Alcatel-Lucent 7705 SAR Service Aggregation Router System Management Guide

Alcatel-Lucent 7705

SERVICE AGGREGATION ROUTER OS | RELEASE 2.1

S Y S T E M M A N A G E M E N T G U I D E

Alcatel-Lucent Proprietary

This document contains proprietary information of Alcatel-Lucent and is not to be disclosed or used except in accordance with applicable agreements.

Copyright 2009 © Alcatel-Lucent. All rights reserved.

Alcatel-Lucent assumes no responsibility for the accuracy of the information presented, which is subject to change without notice.

Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent logo are trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners.

Copyright 2009 Alcatel-Lucent.

All rights reserved.

Disclaimers

Alcatel-Lucent products are intended for commercial uses. Without the appropriate network design engineering, they must not be sold, licensed or otherwise distributed for use in any hazardous environments requiring fail-safe performance, such as in the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, direct life-support machines, or weapons systems, in which the failure of products could lead directly to death, personal injury, or severe physical or environmental damage. The customer hereby agrees that the use, sale, license or other distribution of the products for any such application without the prior written consent of Alcatel-Lucent, shall be at the customer's sole risk. The customer hereby agrees to defend and hold Alcatel-Lucent harmless from any claims for loss, cost, damage, expense or liability that may arise out of or in connection with the use, sale, license or other distribution of the products in such applications.

This document may contain information regarding the use and installation of non-Alcatel-Lucent products. Please note that this information is provided as a courtesy to assist you. While Alcatel-Lucent tries to ensure that this information accurately reflects information provided by the supplier, please refer to the materials provided with any non-Alcatel-Lucent product and contact the supplier for confirmation. Alcatel-Lucent assumes no responsibility or liability for incorrect or incomplete information provided about non-Alcatel-Lucent products.

However, this does not constitute a representation or warranty. The warranties provided for

Alcatel-Lucent products, if any, are set forth in contractual documentation entered into by

Alcatel-Lucent and its customers.

This document was originally written in English. If there is any conflict or inconsistency between the

English version and any other version of a document, the English version shall prevail.

When printed by Alcatel-Lucent, this document is printed on recycled paper.

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Alcatel-Lucent 7705 SAR System Management Configuration Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Notes on 7705 SAR-8 and 7705 SAR-F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Authentication, Authorization, and Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Local Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

TACACS+ Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Local Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

RADIUS Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

TACACS+ Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

TACACS+ Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Security Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

When a Server Does Not Respond . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Access Request Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Vendor-Specific Attributes (VSAs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Sample User (VSA) Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Alcatel-Lucent Dictionary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Other Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Secure Shell (SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

CSM Filters and CSM Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Exponential Login Backoff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Configuration Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Reference Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Configuring Security with CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Setting Up Security Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Configuring Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Configuring Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Configuring Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Security Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Security Configuration Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Configuring Management Access Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Configuring CPM (CSM) Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Configuring Password Management Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Configuring Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Configuring Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Copying and Overwriting Users and Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Copying a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

7705 SAR OS System Management Guide Page 3

Table of Contents

Copying a Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Configuring SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Configuring Login Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

RADIUS Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Configuring RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Configuring RADIUS Authorization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

TACACS+ Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Enabling TACACS+ Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Configuring TACACS+ Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Configuring TACACS+ Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Security Command Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Command Hierarchies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Command Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Clear Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Debug Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

SNMP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

SNMP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

SNMP Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Management Information Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

SNMP Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Management Information Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

User-Based Security Model Community Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Access Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Which SNMP Version to Use? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Configuration Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Reference Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Configuring SNMP with CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

SNMP Configuration Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Configuring SNMPv1 and SNMPv2c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Configuring SNMPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Basic SNMP Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Configuring SNMP Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Configuring a Community String . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Configuring View Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Configuring Access Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Configuring USM Community Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Configuring Other SNMP Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

SNMP Command Reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Command Hierarchies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Command Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Page 4 7705 SAR OS System Management Guide

Table of Contents

Event and Accounting Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Logging Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Log Destinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Memory Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

SNMP Trap Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Event Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Event Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

Log Manager and Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Event Filter Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Event Log Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Simple Logger Event Throttling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Default System Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Accounting Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Accounting Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Accounting Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Configuration Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Reference Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Configuring Logging with CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Log Configuration Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

Log Type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Basic Event Log Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

Common Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Configuring an Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Configuring a File ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Configuring an Accounting Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Configuring Event Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

Configuring Throttle Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Configuring a Log Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Configuring an SNMP Trap Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

Configuring a Syslog Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Log Management Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Modifying a Log File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Deleting a Log File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

Modifying a File ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Deleting a File ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Deleting a Syslog ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Modifying a Syslog ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Modifying an SNMP Trap Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Deleting an SNMP Trap Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Modifying a Log Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Deleting a Log Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Modifying Event Control Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Returning to the Default Event Control Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

7705 SAR OS System Management Guide Page 5

Table of Contents

Log Command Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Command Hierarchies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Command Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

Clear Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Standards and Protocol Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

Page 6 7705 SAR OS System Management Guide

List of Tables

Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Table 1:

Table 2:

Management Configuration Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

7705 SAR-8 and 7705 SAR-F Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Table 3:

Table 4:

Table 5:

Table 6:

Table 7:

Table 8:

Table 9:

Supported Authorization Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Security Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

16-bit Mask Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

IP Protocol IDs and Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

IP Option Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Show System Security Access Group Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Show System Security Authentication Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Table 10: Show Communities Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Table 11: Show CPM Filter Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Table 12: Show Management Access Filter Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Table 13: Show Password Options Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Table 14: Show User Profile Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Table 15: Show Source Address Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Table 16: Show SSH Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Table 17: Show User Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Table 18: Show View Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Table 19: Show Users Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

SNMP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Table 20: Show SNMP Counters Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Table 21: Show System Information Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Table 22: Show System Access Group Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Table 23: Show Communities Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Table 24: Show User Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Table 25: Show System Security View Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Event and Accounting Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Table 26: Event Severity Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Table 27: 7705 SAR to Syslog Severity Level Mappings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Table 28: Valid Filter Policy Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Table 29: Log Entry Field Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Table 30: Accounting Record Name and Collection Periods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Table 31: Accounting Record Name Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

7705 SAR OS System Management Guide Page 7

List of Tables

Table 32: Accounting Record Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Table 33: Valid Facility Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Table 34: Threshold Severity Level Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Table 35: Accounting Policy Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

Table 36: Accounting Records Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

Table 37: Event Control Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Table 38: Log File Summary Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Table 39: Filter ID Summary Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Table 40: Filter ID Match Criteria Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

Table 41: Log Collector Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

Table 42: Log ID Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

Table 43: SNMP Trap Group Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

Table 44: Syslog Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Page 8 7705 SAR OS System Management Guide

List of Figures

Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Figure 1:

Figure 2:

RADIUS Requests and Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Security Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Event and Accounting Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Figure 3:

Figure 4:

Event Logging Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Show Log Applications Command Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

7705 SAR OS System Management Guide Page 9

List of Figures

Page 10 7705 SAR OS System Management Guide

List of Acronyms

Acronym

AC

ACL

ACR

AFI

AIS

ANSI

Apipe

ARP

AS

ASAP

ASBR

ATM

ATM PVC

2G

3DES

3G

5620 SAM

7705 SAR

7710 SR

7750 SR

9500 MPR

ABR

Expansion

second generation wireless telephone technology triple DES (data encryption standard) third generation mobile telephone technology

5620 Service Aware Manager

7705 Service Aggregation Router

7710 Service Router

7750 Service Router

9500 Microwave Packet Radio available bit rate area border router alternating current attachment circuit access control list adaptive clock recovery authority and format identifier alarm indication signal

American National Standards Institute

ATM VLL address resolution protocol autonomous system any service, any port autonomous system boundary router asynchronous transfer mode

ATM permanent virtual circuit

7705 SAR OS System Management Guide Page 11

List of Acronyms

Page 12

Acronym

CCM

CE

CEM

CES

CESoPSN

CFM

CIDR

CIR

CLI

CLP

BSTA

BTS

CAS

CBN

CBS

CC

Batt A

B-bit

Bellcore

BFD

BITS

BOF

BRAS

BSC

Expansion

battery A beginning bit (first packet of a fragment)

Bell Communications Research bidirectional forwarding detection building integrated timing supply boot options file

Broadband Remote Access Server

Base Station Controller

Broadband Service Termination Architecture base transceiver station channel associated signaling common bonding networks committed buffer space control channel continuity check continuity check message customer edge circuit emulation circuit emulation circuit emulation services circuit emulation services over packet switched network connectivity fault management classless inter-domain routing committed information rate command line interface cell loss priority

7705 SAR OS System Management Guide

List of Acronyms

CW

DC

DC-C

DC-I

DCE

DCO

DDoS

DES

DHCP

DIS

DNS

DoS

CPU

CRC

CRON

CSM

CSNP

CSPF

CV

Acronym

CoS

CPE

Cpipe

CPM

Expansion

class of service customer premises equipment circuit emulation (or TDM) VLL

Control and Processing Module (CPM is used instead of CSM when referring to CSM filtering – to align with CLI syntax used with other SR products) central processing unit cyclic redundancy check a time-based scheduling service (from chronos = time)

Control and Switching Module complete sequence number PDU constrained shortest path first connection verification customer VLAN (tag) control word direct current

DC return - common

DC return - isolated data communications equipment digitally controlled oscillator distributed DoS data encryption standard dynamic host configuration protocol designated intermediate system domain name server denial of service

7705 SAR OS System Management Guide Page 13

List of Acronyms

Page 14

Acronym

dot1p

ELER

Epipe

ERO

ESD

ETE

ETH-CFM

EVDO

EXP bits

FC

FCS dot1q

DPLL

DSCP

DSL

DSLAM

DTE

DU e911

E-bit

ECMP

EFM

EGP

EIA/TIA-232

Expansion

IEEE 802.1p bits, found in Ethernet or VLAN ingress packet headers and used to map traffic to up to eight forwarding classes

IEEE 802.1q encapsulation for Ethernet interfaces digital phase locked loop differentiated services code point digital subscriber line digital subscriber line access multiplexer data termination equipment downstream unsolicited enhanced 911 service ending bit (last packet of a fragment) equal cost multi-path

Ethernet in the first mile exterior gateway protocol electronic industries alliance/telecommunications industry association standard 232 (also known as

RS-232 )

egress label edge router

Ethernet VLL explicit route object electrostatic discharge end-to-end

Ethernet connectivity fault management (IEEE 802.1ag) evolution - data optimized experimental bits forwarding class frame check sequence

7705 SAR OS System Management Guide

List of Acronyms

Acronym

FTN

FTP

GigE

GRE

GSM

HCM

HEC

HMAC

FDB

FDL

FEC

FF

FIB

FIFO

FNG

FRR

HSDPA

HSPA

IBN

ICMP

ICP

IEEE

IEEE 1588v2

IES

IETF

Expansion

forwarding database facilities data link forwarding equivalence class fixed filter forwarding information base first in, first out fault notification generator fast reroute

FEC-to-NHLFE file transfer protocol

Gigabit Ethernet generic routing encapsulation

Global System for Mobile Communications (2G) high capacity multiplexing header error control hash message authentication code high-speed downlink packet access high-speed packet access isolated bonding networks

Internet control message protocol

IMA control protocol cells

Institute of Electrical and Electronics Engineers

Institute of Electrical and Electronics Engineers standard

1588-2008

Internet Enhanced Service

Internet Engineering Task Force

7705 SAR OS System Management Guide Page 15

List of Acronyms

Page 16

Acronym

IS-IS

IS-IS-TE

ISO

LB

LBM

LBR

LCP

LDP

IGP

ILER

ILM

IMA

IOM

IP

IPCP

Ipipe

LER

LIB

LLF

LLID

LSA

LSDB

LSP

LSR

Expansion

interior gateway protocol ingress label edge router incoming label map inverse multiplexing over ATM input/output module

Internet Protocol

Internet Protocol Control Protocol

IP interworking VLL

Intermediate System-to-Intermediate System

IS-IS-traffic engineering (extensions)

International Organization for Standardization loopback loopback message loopback reply link control protocol label distribution protocol label edge router label information base link loss forwarding loopback location ID link-state advertisement link-state database label switched path link-state PDU (for IS-IS) label switch router link-state request

7705 SAR OS System Management Guide

List of Acronyms

Acronym

LSU

LT

LTM

LTN

LTR

MA

MAC

MBB

MBS

MEN

MEP

MFC

MHF

MIB

MIP

MIR

MLPPP

MBSP

MC-MLPPP

MD

MD5

MDA

ME

MEF

Expansion

link-state update linktrace linktrace message

LSP ID to NHLFE linktrace reply maintenance association media access control make-before-break maximum buffer space maximum burst size media buffer space

Mobile Backhaul Service Provider multi-class multilink point-to-point protocol maintenance domain message digest version 5 (algorithm) media dependent adapter maintenance entity

Metro Ethernet Forum

Metro Ethernet network maintenance association end point multi-field classification

MIP half function management information base maintenance association intermediate point minimum information rate multilink point-to-point protocol

7705 SAR OS System Management Guide Page 17

List of Acronyms

Page 18

Acronym

MP

MPLS

MPR

MRRU

MRU

MSDU

MS-PW

MTSO

MTU

MW

NBMA

NET

NHLFE

NHOP

NNHOP

NNI

Node B

NSAP

NSSA

NTP

OAM

OAMPDU

OC3

OS

Expansion

merge point multilink protocol multiprotocol label switching see 9500 MPR maximum received reconstructed unit maximum receive unit

MAC Service Data Unit multi-segment pseudowire mobile trunk switching office maximum transmission unit multi-tenant unit microwave non-broadcast multiple access (network) network entity title next hop label forwarding entry next-hop next next-hop network-to-network interface similar to BTS but used in 3G networks — term is used in

UMTS (3G systems) while BTS is used in GSM (2G systems) network service access point not-so-stubby area network time protocol operations, administration, and maintenance

OAM protocol data units optical carrier, level 3 operating system

7705 SAR OS System Management Guide

List of Acronyms

Acronym

PIR

PLR

POP

POS

PE

PHB

PHY

PID

OSI

OSINLCP

OSPF

OSPF-TE

OSS

PDU

PDV

PDVT

PPP

PSN

PSNP

PTP

PVC

PVCC

PW

PWE3

QoS

RADIUS

7705 SAR OS System Management Guide

Expansion

Open Systems Interconnection (reference model)

OSI Network Layer Control Protocol

Open Shortest Path First

OSPF-traffic engineering (extensions) operations support system protocol data units packet delay variation packet delay variation tolerance provider edge router per-hop behavior physical layer protocol ID peak information rate point of local repair point of presence packet over SONET point-to-point protocol packet switched network partial sequence number PDU precision time protocol permanent virtual circuit permanent virtual channel connection pseudowire pseudowire emulation edge-to-edge quality of service

Remote Authentication Dial In User Service

Page 19

List of Acronyms

Page 20

Acronym

RTN

RTP

SAA

SAP

RSVP-TE

R&TTE

RT

RTM

RAN

RDI

RED

RESV

RIB

RNC

RRO

RS-232

SDH

SDI

SDP

SE

SAR-8

SAR-F

SAToP

SCP

SFP

SGT

Expansion

Radio Access Network remote defect indication random early discard reservation routing information base

Radio Network Controller record route object recommended standard 232 (also known as

EIA/TIA-232

) resource reservation protocol - traffic engineering

Radio and Telecommunications Terminal Equipment receive/transmit routing table manager battery return real-time protocol service assurance agent service access point

7705 Service Aggregation Router - 8-slot chassis

7705 Service Aggregation Router - fixed form-factor chassis structure-agnostic TDM over packet secure copy synchronous digital hierarchy serial data interface service destination point shared explicit small form-factor pluggable (transceiver) self-generated traffic

7705 SAR OS System Management Guide

List of Acronyms

Acronym

SPE

SPF

SPT

SR

SRLG

SSH

SSU

STM1

SHA-1

SIR

SLA

SNMP

SNPA

SNTP

SONET

S-PE

SVC

TACACS+

TCP

TDM

TE

TFTP

TLDP

TLV

ToS

T-PE

Expansion

secure hash algorithm sustained information rate

Service Level Agreement

Simple Network Management Protocol subnetwork point of attachment simple network time protocol synchronous optical networking switching provider edge router source provider edge router shortest path first shortest path tree service router (includes 7710 SR, 7750 SR) shared risk link group secure shell system synchronization unit synchronous transport module, level 1 switched virtual circuit

Terminal Access Controller Access-Control System Plus transmission control protocol time division multiplexing traffic engineering trivial file transfer protocol targeted LDP type length value type of service terminating provider edge router

7705 SAR OS System Management Guide Page 21

List of Acronyms

Page 22

Acronym

V.35

VC

VCC

VCCV

VCI

VID

VLAN

VLL

TPE

TPID

TTL

TTM

UBR

UDP

UMTS

UNI

VoIP

VP

VPC

VPI

VPN

VPRN

VRF

WCDMA

WRED

Expansion

target provider edge router tag protocol identifier time to live tunnel table manager unspecified bit rate user datagram protocol

Universal Mobile Telecommunications System (3G) user-to-network interface v-series recommendation 35 virtual circuit virtual channel connection virtual circuit connectivity verification virtual circuit identifier

VLAN ID virtual LAN virtual leased line voice over IP virtual path virtual path connection virtual path identifier virtual private network virtual private routed network virtual routing and forwarding table wideband code division multiple access (transmission protocol used in UMTS networks) weighted random early discard

7705 SAR OS System Management Guide

Preface

About This Guide

This guide describes general information you will need to configure router security, SNMP features, and event and accounting logs. It covers basic tasks such as configuring management access filters that control traffic in and out of the CSM, passwords, user profiles, security such as RADIUS, TACACS+, and SSH servers, the router clock, and virtual routers.

This guide is organized into functional chapters and provides concepts and descriptions of the implementation flow, as well as Command Line Interface (CLI) syntax and command usage.

Audience

This guide is intended for network administrators who are responsible for configuring the

7705 SAR. It is assumed that the network administrators have an understanding of networking principles and configurations. Protocols, standards, and processes described in this guide include the following:

• CLI concepts

• system and user access and security

• SNMP

• event and accounting logs

7705 SAR OS System Management Guide Page 23

Preface

List of Technical Publications

The 7705 SAR documentation set is composed of the following guides:

• 7705 SAR OS Basic System Configuration Guide

This guide describes basic system configurations and operations.

• 7705 SAR OS System Management Guide

This guide describes system security and access configurations as well as event logging and accounting logs.

• 7705 SAR OS Interface Configuration Guide

This guide describes card and port provisioning.

• 7705 SAR OS Router Configuration Guide

This guide describes logical IP routing interfaces, IP-based filtering, and routing policies.

• 7705 SAR OS MPLS Guide

This guide describes how to configure Multiprotocol Label Switching (MPLS),

Resource Reservation Protocol for Traffic Engineering (RSVP-TE), and Label

Distribution Protocol (LDP).

• 7705 SAR OS Services Guide

This guide describes how to configure service parameters such as service access points (SAPs), service destination points (SDPs), customer information, user services, and Operations, Administration and Maintenance (OAM) tools.

• 7705 SAR OS Quality of Service Guide

This guide describes how to configure Quality of Service (QoS) policy management.

• 7705 SAR OS Routing Protocols Guide

This guide provides an overview of dynamic routing concepts and describes how to configure them.

Technical Support

If you purchased a service agreement for your 7705 SAR router and related products from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller for assistance. If you purchased an Alcatel-Lucent service agreement, contact your welcome center at:

Web: http://www.alcatel-lucent.com/support

Page 24 7705 SAR OS System Management Guide

Getting Started

In This Chapter

This chapter provides process flow information to configure system security and access functions as well as event and accounting logs.

Alcatel-Lucent 7705 SAR System Management

Configuration Process

Table 1 lists the tasks necessary to configure system security and access functions and

logging features.

Area

System security

Each chapter in this book is presented in an overall logical configuration flow. Each section describes a software area and provides CLI syntax and command usage to configure parameters for a functional area.

Task

Table 1: Management Configuration Process

Chapter

Configure system security parameters, such as authentication, authorization, and accounting

Security on page 29

Configure SNMP elements

SNMP on page 157

Network management

Operational functions

Reference

Configure event and accounting logs

List of IEEE, IETF, and other proprietary entities

Event and Accounting Logs on page 199

Standards and Protocol Support on page

307

7705 SAR OS System Management Guide Page 25

Getting Started

Notes on 7705 SAR-8 and 7705 SAR-F

The 7705 SAR-8 and the 7705 SAR-F run the same operating system software. The main difference between the products is their hardware configuration. The 7705 SAR-8 has an

8-slot chassis that supports two CSMs, six adapter cards, and a Fan module. The

7705 SAR-F chassis has a fixed hardware configuration, replacing the 7705 SAR-8 physical components (the CSM, Fan module, and adapter cards) with an all-in-one unit that provides

comparable functional blocks, as detailed in Table 2 .

The fixed configuration of the 7705 SAR-F means that provisioning the router at the “card slot” and “type” levels is preset and is not user-configurable. Operators begin configurations at the port level.

Note:

Unless stated otherwise, references to the terms “Adapter card” and “CSM” throughout the 7705 SAR OS documentation set include the equivalent functional blocks on the 7705 SAR-F.

7705 SAR-8

CSM

Fan module

16-port T1/E1 ASAP

Adapter card

Table 2: 7705 SAR-8 and 7705 SAR-F Comparison

7705 SAR-F

Control and switching functions

Notes

The control and switching functions include the console and management interfaces, the alarm and fan functions, the synchronization interfaces, system LEDs, and so on.

Integrated with the control and switching functions

16 individual T1/E1 ports on the faceplate

The T1/E1 ports on the 7705 SAR-F are equivalent to the

T1/E1 ports on the 16-port T1/E1 ASAP Adapter card, except that the 16 T1/E1 ports on the 7705 SAR-F support multiple synchronization sources to support two timing references.

On the 7705 SAR-8, the CLI indicates the MDA type for the

16-port T1/E1 ASAP Adapter card as

a16-chds1

. On the

7705 SAR-F, the CLI indicates the MDA type for the

7705 SAR-F ports as a16-chds1v2

.

Page 26 7705 SAR OS System Management Guide

Getting Started

7705 SAR-8

8-port Ethernet

Adapter card

Requires user configuration at card

(IOM) and MDA

(adapter card) levels

Table 2: 7705 SAR-8 and 7705 SAR-F Comparison (Continued)

7705 SAR-F

8 individual Ethernet ports on the faceplate

Notes

The –48 VDC versions of the 7705 SAR-8 support two versions of the 8-port Ethernet Adapter card, with version 2 having additional support for Synchronous Ethernet. The

Ethernet ports on the 7705 SAR-F are equivalent to the

Ethernet ports on version 2 of the 8-port Ethernet Adapter card and support multiple synchronization sources to support two timing references.

The +24 VDC version of the 7705 SAR-8 only supports version 2 of the 8-port Ethernet Adapter card.

On the 7705 SAR-8, the CLI indicates the MDA type for the

8-port Ethernet Adapter card as

a8-eth

or a8-ethv2

. On the 7705 SAR-F, the CLI indicates the MDA type for the

7705 SAR-F Ethernet ports as a8-ethv3

, to distinguish it from the actual version 2 of the 8-port Ethernet Adapter card.

Configuration at card

(IOM) and MDA

(adapter card) levels is preset and users cannot change these types

7705 SAR OS System Management Guide Page 27

Getting Started

Page 28 7705 SAR OS System Management Guide

Security

In This Chapter

This chapter provides information to configure security parameters. Topics in this chapter include:

•

Authentication, Authorization, and Accounting on page 30

→

Authentication on page 31

→

Authorization on page 33

→

Accounting on page 36

•

Security Controls on page 38

→

When a Server Does Not Respond on page 38

→

Access Request Flow on page 38

•

Vendor-Specific Attributes (VSAs) on page 40

→

Sample User (VSA) Configuration on page 42

•

Other Security Features on page 44

→

Secure Shell (SSH) on page 44

→

CSM Filters and CSM Security on page 45

→

Exponential Login Backoff on page 46

→

Encryption on page 46

•

Configuration Notes on page 47

•

Configuring Security with CLI on page 49

•

Security Command Reference on page 73

7705 SAR OS System Management Guide Page 29

Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting

This chapter describes authentication, authorization, and accounting (AAA) used to monitor and control network access on the 7705 SAR. Network security is based on a multi-step process. The first step, authentication, validates a user’s name and password. The second step is authorization, which allows the user to access and execute commands at various command levels based on profiles assigned to the user.

The third step, accounting, keeps track of the activity of a user who has accessed the network. The type of accounting information recorded can include a history of the commands executed, the amount of time spent in the session, the services accessed, and the data transfer size during the session. The accounting data can then be used to analyze trends, and also for billing and auditing purposes.

You can configure the 7705 SAR to use local, Remote Authentication Dial In User Service

(RADIUS), or Terminal Access Controller Access Control System Plus (TACACS+) security to validate users who attempt to access the router by console, Telnet, or FTP. You can select the authentication order that determines the authentication method to try first, second, and third.

The 7705 SAR supports the following security features:

• RADIUS can be used for authentication, authorization, and accounting

• TACACS+ can be used for authentication, authorization, and accounting

• local security can be implemented for authentication and authorization

Figure 1 depicts end-user access requests sent to a RADIUS server. After validating the user

names and passwords, the RADIUS server returns an access accept message to the users on

ALU-1 and ALU-2. The user name and password from ALU-3 could not be authenticated, thus access was denied.

Page 30 7705 SAR OS System Management Guide

Security

ALU-1

Figure 1: RADIUS Requests and Responses

RADIUS Server

Authentication

Access Request

Access Accepted

Access Request

Access Request

X

Access Accepted

ALU-2 ALU-3

Network

19673

Authentication

Authentication validates a user name and password combination when a user attempts to log in.

When a user attempts to log in through the console, Telnet, SSH, SCP, or FTP, the

7705 SAR client sends an access request to a RADIUS, TACACS+, or local database.

Transactions between the client and a RADIUS server are authenticated through the use of a shared secret. The secret is never transmitted over the network. User passwords are sent encrypted between the client and RADIUS server, which prevents someone snooping on an insecure network to learn password information.

If the RADIUS server does not respond within a specified time, the router issues the access request to the next configured servers. Each RADIUS server must be configured identically to guarantee consistent results. Up to five RADIUS servers can be configured.

If a server is unreachable, it will not be used again by the RADIUS application until 30 seconds have elapsed, to give the server time to recover from its unreachable state. After 30 seconds, the unreachable server becomes available again for the RADIUS application.

If, within the 30 seconds, the RADIUS server receives a valid response to a previously sent

RADIUS packet on that unreachable server, the server immediately becomes available again.

7705 SAR OS System Management Guide Page 31

Authentication, Authorization, and Accounting

If any RADIUS server rejects the authentication request, it sends an access reject message to the router. In this case, no access request is issued to any other RADIUS servers. However, if other authentication methods such as TACACS+ and/or local are configured, then these methods are attempted. If no other authentication methods are configured, or all methods reject the authentication request, then access is denied.

The user login is successful when the RADIUS server accepts the authentication request and responds to the router with an access accept message.

Implementing authentication without authorization for the 7705 SAR does not require the configuration of VSAs (Vendor Specific Attributes) on the RADIUS server. However, users, user access permissions, and command authorization profiles must be configured on each router.

Any combination of these authentication methods can be configured to control network access from a 7705 SAR router:

•

Local Authentication

•

RADIUS Authentication

•

TACACS+ Authentication

Local Authentication

Local authentication uses user names and passwords configured on the router to authenticate login attempts. The user names and passwords are local to each router, not to user profiles.

By default, local authentication is enabled. When one or more of the other security methods are enabled, local authentication is disabled. Local authentication is restored when the other authentication methods are disabled. Local authentication is attempted if the other authentication methods fail and local is included in the authentication order password parameters.

Locally, you can configure user names and password management information. This is referred to as local authentication. Remote security servers such as RADIUS or TACACS+ are not enabled.

RADIUS Authentication

Remote Authentication Dial-In User Service (RADIUS) is a client/server security protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize access to the requested system or service.

Page 32 7705 SAR OS System Management Guide

Security

RADIUS allows you to maintain user profiles in a shared central database and provides better security, allowing a company to set up a policy that can be applied at a single administered network point.

RADIUS Server Selection

Up to five RADIUS servers can be configured. They can be selected to authenticate user requests in two ways, using either the direct method or the round-robin method. The default method is direct.

Direct

In direct mode, the first server, as defined by the server-index

command, is the primary server. This server is always used first when authenticating a request.

Round-robin

In round-robin mode, the server used to authenticate a request is the next server in the list, following the last authentication request. For example, if server 1 is used to authenticate the first request, server 2 is used to authenticate the second request, and so on.

TACACS+ Authentication

Terminal Access Controller Access Control System, commonly referred to as TACACS, is an authentication protocol that allows a remote access server to forward a user's login password to an authentication server to determine whether access can be allowed to a given system. TACACS is an encryption protocol and therefore less secure than the later Terminal

Access Controller Access Control System Plus (TACACS+) and RADIUS protocols.

TACACS+ and RADIUS have largely replaced earlier protocols in the newer or recently updated networks. TACACS+ uses Transmission Control Protocol (TCP) and RADIUS uses the User Datagram Protocol (UDP). TACACS+ is popular as TCP is thought to be a more reliable protocol. RADIUS combines authentication and authorization. TACACS+ separates these operations.

Authorization

The 7705 SAR supports local, RADIUS, and TACACS+ authorization to control the actions of specific users by applying a profile based on user name and password configurations once network access is granted. The profiles are configured locally as well as on the RADIUS

server as VSAs. See Vendor-Specific Attributes (VSAs) .

7705 SAR OS System Management Guide Page 33

Authentication, Authorization, and Accounting

Once a user has been authenticated using RADIUS (or another method), the 7705 SAR router can be configured to perform authorization. The RADIUS server can be used to:

• download the user profile to the 7705 SAR router

• send the profile name that the node should apply to the 7705 SAR router

Profiles consist of a suite of commands that the user is allowed or not allowed to execute.

When a user issues a command, the authorization server looks at the command and the user information and compares it with the commands in the profile. If the user is authorized to issue the command, the command is executed. If the user is not authorized to issue the command, then the command is not executed.

Profiles must be created on each 7705 SAR router and should be identical for consistent results. If the profile is not present, then access is denied.

Table 3 displays the following scenarios.

• If the user is authenticated locally (on the 7705 SAR router), local authorization is supported and remote (RADIUS) authorization cannot be performed.

• If the user is authenticated by the RADIUS server, both local authorization and remote (RADIUS) authorization are supported.

• If the user is TACACS+ authenticated, local authorization is supported and remote

(RADIUS) authorization cannot be performed.

When authorization is configured and profiles are downloaded to the router from the

RADIUS server, the profiles are considered temporary configurations and are not saved when the user session terminates.

Table 3: Supported Authorization Configurations

7705 SAR configured user

Local Authorization RADIUS Authorization

Supported

RADIUS server configured user Supported

Not Supported

Supported

TACACS+ server configured user Supported Not Supported

Page 34 7705 SAR OS System Management Guide

Security

When using authorization, maintaining a user database on the router is not required. User names can be configured on the RADIUS server. User names and their associated passwords are temporary and are not saved in the configuration database when the user session terminates.

•

Local Authorization

•

RADIUS Authorization

•

TACACS+ Authorization

Local Authorization

Local authorization uses user profiles and user access information after a user is authenticated. The profiles and user access information specify the actions the user can and cannot perform.

By default, local authorization is enabled. Local authorization is disabled only when a different remote authorization method is configured (RADIUS authorization or TACACS+).

Local authorization is restored when RADIUS authorization is disabled.

You must configure profile and user access information locally.

RADIUS Authorization

RADIUS authorization grants or denies access permissions for a 7705 SAR router.

Permissions include the use of FTP, Telnet, SSH (SCP), and console access. When granting

Telnet, SSH (SCP) and console access to the 7705 SAR router, authorization can be used to limit what CLI commands the user is allowed to issue and which file systems the user is allowed or denied access to.

TACACS+ Authorization

Like RADIUS authorization, TACACS+ grants or denies access permissions for a

7705 SAR router. The TACACS+ server sends a response based on the user name and password.

TACACS+ separates the authentication and authorization functions. RADIUS combines the authentication and authorization functions.

7705 SAR OS System Management Guide Page 35

Authentication, Authorization, and Accounting

Accounting

Accounting tracks user activity to a specific host. The 7705 SAR supports RADIUS and

TACACS+ accounting.

RADIUS Accounting

When enabled, RADIUS accounting sends command line accounting from the 7705 SAR router to the RADIUS server. The router sends accounting records using UDP packets at port 1813 (decimal).

The router issues an accounting request packet for each event requiring the activity to be recorded by the RADIUS server. The RADIUS server acknowledges each accounting request by sending an accounting response after it has processed the accounting request. If no response is received in the time defined in the timeout parameter, the accounting request must be retransmitted until the configured retry count is exhausted. A trap is issued to alert the NMS (or trap receiver) that the server is unresponsive. The router issues the accounting request to the next configured RADIUS server (up to 5).

User passwords and authentication keys of any type are never transmitted as part of the accounting request.

When RADIUS accounting is enabled, the server is responsible for receiving accounting requests and returning a response to the client indicating that it has successfully received the request. Each command issued on the 7705 SAR router generates a record sent to the

RADIUS server. The record identifies the user who issued the command and the timestamp.

Accounting can be configured independently from RADIUS authorization and RADIUS authentication.

TACACS+ Accounting

The 7705 SAR allows you to configure the type of accounting record packet that is to be sent to the TACACS+ server when specified events occur on the device. The accounting

recordtype

parameter indicates whether TACACS+ accounting start and stop packets will be sent or just stop packets will be sent. A start packet is sent to a TACACS+ server when an authenticated user establishes a Telnet or SSH session and a stop packet is sent when the user logs out.

