delay EXEC Startup

You can delay the startup of the EXEC on noisy lines until the line has been idle for 3 seconds. To do so, perform the following task in global configuration mode:

Delaying startup of the EXEC is useful on noisy modem lines or when a modem attached to the line is configured to ignore MNP or V.42 negotiations, and MNP or V.42 modems may be dialing in. In these cases, noise or MNP/V.42 packets might be interpreted as usernames and passwords, causing authentication failure before the user can type a username/password. Delaying startup is not useful on nonmodem lines or lines without some kind of login configured.

Handle Idle Telnet Connections

You can configure the access server to set the TCP window to zero (0) when the Telnet connection is idle. To do so, perform the following task in global configuration mode:

Normally, data sent to noncurrent Telnet connections is accepted and discarded. When service telnet-zero-idle is enabled, if a session is suspended (that is, some other connection is made active or the EXEC is sitting in command mode), the TCP window is set to zero. This action prevents the remote host from sending any more data until the connection is resumed. Use this command when it is important that all messages sent by the host be seen by the users and the users are likely to use multiple sessions. Do not use this command if your host will eventually time out and log out a TCP user whose window is zero.

Accounting Management

Accounting management allows you to track individual and group usage of network resources. You can then reallocate resources as needed. The following sections describe accounting management tasks:

• Enable AAA/TACACS+ Accounting

• Display Stack Utilization

• Display Memory Utilization

• Enable IP Accounting for Access List Violations

Additional tasks for measuring system resources are covered in other chapters; for example, IP accounting tasks are described in the chapter, "Configuring IP."

Enable AAA/TACACS+ Accounting

The aaa accounting command allows you to set start/stop accounting for any or all of the listed functions for this command. For minimal accounting control, issue the stop-only command, which sends a stop record accounting notice at the end of the requested user process. For additional accounting control, you can issue the start-stop command, where TACACS+ sends a start accounting notice at the beginning of the requested process and a stop accounting notice at the end of the process. You can further control access and accounting by issuing the wait-start command, which ensures that the start notice is received by the TACACS+ server before granting the user's process request. Accounting is only done to the TACACS+ server.

Before using the aaa accounting command, you must initialize AAA/TACACS+ as described in "Enable AAA/TACACS+ and Set Authentication Key" earlier in this chapter.

Perform the following task in global configuration mode:

Display Stack Utilization

You can display stack utilization of processes and interrupt routines, including the reason for the last system reboot. This feature is useful for analyzing system crashes. To display stack utilization, perform the following task in EXEC mode:

Display Memory Utilization

To display memory usage information, perform the following tasks in EXEC mode:

Enable IP Accounting for Access List Violations

You can enable accounting for Internet Protocol (IP) access list violations and display information identifying IP traffic that fails IP access lists. For information on the IP accounting access-violations feature and commands, see the "Configuring IP" chapter of this publication and the "IP Commands" chapter of the Access and Communication Servers Command Reference publication.

System Management Examples

The following sections provide system management examples:

• System Configuration File Example

• Allowing Users to Clear Lines Example

• Defining an Enable Password for System Operators Example

• Buffer Modification Examples

• TACACS Authentication Examples

• AAA/TACACS+ Authentication Examples

• Username Examples

System Configuration File Example

The following is an example of a typical system configuration file:

! Define line password
line 0 4
 password secret
 login
!
! Define privileged-level password
 enable-password Secret Word
!
! Define a system hostname
hostname TIP
! Define host filenames
boot host host1-confg 172.30.1.111
boot host host2-confg 172.30.1.111
! Define system filenames
boot system sys1-system 172.30.13.111
boot system sys2-system 172.30.1.111
!
! Enable SNMP
snmp-server community
snmp-server trap-authentication
snmp-server host 172.30.1.27 public
snmp-server host 172.30.1.111 public
snmp-server host 172.30.2.63 public
!
! Define TACACS server hosts
tacacs-server host 172.30.1.27
tacacs-server host 172.30.13.33
tacacs-server host 172.30.1.33
!
! Define a message-of-the-day banner
banner motd ^C
The Information Place welcomes you
Please call 1-800-555-2222 for a login account, or enter
your password at the prompt.
^C

Allowing Users to Clear Lines Example

If you want to allow users to clear lines, you can do either of the following:

• Change the privilege level for the clear and clear line commands to 1 or "ordinary user level," as follows. This will allow any user to clear lines.

privilege exec level 1 clear line

• Change the privilege level for the clear and clear line commands to level 2. To do this, use the privilege level global configuration command to specify privilege level 2. Then define an enable password for privilege level 2 and tell all of the users who can be trusted with this feature what the password is.

enable password level 2 pswd2
privilege exec level 2 clear line

Defining an Enable Password for System Operators Example

In the following example, you define an enable password for privilege level 10 for system operators and make clear and debug commands available to anyone with that privilege level enabled.

enable password level 10 pswd10
privilege exec level 10 clear line
privilege exec level 10 debug ppp chap
privilege exec level 10 debug ppp error
privilege exec level 10 debug ppp negotiation

enable password level 15 pswd15
privilege exec level 15 configure
enable password level 10 pswd10
privilege exec level 10 write terminal

Buffer Modification Examples

In the following example, the system will try to keep at least 50 small buffers free:

buffers small min-free 50

In the following example, the system will try to keep no more than 200 medium buffers free:

buffers middle max-free 200

In the following example, the system will try to create one large temporary extra buffer, just after a reload:

buffers large initial 1

In the following example, the system will try to create one permanent huge buffer:

buffers huge permanent 1

TACACS Authentication Examples

The following example shows TACACS enabled for PPP authentication:

int async 1
 ppp authentication chap
 ppp use-tacacs

line 3
 arap use-tacacs

AAA/TACACS+ Authentication Examples

The following example creates a default AAA authentication algorithm used with ARAP:

aaa authentication arap default if-needed none

aaa authentication arap MIS-users if-needed none

Restrict Network Access Examples

The following example allows network authorization using TACACS+:

aaa authorization network tacacs+

The following example provides the same authorization, but also creates address pools called mci and att.

aaa authorization network tacacs+
ip address-pool local
ip local-pool mci 172.16.0.1 172.16.0.255
ip local-pool att 172.17.0.1 172.17.0.255

These address pools can then be selected by the TACACS daemon. A sample configuration of the daemon follows:

       user = mci_customer1 {
            login = cleartext "some password"
            service = ppp protocol = ip {
                addr-pool=mci
            }
        }
        user = att_customer1 {
            login = cleartext "some other password"
            service = ppp protocol = ip {
                addr-pool=att
            }
        }

Username Examples

The following sample configuration sets up secret passwords on access servers A, B, and C, thus enabling the three access servers to connect to each other.

To authenticate connections between access servers A and B, enter the following commands:

• On access server A:

username B password a-b_secret

username A password a-b_secret

username C password a-c_secret

username A password a-c_secret

username C password b-c_secret

username B password b-c_secret

username bill password westward

username bill password 7 21398211

username bill password 7 21398211
username bill password 7 21398211