Page 36 7705 SAR OS System Management Guide

Security

When a user logs in to request access to the network using Telnet or SSH, or a user enters a command for which accounting parameters are configured, or a system event occurs, such as a reboot or a configuration file reload, the 7705 SAR checks the configuration to see if

TACACS+ accounting is required for the particular event.

If TACACS+ accounting is required, then, depending on the accounting record type specified, the device sends a start packet to the TACACS+ accounting server that contains information about the event.

The TACACS+ accounting server acknowledges the start packet and records information about the event. When the event ends, the device sends a stop packet. The stop packet is acknowledged by the TACACS+ accounting server.

7705 SAR OS System Management Guide Page 37

Security Controls

Security Controls

You can configure the 7705 SAR to use RADIUS, TACACS+, and local authentication to validate users requesting access to the network. The order in which password authentication is processed among RADIUS, TACACS+ and local passwords can be specifically configured. For example, the authentication order can be configured to process authorization via TACACS+ first, then RADIUS for authentication and accounting. Local access can be specified next in the authentication order in the event that the RADIUS and TACACS+ servers are not operational.

When a Server Does Not Respond

A trap is issued if a RADIUS server is unresponsive. An alarm is raised if RADIUS is enabled with at least one RADIUS server and no response is received to either accounting or user access requests from any server.

Periodic checks to determine if the primary server is responsive again are performed. If a server is down, it will not be contacted for 5 minutes. If a login is attempted after 5 minutes, then the server is contacted again. If a server has the health check feature enabled and is unresponsive, the server’s status is checked every 30 seconds. Health check is enabled by default. When a service response is restored from at least one server, the alarm condition is cleared. Alarms are raised and cleared on the Alcatel-Lucent Fault Manager or other third party fault management servers.

The servers are accessed in order from lowest to highest specified index (from 1 to 5) for authentication requests until a response from a server is received. A higher indexed server is only queried if no response is received from a lower indexed server. If a response from the server is received, no other server is queried.

Access Request Flow

In Figure 2 , the authentication process is defined in the

config>system>security> password

context. The authentication order is determined by specifying the sequence in which password authentication is attempted among RADIUS, TACACS+, and local servers.

This example uses the authentication order of RADIUS, then TACACS+, and finally, local.

An access request is sent to RADIUS server 1. One of two scenarios can occur. If there is no response from the server, the request is passed to the next RADIUS server with the next lowest index (RADIUS server 2) and so on, until the last RADIUS server is attempted

(RADIUS server 5). If server 5 does not respond, the request is passed to the TACACS+ server 1. If there is no response from that server, the request is passed to the next TACACS+ server with the next lowest index (TACACS+ server 2) and so on.

Page 38 7705 SAR OS System Management Guide

Security

If a request is sent to an active RADIUS server and the user name and password are not recognized, access is denied and passed on to the next authentication option, in this case, the

TACACS+ server. The process continues until the request is either accepted, denied, or each server is queried. Finally, if the request is denied by the active TACACS+ server, the local parameters are checked for user name and password verification. This is the last chance for the access request to be accepted.

Figure 2: Security Flow

No Response No Response No Response No Response

Start

Deny

RADIUS

Server 1

Access

Denied

RADIUS

Server 2

Access

Denied

RADIUS

Server 3

Access

Denied

RADIUS

Server 4

Access

Denied

RADIUS

Server 5

No Response No Response No Response No Response

TACACS+

Server 1

Access

Denied

TACACS+

Server 2

Access

Denied

TACACS+

Server 3

TACACS+

Server 4

TACACS+

Server 5

Deny

Local

Accept

Deny

Access

19672

7705 SAR OS System Management Guide Page 39

Vendor-Specific Attributes (VSAs)

Vendor-Specific Attributes (VSAs)

The 7705 SAR software supports the configuration of Alcatel-Lucent-specific RADIUS attributes. These attributes are known as vendor-specific attributes (VSAs) and are discussed in RFC 2138. VSAs must be configured when RADIUS authorization is enabled. It is up to the vendor to specify the format of their VSA. The attribute-specific field is dependent on the vendor's definition of that attribute. The Alcatel-Lucent-defined attributes are encapsulated in a RADIUS vendor-specific attribute with the vendor ID field set to 6527, the vendor ID number.

Note that “PE-Record” should be added as a new standard attribute in the standard RADIUS dictionary file.

The following RADIUS VSAs are supported by Alcatel-Lucent:

• timetra-access <ftp> <console> <both>

— this is a mandatory command that must be configured. This command specifies whether the user has FTP and /or console (serial port, Telnet, and SSH) access.

• timetra-profile <profile-name>

— when configuring this VSA for a user, it is assumed that the user profiles are configured on the local 7705 SAR router and the following applies for local and remote authentication:

1. The authentication-order

parameters configured on the router must include the local

keyword.

2. The user name may or may not be configured on the 7705 SAR router.

3. The user must be authenticated by the RADIUS server.

4. Up to eight valid profiles can exist on the router for a user. The sequence in which the profiles are specified is relevant. The most explicit matching criteria must be ordered first. The process stops when the first complete match is found.

If all the above-mentioned conditions are not met, then access to the router is denied and a failed login event/trap is written to the security log.

• timetra-default-action <permit-all | deny-all | none>

— this is a mandatory command that must be configured even if the timetra-cmd

VSA is not used. This command specifies the default action when the user has entered a command and no entry configured in the timetra-cmd

VSA for the user resulted in a match condition.

• timetra-cmd <match-string>

— configures a command or command subtree as the scope for the match condition

The command and all subordinate commands in subordinate command levels are specified.

Configure from most specific to least specific. The 7705 SAR exits on the first match; subordinate levels cannot be modified with subsequent action commands.

Subordinate level VSAs must be entered prior to this entry to be effective.

Page 40 7705 SAR OS System Management Guide

Security

All commands at and below the hierarchy level of the matched command are subject to the timetra-action

VSA.

Multiple match-strings can be entered in a single timetra-cmd

VSA. Match strings must be semicolon (;) separated (maximum string length is 254 characters).

One or more

timetra-cmd

VSAs can be entered followed by a single timetra-action

VSA:

• timetra-action <deny | permit>

— causes the permit or deny action to be applied to all match strings specified since the last timetra-action

VSA

• timetra-home-directory <home-directory string>

— specifies the home directory that applies for the FTP and CLI user. If this VSA is not configured, the home directory is Compact Flash slot 1 (

cf3

:).

• timetra-restrict-to-home-directory <true | false>

— specifies if user access is limited to their home directory (and directories and files subordinate to their home directory). If this VSA is not configured, the user is allowed to access the entire file system.

• timetra-login-exec <login-exec-string>

— specifies the login exec file that is executed when the user login is successful. If this VSA is not configured, no login exec file is applied.

If no VSAs are configured for a user, then the following applies.

• The password authentication-order command on the 7705 SAR router

must

include local

.

• The user name must be configured on the 7705 SAR router.

• The user must be successfully authenticated by the RADIUS server.

• A valid profile must exist on the 7705 SAR router for this user.

If all conditions listed above are not met, then access to the 7705 SAR

router

is denied and a failed login event/trap is written to the security log.

For receiving data from the RADIUS server, the following are supported:

• Juniper (vendor-id 4874) attributes 4 (Primary DNS server) and 5 (Secondary DNS server)

• Redback (vendor-id 2352) attributes 1 (Primary DNS) and 2 (Secondary DNS)

• sending authentication requests: (from the DSL Forum) (vendor-id 3561), attributes

1 (Circuit ID) and 2 (Remote ID)

7705 SAR OS System Management Guide Page 41

Vendor-Specific Attributes (VSAs)

Sample User (VSA) Configuration

The following example displays a user-specific VSA configuration. This configuration shows attributes for users named ruser1

and ruser2

.

The following example shows that user ruser1

is granted console access. ruser1

’s home directory is in compact flash slot 3 and is limited to the home directory. The default action permits all packets when matching conditions are not met. The timetra-cmd

parameters allow the user to use the tools;telnet;configure system security commands.

Matching strings specified in the timetra-action

command are denied for this user.

The user ruser2

is granted FTP access. The default action denies all packets when matching conditions are not met. The timetra-cmd

parameters allow the user to use the configure, show, and debug commands. Matching strings specified in the timetra-action

command are permitted for this user.

users.timetra

ruser1 Auth-Type := System, Password == "ruser1"

Service-Type = Login-User,

Idle-Timeout = 600,

Timetra-Access = console,

Timetra-Home-Directory = cf3:

Timetra-Restrict-To-Home = true

Timetra-Default-Action = permit-all,

Timetra-Cmd = "tools;telnet;configure system security",

Timetra-Action = deny ruser2 Auth-Type := System, Password == "ruser2"

Service-Type = Login-User,

Idle-Timeout = 600,

Timetra-Access = ftp

Timetra-Default-Action = deny-all,

Timetra-Cmd = "configure",

Timetra-Cmd = "show",

Timetra-Action = permit,

Timetra-Cmd = "debug",

Timetra-Action = permit,

Page 42 7705 SAR OS System Management Guide

Security

Alcatel-Lucent Dictionary

# Version: 20061003-1

VENDORAlcatel-IPD6527

# User management VSAs

ATTRIBUTE Timetra-Access1integerAlcatel-IPD

ATTRIBUTE Timetra-Home-Directory2stringAlcatel-IPD

ATTRIBUTE Timetra-Restrict-To-Home3integerAlcatel-IPD

ATTRIBUTE Timetra-Profile4stringAlcatel-IPD

ATTRIBUTE Timetra-Default-Action5integer Alcatel-IPD

ATTRIBUTE Timetra-Cmd6stringAlcatel-IPD

ATTRIBUTE Timetra-Action7integerAlcatel-IPD

ATTRIBUTE Timetra-Exec-File8stringAlcatel-IPD

# RADIUS authorization and CoA VSAs

ATTRIBUTE Alc-Primary-Dns9ipaddrAlcatel-IPD

ATTRIBUTE Alc-Secondary-Dns10ipaddrAlcatel-IPD

ATTRIBUTE Alc-Subsc-ID-Str11stringAlcatel-IPD

ATTRIBUTE Alc-Subsc-Prof-Str12stringAlcatel-IPD

ATTRIBUTE Alc-SLA-Prof-Str13stringAlcatel-IPD

ATTRIBUTE Alc-Force-Renew14stringAlcatel-IPD

# CoA

ATTRIBUTE Alc-Create-Host15stringAlcatel-IPD

# CoA

ATTRIBUTE Alc-ANCP-Str16stringAlcatel-IPD

ATTRIBUTE Alc-Retail-Serv-Id17integerAlcatel-IPD

ATTRIBUTE Alc-Default-Router18ipaddrAlcatel-IPD

# RADIUS accounting VSAs

ATTRIBUTE Alc-Acct-I-Inprof-Octets-6419octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-I-Outprof-Octets-6420octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-O-Inprof-Octets-6421octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-O-Outprof-Octets-6422octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-I-Inprof-Pkts-6423octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-I-Outprof-Pkts-6424octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-O-Inprof-Pkts-6425octetsAlcatel-IPD

ATTRIBUTE Alc-Acct-O-Outprof-Pkts-6426octetsAlcatel-IPD

ATTRIBUTE Alc-Client-Hardware-Addr27stringAlcatel-IPD

# CoA

VALUE Timetra-Restrict-To-Hometrue1

VALUE Timetra-Restrict-To-Homefalse2

VALUE Timetra-Accessftp1

VALUE Timetra-Accessconsole2

VALUE Timetra-Accessboth3

VALUE Timetra-Default-Actionpermit-all1

VALUE Timetra-Default-Actiondeny-all2

VALUE Timetra-Default-Actionnone3

VALUE Timetra-Actionpermit1

VALUE Timetra-Actiondeny2

7705 SAR OS System Management Guide Page 43

Other Security Features

Other Security Features

Secure Shell (SSH)

Secure Shell Version 1 (SSH1) is a protocol that provides a secure, encrypted Telnet-like connection to a router. A connection is always initiated by the client (the user).

Authentication takes place by one of the configured authentication methods (local,

RADIUS, or TACACS+). With authentication and encryption, SSH allows for a secure connection over an insecure network.

The 7705 SAR allows you to configure SSH1 or Secure Shell Version 2 (SSH2). SSH1 and

SSH2 are different protocols and encrypt at different parts of the packets. SSH1 uses the server as well as host keys to authenticate systems, whereas SSH2 only uses host keys.

SSH2 does not use the same networking implementation that SSH1 does and is considered a more secure, efficient, and portable version of SSH that includes Secure FTP (SFTP). SFTP is functionally similar to FTP but is SSH2-encrypted. Rather than validating identities via passwords, SSH2 can also use public key encryption to authenticate remote hosts. For example, if you were to connect to a remote host also running SSH2, the secure shell would use this system to verify that the remote system is the host and not a computer set up to imitate it.

SSH runs on top of a transport layer (like TCP or IP), and provides authentication and encryption capabilities. SSH supports remote login to another computer over a network, remote command execution, and file relocation from one host to another.

The 7705 SAR has a global SSH server process to support inbound SSH and SCP sessions initiated by external SSH or SCP client applications. The SSH server supports SSH1. Note that this server process is separate from the SSH and SCP client commands on the

7705 SAR, which initiate outbound SSH and SCP sessions.

Inbound SSH sessions are counted as inbound Telnet sessions for the purposes of the maximum number of inbound sessions specified by Login Control. Inbound SCP sessions are counted as inbound FTP sessions by Login Control.

When the SSH server is enabled, an SSH security key is generated. The key is only valid until either the node is restarted or the SSH server is stopped and restarted. The key size is non-configurable and set at 1024 bits. When the server is enabled, both inbound SSH and

SCP sessions will be accepted provided the session is properly authenticated.

When the global SSH server process is disabled, no inbound SSH or SCP sessions will be accepted.

Page 44 7705 SAR OS System Management Guide

Security

When using SCP to copy files from an external device to the file system, the 7705 SAR SCP server will accept either forward slash (“/”) or backslash (“\”) characters to delimit directory and/or filenames. Similarly, the 7705 SAR SCP client application can use either slash or backslash characters, but not all SCP clients treat backslash characters as equivalent to slash characters. In particular, UNIX systems will often interpret the backslash character as an

“escape” character, which does not get transmitted to the 7705 SAR SCP server. For example, a destination directory specified as “cf3:\dir1\file1” will be transmitted to the

7705 SAR SCP server as “cf3:dir1file1” where the backslash escape characters are stripped by the SCP client system before transmission. On systems where the client treats the backslash like an “escape” character, a double backslash “\\” or the forward slash “/” can typically be used to properly delimit directories and the filename.

CSM Filters and CSM Security

In previous releases of the 7705 SAR, all traffic received by the router was destined for the router itself. All received IP packets were extracted to the CSM for processing. Rather than using CSM filters, basic IP filters were used to protect the control plane from DoS attacks, unauthorized access to the node, and similar security breaches.

With the introduction of IP forwarding on the 7705 SAR, IP filters applied to network interfaces have been enhanced, and CSM filters have been introduced that apply to IP packets extracted to the control plane.

IP filters scan all traffic and take the appropriate (configured) action against matching packets. Packets that are not filtered by the IP filters and are destined for the SAR are scanned by the configured CSM filter.

For information on IP filters, refer to the 7705 SAR OS Router Configuration Guide.

Note:

Although the Control and Switching module on the 7705 SAR is called a CSM, the

CSM filters are referred to as CPM filters in the CLI in order to maintain consistency with other SR routers.

CSM filters drop or accept incoming packets based on the following match criteria:

• DSCP name

• destination IP address

• destination port

• fragmentation

• ICMP code

• ICMP type

• IP option value

7705 SAR OS System Management Guide Page 45

Security

• multiple options

• option present

• source IP

• source port

• TCP ACK

• TCP SYN

To avoid DoS-like attacks overwhelming the control plane while ensuring that critical control traffic such as signaling is always serviced in a timely manner, the 7705 SAR has three queues (High, Low, and Ftp) for handling packets addressed to the CSM:

• High – handles all important messaging, such as network management and signaling links

• Low – handles lower-importance messages, such as pings

• Ftp – handles bulk file transfers, such as new software image downloads

These queues are fixed use (each queue handles a certain type of traffic, which is not userconfigurable) and fixed configuration (each queue is configured for particular rates and buffering capacity and is not user-configurable).

Exponential Login Backoff

A malicious user can gain CLI access via a dictionary attack: using a script to try "admin" with any password.

The 7705 SAR increases the delay between login attempts exponentially to mitigate attacks.

It is applied to the console login. SSH and Telnet sessions terminate after four attempts.

Encryption

Data Encryption Standard (DES) and Triple DES (3DES) are supported for encryption.

• DES is a widely used method of data encryption using a private (secret) key. Both the sender and the receiver must know and use the same private key.

• 3DES is a more secure version of the DES protocol.

Page 46 7705 SAR OS System Management Guide

Security

Configuration Notes

This section describes security configuration caveats.

• If a RADIUS or a TACACS+ server is not configured, then password, profiles, and user access information must be configured on each router in the domain.

• If RADIUS authorization is enabled, then VSAs must be configured on the

RADIUS server.

Reference Sources

For information on supported IEEE standards, IETF drafts and standards as well as standard and proprietary MIBs, refer to

Standards and Protocol Support .

7705 SAR OS System Management Guide Page 47

Security

Page 48 7705 SAR OS System Management Guide

Security

Configuring Security with CLI

This section provides information to configure security using the command line interface.

Topics in this section include:

•

Setting Up Security Attributes on page 50

→

Configuring Authentication on page 50

→

Configuring Authorization on page 51

→

Configuring Accounting on page 52

•

Security Configurations on page 53

•

Security Configuration Procedures on page 55

→

Configuring Management Access Filters on page 55

→

Configuring CPM (CSM) Filters on page 57

→

Configuring Password Management Parameters on page 58

→

Configuring Profiles on page 59

→

Configuring Users on page 60

→

Copying and Overwriting Users and Profiles on page 61

→

Configuring SSH on page 65

→

Configuring Login Controls on page 65

•

RADIUS Configurations on page 67

→

Configuring RADIUS Authentication on page 67

→

Configuring RADIUS Authorization on page 68

→

Configuring RADIUS Accounting on page 69

•

TACACS+ Configurations on page 70

→

Enabling TACACS+ Authentication on page 70

→

Configuring TACACS+ Authorization on page 71

→

Configuring TACACS+ Accounting on page 71

7705 SAR OS System Management Guide Page 49

Setting Up Security Attributes

Setting Up Security Attributes

Table 4 depicts the capabilities of authentication, authorization, and accounting

configurations. For example, authentication can be enabled locally and on RADIUS and

TACACS+ servers. Authorization can be executed locally, on a RADIUS server, or on a

TACACS+ server. Accounting can be performed on a RADIUS or TACACS+ server.

Table 4: Security Configuration Requirements

Authentication

Local

RADIUS

TACACS+

Authorization

Local

Local and RADIUS

Local and TACACS+

Accounting

None

RADIUS

TACACS+

Configuring Authentication

Refer to the following sections to configure authentication:

• Local authentication

→

Configuring Password Management Parameters on page 58

→

Configuring Profiles on page 59

→

Configuring Users on page 60

• RADIUS authentication (with local authorization)

By default, authentication is enabled locally. Perform the following tasks to configure security on each participating 7705 SAR router:

→

Configuring Profiles on page 59

→

Configuring RADIUS Authentication on page 67

→

Configuring Users on page 60

• RADIUS authentication (with RADIUS authorization)

To implement RADIUS authentication with authorization, perform the following tasks on each participating 7705 SAR router:

→

Configuring RADIUS Authentication on page 67

→

Configuring RADIUS Authorization on page 68

Page 50 7705 SAR OS System Management Guide

Security

• TACACS+ authentication

To implement TACACS+ authentication, perform the following tasks on each participating 7705 SAR router:

→

Configuring Profiles on page 59

→

Configuring Users on page 60

→

Enabling TACACS+ Authentication on page 70

Configuring Authorization

Refer to the following sections to configure authorization:

• Local authorization

For local authorization, configure these tasks on each participating 7705 SAR router:

→

Configuring Profiles on page 59

→

Configuring Users on page 60

• RADIUS authorization with authentication

For RADIUS authorization with authentication, configure these tasks on each participating 7705 SAR router:

→

Configuring RADIUS Authorization on page 68

For RADIUS authorization, VSAs must be configured on the RADIUS server.

See

Vendor-Specific Attributes (VSAs) on page 40

.

→

Configuring RADIUS Authentication on page 67

→

Configuring Profiles on page 59

• TACACS+ authorization (only)

For TACACS+ authorization without authentication, configure these tasks on each participating 7705 SAR router:

→

Configuring TACACS+ Authorization on page 71

• TACACS+ authorization

For TACACS+ authorization with authentication, configure these tasks on each participating 7705 SAR router:

→

Enabling TACACS+ Authentication on page 70

→

Configuring TACACS+ Authorization on page 71

7705 SAR OS System Management Guide Page 51

Setting Up Security Attributes

Configuring Accounting

Refer to the following sections to configure accounting.

• Local accounting is not implemented. For information about configuring accounting policies, refer to

Configuring Logging with CLI on page 221 .

•

Configuring RADIUS Accounting on page 69

•

Configuring TACACS+ Accounting on page 71

Page 52 7705 SAR OS System Management Guide

Security

Security Configurations

This section provides information on configuring security and examples of configuration tasks.

To implement security features, configure the following components:

• management access filters

• CPM (CSM) filters

• profiles

• user access parameters

• password management parameters

• RADIUS and/or TACACS+

→ enable one to five RADIUS and/or TACACS+ servers

→ configure RADIUS and/or TACACS+ parameters

The following example displays default values for security parameters.

ALU-1>config>system>security# info detail

---------------------------------------------management-access-filter ip-filter default-action permit entry 1 action permit src-ip 10.10.10.xx/32 exit entry 2 action permit src-ip 10.10.0.xx/32 exit exit cpm-filter

ip-filter

shutdown

entry 2 create

action drop

exit

exit

profile "default" default-action none entry 10 no description match "exec" action permit exit

...

entry 70 no description match "show" action permit

7705 SAR OS System Management Guide Page 53

Security Configurations

Page 54

exit exit profile "administrative" default-action permit-all entry 10 no description match "configure system security" action permit exit

...

password authentication-order radius tacplus local no aging minimum-length 6 attempts 3 time 5 lockout 10 complexity exit user "admin" password "./3kQWERTYn0Q6w" hash access console no home-directory no restricted-to-home console no login-exec no cannot-change-password no new-password-at-login member "administrative" exit exit snmp view iso subtree 1 mask ff type included exit

...

access group snmp-ro security-model snmpv1 security-level no-auth-no-privacy read nosecurity notify no-security access group snmp-ro security-model snmpv2c security-level no-auth-no-privacy read no-security notify no-security access group snmp-rw security-model snmpv1 security-level no-auth-no-privacy read nosecurity write no-security notify no-security access group snmp-rw security-model snmpv2c security-level no-auth-no-privacy read no-security write no-security notify no-security access group snmp-rwa security-model snmpv1 security-level no-auth-no-privacy read iso write iso notify iso access group snmp-rwa security-model snmpv2c security-level no auth-no-privacy read iso write iso notify iso access group snmp-trap security-model snmpv1 security-level no-auth-no-privacy notify iso access group snmp-trap security-model snmpv2c security-level no-auth-no-privacy notify iso access group cli-readonly security-model snmpv2c security-level no-auth-no-privacy read iso notify iso access group cli-readwrite security-model snmpv2c security-level no-auth-no-privacy read iso write iso notify iso

attempts 20 time 5 lockout 10

exit

no ssh

exit

7705 SAR OS System Management Guide

Security

Security Configuration Procedures

•

Configuring Management Access Filters

•

Configuring CPM (CSM) Filters

•

Configuring Password Management Parameters

•

Configuring Profiles

•

Configuring Users

•

Copying and Overwriting Users and Profiles

•

Configuring SSH

•

Configuring Login Controls

•

RADIUS Configurations

•

TACACS+ Configurations

Configuring Management Access Filters

Creating and implementing management access filters is optional. Management access filters control all traffic going in to the CSM, including all routing protocols. They apply to packets from all ports. The filters can be used to restrict management of the 7705 SAR router by other nodes outside either specific (sub)networks or through designated ports. By default, there are no filters associated with security options. The management access filter and entries must be explicitly created on each router. These filters apply to the management

Ethernet port.

The 7705 SAR exits the filter when the first match is found and executes the actions according to the specified action. For this reason, entries must be sequenced correctly from most to least explicit.

An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword action

to be considered complete. Entries without the action

keyword are considered incomplete and will be rendered inactive.

Use the following CLI commands to configure a management access filter. This example only accepts packets matching the criteria specified in entries 1 and 2. Non-matching packets are denied.

CLI Syntax:

config>system security management-access-filter ip-filter default-action {permit | deny | deny-hostunreachable} renum

old-entry-number new-entry-number

7705 SAR OS System Management Guide Page 55

Security Configuration Procedures no shutdown entry

entry-id

description

description-string

src-port {

port-id

cpm} src-ip {

ip-prefix/mask

|

ip-prefix netmask

} protocol

protocol-id

router {

router-instance

} dst-port

port

[

mask

] action {permit | deny | deny-hostlog unreachable}

The following displays an example of the management access filter command usage.

Example:

config>system>security# management-access-filter security>mgmt-access-filter# ip-filter default-action

deny

security>mgmt-access-filter# ip-filter entry

1

security>mgmt-access-filter>entry# mgmt-accessfilter>ip-filter>entry# src-ip

10.10.10.104/32

security>mgmt-access-filter>ip-filter>entry# exit security>mgmt-access-filter>ip-filter# entry

2

security>mgmt-access-filter>ip-filter>entry# mgmt-accessfilter>entry# src-ip

10.10.10.1/32

security>mgmt-access-filter>ip-filter>entry# exit

The following example displays the management access filter configuration.

ALU-1>config>system>security# info

----------------------------------------------

management-access-filter

ip-filter

default-action

deny

entry

1

action

permit

src-ip 10.10.10.104/32

exit

entry

2

action permit

src-ip

10.10.0.1/32

exit

exit

snmp

community "private" rwa version both

exit

----------------------------------------------

ALU-1>config>system>security#

Page 56 7705 SAR OS System Management Guide

Security

Configuring CPM (CSM) Filters

CPM filters control all traffic going in to the CSM, including all routing protocols. They apply to packets from all network and access ports, but not to packets from a management

Ethernet port. CPM packet filtering is performed by network processor hardware using no resources on the main CPUs.

Use the following CLI commands to configure a CPM filter.

CLI Syntax:

config>system>security cpm-filter default-action {accept | drop} ip-filter entry

entry-id

[create] action {accept | drop} description

description-string

log

log-id

match [protocol

protocol-id

] dscp

dscp-name

dst-ip {

ip-address/mask

|

ip-address netmask

} dst-port [

tcp/udp port-number

] [

mask

] fragment {true | false} icmp-code

icmp-code

icmp-type

icmp-type

ip-option

ip-option-value

[

ip-option-mask

] multiple-option {true | false} option-present {true | false} src-ip {

ip-address/mask

|

ip-address netmask

} src-port

src-port-number

[

mask

] tcp-ack {true | false} tcp-syn {true | false} renum

old-entry-id new-entry-id

The following displays a CPM filter configuration example:

A:ALU-49>config>sys>sec>cpm>ip-filter# info

----------------------------------------------

entry 10 create

action drop

description "CPM-Filter 10.4.101.2 #101"

log 101

exit

entry 20 create

no action

description "CPM-Filter 10.4.101.2 #201"

log 101

exit

no shutdown

----------------------------------------------

A:ALU-49>config>sys>sec>cpm>ip-filter#

7705 SAR OS System Management Guide Page 57

Security Configuration Procedures

Configuring Password Management Parameters

Configuring password management parameters consists of defining aging, the authentication order and authentication methods, password length and complexity, as well as the number of attempts a user can make to enter a password.

Depending on the authentication requirements, password parameters are configured locally or on the RADIUS or TACACS+ server.

Use the following CLI commands to configure password support:

CLI Syntax:

config>system>security password admin-password

password

[hash | hash2] aging

days

attempts

count

[time

minutes1

] [lockout

minutes2

] authentication-order [

method-1

] [

method-2

]

[

method-3

] [exit-on-reject] complexity [numeric] [special-character] [mixedcase] health-check minimum-length

value

The following displays an example of the password command usage.

Example:

config>system>security#password security>password# aging

365

security>password# minimum-length

8

security>password# attempts

5

time

5

lockout

20

security>password# authentication-order

radius tacplus

local

The following example displays the password configuration:

ALU-1>config>system>security# info

---------------------------------------------password authentication-order radius tacplus local aging 365 minimum-length 8 attempts 5 time 5 lockout 20 exit

----------------------------------------------

ALU-1>config>system>security#

Page 58 7705 SAR OS System Management Guide

Security

Configuring Profiles

Profiles are used to deny or permit access to a hierarchical branch or specific commands.

Profiles are referenced in a user configuration. A maximum of 16 user profiles can be defined. A user can participate in up to 16 profiles. Depending on the the authorization requirements, passwords are configured locally or on the RADIUS server.

Use the following CLI commands to configure user profiles:

CLI Syntax:

config>system>security profile

user-profile-name

default-action {deny-all | permit-all | none} renum

old-entry-number new-entry-number

entry

entry-id

description

description-string

match

command-string

action {permit | deny}

The following displays an example of the user profile command usage.

Example:

config>system>security# profile ghost config>system>security>profile$ default-action permit-all config>system>security>profile# entry 1 config>system>security>profile>entry$ action permit config>system>security>profile>entry# match "configure" config>system>security>profile>entry# exit config>system>security>profile# entry 2 config>system>security>profile>entry$ match "show" config>system>security>profile>entry# exit config>system>security>profile# entry 3 config>system>security>profile>entry$ match "exit"

The following example displays the user profile output:

ALU-1>config>system>security# info

----------------------------------------------

...

profile "ghost"

default-action permit-all

entry 1

match "configure"

action permit

exit

entry 2

match "show"

exit

entry 3

match "exit"

exit

...

----------------------------------------------

ALU-1>config>system>security#

7705 SAR OS System Management Guide Page 59

Security Configuration Procedures

Configuring Users

Access parameters are configured for individual users. For each user, the login name and, optionally, information that identifies the user is defined. Use the following CLI commands to configure access parameters for users:

CLI Syntax:

config>system>security user-template

template-name

user

user-name

access [ftp] [snmp] [console] console cannot-change-password login-exec

url-prefix:source-url

member

user-profile-name

[

user-profilename.

..(up to 8 max)] new-password-at-login home-directory

url-prefix

[

directory

]

[

directory/directory ..

] password [

password

] [hash | hash2] restricted-to-home snmp authentication {[none] | [[hash] {md5

key-1

| sha

key-1

} privacy {none | des-key key-2

}

]} group

group-name

The following displays an example of the command usage.

Example:

config>system>security config>system>security# user 49ers config>system>security>user$ access ftp snmp console config>system>security>user$ console config>system>security>user>console# member default ghost config>system>security>user>console# new-password-atlogin config>system>security>user>console# exit config>system>security>user# password testuser1 config>system>security>user# restricted-to-home config>system>security>user# exit

Page 60 7705 SAR OS System Management Guide

Security

The following example displays the user configuration:

ALU-1>config>system>security# info

----------------------------------------------

...

user "49ers"

password "qQbnuzLd7H/VxGdUqdh7bE" hash2

access console ftp snmp

restricted-to-home

console

member "default"

member "ghost"

exit

exit

...

--------------------------------------------

ALU-1>config>system>security#

Copying and Overwriting Users and Profiles

You can copy a profile or user or overwrite an existing profile or user. The

overwrite option must be specified; otherwise, an error occurs if the destination profile or user name already exists.

Copying a User

CLI Syntax:

config>system>security# copy {user

source-user

| profile

source-profile

} to

destination

[overwrite]

Example:

config>system>security# copy user "testuser" to

"testuserA"

MINOR: CLI User "testuserA" already exists - use overwrite flag.

config>system>security# config>system>security# copy user "testuser" to

"testuserA" overwrite config>system>security#

The following output displays the copied user configurations:

ALU-12>config>system>security# info

----------------------------------------------

...

user "testuser"

password "F6XjryaATzM" hash

access snmp

snmp

authentication hash md5 e14672e71d3e96e7a1e19472527ee969 privacy none

7705 SAR OS System Management Guide Page 61

Security Configuration Procedures

group "testgroup"

exit

exit

user "testuserA"

password "" hash2

access snmp

console

new-password-at-login

exit

snmp

authentication hash md5 e14672e71d3e96e7a1e19472527ee969 privacy none

group "testgroup"

exit

exit

...

----------------------------------------------

ALU-12>config>system>security# info

Note:

The cannot-change-password flag

is not replicated when a copy user command is performed. A new-password-at-login flag is created instead.

ALU-12>config>system>security>user# info

---------------------------------------------password "F6XjryaATzM" hash access snmp console cannot-change-password exit snmp authentication hash md5 e14672e71d3e96e7a1e19472527ee969 privacy none group "testgroup" exit

----------------------------------------------

ALU-12>config>system>security>user# exit

ALU-12>config>system>security# user testuserA

ALU-12>config>system>security>user# info

---------------------------------------------password "" hash2 access snmp console new-password-at-login exit snmp authentication hash md5 e14672e71d3e96e7a1e19472527ee969 privacy none group "testgroup" exit

----------------------------------------------

ALU-12>config>system>security>user#

Page 62 7705 SAR OS System Management Guide

Security

Copying a Profile

CLI Syntax:

config>system>security# copy {user

source-user

| profile

source-profile

} to

destination

[overwrite]

Example:

config>system>security# copy profile default to testuser

The following output displays the copied profiles:

A:ALU-49>config>system>security# info

----------------------------------------------

...

A:ALU-49>config>system>security# info detail

----------------------------------------------

...

profile "default"

default-action none

entry 10

no description

match "exec"

action permit

exit

entry 20

no description

match "exit"

action permit

exit

entry 30

no description

match "help"

action permit

exit

entry 40

no description

match "logout"

action permit

exit

entry 50

no description

match "password"

action permit

exit

entry 60

no description

match "show config"

action deny

exit

entry 70

no description

match "show"

action permit

exit

entry 80

no description

match "enable-admin"

action permit

exit

7705 SAR OS System Management Guide Page 63

Security Configuration Procedures

exit

profile "testuser"

default-action none

entry 10

no description

match "exec"

action permit

exit

entry 20

no description

match "exit"

action permit

exit

entry 30

no description

match "help"

action permit

exit

entry 40

no description

match "logout"

action permit

exit

entry 50

no description

match "password"

action permit

exit

entry 60

no description

match "show config"

action deny

exit

entry 70

no description

match "show"

action permit

exit

entry 80

no description

match "enable-admin"

action permit

exit

exit

profile "administrative"

default-action permit-all exit

...

----------------------------------------------

ALU-12>config>system>security#

Page 64 7705 SAR OS System Management Guide

Security

Configuring SSH

Use the SSH command to configure the SSH server as SSH1, SSH2 or both. The default is

SSH2. This command should only be enabled or disabled when the SSH server is disabled.

This setting cannot be changed while the SSH server is running.

CLI Syntax:

config>system>security ssh preserve-key no server-shutdown version

ssh-version

Example:

config>system>security# ssh config>system>security>ssh# preserve-key config>system>security>ssh# version 1-2

The following example displays the SSH server configuration as both SSH1 and SSH2 using a host-key:

A:ALU-1>config>system>security>ssh# info

----------------------------------------------

preserve-key

version 1-2

----------------------------------------------

A:ALU-1>config>system>security>ssh#

Configuring Login Controls

Use the login-control

context to configure parameters for console, Telnet, and FTP sessions.

CLI Syntax:

config>system login-control exponential-backoff ftp inbound-max-sessions

value

telnet inbound-max-sessions

value

outbound-max-sessions

value

idle-timeout {

minutes

| disable} pre-login-message

login-text-string

[

name

] login-banner motd {url

url-prefix

:

source-url

| text

motd-textstring

}

7705 SAR OS System Management Guide Page 65

Security Configuration Procedures

The following example displays the login control configuration:

Example:

config>system>login-control# ftp inbound-max-sessions

5

config>system>login-control# telnet inbound-max-sessions

7

config>system>login-control# telnet outbound-max-sessions

2

config>system>login-control# idle-timeout

1440

config>system>login-control# pre-login-message "Property of Service Routing Inc. Unauthorized access prohibited." config>system>login-control# motd text "Notice to all users: Software upgrade scheduled 3/2 1:00 AM"

The following example displays the login control configuration:

ALU-1>config>system# info

----------------------------------------------

...

login-control

ftp

inbound-max-sessions 5

exit

telnet

inbound-max-sessions 7

outbound-max-sessions 2

exit

idle-timeout 1440

pre-login-message "Property of Service Routing Inc. Unauthorized access prohibited."

motd text "Notice to all users: Software upgrade scheduled 3/2 1:00 AM"

exit

no exponential-backoff

...

----------------------------------------------

ALU-1>config>system#

Page 66 7705 SAR OS System Management Guide

Security

RADIUS Configurations

•

Configuring RADIUS Authentication

•

Configuring RADIUS Authorization

•

Configuring RADIUS Accounting

Configuring RADIUS Authentication

RADIUS is disabled by default and must be explicitly enabled. The mandatory commands to enable RADIUS on the local router are radius

and server

server-index

address

ip-address

secret

key

. The server

command adds a RADIUS server and configures the RADIUS server’s IP address, index, and key values. The index determines the sequence in which the servers are queried for authentication requests.

Also, the system IP address must be configured in order for the RADIUS client to work. See

“Configuring a System Interface” in the 7705 SAR OS Router Configuration Guide.

The other commands are optional.

On the local router, use the following CLI commands to configure RADIUS authentication:

CLI Syntax:

config>system>security radius port

port

retry

count

server

server-index

address

ip-address

secret

key

[hash1 | hash2] timeout

seconds

no shutdown

The following example displays the CLI syntax usage:

Example:

config>system>security> security# radius security# no shutdown security>radius# server 1 address 10.10.10.103 secret test11 security>radius# server 2 address 10.10.0.1 secret test2 security>radius# server 3 address 10.10.0.2 secret test3 security>radius# server 4 address 10.10.0.3 secret test4 security>radius# retry 5 security>radius# timeout 5 config>system>security>radius# exit

7705 SAR OS System Management Guide Page 67

Security Configuration Procedures

The following example displays the RADIUS authentication configuration:

ALU-1>config>system>security# info

----------------------------------------------

retry 5

timeout 5

server 1 address 10.10.10.103 secret "test1"

server 2 address 10.10.0.1 secret "test2"

server 3 address 10.10.0.2 secret "test3"

server 4 address 10.10.0.3 secret "test4"

...

----------------------------------------

ALU-1>config>system>security#

Configuring RADIUS Authorization

In order for RADIUS authorization to function, RADIUS authentication must be enabled

first. See Configuring RADIUS Authentication on page 67

.

In addition to the local configuration requirements, VSAs must be configured on the

RADIUS server. See

Vendor-Specific Attributes (VSAs) on page 40

.

On the local router, use the following CLI commands to configure RADIUS authorization:

CLI Syntax:

config>system>security radius authorization

The following example displays the CLI syntax usage:

Example:

config>system>security> config>system>security# radius config>system>security>radius# authorization

The following example displays the RADIUS authorization configuration:

ALU-1>config>system>security# info

----------------------------------------------

...

radius

authorization

retry 5

timeout 5

server 1 address 10.10.10.103 secret "test1"

server 2 address 10.10.0.1 secret "test2"

server 3 address 10.10.0.2 secret "test3"

server 4 address 10.10.0.3 secret "test4"

exit

...

----------------------------------------------

ALU-1>config>system>security#

Page 68 7705 SAR OS System Management Guide

Security

Configuring RADIUS Accounting

On the local router, use the following CLI commands to configure RADIUS accounting:

CLI Syntax:

config>system>security radius accounting

The following example displays the CLI syntax usage:

Example:

config>system>security> config>system>security# radius config>system>security>radius# accounting

The following example displays the RADIUS accounting configuration:

ALU-1>config>system>security# info

----------------------------------------------

...

radius

shutdown

authorization

accounting

retry 5

timeout 5

server 1 address 10.10.10.103 secret "test1"

server 2 address 10.10.0.1 secret "test2"

server 3 address 10.10.0.2 secret "test3"

server 4 address 10.10.0.3 secret "test4"

exit

...

----------------------------------------------

ALU-1>config>system>security#

7705 SAR OS System Management Guide Page 69

Security Configuration Procedures

TACACS+ Configurations

•

Enabling TACACS+ Authentication

•

Configuring TACACS+ Authorization

•

Configuring TACACS+ Accounting

Enabling TACACS+ Authentication

To use TACACS+ authentication on the router, configure one or more TACACS+ servers on the network.

Use the following CLI commands to configure TACACS+ authentication:

CLI Syntax:

config>system>security tacplus server

server-index

address

ip-address

secret

key

[hash1 | hash2] single-connection timeout

seconds

no shutdown

The following example is configured in the c onfig>system

context:

Example:

security# tacplus security>tacplus# server 1 address 10.10.0.5 secret test1 security>tacplus# server 2 address 10.10.0.6 secret test2 security>tacplus# server 3 address 10.10.0.7 secret test3 security>tacplus# server 4 address 10.10.0.8 secret test4 security>tacplus# server 5 address 10.10.0.9 secret test5 config>system>security>tacplus# single-connection config>system>security>tacplus# timeout 5 config>system>security>tacplus# no shutdown

The following example displays the TACACS+ authentication configuration:

ALU-1>config>system>security>tacplus# info

----------------------------------------------

timeout 5

single-connection

server 1 address 10.10.0.5 secret "h6.TeL7YPohbmhlvz0gob." hash2

server 2 address 10.10.0.6 secret "h6.TeL7YPog7WbLsR3QRd." hash2

server 3 address 10.10.0.7 secret "h6.TeL7YPojGJqbYt85LVk" hash2

server 4 address 10.10.0.8 secret "h6.TeL7YPoiCfWKUFHARvk" hash2

server 5 address 10.10.0.9 secret "h6.TeL7YPojuCyTFvTNGBU" hash2

----------------------------------------------

ALU-1>config>system>security>tacplus#

Page 70 7705 SAR OS System Management Guide

Security

Configuring TACACS+ Authorization

In order for TACACS+ authorization to function, TACACS+ authentication must be enabled first. See

Enabling TACACS+ Authentication on page 70 .

On the local router, use the following CLI commands to configure TACACS+ authorization:

CLI Syntax:

config>system>security tacplus authorization no shutdown

The following example displays the CLI syntax usage:

Example:

config>system>security> config>system>security# tacplus config>system>security>tacplus# authorization config>system>security>tacplus# no shutdown

The following example displays the TACACS+ authorization configuration:

ALU-1>config>system>security>tacplus# info

----------------------------------------------

authorization

timeout 5

single-connection

server 1 address 10.10.0.5 secret "h6.TeL7YPohbmhlvz0gob." hash2

server 2 address 10.10.0.6 secret "h6.TeL7YPog7WbLsR3QRd." hash2

server 3 address 10.10.0.7 secret "h6.TeL7YPojGJqbYt85LVk" hash2

server 4 address 10.10.0.8 secret "h6.TeL7YPoiCfWKUFHARvk" hash2

server 5 address 10.10.0.9 secret "h6.TeL7YPojuCyTFvTNGBU" hash2

----------------------------------------------

ALU-1>config>system>security>tacplus#

Configuring TACACS+ Accounting

On the local router, use the following CLI commands to configure TACACS+ accounting:

CLI Syntax:

config>system>security tacplus accounting

The following example displays the CLI syntax usage:

Example:

config>system>security> config>system>security# tacplus config>system>security>tacplus# accounting

7705 SAR OS System Management Guide Page 71

Security Configuration Procedures

The following example displays the TACACS+ accounting configuration:

ALU-1>config>system>security>tacplus# info

----------------------------------------------

accounting

authorization

timeout 5

single-connection

server 1 address 10.10.0.5 secret "h6.TeL7YPohbmhlvz0gob." hash2

server 2 address 10.10.0.6 secret "h6.TeL7YPog7WbLsR3QRd." hash2

server 3 address 10.10.0.7 secret "h6.TeL7YPojGJqbYt85LVk" hash2

server 4 address 10.10.0.8 secret "h6.TeL7YPoiCfWKUFHARvk" hash2

server 5 address 10.10.0.9 secret "h6.TeL7YPojuCyTFvTNGBU" hash2

----------------------------------------------

ALU-1>config>system>security>tacplus#

Page 72 7705 SAR OS System Management Guide

Security Command Reference

Command Hierarchies

•

Configuration Commands

→

Security Configuration Commands

→

Management Access Filter Commands

→

CPM Filter Commands

→

Password Commands

→

Profile Commands

→

User Commands

→

RADIUS Commands

→

TACACS+ Commands

→

SSH Commands

•

Login Control Commands

•

Show Commands

→

Security

→

Login Control

•

Clear Commands

→

Authentication

•

Debug Commands

Security

7705 SAR OS System Management Guide Page 73

Security Command Reference

Configuration Commands

Security Configuration Commands

config

— system

—

security

—

copy

{

user

source-user

| profile

source-profile

}

to

destination

[

overwrite

]

—

ftp-server

— no

ftp-server

—

hash-control

[

read-version

{

1 | 2 | all

}] [

write-version

{

1 | 2

}]

— no

hash-control

—

source-address

—

application

app

[

ip-int-name

|

ip-address

]

— no

application

app

—

[

no

]

telnet-server

Management Access Filter Commands

config

— system

—

security

—

[

no

]

management-access-filter

— ip-filter

—

default-action

{

permit

|

deny

|

deny

host-unreachable

}

—

renum

old-entry-number new-entry-number

—

[

no

]

shutdown

—

[

no

]

entry

entry-id

—

action

{

permit

|

deny

|

deny

host-unreachable

}

— no

action

—

description

description-string

— no

description

—

dst-port

port

[

mask

]

— no

dst-port

—

[

no

]

log

—

[

no

]

protocol

protocol-id

—

router

router-instance

— no

router

—

src-ip

{

ip-prefix

/ mask | ip-prefix netmask

}

— no

src-ip

—

src-port

{

port-id

|

cpm

}

— no

src-port

Page 74 7705 SAR OS System Management Guide

Security

CPM Filter Commands

config

— system

—

security

—

[

no

]

cpm-filter

—

default-action

{

accept

|

drop

}

—

ip-filter

—

entry

entry-id

[

create

]

— no

entry

entry-id

—

action

{

accept

|

drop

}

— no

action

—

description

description-string

— no

description

—

log

log-id

— no

log

—

match

[

protocol

protocol-id

]

— no

match

—

dscp

dscp-name

— no

dscp

—

dst-ip

{

ip-address/mask

|

ip-address netmask

}

— no

dst-ip

—

dst-port

tcp/udp port-number

[

mask

]

— no

dst-port

—

fragment

{

true

|

false

}

— no

fragment

—

icmp-code

icmp-code

— no

icmp-code

—

icmp-type

icmp-type

— no

icmp-type

—

ip-option

ip-option-value

[

ip-option-mask

]

— no

ip-option

—

multiple-option

{

true

|

false

}

— no

multiple-option

—

option-present

{

true

|

false

}

— no

option-present

—

src-ip

{

ip-address/mask

|

ip-address netmask

}

— no

src-ip

—

src-port

src-port-number

[

mask

]

— no

src-port

—

tcp-ack

{

true

|

false

}

— no

tcp-ack

—

tcp-syn

{

true

|

false

}

— no

tcp-syn

—

renum

old-entry-id new-entry-id

—

[

no

]

shutdown

7705 SAR OS System Management Guide Page 75

Security Command Reference

Password Commands

config

— system

—

security

—

password

—

admin-password

password

[

hash | hash2

]

— no

admin-password

—

aging

days

— no

aging

—

attempts

count

[

time

minutes1

] [

lockout

minutes2

]

— no

attempts

—

authentication-order

[

method-1

] [

method-2

] [

method-3

] [

exit-onreject

]

— no

authentication-order

—

[

no

]

complexity

[

numeric

] [

special-character

] [

mixed-case

]

—

[

no

]

health-check

—

minimum-length

value

— no

minimum-length

Profile Commands

config

— system

—

security

—

[

no

]

profile

user-profile-name

—

default-action

{

deny-all

|

permit-all

|

none

}

—

renum

old-entry-number new-entry-number

—

[

no

]

entry

entry-id

—

action

{

permit

|

deny

}

—

description

description-string

— no

description

—

match

command-string

— no

match

Page 76 7705 SAR OS System Management Guide

Security

User Commands

config

— system

—

security

—

[

no

]

user

user-name

—

[

no

]

access

[

ftp

] [

snmp

] [

console

]

—

console

—

[

no

]

cannot-change-password

—

login-exec

url-prefix

:

source-url

— no

login-exec

—

member

user-profile-name

[

user-profile-name…

(up to 8 max)]

— no

member

user-profile-name

—

[

no

]

new-password-at-login

—

home-directory

url-prefix

[

directory

] [

directory

/ directory…

]

— no

home-directory

—

password

[

password

]

[

hash | hash2

]

—

[

no

]

restricted-to-home

—

snmp

—

authentication

{

[

none

] | [[

hash

] {

md5

key-1

|

sha

key-1

}

privacy

{

privacy-level key-2

}]}

—

group

group-name

— no

group

—

user-template

{

tacplus_default | radius_default

}

—

[

no

]

access

[

ftp

] [

console

]

—

console

—

login-exec

url-prefix:source-url

— no

login-exec

—

home-directory

url-prefix

[

directory

][

directory

/

directory

..]

— no

home-directory

—

[

no

]

restricted-to-home

7705 SAR OS System Management Guide Page 77

Security Command Reference

RADIUS Commands

config

— system

—

security

—

[

no

]

radius

—

access-algorithm

{

direct

|

round-robin

}

— [

no

]

access-algorithm

—

[

no

]

accounting

—

accounting-port

port

— no

accounting-port

—

[

no

]

authorization

—

port

port

— no

port

—

retry

count

— no

retry

—

server

serverindex

address

ip-address

secret

key

[

hash

|

hash2

]

— no

server

serverindex

—

[

no

]

shutdown

—

timeout

seconds

— no

timeout

—

use-default-template

TACACS+ Commands

config

— system

—

security

—

[

no

]

tacplus

—

accounting

[

record-type {start-stop | stop-only

}]

— no

accounting

—

[

no

]

authorization

—

server

server

index

address

ip-address

secret

key

[

hash

|

hash2

]

— no

server

server

index

—

[

no

]

single-connection

—

timeout

seconds

— no

timeout

—

[

no

]

shutdown

—

[

no

]

use-default-template

SSH Commands

config

— system

—

security

—

ssh

—

—

—

[

no

]

preserve-key

[

no

]

server-shutdown

[

no

]

version

SSH-version

Page 78 7705 SAR OS System Management Guide

Security

Login Control Commands

config

— system

—

login-control

—

[

no

]

exponential-backoff

—

ftp

—

inbound-max-sessions

value

— no

inbound-max-sessions

—

telnet

—

inbound-max-sessions

value

— no

inbound-max-sessions

—

outbound-max-sessions

value

— no

outbound-max-sessions

—

idle-timeout

{

minutes

|

disable

}

— no

idle-timeout

—

[

no

]

login-banner

—

motd

{

url

url-prefix

:

source-url

|

text

motd-text-string

}

— no

motd

—

pre-login-message

login-text-string

[

name

]

— no

pre-login-message

Show Commands

Security

show

— system

— security

—

access-group

[

group-name

]

—

authentication

[

statistics

]

—

communities

—

cpm-filter

— ip-filter

[

entry

entry-id

]

—

management-access-filter

— ip-filter

[

entry

entry-id

]

—

password-options

—

profile

user-profile-name

—

source-address

—

ssh

—

user

[

user-id

] [

detail

]

—

view

[

view-name

] [

detail

]

Login Control

show

—

users

7705 SAR OS System Management Guide Page 79

Security Command Reference

Clear Commands

Authentication

clear

— router

— authentication

—

statistics

[

interface

ip-int-name

|

ip-address

]

Debug Commands

debug

—

radius

[

detail

] [

hex

]

— no

radius

Page 80 7705 SAR OS System Management Guide

Command Descriptions

•

Configuration Commands on page 82

•

Show Commands on page 135

•

Clear Commands on page 155

•

Debug Commands on page 156

Security

7705 SAR OS System Management Guide Page 81

Security Command Reference

Configuration Commands

•

Generic Security Commands on page 83

•

Security Commands on page 84

•

Management Access Filter Commands on page 87

→

Management Access Filter Entry Commands on page 88

•

CPM Filter Commands on page 93

•

Global Password Commands on page 105

•

Password Commands on page 106

•

Profile Management Commands on page 111

→

Profile Management Entry Commands on page 112

•

User Management Commands on page 114

→

User Management Console Commands on page 117

→

User Management SNMP Commands on page 119

•

RADIUS Client Commands on page 121

•

TACACS+ Client Commands on page 125

•

SSH Commands on page 128

•

Login Control Commands on page 130

→

FTP Login Control Commands on page 132

→

Telnet Login Control Commands on page 133

Page 82 7705 SAR OS System Management Guide

Security

Generic Security Commands description

Syntax description

description-string

no description

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

config>system>security>cpm-filter>ip-filter>entry>

entry-id

config>system>security>profile

user-profile-name

>entry

entry-id

Description

This command creates a text description stored in the configuration file for a configuration context.

The

no

form of the command removes the string.

Default

No description associated with the configuration context.

Parameters

description-string —

the description character string. Allowed values are any string up to 80 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.

shutdown

Syntax

[

no

]

shutdown

Context

config>system>security>management-access-filter>ip-filter config>system>security>cpm-filter>ip-filter config>system>security>radius config>system>security>tacplus

Description

This command administratively disables the entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. When disabled, an entity does not change, reset, or remove any configuration settings or statistics, other than the administrative state.

Many objects must be shut down before they can be deleted.

The

no

form of the command puts an entity into the administratively enabled state. Many entities must be explicitly enabled using the

no shutdown

command.

Default no shutdown

7705 SAR OS System Management Guide Page 83

Security Command Reference

Security Commands security

Syntax security

Context

config>system

Description

This command creates the context to configure security settings.

Security commands manage user profiles and user membership. Security commands also manage user login registrations.

copy

Syntax copy

{

user

source-user

|

profile

source-profile

}

to

destination

[

overwrite

]

Context

config>system>security

Description

This command copies the specified user or profile configuration parameters to another (destination) user or profile.

The password is set to the return key and a new password at login must be selected.

Parameters

source-user —

the user to copy from. The user must already exist.

source-profile —

the profile to copy from. The profile must already exist.

destination —

the destination user or profile

overwrite —

specifies that the destination user or profile configuration will be overwritten with the copied source user or profile configuration. A configuration will not be overwritten if the

overwrite

command is not specified.

ftp-server

Syntax

[

no

]

ftp-server

Context

config>system>security

Description

This command enables FTP servers running on the system.

FTP servers are disabled by default. At system startup, only SSH servers are enabled.

The

no

form of the command disables FTP servers running on the system.

Default no ftp-server

Page 84 7705 SAR OS System Management Guide

Security

hash-control

Syntax hash-control

[

read-version

{

1 | 2 | all

}] [

write-version

{

1 | 2

}]

no hash-control

Context

config>system>security

Description

Whenever the user executes a

save

or

info

command, the system will encrypt all passwords and keys, and so on for security reasons. At present, two algorithms exist.

The first algorithm is a simple, short key that can be copied and pasted in a different location when the user wants to configure the same password. However, because it is the same password and the hash key is limited to the password/key, it is obvious that it is the same key.

The second algorithm is a more complex key, and cannot be copied and pasted in different locations in the configuration file. In this case, if the same key or password is used repeatedly in different contexts, each encrypted (hashed) version will be different.

Default all —

read-version set to accept both versions 1 and 2

Parameters read-version

{

1 | 2 | all

}

—

when the read-version is configured as “all,” both versions 1 and 2 will be accepted by the system. Otherwise, only the selected version will be accepted when reading configuration or exec files. The presence of incorrect hash versions will abort the script/startup.

write-version

{

1 | 2

}

—

selects the hash version that will be used the next time the configuration file is saved (or an

info

command is executed). Be careful to save the read and write version correctly, so that the file can be properly processed after the next reboot or exec.

source-address

Syntax source-address

Context

config>system>security

Description

This command specifies the source address that should be used in all unsolicited packets sent by the application.

application

Syntax application

app

[

ip-int-name | ip-address

]

no application

app

Context

config>system>security>source-address

Description

This command specifies the application to use the source IP address specified by the

source-address

command.

The

no

form of the command removes the specified source address from the application, causing the application to use the system IP address as the source address.

7705 SAR OS System Management Guide Page 85

Security Command Reference

Parameters

app —

specifies the application name

Values

telnet, ftp, ssh, radius, tacplus, snmptrap, syslog, ping, traceroute, dns, sntp, ntp

ip-int-name | ip-address —

specifies the name of the IP interface or IP address. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.

telnet-server

Syntax

[

no

]

telnet-server

Context

config>system>security

Description

This command enables Telnet servers running on the system.

Telnet servers are off by default. At system startup, only SSH servers are enabled.

Telnet servers in 7705 SAR networks limit a Telnet client to three retries to log in. The Telnet server disconnects the Telnet client session after three retries.

The

no

form of the command disables Telnet servers running on the system.

Default no telnet-server

Page 86 7705 SAR OS System Management Guide

Security

Management Access Filter Commands management-access-filter

Syntax

[

no

]

management-access-filter

Context

config>system>security

Description

This command creates the context to edit management access filters and to reset match criteria.

Management access filters control all traffic in and out of the

CSM

. They can be used to restrict management of the 7705 SAR by other nodes outside either specific (sub)networks or through designated ports.

Management filters, as opposed to other traffic filters, are enforced by system software.

The

no

form of the command removes management access filters from the configuration.

Default

No management access filters are defined.

ip-filter

Syntax ip-filter

Context

config>system>security>management-access-filter

Description

This command creates the context to configure IP filter commands.

default-action

Syntax default-action

{

permit

|

deny

|

deny-host-unreachable

}

Context

config>system>security>management-access-filter>ip-filter

Description

This command creates the default action for management access in the absence of a specific management access filter match.

The

default-action

is applied to a packet that does not satisfy any match criteria in any of the management access filters. Whenever management access filters are configured, the

default-action

must be defined.

Default

No default action is defined.

Parameters permit —

specifies that packets not matching the configured selection criteria in any of the filter entries will be permitted

deny —

specifies that packets not matching the selection criteria will be denied

7705 SAR OS System Management Guide Page 87

Security Command Reference

deny-host-unreachable —

specifies that packets not matching the selection criteria will be denied and a host unreachable message will be issued

renum

Syntax renum

old-entry-number new-entry-number

Context

config>system>security>management-access-filter>ip-filter

Description

This command renumbers existing management access filter entries to resequence filter entries.

The 7705 SAR exits on the first match found and executes the actions in accordance with the accompanying

action

command. This may require some entries to be renumbered from most to least explicit.

Parameters

old-entry-number —

the entry number of the existing entry

Values

1 to 9999

new-entry-number —

the new entry number that will replace the old entry number

Values

1 to 9999

Management Access Filter Entry Commands

entry

Syntax

[

no

]

entry

entry-id

Context

config>system>security>management-access-filter>ip-filter

Description

This command is used to create or edit a management access filter entry. Multiple entries can be created with unique

entry-id

numbers. The 7705 SAR exits the filter upon the first match found and executes the actions according to the respective action command. For this reason, entries must be sequenced correctly from most to least explicit.

An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword

action

defined to be considered complete. Entries without the

action

keyword are considered incomplete and inactive.

The

no

form of the command removes the specified entry from the management access filter.

Default

No entries are defined.

Parameters

entry-id —

an entry ID uniquely identifies a match criteria and the corresponding action. It is recommended that entries be numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries.

Values

1 to 9999

Page 88 7705 SAR OS System Management Guide

Security

action

Syntax action

{

permit

|

deny | deny-host-unreachable

}

no action

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command creates the action associated with the management access filter match criteria entry.

The

action

keyword is required. If no

action

is defined, the filter is ignored. If multiple action statements are configured, the last one overwrites previous configured actions.

If the packet does not meet any of the match criteria, the configured

default action

is applied.

Default none —

The action is specified by

default-action

command.

Parameters permit —

specifies that packets matching the configured criteria will be permitted

deny —

specifies that packets not matching the selection criteria will be denied

deny-host-unreachable —

specifies that packets not matching the selection criteria will be denied and a host unreachable message will be issued

dst-port

Syntax

[

no

]

dst-port

value

[

mask

]

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command configures a destination TCP or UDP port number or port range for a management access filter match criterion.

The

no

form of the command removes the destination port match criterion.

Default

No dst-port match criterion.

Parameters

value —

the source TCP or UDP port number as match criteria

Values

1 to 65535 (decimal)

mask —

mask used to specify a range of destination port numbers as the match criterion

This 16-bit mask can be configured using the following formats:

Table 5: 16-bit Mask Format

Format Style

Decimal

Hexadecimal

Binary

Format Syntax

DDDDD

0xHHHH

0bBBBBBBBBBBBBBBBB

Example

63488

0xF800

0b1111100000000000

7705 SAR OS System Management Guide Page 89

Security Command Reference

For example, to select a range from 1024 up to 2047, specify 1024 0xFC00 for value and mask.

Default

65535 (exact match)

Values

1 to 65535 (decimal)

log

Syntax

[

no

] log

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command enables match logging.

The

no

form of this command disables match logging.

Default no log

protocol

Syntax

[

no

]

protocol

protocol-id

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command configures an IP protocol type to be used as a management access filter match criterion.

The protocol type is identified by its respective protocol number. Well-known protocol numbers include ICMP (1), TCP (6), and UDP (17).

The

no

form of the command removes the protocol from the match criteria.

Default

No protocol match criterion is specified.

Parameters

protocol-id —

the protocol number for the match criterion

Values

1 to 255 (decimal)

router

Syntax router

router-instance

no router

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command configures a router name or service ID to be used as a management access filter match criterion.

The

no

form of the command removes the router name or service ID from the match criteria.

Page 90 7705 SAR OS System Management Guide

Security

Parameters

router-instance —

specifies one of the following parameters for the router instance:

router-name

— specifies a router name up to 32 characters to be used in the match criteria

service-id

— specifies an existing service ID to be used in the match criteria

Values

1 to 2147483647

src-ip

Syntax

[

no

]

src-ip

{[

ip-prefix

/

mask

]

|

[

ip-prefix

]}

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command configures a source IP address range to be used as a management access filter match criterion.

To match on the source IP address, specify the address and the associated mask (for example,

10.1.0.0/16). The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The

no

form of the command removes the source IP address match criterion.

Default

No source IP match criterion is specified.

Parameters

ip-prefix —

the IP prefix for the IP match criterion in dotted-decimal notation

mask —

specifies the subnet mask length expressed as a decimal integer

Values

0.0.0.0 to 255.255.255.255 (IP prefix), 1 to 32 (mask length)

src-port

Syntax src-port

{

port-id

|

cpm

}

no src-port

Context

config>system>security>management-access-filter>ip-filter>entry

entry-id

Description

This command restricts ingress management traffic to either the

CSM

Ethernet port or any other logical port (port or channel) on the device.

When the source interface is configured, only management traffic arriving on those ports satisfy the match criteria.

The

no

form of the command reverts to the default value.

Default any interface

7705 SAR OS System Management Guide Page 91

Security Command Reference

Parameters

port-id —

the port ID in the following format: slot/mda/port ( the slot ID is always 1)

For example: port 3 on MDA 2 on card 1 would be specified as 1/2/3.

Syntax:

port-id

Values

port-id

slot

/

mda

/

port

[.

channel

]

bundle-id - bundle-<type>-slot/mda.<bundle-num>

bundle - keyword

type - ima | ppp

bundle-num - [1..10]

cpm —

specifies that ingress management traffic is restricted to the CSM Ethernet port

Page 92 7705 SAR OS System Management Guide

Security

CPM Filter Commands cpm-filter

Syntax [no] cpm-filter

Context

config>system>security

Description

This command enables the context to configure a CPM filter. A CPM filter is a hardware filter on the

CSM

that applies to all the traffic going to the

CSM

CPU. It can be used to drop or accept packets, as well as allocate dedicated hardware queues for the traffic. The hardware queues are not userconfigurable.

The

no

form of the command disables the CPM filter.

default-action

Syntax default-action

{

accept

|

drop

}

Context

config>system>security>cpm-filter

Description

This command specifies the action to be applied to packets when the packets do not match the specified criteria in all of the IP filter entries of the filter. If there are no filter entries defined, the packets received will either be accepted or dropped based on that default action.

Default accept

Parameters accept —

packets are accepted unless there is a specific filter entry that causes the packet to be dropped

drop —

packets are dropped unless there is a specific filter entry that causes the packet to be accepted

ip-filter

Syntax ip-filter

Context

config>system>security>cpm-filter

Description

This command enables the context to configure CPM IP filter parameters.

7705 SAR OS System Management Guide Page 93

Security Command Reference

entry

Syntax entry

entry-id

[

create

]

no entry

entry-id

Context

config>system>security>cpm-filter>ip-filter

Description

This command specifies a particular CPM filter match entry. Every CPM filter must have at least one filter match entry. A filter entry with no match criteria set will match every packet, and the entry action will be taken.

The

create

keyword must be used with every new entry configured. Once the entry has been created, you can navigate to the entry context without using the

create

keyword.

For filter entries 1 to 29, the match parameters can be any combination of source IP address/range, destination IP address/range, source port/range, and destination port/range as long as the accumulated total of the number of unique records does not exceed 256 combinations.

For filter entries 30 to 64 (extended filter entries), there are no range-based restrictions. As few or as many match parameters can be specified as required.

Parameters

entry-id —

identifies a CPM filter entry as configured on this system.

Values

1 to 64 where: 1 to 29 are filter entries

30 to 64 are extended filter entries

action

Syntax action

{

accept

|

drop

}

no action

Context

config>system>security>cpm-filter>ip-filter>entry

Description

This command specifies the action to take for packets that match this filter entry.

Default drop

Parameters accept —

packets matching the entry criteria will be forwarded

drop —

packets matching the entry criteria will be dropped

Page 94 7705 SAR OS System Management Guide

Security

log

Syntax log

log-id

no log

Context

config>system>security>cpm-filter>ip-filter>entry

Description

This command specifies the log in which packets matching this entry should be entered. The value 0 indicates that logging is disabled.

The

no

form of the command deletes the log ID.

Parameters

log-id —

the log ID where packets matching this entry should be entered

Values

101 to 199

match

Syntax match

[

protocol

protocol-id

]

no match

Context

config>system>security>cpm-filter>ip-filter>entry

Description

This command enables the context to enter match criteria for the filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) are configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A

match

context may consist of multiple match criteria, but multiple

match

statements cannot be entered per entry.

The

no

form of the command removes the match criteria for the

entry-id

.

Parameters protocol —

configures an IP protocol to be used as an IP filter match criterion. The protocol type such as TCP or UDP is identified by its respective protocol number.

protocol-id —

configures the decimal value representing the IP protocol to be used as an IP filter match criterion. Common protocol numbers include ICMP(1), TCP(6), UDP(17). The

no

form the command removes the protocol from the match criteria. See

Table 6

for the protocol IDs and descriptions for the IP protocols.

Values

0 to 255 (values can be expressed in decimal, hexadecimal, or binary – DHB) keywords - none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, ipv6, ipv6-frag, ipv6-icmp, ipv6-no-nxt, ipv6-opts, ipv6-route, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp

* — udp/tcp wildcard

7705 SAR OS System Management Guide Page 95

Security Command Reference

Page 96

Protocol

ipv6-opts iso-ip eigrp ospf-igp ether-ip encap pnni pim vrrp l2tp stp egp igp udp rdp icmp igmp ip tcp ipv6 ipv6-route ipv6-frag idrp rsvp gre ipv6-icmp ipv6-no-nxt

Table 6: IP Protocol IDs and Descriptions

Protocol ID

97

98

102

103

60

80

88

89

112

115

118

46

47

58

59

41

43

44

45

8

9

17

27

4

6

1

2

Description

Internet Control Message

Internet Group Management

IP in IP (encapsulation)

Transmission Control

Exterior Gateway Protocol

Any private interior gateway

User Datagram

Reliable Data Protocol

IPv6

Routing Header for IPv6

Fragment Header for IPv6

Inter-Domain Routing Protocol

Reservation Protocol

General Routing Encapsulation

ICMP for IPv6

No Next Header for IPv6

Destination Options for IPv6

ISO Internet Protocol

EIGRP

OSPFIGP

Ethernet-within-IP Encapsulation

Encapsulation Header

PNNI over IP

Protocol Independent Multicast

Virtual Router Redundancy Protocol

Layer Two Tunneling Protocol

Schedule Transfer Protocol

7705 SAR OS System Management Guide

Security

Protocol

ptp isis crtp crudp

Table 6: IP Protocol IDs and Descriptions (Continued)

Protocol ID

123

124

126

127

Description

Performance Transparency Protocol

ISIS over IPv4

Combat Radio Transport Protocol

Combat Radio User Datagram

dscp

Syntax dscp

dscp-name

no dscp

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures a DiffServ Code Point (DSCP) name to be used as an IP filter match criterion.

The

no

form of the command removes the DSCP match criterion.

Default no dscp

Parameters

dscp-name —

a DSCP name that has been previously mapped to a value using the

dscp-name

command. The DiffServ Code Point may only be specified by its name.

Values

be|cp1|cp2|cp3|cp4|cp5|cp6|cp7|cs1|cp9|af11|cp11| af12|cp13|af13|cp15|cs2|cp17|af21|cp19|af22|cp21| af23|cp23|cs3|cp25|af31|cp27|af32|cp29|af33|cp31|cs4| cp33|af41|cp35|af42|cp37|af43|cp39|cs5|cp41|cp42| cp43|cp44|cp45|ef|cp47|nc1|cp49|cp50|cp51|cp52|cp53| cp54|cp55|nc2|cp57|cp58|cp59|cp60|cp61|cp62|cp63

dst-ip

Syntax dst-ip

{

ip-address/mask

|

ip-address netmask

}

no dst-ip

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures a destination IP address range to be used as an IP filter match criterion.

To match on the destination IP address, specify the address and its associated mask; for example,

10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The

no

form of the command removes the destination IP address match criterion.

7705 SAR OS System Management Guide Page 97

Security Command Reference

Default no dst-ip

Parameters

ip-address —

the IP prefix for the IP match criterion in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

mask —

the subnet mask length expressed as a decimal integer

Values

1 to 32

netmask —

the dotted-decimal equivalent of the mask length

Values

0.0.0.0 to 255.255.255.255

dst-port

Syntax dst-port

tcp/udp port-number

[

mask

]

no dst-port

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command specifies the TCP/UDP port to match the destination port of the packet.

The

no

form of the command removes the destination port match criterion.

The TCP or UDP protocol must be configured using the

match

command before this filter can be configured.

Parameters

tcp/udp port-number —

the destination port number to be used as a match criterion

Values

0 to 65535 (accepted in decimal, hexadecimal, or binary format)

mask —

the 16-bit mask to be applied when matching the destination port

fragment

Syntax fragment

{

true

|

false

}

no fragment

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures fragmented or non-fragmented IP packets as an IP filter match criterion.

The

no

form of the command removes the match criterion.

Default false

Parameters true —

configures a match on all fragmented IP packets. A match will occur for all packets that have either the MF (more fragment) bit set or have the Fragment Offset field of the IP header set to a non-zero value.

false —

configures a match on all non-fragmented IP packets. Non-fragmented IP packets are packets that have the MF bit set to zero and have the Fragment Offset field also set to zero.

Page 98 7705 SAR OS System Management Guide

Security

icmp-code

Syntax icmp-code

icmp-code

no icmp-code

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching on an ICMP code field in the ICMP header of an IP packet as an

IP filter match criterion.

The ICMP protocol must be configured using the

match

command before this filter can be configured.

The

no

form of the command removes the criterion from the match entry.

Default no icmp-code

Parameters

icmp-code —

specifies the ICMP code values that must be present to match

Values

0 to 255 (values can be expressed in decimal, hexadecimal, or binary – DHB) keywords - none | network-unreachable | host-unreachable | protocol-unreachable | port-unreachable | fragmentation-needed | dest-network-unknown | dest-host-unknown

icmp-type

Syntax icmp-type

icmp-type

no icmp-type

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching on an ICMP type field in the ICMP header of an IP packet as an

IP filter match criterion.

The ICMP protocol must be configured using the

match

command before this filter can be configured.

The

no

form of the command removes the criterion from the match entry.

Default no icmp-type

Parameters

icmp-type —

specifies the ICMP type values that must be present to match

Values

0 to 255 (values can be expressed in decimal, hexadecimal, or binary – DHB) keywords - none | echo-reply | dest-unreachable | echo-request | time-exceeded | parameter-problem

7705 SAR OS System Management Guide Page 99

Security Command Reference

ip-option

Syntax ip-option

ip-option-value

[

ip-option-mask

]

no ip-option

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching packets with a specific IP option or a range of IP options in the IP header as an IP filter match criterion.

The option type octet contains 3 fields:

• 1 bit copied flag (copy options in all fragments)

• 2 bits option class

• 5 bits option number

The

no

form of the command removes the match criterion.

Default no ip-option

Parameters

ip-option-value —

the 8-bit option type (can be entered using decimal, hexadecimal, or binary formats). The mask is applied as an AND to the option byte and the result is compared with the option value.

The decimal value entered for the match should be a combined value of the 8-bit option type field and not just the option number. Therefore, to match on IP packets that contain the Router Alert option (option number = 20), enter the option type of 148 (10010100).

Values

0 to 255

ip-option-mask —

specifies a range of option numbers to use as the match criteria

This 8-bit mask can be entered using decimal, hexadecimal, or binary formats as shown in

Table 7

.

Format Style

Decimal

Hexadecimal

Binary

Table 7: IP Option Formats

Format Syntax

DDD

0xHH

0bBBBBBBBB

Example

20

0x14

0b0010100

Default

Values

255 (decimal) (exact match)

0 to 255

Page 100 7705 SAR OS System Management Guide

Security

multiple-option

Syntax multiple-option

{

true

|

false

}

no multiple-option

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching packets that contain more than one option field in the IP header as an IP filter match criterion.

The

no

form of the command removes the checking of the number of option fields in the IP header as a match criterion.

Default no multiple-option

Parameters true —

specifies matching on IP packets that contain more than one option field in the header

false —

specifies matching on IP packets that do not contain multiple option fields in the header

option-present

Syntax option-present

{

true

|

false

}

no option-present

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching packets that contain the option field or have an option field of 0 in the IP header as an IP filter match criterion.

The

no

form of the command removes the checking of the option field in the IP header as a match criterion.

Parameters true —

specifies matching on all IP packets that contain the option field in the header. A match will occur for all packets that have the option field present. An option field of 0 is considered as no option present.

false —

specifies matching on IP packets that do not have any option field present in the IP header

(an option field of 0)

7705 SAR OS System Management Guide Page 101

Security Command Reference

src-ip

Syntax src-ip

{

ip-address/mask

|

ip-address netmask

}

no src-ip

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command specifies the IP address to match the source IP address of the packet.

To match on the source IP address, specify the address and its associated mask; for example,

10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The

no

form of the command removes the source IP address match criterion.

Default no src-ip

Parameters

ip-address —

the IP prefix for the IP match criterion in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

mask —

the subnet mask length expressed as a decimal integer

Values

1 to 32

netmask —

the dotted-decimal equivalent of the mask length

Values

0.0.0.0 to 255.255.255.255

src-port

Syntax src-port

src-port-number

[

mask

]

no src-port

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command specifies the TCP/UDP port to match the source port of the packet.

Default no src-port

Parameters

src-port-number —

the source port number to be used as a match criterion

Values

0 to 65535 (accepted in decimal, hexadecimal, or binary format)

mask —

the 16-bit mask to be applied when matching the destination port

Page 102 7705 SAR OS System Management Guide

Security

tcp-ack

Syntax tcp-ack

{

true

|

false

}

no tcp-ack

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching on the ACK bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The

no

form of the command removes the criterion from the match entry.

Default no tcp-ack

Parameters true —

specifies matching on IP packets that have the ACK bit set in the control bits of the TCP header of an IP packet

false —

specifies matching on IP packets that do not have the ACK bit set in the control bits of the

TCP header of the IP packet

tcp-syn

Syntax tcp-syn

{

true

|

false

}

no tcp-syn

Context

config>system>security>cpm-filter>ip-filter>entry>match

Description

This command configures matching on the SYN bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The SYN bit is normally set when the source of the packet wants to initiate a TCP session with the specified destination IP address.

The

no

form of the command removes the criterion from the match entry.

Default no tcp-syn

Parameters true —

specifies matching on IP packets that have the SYN bit set in the control bits of the TCP header

false —

specifies matching on IP packets that do not have the SYN bit set in the control bits of the

TCP header

7705 SAR OS System Management Guide Page 103

Security Command Reference

renum

Syntax renum

old-entry-id new-entry-id

Context

config>system>security>cpm-filter>ip-filter

Description

This command renumbers existing IP filter entries in order to resequence filter entries.

Resequencing may be required in some cases because the OS exits when the first match is found and executes the actions according to the accompanying action command. This requires that entries be sequenced correctly from most to least explicit.

Parameters

old-entry-id —

the entry number of an existing entry

Values

1 to 64 where: 1 to 29 are filter entries

30 to 64 are extended filter entries

new-entry-id —

the new entry number to be assigned to the old entry

Values

1 to 64 where: 1 to 29 are filter entries

30 to 64 are extended filter entries

Page 104 7705 SAR OS System Management Guide

Security

Global Password Commands enable-admin

Syntax enable-admin

Context

<global>

Description

Note:

See the description for the admin-password

command. If the

adminpassword

is configured in the

config>system>security>password

context, then any user can enter the special administrative mode by entering the

enable-admin

command.

The

enable-admin

command is in the default profile. By default, all users are given access to this command.

Once the

enable-admin

command is entered, the user is prompted for a password. If the password matches, the user is given unrestricted access to all the commands.

There are two ways to verify that a user is in the enable-admin mode:

• Enter the show users command

—

Administrator can know which users are in this mode

• Enter the enable-admin command again at the root prompt and an error message will be returned

A:ALU-1# show users

===============================================================================

User Type Login time Idle time

From

=============================================================================== admin Console 10AUG2006 13:55:24 0d 19:42:22

-admin Telnet 09AUG2006 08:35:23 0d 00:00:00 A

10.20.30.93

-------------------------------------------------------------------------------

Number of users : 2

'A' indicates user is in admin mode

===============================================================================

A:ALU-1#

A:ALU-1# enable-admin

MINOR: CLI Already in admin mode.

A:ALU-1#

7705 SAR OS System Management Guide Page 105

Security Command Reference

Password Commands password

Syntax password

Context

config>system>security

Description

This command creates the context to configure password management parameters.

admin-password

Syntax admin-password

password

[

hash

|

hash2

]

no admin-password

Context

config>system>security>password

Description

This command allows a user (with admin permissions) to configure a password which enables a user to become an administrator.

This password is valid only for one session. When enabled, no authorization to TACACS+ or

RADIUS is performed and the user is locally regarded as an admin user.

Note:

See the description for the

enable-admin

command. If the

admin-password

is configured in the

config>system>security>password

context, then any user can enter the admin mode by entering the

enable-admin

command and the correct admin password.

The minimum length of the password is determined by the

minimum-length

command. The complexity requirements for the password are determined by the

complexity

command.

Note:

The

password

argument of this command is not sent to the servers. This is consistent with other commands that configure secrets. User names and passwords in the FTP and TFTP URLs will not be sent to the authorization or accounting servers when the

file>copy

source-url dest-url

command is executed.

For example: file copy ftp://test:[email protected]/test/srcfile cf3:\destfile

In this example, the user name “test” and password “secret” will not be sent to the AAA servers (or to any logs). They will be replaced with “****”.

The

no

form of the command removes the admin password from the configuration.

Page 106 7705 SAR OS System Management Guide

Security

Default no admin-password

Parameters

password —

configures the password that enables a user to become a system administrator. The maximum length can be up to 20 characters if unhashed, 32 characters if hashed, and 54 characters if the

hash2

keyword is specified.

hash —

specifies that the key is entered and stored on the node in encrypted form

hash2 —

specifies that the key is entered and stored on the node in a more complex encrypted form

Note:

If neither the hash nor hash2 keyword is specified, the key is entered in clear text.

However, for security purposes, the key is stored on the node using hash encryption.

aging

Syntax aging

days

no aging

Context

config>system>security>password

Description

This command configures the number of days a user password is valid before the user must change their password.

The

no

form of the command reverts to the default value.

Default

No aging is enforced.

Parameters

days —

the maximum number of days the password is valid

Values

1 to 500

attempts

Syntax attempts

count

[

time

minutes1

] [

lockout

minutes2

]

no attempts

Context

config>system>security>password

Description

This command configures a threshold value of unsuccessful login attempts allowed in a specified time frame.

If the threshold is exceeded, the user is locked out for a specified time period.

If multiple

attempts

commands are entered, each command overwrites the previously entered command.

The

no attempts

command resets all values to default.

7705 SAR OS System Management Guide Page 107

Security Command Reference

Default

count

: 3 time

minutes

: 5 lockout

minutes

: 10

Parameters

count —

the number of unsuccessful login attempts allowed for the specified

time

. This is a mandatory value that must be explicitly entered.

Values

1 to 64

time

minutes

—

the period of time, in minutes, that a specified number of unsuccessful attempts can be made before the user is locked out

Values

0 to 60

lockout

minutes

—

the lockout period, in minutes, where the user is not allowed to log in. Values are minutes.

Values

0 to 1440

When the user exceeds the attempted count times in the specified time, then that user is locked out from any further login attempts for the configured time period.

authentication-order

Syntax authentication-order

[

method-1

] [

method-2

] [

method-3

] [

exit-on-reject

]

no authentication-order

Context

config>system>security>password

Description

This command configures the sequence in which password authentication, authorization, and accounting is attempted among RADIUS, TACACS+, and local passwords.

The order should be from the most preferred authentication method to the least preferred. The presence of all methods in the command line does not guarantee that they are all operational.

Specifying options that are not available delays user authentication.

If all (operational) methods are attempted and no authentication for a particular login has been granted, then an entry in the security log registers the failed attempt. Both the attempted login identification and originating IP address are logged with a timestamp.

The

no

form of the command reverts to the default authentication sequence.

Default authentication-order radius tacplus local

Parameters

method-1 —

the first password authentication method to attempt

Default

radius

Values

radius, tacplus, local

method-2 —

the second password authentication method to attempt

Default

tacplus

Values

radius, tacplus, local

Page 108 7705 SAR OS System Management Guide

Security

method-3 —

the third password authentication method to attempt

Default

local

Values

radius, tacplus, local

radius —

RADIUS authentication

tacplus —

TACACS+ authentication

local —

password authentication based on the local password database

exit-on-reject —

when enabled, and if one of the AAA methods configured in the authentication order sends a reject, then the next method in the order will not be tried. If the

exit-on-reject

keyword is not specified and one AAA method sends a reject, the next AAA method will be attempted. If in this process all the AAA methods are exhausted, it will be considered a reject.

Note that a rejection is distinct from an unreachable authentication server. When the

exit-onreject

keyword is specified, authorization and accounting will only use the method that provided an affirmation authentication; only if that method is no longer readable or is removed from the configuration will other configured methods be attempted. If the local keyword is the first authentication and:

•

exit-on-reject

is configured and the user does not exist, the user will not be authenticated

• the user is authenticated locally, then other methods, if configured, will be used for authorization and accounting

• the user is configured locally but without console access, login will be denied

complexity

Syntax [no] complexity [numeric] [special-character] [mixed-case]

Context

config>system>security>password

Description

This command configures the complexity requirements of locally administered passwords, HMAC-

MD5-96, HMAC-SHA-96, and des-keys configured in the

config>system>security>user

user-name

>snmp>authentication

context.

If more than one complexity command is entered, each command overwrites the previous command.

The

no

form of the command cancels all requirements. To remove a single requirement, enter the

no

form of the command followed by the requirement that needs to be removed (for example,

no complexity numeric

).

Default

No complexity requirements are configured.

Parameters mixed-case —

specifies that at least one uppercase and one lowercase character must be present in the password. This keyword can be used in conjunction with the

numeric

and

special-character

parameters. However, if this command is used with the

authentication

none

command, the

complexity

command is rejected.

7705 SAR OS System Management Guide Page 109

Security Command Reference

numeric —

specifies that at least one numeric character must be present in the password. This keyword can be used in conjunction with the

mixed-case

and

special-character

parameters.

However, if this command is used with the

authentication

none

command, the

complexity

command is rejected.

special-character —

specifies that at least one special character must be present in the password.

This keyword can be used in conjunction with the

numeric

and

mixed-case

parameters.

However, if this command is used with the

authentication

none

command, the

complexity

command is rejected.

Special characters include: ~!@#$%^&*()_+|{}:”<>?`-=\[];’,./.

health-check

Syntax

[

no

]

health-check

Context

config>system>security>password

Description

This command specifies that RADIUS and TACACS+ servers are monitored for 3 seconds each at

30-second intervals. Servers that are not configured will have 3 seconds of idle time. If in this process a server is found to be unreachable, or a previously unreachable server starts responding, depending on the type of server, a trap will be sent.

The

no

form of the command disables the periodic monitoring of the RADIUS and TACACS+ servers. In this case, the operational status for the active server will be up if the last access was successful.

Default health-check

minimum-length

Syntax minimum-length

value

no minimum-length

Context

config>system>security>password

Description

This command configures the minimum number of characters required for locally administered passwords, HMAC-MD5-96, HMAC-SHA-96, and des-keys configured in the

config>system>security

context.

If multiple

minimum-length

commands are entered, each command overwrites the previously entered command.

The

no

form of the command reverts to the default value.

Default minimum-length 6

Parameters

value —

the minimum number of characters required for a password

Values

1 to 8

Page 110 7705 SAR OS System Management Guide

Security

Profile Management Commands profile

Syntax

[

no

]

profile

user-profile-name

Context

config>system>security

Description

This command creates a context to create user profiles for CLI command tree permissions.

Profiles are used to either deny or permit user console access to a hierarchical branch or to specific commands.

Once the profiles are created, the

user

command assigns users to one or more profiles. You can define up to 16 user profiles, but a maximum of 8 profiles can be assigned to a user.

The

no

form of the command deletes a user profile.

Default user-profile default

Parameters

user-profile-name —

the user profile name entered as a character string. The string is case-sensitive and limited to 32 ASCII 7-bit printable characters with no spaces.

default-action

Syntax default-action

{

deny-all

|

permit-all

|

none}

Context

config>system>security>profile

user-profile-name

Description

This command specifies the default action to be applied when no match conditions are met.

Default none

Parameters deny-all —

sets the default of the profile to deny access to all commands

permit-all —

sets the default of the profile to permit access to all commands

Note: permit-all

does not change access to security commands. Security commands are only and always available to members of the admin-user profile.

7705 SAR OS System Management Guide Page 111

Security Command Reference

none —

sets the default of the profile to no-action. This option is useful to assign multiple profiles to a user.

For example, if a user is a member of two profiles and the default action of the first profile is

permit-all

, then the second profile will never be evaluated because

permit-all

is executed first.

If the first profile default action is set to

none

and if no match conditions are met in the first profile, then the second profile will be evaluated. If the default action of the last profile is

none

and no explicit match is found, then the default-action

deny-all

takes effect.

renum

Syntax renum

old-entry-number new-entry-number

Context

config>system>security>profile

user-profile-name

Description

This command renumbers profile entries to resequence the entries.

Since the 7705 SAR exits when the first match is found and executes the actions according to the accompanying action command, renumbering is useful to rearrange the entries from most explicit to least explicit.

Parameters

old-entry-number —

the entry number of an existing entry

Values

1 to 9999

new-entry-number —

the new entry number

Values

1 to 9999

Profile Management Entry Commands

entry

Syntax

[

no

]

entry

entry-id

Context

config>system>security>profile

user-profile-name

Description

This command is used to create a user profile entry.

More than one entry can be created with unique

entry-id

numbers. The 7705 SAR exits when the first match is found and executes the actions according to the accompanying

action

command. Entries should be sequenced from most explicit to least explicit.

An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword

action

for it to be considered complete.

The

no

form of the command removes the specified entry from the user profile.

Default

No entry IDs are defined.

Page 112 7705 SAR OS System Management Guide

Security

Parameters

entry-id —

an entry-id uniquely identifies a user profile command match criteria and a corresponding action. If more than one entry is configured, the

entry-ids

should be numbered in staggered increments to allow users to insert a new entry without requiring renumbering of the existing entries.

Values

1 to 9999

action

Syntax action

{

deny

|

permit

}

Context

config>system>security>profile

user-profile-name

>entry

entry-id

Description

This command configures the action associated with the profile entry.

Parameters deny —

specifies that commands matching the entry command match criteria will be denied

permit —

specifies that commands matching the entry command match criteria will be permitted

match

Syntax match

command-string

no match

Context

config>system>security>profile

user-profile-name

>entry

entry-id

Description

This command configures a command or command subtree.

Because the 7705 SAR exits when the first match is found, subordinate levels cannot be modified with subsequent action commands. More specific action commands should be entered with a lower entry number or in a profile that is evaluated prior to this profile.

All commands below the hierarchy level of the matched command are denied.

The

no

form of this command removes a match condition.

Default

No match command string is specified.

Parameters

command-string —

the CLI command or CLI tree level that is the scope of the profile entry

7705 SAR OS System Management Guide Page 113

Security Command Reference

User Management Commands user

Syntax

[

no

]

user

user-name

Context

config>system>security

Description

This command creates a local user and a context to edit the user configuration.

If a new

user-name

is entered, the user is created. When an existing

user-name

is specified, the user parameters can be edited.

When a new user is created and the

info

command is entered, the system displays a password with has2 encryption in the output screen. However, when using that user name, there will be no password required. The user can log in to the system by entering their user name and then pressing

↵

at the password prompt.

Unless an administrator explicitly changes the password, it will be null. The hashed value displayed uses the user name and null password field, so when the user name is changed, the displayed hashed value will change.

The

no

form of the command deletes the user and all configuration data. Users cannot delete themselves.

Default none

Parameters

user-name —

the name of the user, up to 16 characters

user-template

Syntax user-template

{

tacplus_default | radius_default

}

Context

config>system>security

Description

This command configures default security user template parameters.

Parameters tacplus_default —

specifies that the default template is used for the configuration

Page 114 7705 SAR OS System Management Guide

Security

access

Syntax

[

no

]

access

[

ftp

] [

snmp

] [

console

]

[

no

]

access

[

ftp

] [

console

]

Context

config>system>security>user

user-name

config>system>security>user-template

Description

This command grants a user permission for FTP, SNMP, or console access.

If a user requires access to more than one application, then multiple applications can be specified in a single command. Multiple commands are treated sequentially.

The

no

form of command removes access for a specific application.

The

no access

command denies permission for all management access methods. To deny a single access method, enter the

no

form of the command followed by the method to be denied; for example,

no access FTP

denies FTP access.

Default no access

Parameters ftp —

specifies FTP permission

snmp —

specifies SNMP permission. This keyword is only configurable in the

config>system>security>user

context.

console —

specifies console access (serial port or Telnet) permission

home-directory

Syntax home-directory

url-prefix

[

directory

] [

directory

/

directory…

]

no home-directory

Context

config>system>security>user

user-name

config>system>security>user-template

Description

This command configures the local home directory for the user for both console and FTP access.

If the URL or the specified URL/directory structure is not present, then a warning message is issued and the default is assumed.

The

no

form of the command removes the configured home directory.

Default no home-directory

Note:

If restrict-to-home has been configured, no file access is granted and no home-directory is created; if restricted-to-home is not applied, root becomes the user’s home-directory.

7705 SAR OS System Management Guide Page 115

Security Command Reference

Parameters

url-prefix

[

directory

] [

directory/directory

…]

—

the user’s local home directory URL prefix and directory structure, up to 190 characters in length

password

Syntax password

[

password

] [

hash

|

hash2

]

Context

config>system>security>user

user-name

Description

This command configures the user password for console and FTP access.

The use of the

hash

keyword sets the initial password when the user is created or modifies the password of an existing user and specifies that the given password was hashed using hashing algorithm version 1.

The use of the

hash2

keyword specifies that the given password is already hashed using hashing algorithm version 2. A semantic check is performed on the given password field to verify that it is a valid hash 2 key to store in the database.

The password is stored in an encrypted format in the configuration file when specified. Passwords must be encased in double quotes (" ") at the time of the password creation if they contain any special characters. The double quote character (") is not accepted inside a password. It is interpreted as the start or stop delimiter of a string.

For example: config>system>security# user testuser1 config>system>security>user$ password "zx/Uhcn6ReMOZ3BVrWcvk." hash2 config>system>security>user# exit config>system>security# info

-------------------------------------

...

user "testuser1"

password "zx/Uhcn6ReMOZ3BVrWcvk." hash2

exit

...

------------------------------------config>system>security#

Parameters

password —

the password for the user that must be entered by this user during the login procedure.

The minimum length of the password is determined by the

minimum-length

command. The maximum length can be up to 20 characters if unhashed and 32 characters if hashed or 54 characters if hash2. The complexity requirements for the password are determined by the

complexity

command.

Passwords that contain special characters (#, $, spaces, etc.) must be enclosed within double quotes.

For example:

config>system>security>user# password “south#bay?”

The question mark character (?) cannot be directly inserted as input during a Telnet connection because the character is bound to the

help

command during a normal Telnet/console connection.

Page 116 7705 SAR OS System Management Guide

Security

To insert

# or

? characters, they must be entered inside a notepad or clipboard program and then cut and pasted into the Telnet session in the password field that is encased in the double quotes as delimiters for the password.

If a password is entered without any parameters, a password length of zero is implied (return key).

hash —

specifies that the given password is already hashed using hashing algorithm version 1. A semantic check is performed on the given password field to verify that it is a valid hash 1 key to store in the database.

hash2 —

specifies that the given password is already hashed using hashing algorithm version 2. A semantic check is performed on the given password field to verify that it is a valid hash 2 key to store in the database.

restricted-to-home

Syntax

[

no

]

restricted-to-home

Context

config>system>security>user

user-name

config>system>security>user-template

Description

This command prevents users from navigating above their home directories for file access. A user is not allowed to navigate to a directory higher in the directory tree on the home directory device. The user is allowed to create and access subdirectories below their home directory.

If a home directory is not configured or the home directory is not available, then the user has no file access.

The

no

form of the command allows the user access to navigate to directories above their home directory.

Default no restricted-to-home

User Management Console Commands

console

Syntax console

Context

config>system>security>user

user-name

config>system>security>user-template

Description

This command creates the context to configure user profile membership for the console.

7705 SAR OS System Management Guide Page 117

Security Command Reference

cannot-change-password

Syntax

[

no

]

cannot-change-password

Context

config>system>security>user

user-name

>console

Description

This command allows a user to change their password for both FTP and console login.

To disable a user’s privilege to change their password, use the

cannot-change-password

form of the command.

Note that the cannot-change-password flag is not replicated when a user copy is performed. A newpassword-at-login flag is created instead.

Default no cannot-change-password

login-exec

Syntax

[

no

]

login-exec

url-prefix

:

source-url

Context

config>system>security>user

user-name

>console config>system>security>user-template>console

Description

This command configures a user’s login exec file, which executes whenever the user successfully logs in to a console session.

Only one exec file can be configured. If multiple

login-exec

commands are entered for the same user, each subsequent entry overwrites the previous entry.

The

no

form of the command disables the login exec file for the user.

Default

No login exec file is defined.

Parameters

url-prefix: source-url —

enter either a local or remote URL, up to 200 characters in length, that identifies the exec file that will be executed after the user successfully logs in

member

Syntax member

user-profile-name

[

user-profile-name…

]

no member

user-profile-name

Context

config>system>security>user

user-name

>console

Description

This command allows the user access to a profile.

A user can participate in up to eight profiles.

The

no

form of this command deletes access user access to a profile.

Page 118 7705 SAR OS System Management Guide

Security

Default default

Parameters

user-profile-name —

the user profile name

new-password-at-login

Syntax

[

no

]

new-password-at-login

Context

config>system>security>user

user-name

>console

Description

This command forces the user to change passwords at the next console or FTP login.

If the user is limited to FTP access, the administrator must create the new password.

The

no

form of the command does not force the user to change passwords.

Default no new-password-at-login

User Management SNMP Commands

snmp

Syntax snmp

Context

config>system>security>user

user-name

Description

This command creates the context to configure SNMP group membership for a specific user and defines encryption and authentication parameters.

All SNMPv3 users must be configured with the commands available in this CLI context.

The 7705 SAR always uses the configured SNMPv3 user name as the security user name.

authentication

Syntax authentication

{[

none

] | [[

hash

] {

md5

key-1

|

sha

key-1

}

privacy

{

none

|

des-key

key-2

}]

Context

config>system>security>user

user-name

>snmp

Description

This command configures the authentication and encryption method the user must use in order to be validated by the 7705 SAR. SNMP authentication allows the device to validate the managing node that issued the SNMP message and determine if the message has been tampered with. The authentication protocol can either be HMAC-MD5-96 or HMAC-SHA-96.

The user password is encrypted first by the MD5/SHA/DES algorithm. The output of the algorithm is always a fixed-length string (key). Copy the

password

key and paste the output in the appropriate

authentication

command

key

parameter.

7705 SAR OS System Management Guide Page 119

Security Command Reference

Default authentication none -

No authentication is configured and privacy cannot be configured.

Parameters none —

do not use authentication. If

none

is specified, then privacy cannot be configured.

hash —

when

hash

is not specified, unencrypted characters can be entered. When

hash

is configured, all specified keys are stored in an encrypted format in the configuration file. The password must be entered in encrypted form when the

hash

parameter is used.

md5

key-1

—

the MD5 authentication key is stored in an encrypted format. The minimum key length is determined by the

config>system>security>password>minimum-length

value. The maximum length is 16 octets (32 printable characters).

The complexity of the key is determined by the

complexity

command.

sha

key-1

—

the

sha

authentication key is stored in an encrypted format. The minimum key length is determined by the

config>system>security>password>minimum-length

value. The maximum length is 20 octets (40 printable characters).

The complexity of the key is determined by the

complexity

command.

privacy none —

do not perform SNMP packet encryption

privacy des-key

key-2

—

configure the

des-key

for SNMP packet encryption. This key is stored in an encrypted format . The minimum key length is determined by the

config>system>security>password>minimum-length

value. The maximum length is 16 octets

(32 printable characters). If privacy is configured, then

authentication

must be enabled.

To remove a previously configured

des-key,

enter

privacy none

.

The complexity of the key is determined by the

complexity

command.

Default

privacy none

group

Syntax group

group-name

no group

Context

config>system>security>user

user-name

>snmp

Description

This command associates (or links) a user to a group name. The access

command links the group with one or more views, security model(s), security level(s), and read, write, and notify permissions.

Default

No group name is associated with a user.

Parameters

group-name —

enter the group name (between 1 and 32 alphanumeric characters) that is associated with this user. A user can be associated with one group name per security model.

Page 120 7705 SAR OS System Management Guide

Security

RADIUS Client Commands radius

Syntax

[

no

]

radius

Context

config>system>security

Description

This command creates the context to configure RADIUS authentication on the 7705 SAR.

Implement redundancy by configuring multiple server addresses for each 7705 SAR.

The

no

form of the command removes the RADIUS configuration.

access-algorithm

Syntax access-algorithm {direct | round-robin}

[

no

]

access-algorithm

Context

config>system>security>radius

Description

This command configures the algorithm used to access the set of RADIUS servers. Up to five servers can be configured.

In direct mode, the first server, as defined by the

server

command, is the primary server. This server

is always used first when authenticating a request. In round-robin mode, the server used to authenticate a request is the next server in the list, following the last authentication request. For example, if server 1 is used to authenticate the first request, server 2 is used to authenticate the second request, and so on.

Default direct

Parameters direct —

first server is always used to authenticate a request

round-robin —

server used to authenticate a request is the next server in the list, following the last authentication request

accounting

Syntax

[

no

]

accounting

Context

config>system>security>radius

Description

This command enables RADIUS accounting. The

no

form of this command disables RADIUS accounting.

Default no accounting

7705 SAR OS System Management Guide Page 121

Security Command Reference

accounting-port

Syntax accounting-port

port

no accounting-port

Context

config>system>security>radius

Description

This command specifies a UDP port number on which to contact the RADIUS server for accounting requests.

Parameters

port —

specifies the UDP port number

Values

1 to 65535

Default

1813

authorization

Syntax

[

no

]

authorization

Context

config>system>security>radius

Description

This command configures RADIUS authorization parameters for the system.

The

no

form of this command disables RADIUS authorization for the system.

Default no authorization

port

Syntax port

port

no port

Context

config>system>security>radius

Description

This command configures the TCP port number to contact the RADIUS server.

The

no

form of the command reverts to the default value.

Default 1812

(as specified in RFC 2865,

Remote Authentication Dial In User Service

(

RADIUS

) )

Parameters

port —

the TCP port number to contact the RADIUS server

Values

1 to 65535

Page 122 7705 SAR OS System Management Guide

Security

retry

Syntax retry

count

no retry

Context

config>system>security>radius

Description

This command configures the number of times the router attempts to contact the RADIUS server for authentication if there are problems communicating with the server.

The

no

form of the command reverts to the default value.

Default

3

Parameters

count —

the retry count

Values

1 to 10

server

Syntax server

server-index

address

ip-address

secret

key

[

hash

|

hash2

]

no server

server-index

Context

config>system>security>radius

Description

This command adds a RADIUS server and configures the RADIUS server IP address, index, and key values.

Up to five RADIUS servers can be configured at any one time. RADIUS servers are accessed in order from lowest to highest index for authentication requests until a response from a server is received. A higher-indexed server is only queried if no response is received from a lower-indexed server (which implies that the server is not available). If a response from a server is received, no other RADIUS servers are queried. It is assumed that there are multiple identical servers configured as backups and that the servers do not have redundant data.

The

no

form of the command removes the server from the configuration.

Default

No RADIUS servers are configured.

Parameters

index —

the index for the RADIUS server. The index determines the sequence in which the servers are queried for authentication requests. Servers are queried in order from lowest to highest index.

Values

1 to 5

address

ip-address

—

the IP address of the RADIUS server. Two RADIUS servers cannot have the same IP address. An error message is generated if the server address is a duplicate.

Values

ipv4-address a.b.c.d (host bits must be 0)

secret

key

—

the secret key to access the RADIUS server. This secret key must match the password on the RADIUS server.

Values

Up to 20 characters in length

7705 SAR OS System Management Guide Page 123

Security Command Reference

hash —

specifies that the key is entered in an encrypted form. If the

hash

parameter is not used, the key is assumed to be in an unencrypted, clear text form. For security, all keys are stored in encrypted form in the configuration file with the

hash

parameter specified.

hash2 —

specifies that the key is entered in a more complex encrypted form. If the

hash2

parameter is not used, the less encrypted

hash

form is assumed.

timeout

Syntax timeout

seconds

no timeout

Context

config>system>security>radius

Description

This command configures the number of seconds the router waits for a response from a RADIUS server.

The

no

form of the command reverts to the default value.

Default

3

Parameters

seconds —

the number of seconds the router waits for a response from a RADIUS server, expressed as a decimal integer

Values

1 to 90

use-default-template

Syntax

[

no

]

use-default-template

Context

config>system>security>radius

Description

This command specifies whether or not the user template defined by this entry is to be actively applied to the RADIUS user.

Default no use-default-template

Page 124 7705 SAR OS System Management Guide

Security

TACACS+ Client Commands tacplus

Syntax

[

no

]

tacplus

Context

config>system>security

Description

This command creates the context to configure TACACS+ authentication on the 7705 SAR.

Configure multiple server addresses for each 7705 SAR for redundancy.

The

no

form of the command removes the TACACS+ configuration.

accounting

Syntax accounting

[

record-type

{

start-stop

|

stop-only

}]

no accounting

Context

config>system>security>tacplus

Description

This command enables TACACS+ accounting and configures the type of accounting record packet that is to be sent to the TACACS+ server. The

record-type

parameter indicates whether TACACS+ accounting start and stop packets will be sent or just stop packets will be sent.

Default record-type stop-only

Parameters record-type start-stop —

specifies that a TACACS+ start packet is sent whenever the user executes a command and a stop packet is sent when the command is complete

record-type stop-only —

specifies that a stop packet is sent when the command execution is complete

authorization

Syntax

[

no

]

authorization

Context

config>system>security>tacplus

Description

This command configures TACACS+ authorization parameters for the system.

Default no authorization

7705 SAR OS System Management Guide Page 125

Security Command Reference

server

Syntax server

index

address

ip-address

secret

key

[

hash | hash2

]

no server

index

Context

config>system>security>tacplus

Description

This command adds a TACACS+ server and configures the TACACS+ server IP address, index, and key values.

Up to five TACACS+ servers can be configured at any one time. TACACS+ servers are accessed in order from the lowest index to the highest index for authentication requests.

The

no

form of the command removes the server from the configuration.

Default

No TACACS+ servers are configured.

Parameters

index —

the index for the TACACS+ server. The index determines the sequence in which the servers are queried for authentication requests. Servers are queried in order from the lowest index to the highest index.

Values

1 to 5

address

ip-address

—

the IP address of the TACACS+ server. Two TACACS+ servers cannot have the same IP address. An error message is generated if the server address is a duplicate.

Values

ipv4-address a.b.c.d (host bits must be 0)

secret

key

—

the secret key to access the RADIUS server. This secret key must match the password on the TACACS+ server.

Values

Up to 20 characters in length

hash —

specifies that the key is entered in an encrypted form. If the

hash

parameter is not used, the key is assumed to be in an unencrypted, clear text form. For security, all keys are stored in encrypted form in the configuration file with the

hash

parameter specified.

hash2 —

specifies that the key is entered in a more complex encrypted form. If the

hash2

parameter is not used, the less encrypted

hash

form is assumed.

single-connection

Syntax

[

no

]

single-connection

Context

config>system>security>tacplus

Description

This command sets up a single connection to the TACACS+ server and validates everything via that connection. Normally, each authentication event sets up a connection to validate that particular event.

The

no

form of the command disables TACACS+ single connection configuration.

Default no single-connection

Page 126 7705 SAR OS System Management Guide

Security

timeout

Syntax timeout

second

s

no timeout

Context

config>system>security>tacplus

Description

This command configures the number of seconds the router waits for a response from a TACACS+ server.

The

no

form of the command reverts to the default value.

Default

3

Parameters

seconds —

the number of seconds the router waits for a response from a TACACS+ server, expressed as a decimal integer

Values

1 to 90

use-default-template

Syntax

[

no

]

use-default-template

Context

config>system>security>tacplus

Description

This command specifies whether or not the user template defined by this entry is to be actively applied to the TACACS+ user.

7705 SAR OS System Management Guide Page 127

Security Command Reference

SSH Commands ssh

Syntax ssh

Context

config>system>security

Description

This command enables the context to configure the SSH server on the system. This command should only be enabled or disabled no SSH session is running.

When the command is executed, an SSH security key is generated. This key is valid until either the node is restarted or the SSH server is stopped with the

no ssh

command and restarted. The key size is non-configurable and set at 1024 bits.

Quitting SSH while in the process of authentication is accomplished by either executing a

ctrl-c

or

"~." (tilde and dot), assuming the “~” is the default escape character for the SSH session.

Default ssh —

The SSH server is enabled.

preserve-key

Syntax

[

no

]

preserve-key

Context

config>system>security>ssh

Description

This command specifies the persistence of the SSH server host key. When enabled, the host key will be saved by the server and restored following a system reboot. This command can only be enabled or disabled when no SSH session is running.

The

no

form of the command specifies that the host key will be held in memory by the SSH server and not be restored following a system reboot.

Default no preserve-key

server-shutdown

Syntax

[

no

]

server-shutdown

Context

config>system>security>ssh

Description

This command enables the SSH servers running on the system.

Default

At system startup, only the SSH server is enabled.

Page 128 7705 SAR OS System Management Guide

Security

version

Syntax version

ssh-version

no version

Context

config>system>security>ssh

Description

This command specifies the SSH protocol version that will be supported by the SSH server. The server may be configured as Secure Shell Version 1 (SSH1), Version 2 (SSH2) or both. SSH1 and

SSH2 are different protocols and encrypt at different parts of the packets. SSH1 uses the server as well as host keys to authenticate systems, whereas SSH2 only uses host keys. SSH2 does not use the same networking implementation that SSH1 does and is considered a more secure, efficient, and portable version of SSH that includes Secure FTP (SFTP).

Parameters

ssh-version —

specifies the SSH version

Values

1 — specifies that the SSH server will only accept connections from clients supporting SSH protocol version 1

2 — specifies that the SSH server will only accept connections from clients supporting SSH protocol version 2

1-2 — specifies that the SSH server will accept connections from clients supporting either SSH protocol version 1, or SSH protocol version 2, or both

Default

2

7705 SAR OS System Management Guide Page 129

Security Command Reference

Login Control Commands login-control

Syntax login-control

Context

config>system

Description

This command creates the context to configure the session control for console, Telnet and FTP.

exponential-backoff

Syntax

[

no

]

exponential-backoff

Context

config>system>login-control

Description

This command enables the exponential-backoff of the login prompt. The exponential-backoff command is used to deter dictionary attacks, when a malicious user can gain access to the CLI by using a script to try

admin

with any conceivable password.

The

no

form of the command disables exponential-backoff.

Default no exponential-backoff

idle-timeout

Syntax idle-timeout

{

minutes

|

disable} no idle-timeout

Context

config>system>login-control

Description

This command configures the idle timeout for FTP, console, or Telnet sessions before the session is terminated by the system.

By default, an idle FTP, console, or Telnet session times out after 30 minutes of inactivity. This timer can be set per session.

The

no

form of the command reverts to the default value.

Default

30

Parameters

minutes —

the idle timeout in minutes. Allowed values are 1 to 1440.

Values

1 to 1440

disable —

when the

disable

option is specified, a session will never time out. To re-enable idle timeout, enter the command without the disable option.

Page 130 7705 SAR OS System Management Guide

Security

login-banner

Syntax [no] login-banner

Context

config>system>login-control

Description

This command enables or disables the display of a login banner. The login banner contains the

7705 SAR copyright and build date information for a console login attempt.

The

no

form of the command causes only the configured pre-login-message and a generic login prompt to display.

motd

Syntax motd

{

url

url-prefix

:

source-url

|

text

motd-text-string

}

no motd

Context

config>system>login-control

Description

This command creates the message of the day that is displayed after a successful console login.

Only one message can be configured.

The

no

form of the command removes the message.

Default no motd

Parameters url

url-prefix

:

source-url

—

when the message of the day is present as a text file, provide both urlprefix and the source-url of the file containing the message of the day. The URL prefix can be local or remote.

text

motd-text-string

—

the text of the message of the day. The

motd-text-string

must be enclosed in double quotes. Multiple text strings are not appended to one another.

Some special characters can be used to format the message text. The “\n” character creates multiline MOTDs and the “\r” character restarts at the beginning of the new line. For example, entering “\n\r” will start the string at the beginning of the new line, while entering “\n” will start the second line below the last character from the first line.

pre-login-message

Syntax pre-login-message

login-text-string

[

name

]

no pre-login-message

Context

config>system>login-control

Description

This command creates a message displayed prior to console login attempts on the console via Telnet.

Only one message can be configured. If multiple

pre-login-messages

are configured, the last message entered overwrites the previous entry.

7705 SAR OS System Management Guide Page 131

Security Command Reference

The system name can be added to an existing message without affecting the current

pre-login-message

.

The

no

form of the command removes the message.

Default no pre-login-message

Parameters

login-text-string —

a text string, up to 900 characters. Any printable, 7-bit ASCII characters can be used. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.

name —

when the keyword

name

is defined, the configured system name is always displayed first in the login message. To remove the name from the login message, the message must be cleared and a new message entered without the name.

FTP Login Control Commands

ftp

Syntax ftp

Context

config>system>login-control

Description

This command creates the context to configure FTP login control parameters.

inbound-max-sessions

Syntax inbound-max-sessions

value

no inbound-max-sessions

Context

config>system>login-control>ftp

Description

This command configures the maximum number of concurrent inbound FTP sessions.

This value is the combined total of inbound and outbound sessions.

The

no

form of the command reverts to the default value.

Default 3

Parameters

value —

the maximum number of concurrent FTP sessions on the node

Values

0 to 5

Page 132 7705 SAR OS System Management Guide

Security

Telnet Login Control Commands

telnet

Syntax telnet

Context

config>system>login-control

Description

This command creates the context to configure the Telnet login control parameters.

inbound-max-sessions

Syntax inbound-max-sessions

value

no inbound-max-sessions

Context

config>system>login-control>telnet

Description

This parameter limits the number of inbound Telnet sessions. Each 7705 SAR router is limited to a total of 7 Telnet or SSH sessions.

The value controls inbound Telnet sessions only. Console sessions though the local serial (console) port cannot be disabled.

The

no

form of the command reverts to the default value.

Default 5

Parameters

value —

the maximum number of concurrent inbound Telnet sessions, expressed as an integer

Values

0 to 7

outbound-max-sessions

Syntax outbound-max-sessions

value

no outbound-max-sessions

Context

config>system>login-control>telnet

Description

This parameter limits the number of outbound Telnet sessions. Each 7705 SAR router is limited to a total of 7 Telnet or SSH sessions.

The value controls Telnet outbound sessions only. The local serial port cannot be disabled.

The

no

form of the command reverts to the default value.

Default 5

7705 SAR OS System Management Guide Page 133

Security Command Reference

Parameters

value —

the maximum number of concurrent outbound Telnet sessions, expressed as an integer

Values

0 to 7

Page 134 7705 SAR OS System Management Guide

Show Commands

•

Security Show Commands on page 136

•

Login Control Show Commands on page 154

Security

7705 SAR OS System Management Guide Page 135

Security Command Reference

Security Show Commands access-group

Syntax access-group

[

group-name

]

Context

show>system>security

Description

This command displays SNMP access group information.

Parameters

group-name —

displays information for the specified access group

Output

The following output is an examples of system security access group information, and describes the fields.

Table 8

Sample Output

A:ALU-4#

show system security access-group

===============================================================================

Access Groups

=============================================================================== group name security security read write notify

model level view view view

------------------------------------------------------------------------------snmp-ro snmpv1 none no-security no-security snmp-ro snmpv2c none no-security no-security snmp-rw snmpv1 none no-security no-security no-security snmp-rw snmpv2c none no-security no-security no-security snmp-rwa snmpv1 none iso iso iso snmp-rwa snmpv2c none iso iso iso snmp-trap snmpv1 none iso snmp-trap snmpv2c none iso

===============================================================================

A:ALU-7#

Label

Security model

Table 8: Show System Security Access Group Output Fields

Group name

Description

The access group name

The security model required to access the views configured in this node

Security level

Read view

Write view

Notify view

Specifies the required authentication and privacy levels to access the views configured in this node

Specifies the variable of the view to read the MIB objects

Specifies the variable of the view to configure the contents of the agent

Specifies the variable of the view to send a trap about MIB objects

Page 136 7705 SAR OS System Management Guide

Security

authentication

Syntax authentication

[

statistics

]

Context

show>system>security

Description

This command displays system login authentication configuration and statistics.

Parameters statistics —

appends login and accounting statistics to the display

Output

The following output is an examples of system security authentication information, and describes the fields.

Table 9

Sample Output

A:ALU-4#

show system security authentication

===============================================================================

Authentication sequence : radius tacplus local

=============================================================================== type status timeout single retry

server address (secs) conn count

------------------------------------------------------------------------------radius

10.10.10.103 up 5 n/a 5 radius

10.10.0.1 up 5 n/a 5 radius

10.10.0.2 up 5 n/a 5 tacplus

10.10.0.9(49) down 5 true n/a

------------------------------------------------------------------------------radius admin status : up tacplus admin status : down health check : enabled (interval 30)

-------------------------------------------------------------------------------

No. of Servers: 4

===============================================================================

A:ALU-4#

7705 SAR OS System Management Guide Page 137

Security Command Reference

A:ALU-7>show>system>security# authentication statistics

===============================================================================

Authentication sequence : radius tacplus local

=============================================================================== type status timeout single retry

server address (secs) conn count

------------------------------------------------------------------------------radius

10.10.10.103 up 5 n/a 5 radius

10.10.0.1 up 5 n/a 5 radius

10.10.0.2 up 5 n/a 5 tacplus

10.10.0.9(49) down 5 true n/a

------------------------------------------------------------------------------radius admin status : up tacplus admin status : down health check : enabled (interval 30)

-------------------------------------------------------------------------------

No. of Servers: 4

===============================================================================

Login Statistics

=============================================================================== server address conn accepted rejected

errors logins logins

-------------------------------------------------------------------------------

10.10.10.103 0 0 0

10.10.0.1 0 0 0

10.10.0.2 0 0 0

10.10.0.9 0 0 0 local n/a 1 0

===============================================================================

Authorization Statistics (TACACS+)

=============================================================================== server address conn sent rejected

errors pkts pkts

-------------------------------------------------------------------------------

10.10.0.9 0 0 0

===============================================================================

Accounting Statistics

=============================================================================== server address conn sent rejected

errors pkts pkts

-------------------------------------------------------------------------------

10.10.10.103 0 0 0

10.10.0.1 0 0 0

10.10.0.2 0 0 0

===============================================================================

A:ALU-7#

Page 138 7705 SAR OS System Management Guide

Security

Table 9: Show System Security Authentication Output Fields

Label Description

Sequence

Server address

Status

Type

Timeout (secs)

Single connection

Retry count

Connection errors

The sequence in which authentication is processed

The IP address of the RADIUS server

The current status of the RADIUS server

The authentication type

The number of seconds the router waits for a response from a RADIUS server

Enabled —

Specifies a single connection to the TACACS+ server and validates everything via that connection

Disabled —

The TACACS+ protocol operation is disabled

Displays the number of times the router attempts to contact the

RADIUS server for authentication if there are problems communicating with the server

The number of times a user has attempted to log in irrespective of whether the login succeeded or failed

Accepted logins

Rejected logins

The number of times the user has successfully logged in

The number of unsuccessful login attempts

Sent packets

The number of packets sent

Rejected packets

The number of packets rejected

7705 SAR OS System Management Guide Page 139

Security Command Reference

communities

Syntax communities

Context

show>system>security

Description

This command displays SNMP communities and characteristics.

Output

The following output is an examples of community information, and

Table 10

describes the fields.

Sample Output

A:ALU-48# show system security communities

=============================================================================

Communities

============================================================================= community access view version group name

----------------------------------------------------------------------------cli-readonly r iso v2c cli-readonly cli-readwrite rw iso v2c cli-readwrite public r no-security v1 v2c snmp-ro

-----------------------------------------------------------------------------

No. of Communities: 3

=============================================================================

A:ALU-48#

Label

Community

Access

View

Version

Group Name

No of

Communities

Table 10: Show Communities Output Fields

Description

The community string name for SNMPv1 and SNMPv2c access only.

r —

The community string allows read-only access rw —

The community string allows read-write access rwa —

The community string allows read-write access mgmt —

The unique SNMP community string assigned to the management router

The view name

The SNMP version

The access group name

The total number of configured community strings

Page 140 7705 SAR OS System Management Guide

Security

cpm-filter

Syntax cpm-filter ip-filter

[

entry

entry-id

]

Context

show>system>security

Description

This command displays information on CPM (CSM) filters.

If an entry number is not specified, all entries are displayed.

Parameters

entry-id —

displays information about the specified CPM filter entry

Default

All filter entries

Values

1 to 9999

Output

The following output is an examples of CPM filter information, and

Table 11

describes the fields.

Sample Output

A:ALU-35# show system security cpm-filter ip-filter

===============================================================================

CPM IP Filters

===============================================================================

Entry-Id Dropped Forwarded Description

-------------------------------------------------------------------------------

2 0 0 CPM filter #2

3 25880 0 CPM filter #3

4 25880 0 CPM filter #4

5 25882 0 CPM filter #5

6 25926 0 CPM filter #6

7 25926 0 CPM filter #7

8 25944 0 CPM filter #8

9 25950 0 CPM filter #9

10 25968 0 CPM filter #10

11 25984 0 CPM filter #11

12 26000 0 CPM filter #12

13 26018 0 CPM filter #13

14 26034 0 CPM filter #14

15 26050 0 CPM filter #15

===============================================================================

A:ALU-35#

A:ALU-35# show system security cpm-filter ip-filter entry 2

===============================================================================

CPM IP Filter Entry

===============================================================================

Entry Id : 2

Description : CPM filter #2

-------------------------------------------------------------------------------

Filter Entry Match Criteria :

-------------------------------------------------------------------------------

Log Id : 101

Src. IP : 10.4.101.2/32 Src. Port : 0

Dest. IP : 10.4.101.1/32 Dest. Port : 0

Protocol : tcp Dscp : ef

ICMP Type : Undefined ICMP Code : Undefined

7705 SAR OS System Management Guide Page 141

Security Command Reference

Fragment : True Option-present : Off

IP-Option : n/a Multiple Option : True

TCP-syn : Off TCP-ack : True

Match action : Drop

Dropped pkts : 0 Forwarded pkts : 0

===============================================================================

A:ALU-35#

Label

Entry-id

Dropped

Forwarded

Description

Log ID

Src. IP

Dest. IP

Protocol

ICMP Type

Fragment

IP-Option

TCP-syn

Match action

Dropped pkts

Src. Port

Dest. Port

Dscp

ICMP Code

Option-present

Multiple Option

TCP-ack

Match action

Table 11: Show CPM Filter Output Fields

Description

Displays information about the specified CPM filter entry

The number of dropped events

The number of forwarded events

The CPM filter description

The log ID where matched packets will be logged

The source IP address(/netmask)

The destination IP address(/netmask)

The Protocol field in the IP header

The ICMP type field in the ICMP header

The 3-bit fragment flags or 13-bit fragment offset field

The IP option setting

The SYN flag in the TCP header

When the criteria matches, displays drop or forward packet

The number of matched dropped packets

The source port number (range)

The destination port number (range)

The DSCP field in the IP header

The ICMP code field in the ICMP header

The option present setting

The multiple option setting

The ACK flag in the TCP header

When the criteria matches, displays drop or forward packet

Page 142 7705 SAR OS System Management Guide

Security

Label

Next Hop

Table 11: Show CPM Filter Output Fields (Continued)

Forwarded pkts

Description

If match action is forward, indicates destination of the matched packet

Indicates number of matched forwarded packets

management-access-filter

Syntax management-access-filter ip-filter

[

entry

entry-id

]

Context

show>system>security

Description

This command displays management access control filter information.

If no specific entry number is specified, all entries are displayed.

Parameters

entry-id —

displays information about the specified management access filter entry

Default

All filter entries

Values

1 to 9999

Output

The following output is an examples of CPM management access filter information, and

describes the fields.

Table 12

Sample Output

A:ALU-7#

show system security management-access-filter ip-filter entry 1

=============================================================================

IPv4 Management Access Filters

============================================================================= filter type: : ip

Def. Action : permit

Admin Status : enabled (no shutdown)

-----------------------------------------------------------------------------

Entry : 1

Description : test description

Src IP : 10.10.10.104

Src interface : undefined

Dest port : 10.10.10.103

Protocol : 6

Router : undefined

Action : permit

Log : disabled

Matches : 0

=============================================================================

A:ALU-7#

7705 SAR OS System Management Guide Page 143

Security Command Reference

Label

Dest port

Protocol

Action

Matches

Table 12: Show Management Access Filter Output Fields

filter type

Def. action

Admin Status

Entry

Description

Src IP

Src interface

Description

The management access filter type

Permit —

Specifies that packets not matching the configured selection criteria in any of the filter entries are permitted

Deny —

Specifies that packets not matching the configured selection criteria in any of the filter entries are denied and that a ICMP host unreachable message will be issued

Deny-host-unreachble —

Specifies that packets not matching the configured selection criteria in the filter entries are denied

Up — indicates that the management access filter is administratively enabled

Down — indicates that the management access filter is administratively disabled

The entry ID in a policy or filter table

A text string describing the filter

The source IP address used for management access filter match criteria

The interface name for the next hop to which the packet should be forwarded if it hits this filter entry

The destination port

The IP protocol to match

The action to take for packets that match this filter entry

The number of times a management packet has matched this filter entry

Page 144 7705 SAR OS System Management Guide

Security

password-options

Syntax password-options

Context

show>system>security

Description

This command displays configured password options.

Output

The following output is an examples of password options information, and fields.

Table 13

describes the

Sample Output

A:ALU-7#

show system security password-options

===============================================================================

Password Options

===============================================================================

Password aging in days : none

Number of invalid attempts permitted per login : 3

Time in minutes per login attempt : 5

Lockout period (when threshold breached) : 10

Authentication order : radius tacplus local

Configured complexity options :

Minimum password length : 6

===============================================================================

A:ALU-7#

Label

Number of invalid attempts permitted per login

Table 13: Show Password Options Output Fields

Password aging in days

Description

The number of days a user password is valid before the user must change their password

The number of unsuccessful login attempts allowed for the specified

time

Time in minutes per login attempt

Lockout period (when threshold breached)

Authentication order

The period of time, in minutes, that a specified number of unsuccessful attempts can be made before the user is locked out

The lockout period, in minutes, where the user is not allowed to log in

The sequence in which password authentication is attempted among RADIUS, TACACS+, and local passwords

7705 SAR OS System Management Guide Page 145

Security Command Reference

Label

Configured complexity options

Table 13: Show Password Options Output Fields (Continued)

Minimum password length

Description

The complexity requirements of locally administered passwords, HMAC-MD5-96, HMAC-SHA-96 and

DES-keys configured in the

authentication

section

The minimum number of characters required for locally administered passwords, HMAC-MD5-96,

HMAC-SHA-96, and DES-keys configured in the system security section

profile

Syntax profile

user-profile-name

Context

show>system>security

Description

This command displays user profile information.

If the

profile-name

is not specified, then information for all profiles is displayed.

Parameters

profile-name —

displays information for the specified user profile

Output

The following output is an examples of user profile information, and

Table 14

describes the fields.

Sample Output

A:ALU-7#

show system security profile administrative

===============================================================================

User Profile

===============================================================================

User Profile : administrative

Def. Action : permit-all

LI : no

-------------------------------------------------------------------------------

Entry : 10

Description :

Match Command: configure system security

Action : permit

-------------------------------------------------------------------------------

Entry : 20

Description :

Match Command: show system security

Action : permit

-------------------------------------------------------------------------------

No. of profiles: 1

===============================================================================

A:ALU-7#

Page 146 7705 SAR OS System Management Guide

Security

Label

User Profile

Def. action

Entry

Description

Match Command

Action

No. of profiles

Table 14: Show User Profile Output Fields

Description

The profile name used to deny or permit user console access to a hierarchical branch or to specific commands

Permit all —

Permits access to all commands

Deny —

Denies access to all commands

None —

No action is taken

The entry ID in a policy or filter table

Displays the text string describing the entry

Displays the command or subtree commands in subordinate command levels

Permit all —

Commands matching the entry command match criteria are permitted

Deny —

Commands not matching the entry command match criteria are not permitted

The total number of profiles listed

source-address

Syntax source-address

Context

show>system>security

Description

This command displays the source address configured for applications.

Output

The following output is an examples of source address information, and

fields.

Table 15

describes the

Sample Output

A:ALU-1# show system security source-address

===============================================================================

Source-Address applications

===============================================================================

Application IP address/Interface Name Oper status

------------------------------------------------------------------------------telnet 10.20.1.7 Up radius loopback1 Up

===============================================================================

A:ALU-1#

7705 SAR OS System Management Guide Page 147

Security Command Reference

Label

Application

IP address

Interface Name

Table 15: Show Source Address Output Fields

Description

The source-address application

The source address IP address or interface name

Oper status Up —

The source address is operationally up

Down —

The source address is operationally down

ssh

Syntax ssh

Context

show>system>security

Description

This command displays all the SSH sessions as well as the SSH status and fingerprint.

Output

The following output is an examples of SSH information, and

Table 16

describes the fields.

Sample Output

ALU-7#

show system security ssh

SSH is enabled

SSH preserve key: Enabled

SSH protocol version 1: Enabled

RSA host key finger print:c6:a9:57:cb:ee:ec:df:33:1a:cd:d2:ef:3f:b5:46:34

SSH protocol version 2: Enabled

DSA host key finger print:c0:be:4a:da:55:87:e0:92:da:33:b8:55:fb:42:71:58

RSA host key finger print:79:28:68:61:d8:8b:c0:f0:5c:f5:bc:0b:fa:02:24:d8

=======================================================

Connection Username Version

=======================================================

192.168.5.218 admin 1-2

-------------------------------------------------------

Number of SSH sessions : 1

=======================================================

ALU-7#

Page 148 7705 SAR OS System Management Guide

Security

Label

SSH status

SSH Preserve Key

SSH protocol version 1

SSH protocol version 2

Key fingerprint

Connection

User name

Version

Number of SSH sessions

Table 16: Show SSH Output Fields

Description

SSH is enabled —

Displays that SSH server is enabled

SSH is disabled —

Displays that SSH server is disabled

Enabled —

Displays that preserve-key is enabled

Disabled —

Displays that preserve-key is disabled

Enabled —

Displays that SSH1 is enabled

Disabled —

Displays that SSH1 is disabled

Enabled —

Displays that SSH2 is enabled

Disabled —

Displays that SSH2 is disabled

The key fingerprint is the server’s identity. Clients trying to connect to the server verify the server's fingerprint. If the server fingerprint is not known, the client may not continue with the

SSH session since the server might be spoofed.

The IP address of the connected router(s) (remote client)

The name of the user

The SSH version

The total number of SSH sessions

user

Syntax user

[

user-id

] [

detail

]

Context

show>system>security

Description

This command displays user registration information.

If no command line options are specified, summary information for all users displays.

Parameters

user-id —

displays information for the specified user

Default

All users

detail —

displays detailed user information to the summary output

Output

The following output is an examples of user information, and

Table 17

describes the fields.

7705 SAR OS System Management Guide Page 149

Security Command Reference

Sample Output

ALU-7# show system security user

===============================================================================

Users

=============================================================================== user id New User Permissions Password Login Failed Local

Pwd Console ftp snmp Expires Attempts Logins Conf

------------------------------------------------------------------------------- admin n y n n never 21 0 y testuser n n n n never 0 0 y

-------------------------------------------------------------------------------

Number of users: 2

===============================================================================

ALU-7#

ALU-7# show system security user detail

===============================================================================

Users

=============================================================================== user id New User Permissions Password Login Failed Local

Pwd Console ftp snmp Expires Attempts Logins Conf

------------------------------------------------------------------------------- admin n y n n never 21 0 y testuser n n n n never 0 0 y

-------------------------------------------------------------------------------

Number of users: 2

===============================================================================

===============================================================================

User Configuration Detail

===============================================================================

=============================================================================== user id : admin

------------------------------------------------------------------------------console parameters

------------------------------------------------------------------------------new pw required : no cannot change pw : no home directory : cf3:\ restricted to home : no login exec file : profile : administrative

------------------------------------------------------------------------------snmp parameters

-------------------------------------------------------------------------------

===============================================================================

ALU-7#

Page 150 7705 SAR OS System Management Guide

Security

Table 17: Show User Output Fields

Label Description

User ID

Need new pwd

Cannot change pw

User permissions

The name of a system user

Y —

The user must change their password at the next login

N —

The user is not forced to change their password at the next login

Y —

The user has the ability to change the login password

N —

The user does not have the ability to change the login password

Console —

Y - The user is authorized for console access

N- The user is not authorized for console access

FTP —

Y - The user is authorized for FTP access

N - The user is not authorized for FTP access

SNMP —

Y - The user is authorized for SNMP access

N - The user is not authorized for SNMP access

Password expires

Attempted logins

Failed logins

Local conf

The number of days the user has left before they must change their login password

The number of times the user has attempted to log in irrespective of whether the login succeeded or failed

The number of unsuccessful login attempts

Y —

Password authentication is based on the local password database

N —

Password authentication is not based on the local password database

Home directory

Specifies the local home directory for the user for both console and FTP access

Restricted to home

Login exec file

Yes —

The user is not allowed to navigate to a directory higher in the directory tree on the home directory device

No —

The user is allowed to navigate to a directory higher in the directory tree on the home directory device

Displays the user’s login exec file which executes whenever the user successfully logs in to a console session

7705 SAR OS System Management Guide Page 151

Security Command Reference

view

Syntax view

[

view-name

] [

detail

] [

capabilities

]

Context

show>system>security

Description

This command displays one or all views and permissions in the MIB-OID tree.

Parameters

view-name —

specifies the name of the view to display. If no view name is specified, the complete list of views displays.

detail —

displays detailed view information

Output

The following output is an examples of view information, and

Table 18

describes the fields.

Sample Output

A:ALU-48# show system security view

===============================================================================

Views

=============================================================================== view name oid tree mask permission

------------------------------------------------------------------------------iso 1 included read1 1.1.1.1 11111111 included write1 2.2.2.2 11111111 included testview 1 11111111 included testview 1.3.6.1.2 11111111 excluded mgmt-view 1.3.6.1.2.1.2 included mgmt-view 1.3.6.1.2.1.4 included mgmt-view 1.3.6.1.2.1.5 included mgmt-view 1.3.6.1.2.1.6 included mgmt-view 1.3.6.1.2.1.7 included mgmt-view 1.3.6.1.2.1.31 included mgmt-view 1.3.6.1.2.1.77 included mgmt-view 1.3.6.1.4.1.6527.3.1.2.3.7 included mgmt-view 1.3.6.1.4.1.6527.3.1.2.3.11 included vprn-view 1.3.6.1.2.1.2 included vprn-view 1.3.6.1.2.1.4 included vprn-view 1.3.6.1.2.1.5 included vprn-view 1.3.6.1.2.1.6 included vprn-view 1.3.6.1.2.1.7 included vprn-view 1.3.6.1.2.1.15 included vprn-view 1.3.6.1.2.1.23 included vprn-view 1.3.6.1.2.1.31 included vprn-view 1.3.6.1.2.1.68 included vprn-view 1.3.6.1.2.1.77 included vprn-view 1.3.6.1.4.1.6527.3.1.2.3.7 included vprn-view 1.3.6.1.4.1.6527.3.1.2.3.11 included vprn-view 1.3.6.1.4.1.6527.3.1.2.20.1 included no-security 1 included no-security 1.3.6.1.6.3 excluded no-security 1.3.6.1.6.3.10.2.1 included no-security 1.3.6.1.6.3.11.2.1 included no-security 1.3.6.1.6.3.15.1.1 included on-security 2 00000000 included

-------------------------------------------------------------------------------

Page 152 7705 SAR OS System Management Guide

Security

No. of Views: 33

===============================================================================

A:ALU-48#

Label

view name oid tree mask permission

No. of Views

Table 18: Show View Output Fields

Description

The name of the view. Views control the accessibility of a MIB object within the configured MIB view and subtree.

The object identifier of the ASN.1 subtree

The bit mask that defines a family of view subtrees

Indicates whether each view is included or excluded

The total number of views

7705 SAR OS System Management Guide Page 153

Security Command Reference

Login Control Show Commands users

Syntax users

Context

show

Description

This command displays console user login and connection information.

Output

The following output is an examples of view information, and

Table 19

describes the fields.

Sample Output

A:ALU-7#

show users

===============================================================================

User Type Login time Idle time

From

=============================================================================== testuser Console 21FEB2007 04:58:55 0d 00:00:00 A

--

-------------------------------------------------------------------------------

Number of users : 1

'A' indicates user is in admin mode

===============================================================================

A:ALU-7#

Label

User

Type

From

Login time

Idle time

Number of users

Table 19: Show Users Output Fields

Description

The user name

The user is authorized for this access type

The originating IP address

The time the user logged in

The amount of idle time for a specific login

The total number of users logged in

Page 154 7705 SAR OS System Management Guide

Security

Clear Commands

statistics

Syntax statistics

[

interface

ip-int-name

|

ip-address

]

Context

clear>router>authentication

Description

This command clears authentication statistics.

Parameters

ip-int-name —

clears the authentication statistics for the specified interface name. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes

ip-address —

clears the authentication statistics for the specified IP address

7705 SAR OS System Management Guide Page 155

Security Command Reference

Debug Commands

radius

Syntax radius

[

detail

] [

hex

]

no radius

Context

debug

Description

This command enables debugging for RADIUS connections.

The

no

form of the command disables the debugging.

Parameters detail —

displays detailed output

hex —

displays the packet dump in hexadecimal format

Page 156 7705 SAR OS System Management Guide

SNMP

In This Chapter

This chapter provides information to configure SNMP. Topics in this chapter include:

•

SNMP Overview on page 158

→

SNMP Architecture on page 158

→

Management Information Base on page 158

→

SNMP Versions on page 159

→

Management Information Access Control on page 159

→

User-Based Security Model Community Strings on page 160

→

Views on page 160

→

Access Groups on page 161

→

Users on page 161

•

Which SNMP Version to Use? on page 162

•

Configuration Notes on page 163

→

Reference Sources on page 163

•

Configuring SNMP with CLI on page 165

•

SNMP Command Reference on page 173

7705 SAR OS System Management Guide Page 157

SNMP Overview

SNMP Overview

SNMP Architecture

The Service Assurance Manager (SAM) consists of two elements: managers and agents. The manager is the entity through which network management tasks are facilitated. An agent is a software module integrated into the operating system of the managed device that communicates with the network manager. Managed devices, such as bridges, hubs, routers, and network servers can contain managed objects. A managed object can be a configuration attribute, performance statistic, or control action that is directly related to the operation of a device.

Managed devices collect and store management information and use Simple Network

Management Protocol (SNMP). SNMP is an application-layer protocol that provides a message format to facilitate communication between SNMP managers and agents. SNMP provides a standard framework to monitor and manage devices in a network from a central location.

An SNMP manager controls and monitors the activities of network hosts that use SNMP. An

SNMP manager can obtain (get) a value from an SNMP agent or store (set) a value in the agent. The manager uses definitions in the management information base (MIB) to perform operations on the managed device such as retrieving values from variables or blocks of data, replying to requests, and processing traps.

Between the SNMP agent and the SNMP manager, the following actions can occur.

• The manager can get information from the agent.

• The manager can set the value of a MIB object that is controlled by an agent.

• The agent can send traps to notify the manager of significant events that occur on the managed device (for example, the 7705 SAR router).

Management Information Base

A MIB is a formal specifications document with definitions of management information used to remotely monitor, configure, and control a managed device or network system. The agent’s management information consists of a set of network objects that can be managed with SNMP. Object identifiers are unique object names that are organized in a hierarchical tree structure. The main branches are defined by the Internet Engineering Task Force

(IETF). When requested, the Internet Assigned Numbers Authority (IANA) assigns a unique branch for use by a private organization or company. The branch assigned to the Alcatel-

Lucent 7705 SAR is 1.3.6.1.4.1.6527.

Page 158 7705 SAR OS System Management Guide

SNMP

The SNMP agent provides management information to support a collection of IETF specified MIBs and a number of MIBs defined to manage device parameters and network data unique to the 7705 SAR.

SNMP Versions

The agent supports multiple versions of the SNMP protocol.

• SNMP Version 1 (SNMPv1) is the original Internet-standard network management framework.

SNMPv1 provides access control for communities and uses a community string match for authentication.

• SNMPv2c uses a community string match for authentication.

• SNMP Version 3 (SNMPv3) provides access control for users. In SNMPv3, Userbased Security Model (USM) defines the user authentication and encryption features. The View Access Control MIB (VACM) defines the user access control features. The SNMP-COMMUNITY-MIB is used to associate SNMPv1/SNMPv2c community strings with SNMPv3 VACM access control.

SNMPv3 uses a user name match for authentication.

Management Information Access Control

By default, the 7705 SAR implementation of SNMP uses SNMPv3. SNMPv3 incorporates security model and security level features. A security model is the authentication type for the group and the security level is the permitted level of security within a security model. The combination of the security level and security model determines which security mechanism handles an SNMP packet.

To implement SNMPv1 and SNMPv2c configurations, several access groups are predefined.

These access groups are standard read-only, read-write, and read-write-all access groups and views that can simply be assigned community strings. In order to implement SNMP with security features, security models, security levels, and USM communities must be explicitly configured. Optionally, additional views that specify more specific OIDs (MIB objects in the subtree) can be configured.

Access to the management information in an SNMPv1/SNMPv2c agent is controlled by the inclusion of a community name string in the SNMP request. The community defines the subset of the agent’s managed objects that can be accessed by the requester. It also defines what type of access is allowed: read-only or read-write.

7705 SAR OS System Management Guide Page 159

SNMP Overview

The use of community strings provide minimal security and context checking for both agents and managers that receive requests and initiate trap operations. A community string is a text string that acts like a password to permit access to the agent on the 7705 SAR router.

The Alcatel-Lucent implementation of SNMP has defined three levels of community-named access:

• read-only permission — grants only read access to objects in the MIB, except security objects

• read-write permission — grants read and write access to all objects in the MIB, except security objects

• read-write-all permission — grants read and write access to all objects in the MIB, including security objects

User-Based Security Model Community Strings

User-based security model (USM) community strings associate a community string with an

SNMPv3 access group and its view. The access granted with a community string is restricted to the scope of the configured group.

Views

Views control the access to a managed object. The total MIB of a 7705 SAR router can be viewed as a hierarchical tree. When a view is created, either the entire tree or a portion of the tree can be specified and made available to a user to manage the objects contained in the subtree. Object identifiers (OIDs) uniquely identify managed objects. A view defines the type of operations allowed, such as read, write, or notify.

OIDs are organized in a hierarchical tree with specific values assigned to different organizations. A view defines a subset of the agent’s managed objects controlled by the access rules associated with that view.

Predefined views are available that are particularly useful when configuring SNMPv1 and

SNMPv2c.

The Alcatel-Lucent SNMP agent associates SNMPv1 and SNMPv2c community strings with an SNMPv3 view.

Page 160 7705 SAR OS System Management Guide

SNMP

Access Groups

Access groups associate a user group and a security model with the views the group can access. An access group is defined by a unique combination of a group name, security model

(SNMPv1, SNMPv2c, or SNMPv3), and security level (no-authorization-no privacy, authorization-no-privacy, or privacy).

An access group, is a template that defines a combination of access privileges and views. A group can be associated with one or more network users to control their access privileges and views.

Additional access parameters must be explicitly configured if the preconfigured access groups and views for SNMPv1 and SNMPv2c do not meet your security requirements.

Users

By default, authentication and encryption parameters are not configured. Authentication parameters that a user must use in order to be validated by the 7705 SAR can be modified.

SNMP authentication allows the device to validate the managing node that issued the SNMP message and determine if the message has been tampered with.

User access and authentication privileges must be explicitly configured. In a user configuration, a user is associated with an access group, which is a collection of users who have common access privileges and views.

7705 SAR OS System Management Guide Page 161

Which SNMP Version to Use?

Which SNMP Version to Use?

SNMPv1 and SNMPv2c do not provide security, authentication, or encryption. Without authentication, an unauthorized user could perform SNMP network management functions and eavesdrop on management information as it passes from system to system. Many

SNMPv1 and SNMPv2c implementations are restricted read-only access, which, in turn, reduces the effectiveness of a network monitor in which network control applications cannot be supported.

To implement SNMPv3, an authentication and encryption method must be assigned to a user in order to be validated by the 7705 SAR. SNMP authentication allows the router to validate the managing node that issued the SNMP message and determine if the message was tampered with.

Page 162 7705 SAR OS System Management Guide

SNMP

Configuration Notes

This section describes SNMP configuration caveats.

• To avoid management systems attempting to manage a partially booted system,

SNMP will remain in a shutdown state if the configuration file fails to complete during system startup. While shut down, SNMP gets and sets are not processed.

However, notifications are issued if an SNMP trap group has been configured.

In order to enable SNMP, the portions of the configuration that failed to load must be initialized properly. Start SNMP with the config>system>snmp>no shutdown

command.

• Use caution when changing the SNMP engine ID. If the SNMP engine ID is changed in the config>system>snmp>engineID

engine-id

context, the current configuration must be saved and a reboot must be executed. If the configuration is not saved and the system is not rebooted, the previously configured

SNMP communities and logger trap-target notify communities will not be valid for the new engine ID.

Reference Sources

For information on supported IETF drafts and standards as well as standard and proprietary

MIBS, refer to Standards and Protocol Support on page 307 .

7705 SAR OS System Management Guide Page 163

Configuration Notes

Page 164 7705 SAR OS System Management Guide

Configuring SNMP with CLI

This section provides information about configuring SNMP with CLI.

Topics in this chapter include:

•

SNMP Configuration Overview on page 166

→

Configuring SNMPv1 and SNMPv2c on page 166

→

Configuring SNMPv3 on page 166

•

Basic SNMP Security Configuration on page 167

•

Configuring SNMP Components on page 168

→

Configuring a Community String on page 168

→

Configuring View Options on page 169

→

Configuring Access Options on page 170

→

Configuring USM Community Options on page 171

→

Configuring Other SNMP Parameters on page 172

SNMP

7705 SAR OS System Management Guide Page 165

SNMP Configuration Overview

SNMP Configuration Overview

This section describes how to configure SNMP components that apply to SNMPv1,

SNMPv2c, and SNMPv3 on the 7705 SAR.

•

Configuring SNMPv1 and SNMPv2c

•

Configuring SNMPv3

Configuring SNMPv1 and SNMPv2c

The 7705 SAR router is based on SNMPv3. To use 7705 SAR routers with SNMPv1 and/or

SNMPv2c, SNMP community strings must be configured. Three predefined access methods are available when SNMPv1 or SNMPv2c access is required. Each access method ( r

, rw

, or rwa

) is associated with an SNMPv3 access group that determines the access privileges and the scope of managed objects available. The community

command is used to associate a community string with a specific access method and the required SNMP version (SNMPv1 or SNMPv2c). The access methods are:

• read-only — grants read-only access to the entire management structure with the exception of the security area

• read-write — grants read and write access to the entire management structure with the exception of the security area

• read-write-all — grants read and write access to the entire management structure, including security

If the predefined access groups do not meet your access requirements, then additional access groups and views can be configured. The usm-community

command is used to associate an access group with an SNMPv1 or SNMPv2c community string.

SNMP trap destinations are configured in the config>log>snmp-trap-group

context.

Configuring SNMPv3

The 7705 SAR implements SNMPv3. If security features other than the default views are required, the following parameters must be configured:

• views

• access groups

• SNMP users

Page 166 7705 SAR OS System Management Guide

SNMP

Basic SNMP Security Configuration

This section provides information to configure SNMP parameters and provides examples of common configuration tasks. The minimal SNMP parameters are:

For SNMPv1 and SNMPv2c:

• Configure community string parameters

For SNMPv3:

• Configure view parameters

• Configure SNMP group

• Configure access parameters

• Configure user with SNMP parameters

The following displays SNMP default views, access groups, and attempts parameters.

ALU-1>config>system>security>snmp# info detail

----------------------------------------------

view iso subtree 1

mask ff type included

exit

view “mgmt-view” subtree 1.3.6.1.2.1.2

mask ff type excluded

exit

view “mgmt-view” subtree 1.3.6.1.2.1.4

mask ff type included

exit

view no-security subtree 1.3.6.1.6.3.11.2.1

mask ff type included

exit

view no-security subtree 1.3.6.1.6.3.15.1.1

mask ff type included

exit

access group snmp-ro security-model snmpv1 security-level no-auth-noprivacy read no-security notify no-security

access group snmp-ro security-model snmpv2c security-level no-auth-noprivacy read no-security notify no-security

access group snmp-rw security-model snmpv1 security-level no-auth-noprivacy read no-security write no-security notify no-security

access group snmp-rw security-model snmpv2c security-level no-auth-noprivacy read no-security write no-security notify no-security

access group snmp-rwa security-model snmpv1 security-level no-auth-noprivacy read iso write iso notify iso

access group snmp-rwa security-model snmpv2c security-level no-authno-privacy read iso write iso notify iso

access group snmp-trap security-model snmpv1 security-level no-authno-privacy notify iso

access group snmp-trap security-model snmpv2c security-level no-authno-privacy notify iso

attempts 20 time 5 lockout 10

7705 SAR OS System Management Guide Page 167

Configuring SNMP Components

Configuring SNMP Components

Use the CLI syntax displayed below to configure the following SNMP scenarios:

•

Configuring a Community String

•

Configuring View Options

•

Configuring Access Options

•

Configuring USM Community Options

•

Configuring Other SNMP Parameters

CLI Syntax:

config>system>security>snmp attempts [

count

] [time

minutes1

] [lockout

minutes2

] community

community-string

[hash | hash2] accesspermissions [version SNMP version] usm-community community-string [hash | hash2] group group-name view view-name subtree oid-value mask mask-value [type {included | excluded}] access group

group-name

security-model

security-model

security-level

security-level

[context

contextname

[prefix-match]] [read

view-name-1

] [write

view-name-2

] [notify

view-name-3

]

Configuring a Community String

SNMPv1 and SNMPv2c community strings are used to define the relationship between an

SNMP manager and agent. The community string acts like a password to permit access to the agent. The access granted with a community string is restricted to the scope of the configured group.

One or more of the following characteristics associated with the string can be specified:

• read-only, read-write, and read-write-all permission for the MIB objects accessible to the community

• the SNMP version, SNMPv1 or SNMPv2c

Default access features are preconfigured by the agent for SNMPv1 and SNMPv2c.

Use the following CLI syntax to configure community options:

CLI Syntax:

config>system>security>snmp community

community-string

[hash | hash2]

accesspermissions

[version

SNMP version

]

Page 168 7705 SAR OS System Management Guide

SNMP

The following example displays community string command usage:

Example:

config>system>security# snmp config>system>security>snmp# community

private hash2 rwa

version

both

config>system>security>snmp# community

public hash r

version

v2c

The following example displays the SNMP community configuration:

ALU-1>config>system>security>snmp# info

------------------------------------------------------community "uTdc9j48PBRkxn5DcSjchk" hash2 rwa version

both

community "Lla.RtAyRW2" hash2 r version

v2c

-------------------------------------------------------

ALU-1>config>system>security>snmp#

Configuring View Options

Use the following CLI syntax to configure view options:

CLI Syntax:

config>system>security>snmp view

view-name

subtree

oid-value

mask m

ask-value

[type {included | excluded}]

The following example displays view command usage:

Example:

config>system>security>snmp# view

testview

subtree

1

config>system>security>snmp>view$ mask

ff

type

included

config>system>security>snmp>view$ exit config>system>security>snmp# view

testview

subtree

1.3.6.1.2

config>system>security>snmp>view$ mask

ff

type

excluded

config>system>security>snmp>view$ exit

The following example displays the view configuration:

ALU-1>config>system>security>snmp# info

----------------------------------------------

view

"testview

" subtree

1

mask

ff

exit

view

testview

subtree

1.3.6.1.2

mask

ff

type

excluded

exit

community "private" rwa version both

community "public" r version v2c

----------------------------------------------

ALU-1>config>system>security>snmp#

7705 SAR OS System Management Guide Page 169

Configuring SNMP Components

Configuring Access Options

The access

command creates an association between a user group, a security model, and the views that the user group can access. Access must be configured unless security is limited to the preconfigured access groups and views for SNMPv1 and SNMPv2c. An access group is defined by a unique combination of the group name, security model, and security level.

Use the following CLI syntax to configure access features:

CLI Syntax:

config>system>security>snmp access group

group-name

security-model

security-model

security-level

security-level

[context

context-name

[prefix-match]] [read

view-name-1

] [write

view-name-2

]

[notify

view-name-3

]

The following example displays access command usage:

Example:

ALU-1>config>system>security>snmp# access group testgroup security-model

usm

security-level auth-noprivacy read

testview

write

testview

notify

testview

The following example displays the access configuration with the view configurations.

ALU-1>config>system>security>snmp# info

---------------------------------------------view “testview” subtree 1

mask ff

exit

view “testview” subtree 1.3.6.1.2

mask ff type excluded

exit

access group “testgroup” security-model usm security-level auth-no

-privacy read “testview” write “testview” notify “testview”

community "public" r version both

----------------------------------------------

ALU->config>system>security>snmp#

Use the following CLI syntax to configure user group and authentication parameters:

CLI Syntax:

config>system>security# user

user-name

access [ftp] [snmp] [console] snmp authentication [none] | [[hash]{md5

key

| sha

key

} privacy {none | des-key

key

}] group

group-name

Page 170 7705 SAR OS System Management Guide

SNMP

The following example displays user security command usage:

Example:

ALU-1>config>system>security# user

testuser

config>system>security>user$ access

snmp

config>system>security>user# snmp config>system>security>user>snmp# authentication

hash

md5

e14672e71d3e96e7a1e19472527ee969

privacy

none

config>system>security>user>snmp# group

testgroup

config>system>security>user>snmp# exit config>system>security>user# exit

The following example displays the user’s SNMP configuration.

ALU-1>config>system>security# info

---------------------------------------------user "testuser"

access snmp

snmp

authentication hash md5 e14672e71d3e96e7a1e19472527ee969 privacy none

group testgroup

exit exit

...

----------------------------------------------

ALU-1>config>system>security#

Configuring USM Community Options

User-based security model (USM) community strings associate a community string with an

SNMPv3 access group and its view. The access granted with a community string is restricted to the scope of the configured group.

By default, the 7705 SAR OS implementation of SNMP uses SNMPv3. To implement

SNMPv1 and SNMPv2c, USM community strings must be explicitly configured.

Use the following CLI syntax to configure USM community options:

CLI Syntax:

config>system>security>snmp usm-community

community-string

[hash | hash2] group

group-name

The following example displays USM community string command usage. Note that the group

testgroup

was configured in the config>system>security>snmp>access

CLI context.

Example:

config>system>security>snmp# usm-community "test"

hash2

group "testgroup"

7705 SAR OS System Management Guide Page 171

Configuring SNMP Components

The following example displays the SNMP community configuration:

ALU-1>config>system>security>snmp# info

----------------------------------------------

view testview subtree 1

mask ff

exit

view testview subtree 1.3.6.1.2

mask ff type excluded

exit

access group testgroup security-model usm security-level auth-no

-privacy read testview write testview notify testview

community "private" hash2 rwa version both

community "public" hash r version v2c

usm-community "test" group "testgroup"

----------------------------------------------

ALU-1>config>system>security>snmp#

Configuring Other SNMP Parameters

Use the following CLI syntax to modify the system SNMP options:

CLI Syntax:

config>system>snmp engineID

engine-id

general-port

port

packet-size

bytes

no shutdown

The following example displays the system SNMP default values:

ALU-104>config>system>snmp# info detail

----------------------------------------------

shutdown

engineID "0000xxxx000000000xxxxx00"

packet-size 1500

general-port 161

----------------------------------------------

ALU-104>config>system>snmp#

Page 172 7705 SAR OS System Management Guide

SNMP Command Reference

Command Hierarchies

•

Configuration Commands

→

SNMP System Commands

→

SNMP Security Commands

•

Show Commands

SNMP

7705 SAR OS System Management Guide Page 173

SNMP Command Reference

Configuration Commands

SNMP System Commands

config

— system

— snmp

—

snmp

engine-id

— no

snmp

—

general-port

port

— no

general-port

—

packet-size

bytes

— no

packet-size

—

[

no

]

shutdown

SNMP Security Commands

config

— system

— security

—

usm-community

—

snmp

group-name

security-model

security-model

security-level

security-level

[

context

context-name

[

prefix-match

]] [

read

view-name-

1

] [

write

view-name-2

] [

notify

view-name-3

]

— no

snmp

group-name

[

security-model

security-model

] [

security-level

security-level

] [

context

context-name

[

prefix-match

]] [

read

view-name-

1

] [

write

view-name-2

] [

notify

view-name-3

—

attempts

[

count

] [

time

minutes1

] [

lockout

minutes2

]

— no

attempts

—

community

community-string

[

hash

|

hash2

]

group

group-name

— no

community

community-string

—

usm-community

community-string

group

group-name

— no

usm-community

community-string

—

view

view-name

subtree

oid-value

— no

view

view-name

[

subtree

oid-value

]

—

usm-community

mask-value

[

type

{

included | excluded

}]

— no

usm-community

The following commands configure user-specific SNMP features. Refer to the

Security

section for CLI syntax and command descriptions.

config

— system

— security

—

[

no

]

access

user-name

—

[

no

]

snmp

—

authentication

{[

none

] | [[

hash

] {

md5

key-1

|

sha

key-1

}

privacy

{

privacy-level

|

key-2

}]

—

group

group-name

—

[

no

]

group

Page 174 7705 SAR OS System Management Guide

Show Commands

show

— snmp

—

counters

— system

—

information

— security

—

access-group

[

group-name

]

—

communities

[

statistics

]

—

communities

—

user

[

profile-name

]

—

user

[

user-id

] [

detail

]

—

view

[

view-name

] [

capabilities

] [

detail

]

SNMP

7705 SAR OS System Management Guide Page 175

SNMP Command Reference

Command Descriptions

•

Configuration Commands on page 177

•

Show Commands on page 187

Page 176 7705 SAR OS System Management Guide

Configuration Commands

•

SNMP System Commands on page 178

•

SNMP Security Commands on page 181

SNMP

7705 SAR OS System Management Guide Page 177

SNMP Command Reference

SNMP System Commands snmp

Syntax snmp

Context

config>system

Description

This command creates the context to configure SNMP parameters.

engineID

Syntax

[

no

]

engineID

engine-id

Context

config>system>snmp

Description

This command sets the SNMP engine ID to uniquely identify the SNMPv3 node. By default, the engine ID is generated using information from the system backplane.

If the SNMP engine ID is changed in the

config>system>snmp>engineID

engine-id

context, the current configuration must be saved and a reboot must be executed. If the configuration is not saved and the system is not rebooted, the previously configured SNMP communities and logger trapdestination notify communities will not be valid for the new engine ID.

Caution:

In conformance with IETF standard RFC 2274,

User-based Security Model

(USM) for version 3 of the Simple Network Management Protocol (SNMPv3)

, hashing algorithms that generate SNMPv3 MD5 or SHA security digest keys use the engine ID. Changing the SNMP engine ID invalidates all SNMPv3 MD5 and SHA security digest keys and may render the node unmanageable. If the SNMP engine

ID is changed, the SNMP hash keys must be reconfigured.

This command could be used, for example, when a chassis is replaced. Use the engine ID of the first system and configure it in the new system to preserve SNMPv3 security keys. This allows management stations to use their existing authentication keys for the new system.

Ensure that the engine IDs are not used on multiple systems. A management domain can only have one instance of each engine ID.

The

no

form of the command reverts to the default setting.

Default

The engine ID is system-generated.

Parameters

engine-id —

an identifier from 10 to 64 hexadecimal digits (5 to 32 octet number), uniquely identifying this SNMPv3 node. This string is used to access this node from a remote host with

SNMPv3.

Page 178 7705 SAR OS System Management Guide

SNMP

general-port

Syntax general-port

port-number

no general-port

Context

config>system>snmp

Description

This command configures the port number used by this node to receive SNMP request messages and to send replies. Note that SNMP notifications generated by the agent are sent from the port specified in the config>log>snmp-trap-group>trap-target

command.

The

no

form of the command reverts to the default value.

Default

161

Parameters

port-number —

the port number used to send SNMP traffic other than traps

Values

1 to 65535 (decimal)

packet-size

Syntax packet-size

bytes

no packet-size

Context

config>system>snmp

Description

This command configures the maximum SNMP packet size generated by this node. If the packet size exceeds the MTU size of the egress interface, the packet will be fragmented.

Default

The

no

form of the command reverts to the default value.

1500 bytes

Parameters

bytes —

the SNMP packet size in bytes

Values

484 to 9216

shutdown

Syntax

[

no

]

shutdown

Context

config>system>snmp

Description

This command administratively disables SNMP agent operations. System management can then only be performed using the CLI. Shutting down SNMP does not remove or change configuration parameters other than the administrative state. This command does not prevent the agent from sending SNMP notifications to any configured SNMP trap destinations. SNMP trap destinations are configured under the config>log>snmp-trap-group

context.

7705 SAR OS System Management Guide Page 179

SNMP Command Reference

This command is automatically invoked in the event of a reboot when the processing of the configuration file fails to complete or when an SNMP persistent index file fails while the

bof persist on

command is enabled.

The

no

form of the command administratively enables SNMP.

Default no shutdown

Page 180 7705 SAR OS System Management Guide

SNMP

SNMP Security Commands snmp

Syntax snmp

Context

config>system>security

Description

This command creates the context to configure SNMPv1, SNMPv2c, and SNMPv3 parameters.

access group

Syntax [no] access group

group-name

security-model

{snmpv1 | snmpv2c | usm}

security-level

{

no-auth-no-privacy

|

auth-no-privacy

|

privacy

} [

context

context-name

[

prefix-match

{

exact

|

prefix

}]] [

read

view-name-1

] [

write

view-name-2

] [

notify

view-name-3

]

Context

config>system>security>snmp

Description

This command creates an association between a user group, a security model, and the views that the user group can access. Access parameters must be configured unless security is limited to the preconfigured access groups and views for SNMPv1 and SNMPv2c. An access group is defined by a unique combination of the group name, security model, and security level.

Access must be configured unless security is limited to SNMPv1/SNMPv2c with community strings

(see

community

).

Default access group configurations cannot be modified or deleted.

To remove the user group with associated security model(s) and security level(s), use the command,

no access group

group name

.

To remove a security model and security level combination from a group, use the command,

no access group

group-name

security-model

{

snmpv1

|

snmpv2c

|

usm

}

security-level

{

no-authno-privacy

|

auth-no-privacy

|

privacy

}.

Default none

Parameters

group-name —

specifies a unique group name up to 32 characters

security-model

{

snmpv1

|

snmpv2c

|

usm

}

—

specifies the security model required to access the views configured in this node. A group can have multiple security models. For example, one view may only require SNMPv1/ SNMPv2c access while another view may require USM

(SNMPv3) access rights.

security-level

{

no-auth-no-priv

|

auth-no-priv

|

privacy

}

—

specifies the required authentication and privacy levels to access the views configured in this node

security-level no-auth-no-privacy —

specifies that no authentication and no privacy (encryption) is required. When configuring the user’s authentication, select the

none

option.

7705 SAR OS System Management Guide Page 181

SNMP Command Reference

security-level auth-no-privacy —

specifies that authentication is required but privacy (encryption) is not required. When this option is configured, both the

group

and the

user

must be configured for authentication.

security-level privacy —

specifies that both authentication and privacy (encryption) is required.

When this option is configured, both the

group

and the

user

must be configured for authentication. The user must also be configured for privacy.

context

context-name

—

specifies a set of SNMP objects that are associated with the context-name

The

context-name

is treated as either a full context-name string or a context-name prefix depending on the keyword specified (

exact

or

prefix

).

prefix-match —

specifies the context-name

prefix-match

keywords,

exact

or

prefix

Default

exact

read

view-name-1

—

specifies the keyword and variable of the view to read the MIB objects.

This command must be configured for each view to which the group has read access.

Values

up to 32 characters

write

view-name-2

—

specifies the keyword and variable of the view to configure the contents of the agent. This command must be configured for each view to which the group has write access.

Values

up to 32 characters

notify

view-name-3

—

specifies the keyword and variable of the view to send a trap about MIB objects. This command must be configured for each view to which the group has notify access.

Values

up to 32 characters

attempts

Syntax attempts

[

count

] [

time

minutes1

] [

lockout

minutes2

]

no attempts

Context

config>system>security>snmp

Description

This command configures a threshold value for the number of unsuccessful SNMP connection attempts allowed in a specified time frame. The command parameters are used to counter denial of service (DOS) attacks through SNMP.

If the threshold is exceeded, the host is locked out for the lockout time period.

If multiple

attempts

commands are entered, each command overwrites the previously entered command.

The

no

form of the command resets the parameters to the default values.

Default attempts 20 time 5 lockout 10

Page 182 7705 SAR OS System Management Guide

SNMP

Parameters

count —

the number of unsuccessful SNMP attempts allowed for the specified

time

Default

20

Values

1 to 64

time

minutes1

—

the period of time, in minutes, that a specified number of unsuccessful attempts can be made before the host is locked out

Default

5

Values

0 to 60

lockout

minutes2

—

the lockout period, in minutes, during which the host is not allowed to log in.

When the host exceeds the attempted count times in the specified time, then that host is locked out from any further login attempts for the configured time period.

Default

10

Values

0 to 1440

community

Syntax community

community-string

[

hash

|

hash2

]

access-permissions

group

group-name

no community

community-string

Context

config>system>security>snmp

Description

This command creates SNMP community strings for SNMPv1 and SNMPv2c access. This command is used in combination with the predefined access groups and views. To create custom access groups and views and associate them with SNMPv1 or SNMPv2c access, use the

usm-community

command.

When configured, community implies a security model for SNMPv1 and SNMPv2c only.

For SNMPv3 security, the

snmp

command must be configured.

The

no

form of the command removes a community string.

Default none

Parameters

community

-

string —

configures the SNMPv1/SNMPv2c community string

access-permissions —

•

r

— grants only read access to objects in the MIB, except security objects

•

rw

— grants read and write access to all objects in the MIB, except security objects

•

rwa

— grants read and write access to all objects in the MIB, including security objects

•

mgmt

— assigns a unique SNMP community string to the management router

hash1

|

hash2 —

configures the hashing scheme for the community-string

7705 SAR OS System Management Guide Page 183

SNMP Command Reference

usm-community

Syntax usm-community

community-string

[

hash

|

hash2

]

group

group-name

no usm-community

community-string

Context

config>system>security>snmp

Description

This command is used to associate a community string with an SNMPv3 access group and its view.

The access granted with a community string is restricted to the scope of the configured group.

The 7705 SAR OS implementation of SNMP uses SNMPv3. In order to implement SNMPv1 and

SNMPv2c configurations, several access groups are predefined. In order to implement SNMP with security features (version 3), security models, security levels, and USM communities must be explicitly configured. Optionally, additional views that specify more specific OIDs (MIB objects in the subtree) can be configured.

The

no

form of this command removes a community string.

Default none

Parameters

community-string —

configures the SNMPv1/SNMPv2c community string to determine the SNMPv3 access permissions to be used

group —

specifies the group that governs the access rights of this community string. This group must be configured first in the

config>system>security>snmp>access group

context.

hash1

|

hash2 —

configures hashing scheme for the community-string

view

Syntax view

view-name

subtree

oid-value

no view

view-name

[

subtree

oid-value

]

Context

config>system>security>snmp

Description

This command configures a view. Views control the accessibility of a MIB object within the configured MIB view and subtree. Object identifiers (OIDs) uniquely identify MIB objects in the subtree. OIDs are organized hierarchically with specific values assigned by different organizations.

Once the subtree (OID) is identified, a mask can be created to select the portions of the subtree to be included or excluded for access using this particular view. See the

mask

command. The view(s)

configured with this command can subsequently be used in read, write, and notify commands that are used to assign specific access group permissions to created views and assigned to particular access groups.

Multiple subtrees can be added or removed from a view name to tailor a view to the requirements of the user access group.

The

no view

view-name

command removes a view and all subtrees.

The

no view

view-name

subtree

oid-value

command removes a sub-tree from the view name.

Page 184 7705 SAR OS System Management Guide

SNMP

Default

No views are defined

Parameters

view-name —

the 1 to 32 character view name

Default

none

oid-value —

the object identifier (OID) value for the

view-name

. This value, for example,

1.3.6.1.6.3.11.2.1, combined with the mask and include and exclude statements, configures the access available in the view.

It is possible to have a view with different subtrees with their own masks and include and exclude statements. This allows you to customize visibility and write capabilities for specific user requirements.

mask

Syntax mask

mask-value

[

type

{

included

|

excluded

}]

no mask

Context

config>system>security>snmp>view

view-name

Description

The mask value and the mask type, along with the

oid-value

configured in the

view

command, determines the access of each sub-identifier of an object identifier (MIB subtree) in the view.

Each bit in the mask corresponds to a sub-identifier position; for example, the most significant bit for the first sub-identifier, the next most significant bit for the second sub-identifier, and so on. If the bit position on the sub-identifier is available, it can be included or excluded.

For example, the MIB subtree that represents MIB-II is 1.3.6.1.2.1. The mask that catches all

MIB-II is 0xfc or 0b11111100.

Only a single mask may be configured per view and OID value combination. If more than one entry is configured, each subsequent entry overwrites the previous entry.

Per RFC 2575,

View-based Access Control Model (VACM) for the Simple Network Management

Protocol (SNMP),

each MIB view is defined by two sets of view subtrees, the included view subtrees, and the excluded view subtrees. Every view subtree, both the included and the excluded ones, are defined in this table. To determine if a particular object instance is in a particular MIB view, compare the object instance’s object identifier (OID) with each of the MIB view’s active entries in this table. If none match, then the object instance is not in the MIB view. If one or more match, then the object instance is included in, or excluded from, the MIB view according to the value of vacmViewTreeFamilyType in the entry whose value of vacmViewTreeFamilySubtree has the most sub-identifiers.

The

no

form of this command removes the mask from the configuration.

Default no mask

7705 SAR OS System Management Guide Page 185

SNMP Command Reference

Parameters

mask-value —

the mask value associated with the OID value determines whether the sub-identifiers are included or excluded from the view

The mask can be entered either:

• In hexadecimal format (for example, 0xfc)

• In binary format (for example, 0b11111100)

Note:

If the number of bits in the bit mask is less than the number of sub-identifiers in the MIB subtree, then the mask is extended with ones until the mask length matches the number of sub-identifiers in the MIB subtree.

Default

All 1s

type

{

included | excluded

}

—

specifies whether to include or exclude MIB subtree objects

included

-

all MIB subtree objects that are identified with a 1 in the mask are available in the view

excluded

-

all MIB subtree objects that are identified with a 1 in the mask are denied access in the view

Default

Included

Page 186 7705 SAR OS System Management Guide

SNMP

Show Commands

counters

Syntax counters

Context

show>snmp

Description

This command displays SNMP counter information. SNMP counters will continue to increase even when SNMP is shut down. Some internal modules communicate using SNMP packets.

Output

The following output is an example of SNMP counters information, and fields.

Table 20

describes the

Sample Output

A:ALU-1# show snmp counters

==============================================================================

SNMP counters:

==============================================================================

in packets : 463

------------------------------------------------------------------------------

in gets : 93

in getnexts : 0

in sets : 370

out packets: 463

------------------------------------------------------------------------------

out get responses : 463

out traps : 0

variables requested: 33

variables set : 497

==============================================================================

A:ALU-1#

7705 SAR OS System Management Guide Page 187

SNMP Command Reference

Label

in packets in gets in getnexts in sets out packets out get responses out traps variables requested variables set

Table 20: Show SNMP Counters Output Fields

Description

The total number of messages delivered to SNMP from the transport service

The number of SNMP get request PDUs accepted and processed by

SNMP

The number of SNMP get next PDUs accepted and processed by

SNMP

The number of SNMP set request PDUs accepted and processed by

SNMP

The total number of SNMP messages passed from SNMP to the transport service

The number of SNMP get response PDUs generated by SNMP

The number of SNMP Trap PDUs generated by SNMP

The number of MIB objects requested by SNMP

The number of MIB objects set by SNMP as the result of receiving valid SNMP set request PDUs

Page 188 7705 SAR OS System Management Guide

SNMP

information

Syntax information

Context

show>system

Description

This command lists the SNMP configuration and statistics.

Output

The following output is an example of system information, and

Table 21

describes the fields.

Sample Output

A:ALU-1# show system information

===============================================================================

System Information

===============================================================================

System Name : ALU-1

System Type : 7710 SAR-8

System Version : B-0.0.I1204

System Contact :

System Location :

System Coordinates :

System Active Slot : A

System Up Time : 1 days, 02:12:57.84 (hr:min:sec)

SNMP Port : 161

SNMP Engine ID : 0000197f00000479ff000000

SNMP Max Message Size : 1500

SNMP Admin State : Enabled

SNMP Oper State : Enabled

SNMP Index Boot Status : Not Persistent

SNMP Sync State : OK

Telnet/SSH/FTP Admin : Enabled/Enabled/Disabled

Telnet/SSH/FTP Oper : Up/Up/Down

BOF Source : cf3:

Image Source : primary

Config Source : primary

Last Booted Config File: ftp://172.22.184.249/./debby-sim1/debby-sim1-config.cfg

Last Boot Cfg Version : THU MAR 11 16:58:20 2009 UTC

Last Boot Config Header: # TiMOS-B-0.0.I1042 both/i386 Alcatel-Lucent SAR 7705

Copyright (c) 2000-2009 Alcatel-Lucent. # All rights

reserved. All use subject to applicable license

agreements. # Built on Tue Mar 11 01:26:23 PST 2009 by

builder in /rel0.0/I1042/panos/main # Generated TUE

MAR 11 16:58:20 2009 UTC

Last Boot Index Version: N/A

Last Boot Index Header : # TiMOS-B-0.0.I1042 both/i386 Alcatel-Lucent SAR 7705

Copyright (c) 2000-2009 Alcatel-Lucent. # All rights

reserved. All use subject to applicable license

agreements. # Built on Tue Mar 11 01:26:23 PST 2009 by

builder in /rel0.0/I1042/panos/main # Generated TUE

MAR 11 16:58:20 2009 UTC

Last Saved Config : N/A

Time Last Saved : N/A

Changes Since Last Save: No

7705 SAR OS System Management Guide Page 189

SNMP Command Reference

Time Last Modified : 2009/04/07 18:34:18

Max Cfg/BOF Backup Rev : 5

Cfg-OK Script : N/A

Cfg-OK Script Status : not used

Cfg-Fail Script : N/A

Cfg-Fail Script Status : not used

Management IP Addr : 192.168.2.121/20

Primary DNS Server : 192.168.1.246

Secondary DNS server : N/A

DNS Domain : ca.alcatel.com

BOF Static Routes :

To Next Hop

128.251.10.0/23 192.168.1.251

172.22.184.0/22 192.168.1.251

ATM Location ID : 01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

===============================================================================

A:ALU-1#

Table 21: Show System Information Output Fields

Label Description

System Name

System Contact

System Location

System Coordinates

SNMP Index Boot

Status

The name configured for the device

The text string that identifies the contact name for the device

The text string that identifies the location of the device

The text string that identifies the system coordinates for the device location. For example, “37.390 -122.0550" is read as latitude 37.390 north and longitude 122.0550 west.

System Up Time

SNMP Port

SNMP Engine ID

The time since the last reboot

The port that SNMP sends responses to management requests

The ID for either the local or remote SNMP engine to uniquely identify the SNMPv3 node

SNMP Max Message Size

The maximum size SNMP packet generated by this node

SNMP Admin State Enabled —

SNMP is administratively enabled

SNMP Oper State

Disabled —

SNMP is administratively disabled

Enabled —

SNMP is operationally enabled

Disabled —

SNMP is operationally disabled

Persistent —

Persistent indexes was enabled at the last system reboot

Disabled —

Persistent indexes was disabled at the last system reboot

Page 190 7705 SAR OS System Management Guide

SNMP

Table 21: Show System Information Output Fields (Continued)

Label

Last Boot Index

Header

Last Saved Config

Time Last Saved

Changes Since Last

Save

Time Last Modified

Description

SNMP Sync State

The state when the synchronization of configuration files between the primary and secondary CSMs finish

Telnet/SSH/FTP Admin

The administrative state of the Telnet, SSH, and FTP sessions

Telnet/SSH/FTP Oper

The operational state of the Telnet, SSH, and FTP sessions

BOF Source

Image Source

The boot location of the BOF primary — specifies whether the image was loaded from the primary location specified in the BOF secondary — specifies whether the image was loaded from the secondary location specified in the BOF tertiary — specifies whether the image was loaded from the tertiary location specified in the BOF

Config Source

Last Booted Config

File primary — specifies whether the configuration was loaded from the primary location specified in the BOF secondary — specifies whether the configuration was loaded from the secondary location specified in the BOF tertiary — specifies whether the configuration was loaded from the tertiary location specified in the BOF

The URL and filename of the configuration file used for the most recent boot

Last Boot Cfg Version

The version of the configuration file used for the most recent boot

Last Boot Config

Header

Last Boot Index

Version

The header information of the configuration file used for the most recent boot

The index version used in the most recent boot

The header information of the index used in the most recent boot

The filename of the last saved configuration

The time the configuration was most recently saved

Yes — the configuration has changed since the last save

No — the configuration has not changed since the last save

The time of the last modification

7705 SAR OS System Management Guide Page 191

SNMP Command Reference

Table 21: Show System Information Output Fields (Continued)

Label Description

Max Cfg/BOF Backup

Rev

Cfg-OK Script

The maximum number of backup revisions maintained for a configuration file. This value also applies to the number of revisions maintained for the BOF file.

URL — the location and name of the CLI script file executed following successful completion of the boot-up configuration file execution

N/A — no CLI script file is executed

Cfg-OK Script Status Successful/Failed — the results from the execution of the CLI script file specified in the Cfg-OK Script location

Not used — no CLI script file was executed

Cfg-Fail Script URL — the location and name of the CLI script file executed following a failed boot-up configuration file execution

Not used — no CLI script file was executed

Cfg-Fail Script

Status

Successful/Failed — the results from the execution of the CLI script file specified in the Cfg-Fail Script location

Not used — no CLI script file was executed

Management IP address

The Management IP address of the node

DNS Server

DNS Domain

BOF Static Routes

ATM location ID

The DNS address of the node

The DNS domain name of the node

To — the static route destination

Next Hop — the next hop IP address used to reach the destination

Metric — displays the priority of this static route versus other static routes

None — no static routes are configured

For ATM OAM loopbacks - the address of the network device referenced in the loopback request

Page 192 7705 SAR OS System Management Guide

SNMP

access-group

Syntax access-group

group-name

Context

show>system>security

Description

This command displays access group information.

Parameters

group-name —

the access group name

Output

The following output is an example of access group information, and

Table 22

describes the fields.

Sample Output

A:ALU-1# show system security access-group

===============================================================================

Access Groups

=============================================================================== group name security security read write notify

model level view view view

------------------------------------------------------------------------------snmp-ro snmpv1 none no-security no-security snmp-ro snmpv2c none no-security no-security snmp-rw snmpv1 none no-security no-security no-security snmp-rw snmpv2c none no-security no-security no-security snmp-rwa snmpv1 none iso iso iso snmp-rwa snmpv2c none iso iso iso snmp-trap snmpv1 none iso snmp-trap snmpv2c none iso

-------------------------------------------------------------------------------

No. of Access Groups: 8

===============================================================================

A:ALU-1#

A:ALU-1# show system security access-group snmp-ro

===============================================================================

Access Groups

=============================================================================== group name security security read write notify

model level view view view

------------------------------------------------------------------------------snmp-ro snmpv1 none no-security no-security

-------------------------------------------------------------------------------

No. of Access Groups: 1

...

===============================================================================

A:ALU-1#

7705 SAR OS System Management Guide Page 193

SNMP Command Reference

Label

Group name

Security model

Security level

Read view

Write view

Notify view

No. of access groups

Table 22: Show System Access Group Fields

Description

The access group name

The security model required to access the views configured in this node

The required authentication and privacy levels to access the views configured in this node

The view to read the MIB objects

The view to configure the contents of the agent

The view to send a trap about MIB objects

The total number of configured access groups

communities

Syntax communities

Context

show>system>security

Description

This command lists SNMP communities and characteristics.

Output

The following output is an example of communities information, and

Table 23

describes the fields.

Sample Output

A:ALU-1# show system security communities

=============================================================================

Communities

============================================================================= community access view version group name

----------------------------------------------------------------------------private rw iso v1 v2c snmp-rwa cli-readonly r iso v2c cli-readonly cli-readwrite rw iso v2c cli-readwrite

-----------------------------------------------------------------------------

No. of Communities: 3

=============================================================================

A:ALU-1#

Page 194 7705 SAR OS System Management Guide

SNMP

Label

Community

Access

View

Version

Group Name

No of

Communities

Table 23: Show Communities Output Fields

Description

The community string name for SNMPv1 and SNMPv2c access only r —

The community string allows read-only access to all objects in the MIB except security objects rw —

The community string allows read-write access to all objects in the MIB except security objects rwa —

The community string allows read-write access to all objects in the MIB including security objects mgmt —

The unique SNMP community string assigned to the management router

The view name

The SNMP version

The access group name

The total number of configured community strings

user

Syntax user

[

user-id

] [

detail

]

Context

show>system>security

Description

This command displays user information.

Parameters

user-id —

the name of the user

detail —

displays all information associated with the specified use

Output

The following output is an example of user information, and

Table 24

describes the fields.

7705 SAR OS System Management Guide Page 195

SNMP Command Reference

Sample Output

A:ALU-1# show system security user

===============================================================================

Users

=============================================================================== user id New User Permissions Password Login Failed Local

Pwd console ftp snmp Expires Attempts Logins Conf

------------------------------------------------------------------------------admin n y n n never 2 0 y testuser n n n y never 0 0 y

-------------------------------------------------------------------------------

Number of users : 2

===============================================================================

A:ALU-1#

Table 24: Show User Output Fields

Label Description

User ID

Need New PWD

The name of a system user

Yes — the user must change their password at the next login

No — the user is not forced to change their password at the next login

User Permissions Console — specifies whether the user is permitted console/Telnet access

FTP — specifies whether the user is permitted FTP access

SNMP — specifies whether the user is permitted SNMP access

Password expires

The date on which the current password expires

Attempted logins

The number of times the user has attempted to log in, irrespective of whether the login succeeded or failed

Failed logins

Local Conf.

The number of unsuccessful login attempts

Y — password authentication is based on the local password database

N — password authentication is not based on the local password database

Page 196 7705 SAR OS System Management Guide

SNMP

view

Syntax view

[

view-name

] [

detail

|

capabilities

]

Context

show>system>security

Description

This command lists one or all views and permissions in the MIB-OID tree.

Parameters

view-name —

the name of the view

detail —

displays all groups associated with the view

capabilities —

displays all views, including excluded MIB-OID trees from unsupported features

Output

The following output is an example of system security view information, and

fields.

Table 25

describes the

Sample Output

A:ALU-1# show system security view

===============================================================================

Views

=============================================================================== view name oid tree mask permission

------------------------------------------------------------------------------iso 1 included no-security 1 included no-security 1.3.6.1.6.3 excluded no-security 1.3.6.1.6.3.10.2.1 included no-security 1.3.6.1.6.3.11.2.1 included no-security 1.3.6.1.6.3.15.1.1 included

-------------------------------------------------------------------------------

No. of Views: 6

===============================================================================

A:ALU-1#

A:ALU-1# show system security view no-security detail

===============================================================================

Views

=============================================================================== view name oid tree mask permission

------------------------------------------------------------------------------no-security 1 included no-security 1.3.6.1.6.3 excluded no-security 1.3.6.1.6.3.10.2.1 included no-security 1.3.6.1.6.3.11.2.1 included no-security 1.3.6.1.6.3.15.1.1 included

-------------------------------------------------------------------------------

No. of Views: 5

===============================================================================

======================================= no-security used in

======================================= group name

--------------------------------------snmp-ro snmp-rw

7705 SAR OS System Management Guide Page 197

SNMP Command Reference

=======================================

A:ALU-1#

A:ATMIMA1>config# show system security view capabilities

===============================================================================

Views

=============================================================================== view name oid tree mask permission

------------------------------------------------------------------------------iso 1 included iso 1.0.8802 no-support iso 1.3.6.1.3.37 no-support iso 1.3.6.1.3.92 no-support iso 1.3.6.1.3.95 no-support iso 1.3.6.1.2.1.14 no-support iso 1.3.6.1.2.1.15 no-support iso 1.3.6.1.2.1.23 no-support iso 1.3.6.1.2.1.51 no-support iso 1.3.6.1.2.1.68 no-support iso 1.3.6.1.2.1.85 no-support iso 1.3.6.1.2.1.100 no-support iso 1.3.6.1.2.1.4.39 no-support iso 1.3.6.1.2.1.5.20 no-support

===============================================================================

A:ALU-1#

Label

View name

OID tree

Mask

Permission

No. of Views

Group name

Table 25: Show System Security View Output Fields

Description

The name of the view. Views control the accessibility of a MIB object within the configured MIB view and subtree.

The Object Identifier (OID) value. OIDs uniquely identify MIB objects in the subtree.

The mask value and the mask type, along with the

oid-value

configured in the

view

command, determines the access of each subidentifier of an object identifier (MIB subtree) in the view

Included — specifies to include MIB subtree objects

Excluded — specifies to exclude MIB subtree objects

No-support — specifies not to support MIB subtree objects

The total number of configured views

The access group name

Page 198 7705 SAR OS System Management Guide

Event and Accounting Logs

In This Chapter

This chapter provides information about configuring event and accounting logs in the

7705 SAR. Topics in this chapter include:

•

Logging Overview on page 200

•

Log Destinations on page 202

→

Console on page 202

→

Session on page 202

→

Memory Logs on page 202

→

Log Files on page 203

→

SNMP Trap Group on page 204

→

Syslog on page 205

•

Event Logs on page 206

→

Event Sources on page 206

→

Event Control on page 208

→

Log Manager and Event Logs on page 210

→

Event Filter Policies on page 210

→

Event Log Entries on page 211

→

Simple Logger Event Throttling on page 213

→

Default System Log on page 214

•

Accounting Logs on page 215

→

Accounting Records on page 215

→

Accounting Files on page 218

→

Design Considerations on page 218

•

Configuration Notes on page 219

→

Reference Sources on page 219

•

Configuring Logging with CLI on page 221

•

Log Command Reference on page 245

7705 SAR OS System Management Guide Page 199

Logging Overview

Logging Overview

The two primary types of logging supported on the 7705 SAR are event logging and accounting logs.

Event logging controls the generation, dissemination and recording of system events for monitoring status and troubleshooting faults within the system. Events are messages generated by the system by applications or processes within the 7705 SAR. The 7705 SAR groups events into four major categories or event sources:

• Security events — security events are generated by the SECURITY application and pertain to attempts to breach system security

• Change events — change events are generated by the USER application and pertain to the configuration and operation of the node

• Debug events — debug events are generated by the DEBUG application and pertain to trace or other debugging information

• Main events — events that pertain to 7705 SAR applications that are not assigned to other event categories/sources

The applications listed above have the following properties:

• a timestamp in UTC or local time

• the generating application

• a unique event ID within the application

• the VRF-ID

• a subject identifying the affected object

• a short text description

Event control assigns the severity for each application event and determines whether the event should be generated or suppressed. The severity numbers and severity names supported in the 7705 SAR conform to ITU standards M.3100 X.733 and X.21 and are listed in

Table 26

.

Page 200 7705 SAR OS System Management Guide

Event and Accounting Logs

Table 26: Event Severity Levels

Severity Number

1

2

3

4

5

6

Severity Name

Cleared

Indeterminate (info)

Critical

Major

Minor

Warning

Event control maintains a count of the number of events generated (logged) and dropped

(suppressed) for each application event. The severity of an application event can be configured in event control.

An event log within the 7705 SAR associates the event sources with logging destinations.

Examples of logging destinations include: the console session, memory logs, file destinations, SNMP trap groups, and syslog destinations. A log filter policy can be associated with the event log to control which events will be logged in the event log based on combinations of application, severity, event ID range, and the subject of the event.

The 7705 SAR accounting logs collect comprehensive accounting statistics to support a variety of billing models. The 7705 SAR collects accounting data on services on a perservice class basis. In addition to gathering information critical for service billing, accounting records can be analyzed to provide insight about customer service trends for potential service revenue opportunities.

Accounting statistics are collected according to the parameters defined within the context of an accounting policy. Accounting policies are applied to customer Service Access Points

(SAPs). Accounting statistics are collected by counters for individual service queues defined on the customer’s SAPs.

The type of record defined within the accounting policy determines where a policy is applied, what statistics are collected and the time interval at which to collect statistics.

The only supported destination for an accounting log is a compact flash system device (

cf3)

.

Accounting data is stored within a standard directory structure on the device in compressed

XML format.

7705 SAR OS System Management Guide Page 201

Log Destinations

Log Destinations

Both event logs and accounting logs use a common mechanism for referencing a log destination. 7705 SAR routers support the following log destinations:

•

Console

•

Session

•

Memory Logs

•

Log Files

•

SNMP Trap Group

•

Syslog

An event log can be associated with multiple event sources, but it can only have a single log destination.

A file destination is the only type of log destination that can be configured for an accounting log.

Console

Sending events to a console destination means the message will be sent to the system console. The console device can be used as an event log destination.

Session

A session destination is a temporary log destination that directs entries to the active Telnet or

SSH session for the duration of the session. When the session is terminated, for example, when the user logs out, the event log is removed. Event logs configured with a session destination are not stored in the configuration file. Event logs can direct log entries to the session destination.

Memory Logs

A memory log is a circular buffer. When the log is full, the oldest entry in the log is replaced with the new entry. When a memory log is created, the specific number of entries it can hold can be specified; otherwise, it will assume a default size. An event log can send entries to a memory log destination.

Page 202 7705 SAR OS System Management Guide

Event and Accounting Logs

Log Files

Log files can be used by both event logs and accounting logs and are stored on the compact flash device (

cf3

) in the file system.

A log file is identified by a single log file ID, but a log file will generally be composed of a number of individual files in the file system. A log file is configured with a rollover parameter, expressed in minutes, which represents the length of time an individual log file should be written to before a new file is created for the relevant log file ID. The rollover time is checked only when an update to the log is performed. Thus, this rule is subject to the incoming rate of the data being logged. For example, if the rate is very low, the actual rollover time may be longer than the configured value.

The retention time for a log file specifies the amount of time the file should be retained on the system based on the creation date and time of the file. The retention time is used as a factor to determine which files should be deleted first if the file system device nears 100% usage.

When a log file is created, only the compact flash device for the log file is specified. Log files are created in specific subdirectories with standardized names depending on the type of information stored in the log file.

Event log files are always created in the

\log

directory on the compact flash device. The naming convention for event log files is: log

eeff

-

timestamp

where:

ee

is the event log ID

ff

is the log file destination ID

timestamp

is the timestamp when the file is created in the form of

yyyymmddhhmmss

where:

yyyy

is the four-digit year (for example, 2008)

mm

is the two-digit number representing the month (for example, 12 for

December)

dd

is the two-digit number representing the day of the month (for example, 03 for the 3rd of the month)

hh

is the two-digit hour in a 24-hour clock (for example, 04 for 4 a.m.)

mm

is the two-digit minute (for example, 30 for 30 minutes past the hour)

ss

is the two-digit second (for example, 14 for 14 seconds)

7705 SAR OS System Management Guide Page 203

Log Destinations

Accounting log files are created in the

\act-collect

directory on the compact flash device. The naming convention for accounting logs is: act

aaff-timestamp

.

xml.gz

where:

aa

is the accounting policy ID

ff

is the log file destination ID

timestamp

is the timestamp when the file is created, in the same form as for event logs.

Accounting logs are

.xml

files created in a compressed format and have a

.gz

extension.

The

\act-collect

directory is where active accounting logs are written. When an accounting log is rolled over, the active file is closed and archived in the

\act

directory before a new active accounting log file is created in

\act-collect

.

SNMP Trap Group

An event log can be configured to send events to SNMP trap receivers by specifying an

SNMP trap group destination.

An SNMP trap group can have multiple trap targets. Each trap target can have different operational parameters.

A trap destination has the following properties:

• the IP address of the trap receiver

• the UDP port used to send the SNMP trap

• SNMP version (v1, v2c, or v3) used to format the SNMP notification

• SNMP community name for SNMPv1 and SNMPv2c receivers

• security name and level for SNMPv3 trap receivers

For SNMP traps that will be sent out-of-band through the Management Ethernet port on the

CSM, the source IP address of the trap is the IP interface address defined on the

Management Ethernet port. For SNMP traps that will be sent in-band, the source IP address of the trap is the system IP address of the 7705 SAR.

Each trap target destination of a trap group receives the identical sequence of events as defined by the log ID and the associated sources and log filter applied.

Page 204 7705 SAR OS System Management Guide

Event and Accounting Logs

Syslog

An event log can be configured to send events to one syslog destination. Syslog destinations have the following properties:

• syslog server IP address

• the UDP port used to send the syslog message

• the Syslog Facility Code

• the Syslog Severity Threshold (0 to 7) (events exceeding the configured level will be sent)

Because syslog uses eight severity levels whereas the 7705 SAR uses six internal severity

levels, the severity levels are mapped to syslog severities. Table 27 displays the severity

level mappings to syslog severities.

7705 SAR

Severity Level

3 critical

4 major

5 minor

6 warning

1 cleared

2 indeterminate

Table 27: 7705 SAR to Syslog Severity Level Mappings

Syslog Severity

Level (highest to lowest)

0

1

2

3

4

5

6

7

Syslog

Configured

Severity

emergency alert critical error warning notice info debug

Definition

System is unusable

Action must be taken immediately

Critical conditions

Error conditions

Warning conditions

Normal but significant condition

Informational messages

Debug-level messages

7705 SAR OS System Management Guide Page 205

Event Logs

Event Logs

Event logs are the means of recording-system generated events for later analysis. Events are messages generated by the system by applications or processes within the 7705 SAR.

Figure 3 depicts a functional block diagram of event logging.

EVENT

SOURCES

Figure 3: Event Logging Block Diagram

EVENT

CONTROL

LOG

MANAGER

Main

Security

Change

Log Manager

Logs

Filter Policy

Log Destination

Console

Session

Memory

File

T rap Grou p

Syslog

Debug

= Different Events = Event with Severity Marked

No1025

Event Sources

In Figure 3 , the event sources are the main categories of events that feed the log manager.

• Security — The security event source is all events that affect attempts to breach system security, such as failed login attempts, attempts to access MIB tables to which the user is not granted access, or attempts to enter a branch of the CLI to which access has not been granted. Security events are generated by the SECURITY application.

Page 206 7705 SAR OS System Management Guide

Event and Accounting Logs

• Change — The change activity event source is all events that directly affect the configuration or operation of the node. Change events are generated by the USER application.

• Debug — The debug event source is the debugging configuration that has been enabled on the system. Debug events are generated by the DEBUG application.

• Main — The main event source receives events from all other applications within the 7705 SAR.

Examples of applications within the 7705 SAR include MPLS and services.

Figure 4

displays an example of the show log applications

command output that displays all applications.

Figure 4: Show Log Applications Command Output

*A:ALU-48# show log applications

==================================

Log Event Application Names

==================================

Application Name

----------------------------------

ATM

CHASSIS

DEBUG

EFM_OAM

FILTER

GSMP

IP

LDP

LOGGER

MPLS

NTP

OAM

PORT

PPP

QOS

ROUTE_POLICY

SECURITY

SNMP

STP

SVCMGR

SYSTEM

TIP

TOD

USER

USER_DB

VRTR

==================================

*A:ALU-48#

7705 SAR OS System Management Guide Page 207

Event Logs

Event Control

Event control pre-processes the events generated by applications before the event is passed into the main event stream. Event control assigns a severity to application events and can either forward the event to the main event source or suppress the event. Suppressed events are counted in event control, but these events will not generate log entries as they never reach the log manager.

Simple event throttling is another method of event control and is configured in the same way as the generation and suppression options. See

Simple Logger Event Throttling

.

Events are assigned a default severity level in the system, but the application event severities can be changed by the user.

Application events contain an event number and description that explains why the event is generated. The event number is unique within an application, but the number can be duplicated in other applications.

The following example, generated by querying event control for application-generated events, displays a partial list of event numbers and names.

router# show log event-control

=======================================================================

Log Events

=======================================================================

Application

ID# Event Name P g/s Logged Dropped

-----------------------------------------------------------------------

ATM:

2011 tAtmPlcpSubLayerClear MI gen 0 0

2012 tAtmEpOutOfPeerVpiOrVciRange WA gen 0 0

2013 tAtmMaxPeerVccsExceeded WA gen 0 0

...

CHASSIS:

2001 cardFailure MA gen 0 0

2002 cardInserted MI gen 7 0

2003 cardRemoved MI gen 0 0

...

DEBUG:

L 2001 traceEvent MI gen 0 0

EFM_OAM:

2001 tmnxDot3OamPeerChanged MI gen 0 0

2002 tmnxDot3OamLoopDetected MI gen 0 0

FILTER:

2001 tIPFilterPBRPacketsDrop WA gen 0 0

2002 tFilterEntryActivationFailed WA gen 0 0

2003 tFilterEntryActivationRestored WA gen 0 0

GSMP:

2001 tmnxAncpIngRateMonitorEvent WA gen 0 0

L 2002 tmnxAncpIngRateMonitorEventL WA gen 0 0

2003 tmnxAncpEgrRateMonitorEvent WA gen 0 0

...

IP:

L 2001 clearRTMError MI gen 0 0

Page 208 7705 SAR OS System Management Guide

Event and Accounting Logs

L 2002 ipEtherBroadcast MI gen 0 0

L 2003 ipDuplicateAddress MI gen 0 0

...

LDP:

2001 vRtrLdpStateChange MI gen 0 0

2002 vRtrLdpInstanceStateChange MI gen 0 0

2003 vRtrLdpIfStateChange MI gen 0 0

...

LOGGER:

L 2001 STARTED MI gen 5 0

2002 tmnxLogTraceError CR gen 0 0

2005 tmnxLogSpaceContention MA gen 0 0

...

MPLS:

2001 mplsXCUp WA gen 0 0

2002 mplsXCDown WA gen 0 0

2003 mplsTunnelUp WA gen 0 0

...

NTP:

2001 tmnxNtpAuthMismatch WA gen 0 0

2002 tmnxNtpNoServersAvail MA gen 0 0

2003 tmnxNtpServersAvail MI gen 0 0

...

SYSTEM:

2001 stiDateAndTimeChanged WA gen 0 0

2002 ssiSaveConfigSucceeded MA gen 0 0

2003 ssiSaveConfigFailed CR gen 0 0

...

USER:

L 2001 cli_user_login MI gen 4 0

L 2002 cli_user_logout MI gen 3 0

L 2003 cli_user_login_failed MI gen 0 0

...

VRTR:

2001 tmnxVRtrMidRouteTCA MI gen 0 0

2002 tmnxVRtrHighRouteTCA MI gen 0 0

2003 tmnxVRtrHighRouteCleared MI gen 0 0

...

======================================================================= router#

7705 SAR OS System Management Guide Page 209

Event Logs

Log Manager and Event Logs

Events that are forwarded by event control are sent to the log manager. The log manager manages the event logs in the system and the relationships between the log sources, event logs and log destinations, and log filter policies.

An event log has the following properties:

• a unique log ID

The log ID is a short, numeric identifier for the event log. A maximum of 10 logs can be configured at a time.

• one or more log sources

The source stream or streams to be sent to log destinations can be specified. The source must be identified before the destination can be specified. The events can be from the main event stream, events in the security event stream, or events in the user activity stream.

• one event log destination

A log can only have a single destination. The destination for the log ID destination can be one of console, session, syslog, snmp-trap-group, memory, or a file on the local file system.

• an optional event filter policy

An event filter policy defines whether to forward or drop an event or trap based on match criteria.

Event Filter Policies

The log manager uses event filter policies to control which events are forwarded or dropped based on various criteria. Like other policies with the 7705 SAR, filter policies have a default action. The default actions are either:

• forward

• drop

Filter policies also include a number of filter policy entries that are identified with an entry

ID and define specific match criteria and a forward or drop action for the match criteria.

Each entry contains a combination of matching criteria that define the application, event number, router, severity, and subject conditions. The entry’s action determines how the packets should be treated if they have met the match criteria.

Entries are evaluated in order from the lowest to the highest entry ID. The first matching event is subject to the forward or drop action for that entry.

Page 210 7705 SAR OS System Management Guide

Event and Accounting Logs

Valid operators are displayed in Table 28

.

Table 28: Valid Filter Policy Operators

Operator

eq neq lt lte gt gte

Description

Equal to

Not equal to

Less than

Less than or equal to

Greater than

Greater than or equal to

A match criteria entry can include combinations of:

• equal to or not equal to a given system application

• equal to, not equal to, less than, less than or equal to, greater than, or greater than or equal to an event number within the application

• equal to, not equal to, less than, less than or equal to, greater than, or greater than or equal to a severity level

• equal to or not equal to a router name string or regular expression match

• equal to or not equal to an event subject string or regular expression match

Event Log Entries

Log entries that are forwarded to a destination are formatted in a way that is appropriate for the specific destination; for example, whether it is to be recorded to a file or sent as an

SNMP trap, but log event entries also have common elements or properties. All applicationgenerated events have the following properties:

• a timestamp in UTC or local time

• the generating application

• a unique event ID within the application

• a router name identifying the VRF-ID that generated the event

• a subject identifying the affected object

• a short text description

7705 SAR OS System Management Guide Page 211

Event Logs

Page 212

The general format for an event in an event log with either a memory, console or file destination is as follows: nnnn YYYY/MM/DD HH:MM:SS.SS <severity>:<application> # <event_id> <router-name>

<subject> description

The following is an event log example:

475 2007/11/27 00:19:40.38 WARNING: SNMP #2008 Base 1/1/1

"interface 1/1/1 came up"

The specific elements that make up the general format are described in

Table 29 .

Table 29: Log Entry Field Descriptions

Label

nnnn

YYYY/MM/DD

HH:MM:SS.SS

<severity>

<application>

<event_id>

<router>

<subject>

<description>

Description

The log entry sequence number

The UTC date stamp for the log entry

YYYY —

Year

MM —

Month

DD —

Day

The UTC timestamp for the event

HH —

Hours (24-hour format)

MM —

Minutes

SS.SS —

Seconds

The severity level name of the event

CLEARED

—

a cleared event (severity number 1)

INFO

—

an indeterminate/informational severity event (severity level 2)

CRITICAL

—

a critical severity event (severity level 3)

MAJOR

—

a major severity event (severity level 4)

MINOR

—

a minor severity event (severity level 5)

WARNING

—

a warning severity event (severity 6)

The application generating the log message

The application’s event ID number for the event

The router name representing the VRF-ID that generated the event

The subject/affected object for the event

A text description of the event

7705 SAR OS System Management Guide

Event and Accounting Logs

Simple Logger Event Throttling

Simple event throttling provides a mechanism to protect event receivers from being overloaded when a scenario causes many events to be generated in a very short period of time. A throttling rate (events/seconds), can be configured. Specific application events can be configured to be throttled. Once the throttling event limit is exceeded in a throttling interval, any further events of that type are dropped and the dropped events counter is incremented. Dropped events counts are displayed with the

show>log>event-control

command. Events are dropped before being sent to one of the logger event collector tasks.

There is no record of the details of the dropped events and therefore no way to retrieve event history data lost by this throttling method.

A particular event type can be generated by multiple managed objects within the system. At the point that this throttling method is applied, the logger application has no information about the managed object that generated the event and cannot distinguish between events generated by object "A" from events generated by object "B". If the events have the same event-id, they are throttled regardless of the managed object that generated them. The logger application also cannot distinguish between events that will be logged to destination log-id

<n> from events that will be logged to destination log-id <m>.

Throttle rate applies commonly to all event types. It is not configurable for a specific event type.

A timer task checks for events dropped by throttling when the throttle interval expires. If any events have been dropped, a TIMETRA-SYSTEM-MIB::tmnxTrapDropped notification is sent.

By default, event throttling is set to off for each specific event type. It must be explicitly enabled for each event type where throttling is desired. This makes backwards compatibility of configuration files easier to manage.

7705 SAR OS System Management Guide Page 213

Event Logs

Default System Log

Log 99 is a preconfigured memory-based log that logs events from the main event source

(not security, debug, or change). Log 99 exists by default.

The following example displays the log 99 configuration.

ALU-1>config>log# info detail

#-----------------------------------------echo "Log Configuration "

#------------------------------------------

...

log-id 99

description "Default system log"

no filter

time-format utc

from main

to memory 500

no shutdown

exit

----------------------------------------------

Page 214 7705 SAR OS System Management Guide

Event and Accounting Logs

Accounting Logs

Before an accounting policy can be created, a target log file must be created to collect the accounting records. The files are stored in system memory on a compact flash (

cf3

) in a compressed (tar) XML format and can be retrieved using FTP or SCP.

Accounting Records

An accounting policy must define a record name and collection interval. Only one record name can be configured per accounting policy. Also, a record name can only be used in one accounting policy.

Table 30 lists the record name, sub-record types, and default collection period for service

and network accounting policies.

Table 30: Accounting Record Name and Collection Periods

Record Name

service-ingress-octets service-egress-octets service-ingress-packets service-egress-packets

Sub-Record

Types

sio seo sip sep

Accounting

Object

SAP

SAP

SAP

SAP

Default Collection

Period (minutes)

5

5

5

5

When creating accounting policies, one service accounting policy can be defined as the default. If statistics collection is enabled on a SAP and no accounting policy is applied, then the respective default policy is used. If no default policy is defined, then no statistics are collected unless a specifically defined accounting policy is applied.

Each accounting record name is composed of one or more sub-records, which are in turn composed of multiple fields.

Table 31 lists the accounting policy record names and the

statistics that are collected with each.

7705 SAR OS System Management Guide Page 215

Accounting Logs

Table 31: Accounting Record Name Details

Record Name Sub-Record Field

Service-ingress-octets sio svc

Field Description

SvcId sap SapId qid QueueId hoo hod loo lod

OfferedHiPrioOctets

DroppedHiPrioOctets

LowOctetsOffered

LowOctetsDropped

Service-egress-octets seo sap qid iof iod uco iof oof svc oof ood

UncoloredOctetsOffered

InProfileOctetsForwarded

OutOfProfileOctetsForwarded

SvcId

SapId

QueueId

InProfileOctetsForwarded

InProfileOctetsDropped

OutOfProfileOctetsForwarded

OutOfProfileOctetsDropped

Page 216 7705 SAR OS System Management Guide

Event and Accounting Logs

Service-egresspackets

Table 31: Accounting Record Name Details (Continued)

Record Name

Service-ingresspackets

Sub-Record Field

sip sep svc opf svc sap qid lpo lpd ucp ipf sap qid hpo hpd ipf ipd opf opd sap slaProfile

Field Description

SvcId

SapId

QueueId

HighPktsOffered

HighPktsDropped

LowPktsOffered

LowPktsDropped

UncoloredPacketsOffered

InProfilePktsForwarded

OutOfProfilePktsForwarded

SvcId

SapId

QueueId

InProfilePktsForwarded

InProfilePktsDropped

OutOfProfilePktsForwarded

OutOfProfilePktsDropped

SapId

SlaProfile

7705 SAR OS System Management Guide Page 217

Accounting Logs

Accounting Files

When a policy has been created and applied to a service, the accounting file is stored on the compact flash in a compressed XML file format. The 7705 SAR creates two directories on the compact flash to store the files. The following output displays a directory named actcollect

that holds accounting files that are open and actively collecting statistics, and a directory named act

that stores the files that have been closed and are awaiting retrieval.

ALU-1>file cf3:\# dir act*

12/19/2006 06:08a <DIR> act-collect

12/19/2006 06:08a <DIR> act

ALU-1>file cf3:\act-collect\ # dir

Directory of cf3:\act-collect#

12/23/2006 01:46a <DIR> .

12/23/2006 12:47a <DIR> ..

12/23/2006 01:46a 112 act1111-20031223-014658.xml.gz

12/23/2006 01:38a 197 act1212-20031223-013800.xml.gz

Accounting files always have the prefix act

followed by the accounting policy ID, log ID and timestamp. The accounting log file naming and log file destination properties (such as

rollover and retention) are discussed in more detail in Log Files .

A file ID can only be assigned to either one event log ID or one accounting log.

Design Considerations

The 7705 SAR has ample resources to support large-scale accounting policy deployments.

When preparing for an accounting policy deployment, verify that data collection, file rollover, and file retention intervals are properly tuned for the amount of statistics to be collected.

If the accounting policy collection interval is too brief, there may be insufficient time to store the data from all the services within the specified interval. If that is the case, some records may be lost or incomplete. Interval time, record types, and number of services using an accounting policy are all factors that should be considered when implementing accounting policies.

The rollover and retention intervals on the log files and the frequency of file retrieval must also be considered when designing accounting policy deployments. The amount of data stored depends on the type of record collected, the number of services that are collecting statistics, and the collection interval that is used.

Page 218 7705 SAR OS System Management Guide

Event and Accounting Logs

Configuration Notes

This section describes logging configuration caveats.

• A file or filter cannot be deleted if it has been applied to a log.

• File IDs, syslog IDs, or SNMP trap groups must be configured before they can be applied to a log ID.

• A file ID can only be assigned to either one log ID or one accounting policy.

• Accounting policies must be configured in the config>log

context before they can be applied to a service SAP or service interface.

• The snmp-trap-id

must be the same as the log-id

.

Reference Sources

For information on supported IETF drafts and standards as well as standard and proprietary

MIBS, refer to Standards and Protocol Support .

7705 SAR OS System Management Guide Page 219

Configuration Notes

Page 220 7705 SAR OS System Management Guide

Event and Accounting Logs

Configuring Logging with CLI

This section provides information to configure logging using the command line interface.

Topics in this section include:

•

Log Configuration Overview on page 222

•

Log Type on page 223

•

Basic Event Log Configuration on page 224

•

Common Configuration Tasks on page 225

→

Configuring an Event Log on page 225

→

Configuring a File ID on page 226

→

Configuring an Accounting Policy on page 227

→

Configuring Event Control on page 228

→

Configuring Throttle Rate on page 229

→

Configuring a Log Filter on page 230

→

Configuring an SNMP Trap Group on page 232

→

Configuring a Syslog Target on page 233

•

Log Management Tasks on page 234

→

Modifying a Log File on page 234

→

Deleting a Log File on page 236

→

Modifying a File ID on page 237

→

Deleting a File ID on page 238

→

Deleting a Syslog ID on page 238

→

Deleting a Syslog ID on page 238

→

Modifying an SNMP Trap Group on page 239

→

Deleting an SNMP Trap Group on page 240

→

Modifying a Log Filter on page 241

→

Deleting a Log Filter on page 242

→

Modifying Event Control Parameters on page 243

→

Returning to the Default Event Control Configuration on page 244

7705 SAR OS System Management Guide Page 221

Log Configuration Overview

Log Configuration Overview

Logging on the 7705 SAR is used to provide the operator with logging information for monitoring and troubleshooting. You can configure logging parameters to save information in a log file or direct the messages to other devices. Logging commands allow you to:

• select the types of logging information to be recorded

• assign a severity to the log messages

• select the source and target of logging information

Page 222 7705 SAR OS System Management Guide

Event and Accounting Logs

Log Type

Logs can be configured in the following contexts:

• Log file — log files can contain log event message streams or accounting/billing information. Log file IDs are used to direct events, alarms/traps, and debug information to their respective targets.

• SNMP trap groups — SNMP trap groups contain an IP address and community names that identify targets to send traps following specified events

• Syslog — information can be sent to a syslog host that is capable of receiving selected syslog messages from a network element

• Event control — configures a particular event, or all events associated with an application, to be generated or suppressed

• Event filters — an event filter defines whether to forward or drop an event or trap based on match criteria

• Accounting policies — an accounting policy defines the accounting records that will be created. Accounting policies can be applied to one or more service access points

(SAPs).

• Event logs — an event log defines the types of events to be delivered to an associated destination

• Event throttling rate — defines the rate of throttling events

7705 SAR OS System Management Guide Page 223

Basic Event Log Configuration

Basic Event Log Configuration

The most basic log configuration must have the following:

• a log ID or an accounting policy ID

• a log source

• a log destination

The following displays a log configuration example.

ALU-12>config>log# info

#-----------------------------------------echo "Log Configuration "

#------------------------------------------

file-id 1

description "This is a test file-id."

location cf3:

exit

file-id 2

description "This is a test log."

location cf3:

exit

snmp-trap-group 7

trap-target 11.22.33.44 "snmpv2c" notify-community "public"

exit

log-id 2

from main

to file 2

exit

----------------------------------------------

ALU-12>config>log#

Page 224 7705 SAR OS System Management Guide

Event and Accounting Logs

Common Configuration Tasks

The following sections describe basic system tasks that must be performed.

•

Configuring an Event Log

•

Configuring a File ID

•

Configuring an Accounting Policy

•

Configuring Event Control

•

Configuring Throttle Rate

•

Configuring a Log Filter

•

Configuring an SNMP Trap Group

•

Configuring a Syslog Target

Configuring an Event Log

An event log file contains information used to direct events, alarms, traps, and debug information to their respective destinations.

One or more event sources can be specified.

File IDs, SNMP trap groups, or syslog IDs must be configured before they can be applied to an event log ID.

Use the following CLI syntax to configure a log file:

CLI Syntax:

config>log log-id

log-id

description

description-string

filter

filter-id

from {[main] [security] [change] [debug-trace]} to console to file

file-id

to memory [

size

] to session to snmp [

size

] to syslog

syslog-id

time-format {local | utc} no shutdown

7705 SAR OS System Management Guide Page 225

Common Configuration Tasks

The following displays an example of the log file configuration command syntax:

Example:

config# log config>log# log-id 2 config>log>log-id$ description "This is a test log file." config>log>log-id# filter 1 config>log>log-id# from main security config>log>log-id# to file 1 config>log>log-id# no shutdown config>log>log-id# exit

The following displays a log file configuration:

ALU-12>config>log>log-id# info

----------------------------------------------

...

log-id 2

description "This is a test log file."

filter 1

from

main

security

to file 1 exit

...

----------------------------------------------

ALU-12>config>log>log-id#

Configuring a File ID

To create a log file, a file ID is defined that specifies the target compact flash drive and the rollover and retention interval period for the file. The rollover interval is defined in minutes and determines how long a file will be used before it is closed and a new log file is created.

The retention interval determines how long the file will be stored on the compact flash drive before it is deleted.

Use the following CLI syntax to configure a log file ID:

CLI Syntax:

config>log file-id

log-file-id

description

description-string

location

cflash-id

rollover

minutes

[retention

hours

]

Page 226 7705 SAR OS System Management Guide

Event and Accounting Logs

The following displays an example of the log file ID configuration command syntax:

Example:

config# log config>log# file-id 1 config>log>file-id# description "

This is a log file.

" config>log>file-id# location cf3: config>log>file-id# rollover

600

retention

24

The following displays the file ID configuration:

ALU-12>config>log# info

------------------------------------------

file-id 1

description "This is a log file."

location cf3:

rollover 600 retention 24

exit

----------------------------------------------

ALU-12>config>log#

Configuring an Accounting Policy

Before an accounting policy can be created, a target log file must be created to collect the accounting records. The files are stored in system memory on the compact flash drive in a compressed (tar) XML format and can be retrieved using FTP or SCP. See

Configuring an

Event Log

and

Configuring a File ID .

Accounting policies must be configured in the config>log

context before they can be applied to a SAP or service interface. For information on associating an accounting policy with a SAP, see the 7705 SAR OS Services Guide.

An accounting policy must define a record type and collection interval. Only one record type can be configured per accounting policy.

When creating accounting policies, one service accounting policy can be defined as default.

If statistics collection is enabled on a SAP and no accounting policy is applied, then the respective default policy is used. If no default policy is defined, then no statistics are collected unless a specifically defined accounting policy is applied.

Use the following CLI syntax to configure an accounting policy:

CLI Syntax:

config>log> accounting-policy acct-policy-id interval minutes description description-string default record record-name to file log-file-id no shutdown

7705 SAR OS System Management Guide Page 227

Common Configuration Tasks

The following displays an example of the accounting policy configuration command syntax:

Example:

config>log# accounting-policy 4 config>log>acct-policy# description "This is the default accounting policy." config>log>acct-policy# record service-ingress-packets config>log>acct-policy# default config>log>acct-policy# to file 1 config>log>acct-policy# exit config>log# accounting-policy 5 config>log>acct-policy# description "This is a test accounting policy." config>log>acct-policy# record service-ingress-packets config>log>acct-policy# to file 2 config>log>acct-policy#

The following displays the accounting policy configuration:

ALU-12>config>log# info

---------------------------------------------accounting-policy 4 description "This is the default accounting policy." record service-ingress-packets default to file 1 exit accounting-policy 5 description "This is a test accounting policy." record service-ingress-packets to file 2 exit

----------------------------------------------

ALU-12>config>log#

Configuring Event Control

Use the following CLI syntax to configure event control. Note that the

throttle

parameter used in the

event-control

command syntax enables throttling for a specific event type. The

config>log>throttle-rate

command configures the number of events and interval length to be applied to all event types that have throttling enabled by this

event-control

command.

CLI Syntax:

config>log event-control

application-id

[

event-name

|

eventnumber

] generate[

severity-level

] [throttle] event-control

application-id

[

event-name

|

eventnumber

] suppress throttle-rate

events

[interval

seconds

]

Page 228 7705 SAR OS System Management Guide

Event and Accounting Logs

The following displays an example of an event control configuration command syntax:

Example:

c onfig# log config>log# event-control atm 2014 generate critical config>log# event-control oam 2001 suppress config>log# throttle-rate 500 interval 10

The following displays the event control configuration:

ALU-12>config>log# info

#-----------------------------------------echo "Log Configuration"

#------------------------------------------

throttle-rate 500 interval 10

event-control "atm" 2014 generate critical

event-control "oam" 2001 suppress

..

----------------------------------------------

ALU-12>config>log>filter#

Configuring Throttle Rate

This command configures the number of events and interval length to be applied to all event types that have throttling enabled by the

event-control

command.

Use the following CLI syntax to configure the throttle rate.

CLI Syntax:

config>log# throttle-rate events [interval

seconds

]

The following displays an example of the configuration command syntax:

Example:

config>log# throttle-rate 500 interval 10 config>log# event-control mpls 2001 generate throttle

The following displays the configuration:

*A:gal171>config>log# info

---------------------------------------------

throttle-rate 500 interval 10

event-control “mpls” 2001 generate throttle

----------------------------------------------

*A:gal171>config>log#

7705 SAR OS System Management Guide Page 229

Common Configuration Tasks

Configuring a Log Filter

Use the following CLI syntax to configure a log filter:

CLI Syntax:

config>log filter

filter-id

default-action {drop | forward} description

description-string

entry

entry-id

action {drop | forward} description

description-string

match application {eq | neq}

application-id

number {eq | neq | lt | lte | gt | gte}

event-id

router {eq | neq}

router-instance

[regexp] severity {eq | neq | lt | lte | gt | gte}

severity-level

subject {eq | neq}

subject

[regexp]

The following displays an example of the log filter configuration command syntax:

Example:

c onfig# log config>log# filter 1 config>log>filter# description "This is a sample filter." config>log>filter# default-action drop config>log>filter# entry 1 config>log>filter>entry$ action forward config>log>filter>entry# match application eq atm config>log>filter>entry# match severity eq critical config>log>filter>entry# exit

Page 230 7705 SAR OS System Management Guide

The following displays the log filter configuration:

ALU-12>config>log# info

#-----------------------------------------echo "Log Configuration "

#------------------------------------------

file-id 1

description "This is our log file."

location cf3:

rollover 600 retention 24

exit

filter 1

default-action

drop

description "This is a sample filter."

entry 1

action forward

match

application eq "atm"

severity eq critical

exit

exit

exit

...

log-id 2

shutdown

description "This is a test log file."

filter

1

from main security

to file 1

exit

...

------------------------------------------

ALU-12>config>log#

Event and Accounting Logs

7705 SAR OS System Management Guide Page 231

Common Configuration Tasks

Configuring an SNMP Trap Group

The associated

log-id

does not have to be configured before a

snmp-trap-group

can be created; however, the

snmp-trap-group

must exist before the

log-id

can be configured to use it.

Use the following CLI syntax to configure an SNMP trap group:

CLI Syntax:

config>log snmp-trap-group

log-id

trap-target

name

[address

ip-address

] [port

port

]

[snmpv1 | snmpv2c | snmpv3] notify-community

communityName

|

snmpv3SecurityName

[security-level

{no-auth-no-privacy | auth-no-privacy | privacy}]

The following displays an example of the SNMP trap group configuration command syntax:

Example:

c onfig# log config>log# snmp-trap-group

2

config>log>snmp-trap-group# trap-target "target name" address 10.10.10.104 notify-community

"communitystring" security-level no-auth-no-privacy config>log>snmp-trap-group# exit

The following displays the SNMP trap group configuration:

ALU-12>config>log# info

----------------------------------------------

...

snmp-trap-group 2 trap-target “target name” address 10.10.10.104:5 "snmpv3" notify-community

"communitystring"

exit

...

log-id 2

description "This is a test log file."

filter 1

from main security

to file 1 exit

...

----------------------------------------------

ALU-12>config>log#

Page 232 7705 SAR OS System Management Guide

Event and Accounting Logs

Configuring a Syslog Target

Log events cannot be sent to a syslog target host until a valid syslog ID exists.

Use the following CLI syntax to configure a syslog file:

CLI Syntax:

config>log syslog

syslog-id

description

description-string

address

ip-address

log-prefix

log-prefix-string

port

port

level {emergency | alert | critical | error | warning

| notice | info | debug}

facility syslog-facility

The following displays an example of the syslog file configuration command syntax:

Example:

config# log config>log# syslog 1 config>log>syslog$ description "This is a syslog file." config>log>syslog# address 10.10.10.104

config>log>syslog# facility user config>log>syslog# level warning

The following displays the syslog configuration:

ALU-12>config>log# info

----------------------------------------------

...

syslog 1

description "This is a syslog file."

address 10.10.10.104

facility user

level warning

exit

...

----------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 233

Log Management Tasks

Log Management Tasks

This section discusses the following logging tasks:

•

Modifying a Log File

•

Deleting a Log File

•

Modifying a File ID

•

Deleting a File ID

•

Deleting a Syslog ID

•

Deleting a Syslog ID

•

Modifying an SNMP Trap Group

•

Deleting an SNMP Trap Group

•

Modifying a Log Filter

•

Deleting a Log Filter

•

Modifying Event Control Parameters

•

Returning to the Default Event Control Configuration

Modifying a Log File

Use the following CLI syntax to modify a log file:

CLI Syntax:

config>log log-id

log-id

description

description-string

filter

filter-id

from {[main] [security] [change] [debug-trace]} to console to file

file-id

to memory [

size

] to session to snmp [

size

] to syslog

syslog-id}

Page 234 7705 SAR OS System Management Guide

Event and Accounting Logs

The following displays the current log configuration:

ALU-12>config>log>log-id# info

----------------------------------------------

...

log-id 2

description "This is a test log file."

filter 1

from main security

to file

1

exit

...

----------------------------------------------

ALU-12>config>log>log-id#

The following displays an example of modifying log file parameters:

Example:

c onfig# log config>log# log-id

2

config>log>log-id# description "Chassis log file." config>log>log-id# filter 2 config>log>log-id# from security config>log>log-id# exit

The following displays the modified log file configuration:

ALU-12>config>log# info

----------------------------------------------

...

log-id 2

description "Chassis log file."

filter 2

from security

to file 1 exit

...

----------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 235

Log Management Tasks

Deleting a Log File

The log ID must be shut down first before it can be deleted. In a previous example, file 1 is associated with log-id 2.

ALU-12>config>log# info

---------------------------------------------file-id 1

description "LocationTest."

location cf3:

rollover 600 retention 24

exit

...

log-id 2

description "Chassis log file."

filter 2

from security

to file 1 exit

...

----------------------------------------------

ALU-12>config>log#

Use the following CLI syntax to delete a log file:

CLI Syntax:

config>log no log-id

log-id

shutdown

The following displays an example of deleting a log file:

Example:

c onfig# log config>log# log-id

2

config>log>log-id# shutdown config>log>log-id# exit config>log# no log-id

2

Page 236 7705 SAR OS System Management Guide

Event and Accounting Logs

Modifying a File ID

Note:

When the file-id location parameter is modified, log files are not written to the new location until a rollover occurs or the log is manually cleared. A rollover can be forced by using the

clear>log

command. Subsequent log entries are then written to the new location. If a rollover does not occur or the log is not cleared, the old location remains in effect.

Use the following CLI syntax to modify a file ID :

CLI Syntax:

config>log file-id

log-file-id

description

description-string

location [

cflash-id

] rollover

minutes

[retention

hours

]

The following displays the current file ID configuration:

ALU-12>config>log# info

------------------------------------------

file-id 1

description "This is a log file."

location cf3:

rollover 600 retention 24

exit

----------------------------------------------

ALU-12>config>log#

The following displays an example of modifying file ID parameters:

Example:

config# log config>log# file-id 1 config>log>file-id# description "LocationTest." config>log>file-id# location cf3: config>log>file-id# rollover

2880

retention

500

config>log>file-id# exit

The following displays the file ID modifications:

ALU-12>config>log# info

----------------------------------------------

...

file-id 1

description "

LocationTest

."

location

cf3:

rollover

2880

retention 500

exit

...

----------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 237

Log Management Tasks

Deleting a File ID

Note:

All references to the file ID must be deleted before the file ID can be removed.

Use the following CLI syntax to delete a file ID:

CLI Syntax:

config>log no file-id l

og-file-id

The following displays an example of deleting a file ID:

Example:

config>log# no file-id 1

Deleting a Syslog ID

Use the following CLI syntax to delete a syslog ID:

CLI Syntax:

config>log no syslog

syslog-id

The following displays an example of deleting a syslog ID:

Example:

config# log config>log# no syslog 1

Modifying a Syslog ID

Note:

All references to the syslog ID must be deleted before the syslog ID can be removed.

Use the following CLI syntax to modify syslog ID parameters:

CLI Syntax:

config>log syslog

syslog-id

description

description-string

address

ip-address

log-prefix

log-prefix-string

port

port

level {emergency | alert | critical | error | warning

| notice | info | debug} facility

syslog-facility

Page 238 7705 SAR OS System Management Guide

Event and Accounting Logs

The following displays an example of the syslog ID modifications:

Example:

config# log config>log# syslog 1 config>log>syslog$ description "Test syslog." config>log>syslog# address 10.10.0.91

config>log>syslog# facility mail config>log>syslog# level info

The following displays the syslog configuration:

ALU-12>config>log# info

----------------------------------------------

...

syslog

1

description "Test syslog."

address

10

.10.10.91

facility

m

ail

level info

exit

...

----------------------------------------------

ALU-12>config>log#

Modifying an SNMP Trap Group

Use the following CLI syntax to modify an SNMP trap group:

CLI Syntax:

config>log snmp-trap-group

log-id

trap-target

name

[address

ip-address

] [port

port

]

[snmpv1 | snmpv2c | snmpv3] notify-community

communityName

|

snmpv3SecurityName

[security-level

{no-auth-no-privacy | auth-no-privacy | privacy}]

The following displays the current SNMP trap group configuration:

ALU-12>config>log# info

----------------------------------------------

...

snmp-trap-group 10 trap-target 10.10.10.104:5 "snmpv3" notify-community "communitystring"

exit

...

----------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 239

Log Management Tasks

The following displays an example of the command usage to modify an SNMP trap group:

Example:

c onfig# log config>log# snmp-trap-group 10 config>log>snmp-trap-group# no trap-target 10.10.10.104:5 config>log>snmp-trap-group# snmp-trap-group# trap-target 10.10.0.91:1 snmpv2c notify-community "com1"

The following displays the SNMP trap group configuration:

ALU-12>config>log# info

----------------------------------------------

...

snmp-trap-group 10

trap-target 10.10.0.91:1 "snmpv2c" notify-community "com1”

exit

...

----------------------------------------------

ALU-12>config>log#

Deleting an SNMP Trap Group

Use the following CLI syntax to delete a trap target and SNMP trap group:

CLI Syntax:

config>log no snmp-trap-group

log-id

no trap-target

name

The following displays the SNMP trap group configuration:

ALU-12>config>log# info

----------------------------------------------

...

snmp-trap-group 10

trap-target 10.10.0.91:1 "snmpv2c" notify-community "com1"

exit

...

----------------------------------------------

ALU-12>config>log#

Page 240 7705 SAR OS System Management Guide

Event and Accounting Logs

The following displays an example of deleting a trap target and an SNMP trap group.

Example:

config>log# snmp-trap-group 10 config>log>snmp-trap-group# no trap-target 10.10.0.91:1 config>log>snmp-trap-group# exit config>log# no snmp-trap-group 10

Modifying a Log Filter

Use the following CLI syntax to modify a log filter:

CLI Syntax:

config>log filter

filter-id

default-action {drop | forward} description

description-string

entry

entry-id

action {drop | forward} description

description-string

match application {eq | neq}

application-id

number {eq | neq | lt | lte | gt | gte}

event-id

router {eq | neq}

router-instance

[regexp] severity {eq | neq | lt | lte | gt | gte}

severity-level

subject {eq | neq}

subject

[regexp]

The following output displays the current log filter configuration:

ALU-12>config>log# info

#-----------------------------------------echo "Log Configuration"

#------------------------------------------

...

filter 1

default-action drop

description "This is a sample filter."

entry 1

action forward

match

application eq "atm"

severity eq critical

exit

exit

exit

...

------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 241

Log Management Tasks

The following displays an example of the log filter modifications:

Example:

config# log config>log# filter 1 config>log>filter# description "This allows <n>." config>log>filter# default-action forward config>log>filter# entry 1 config>log>filter>entry$ action drop config>log>filter>entry# match config>log>filter>entry>match# application eq user config>log>filter>entry>match# number eq 2001 config>log>filter>entry>match# no severity config>log>filter>entry>match# exit

The following displays the log filter configuration:

ALU-12>config>log>filter# info

----------------------------------------

...

description "This allows <n>."

entry 1

action drop

match

application eq "user"

number eq 2001

exit

exit

exit

...

----------------------------------------

ALU-12>config>log>filter#

Deleting a Log Filter

Use the following CLI syntax to delete a log filter:

CLI Syntax:

config>log no filter

filter-id

The following output displays the current log filter configuration:

The following displays an example of the command to delete a log filter:

Example:

config>log# no filter 1

Page 242 7705 SAR OS System Management Guide

Event and Accounting Logs

Modifying Event Control Parameters

Use the following CLI syntax to modify event control parameters:

CLI Syntax:

config>log event-control

application-id

[

event-name

|

eventnumber

] generate[

severity-level

] [throttle] event-control a

pplication-id

[

event-name

|

eventnumber

] suppress

The following displays the current event control configuration:

ALU-12>config>log# info

----------------------------------------------

...

event-control "atm" 2014 generate critical

...

----------------------------------------------

ALU-12>config>log#

The following displays an example of event control modifications:

Example:

c onfig# log config>log# event-control atm 2014 suppress

The following displays the log filter configuration:

ALU-12>config>log# info

----------------------------------------------

...

event-control "atm" 2014 suppress

...

----------------------------------------------

ALU-12>config>log#

7705 SAR OS System Management Guide Page 243

Log Management Tasks

Returning to the Default Event Control Configuration

The

no

form of the

event-control

command returns modified values back to the default values.

Use the following CLI syntax to return to the default event control configuration:

CLI Syntax:

config>log no event-control

application

[

event-name

|

eventnumber

]

The following displays an example of the command usage to return to the default values:

Example:

c onfig# log config>log# no event-control "atm" 2014 config>log# no event-control "filter" 2001 config>log# no event-control "mpls" 2001

ALU-12>config>log# info detail

----------------------------------------------

#-----------------------------------------echo "Log Configuration"

#------------------------------------------

...

event-control "atm" 2004 generate minor

event-control "atm" 2005 generate warning

event-control "atm" 2006 generate warning

event-control "atm" 2007 generate critical

event-control "atm" 2008 generate warning

event-control "atm" 2009 generate warning

event-control "atm" 2010 generate warning

event-control "atm" 2011 generate warning

event-control "atm" 2012 generate warning

event-control "atm" 2013 generate warning

event-control "atm" 2014 generate warning

event-control "atm" 2015 generate warning

event-control "atm" 2016 generate warning

event-control "atm" 2017 generate warning

...

----------------------------------------------

ALU-12>config>log#

Page 244 7705 SAR OS System Management Guide

Log Command Reference

Command Hierarchies

•

Configuration Commands

→

Accounting Policy Commands

→

Event Control Commands

→

Log File Commands

→

Log Filter Commands

→

Log Filter Entry Commands

→

Log Filter Entry Match Commands

→

Syslog Commands

→

Logging Destination Commands

→

SNMP Trap Groups

•

Show Commands

•

Clear Commands

Event and Accounting Logs

7705 SAR OS System Management Guide Page 245

Log Command Reference

Configuration Commands

Accounting Policy Commands

config

— log

—

accounting-policy

acct-policy-id

[

interval

minutes

]

— no

accounting-policy

acct-policy-id

—

[

no

]

default

—

description

description-string

— no

description

—

record

record-name

— no

record

—

[

no

]

shutdown

—

to file file

log-file-id

Event Control Commands

config

— log

—

event-control

application-id

[

event-name

|

event-number

]

generate

[

severity-level

]

[

throttle

]

—

event-control

application-id

[

event-name

|

event-number

]

suppress

— no

event-control

application-id

[

event-name

|

event-number

]

—

throttle-rate

events

[

interval

seconds

]

— no

throttle-rate

Log File Commands

config

— log

—

[

no

]

file-id

log-file-id

—

description

description-string

— no

description

—

location

cflash-id

[

backup-cflash-id

]

—

rollover

minutes

[

retention

hours

]

— no

rollover

Log Filter Commands

config

— log

—

[

no

]

filter

filter-id

—

default-action

{

drop

|

forward

}

— no

default-action

—

description

description-string

— no

description

Page 246 7705 SAR OS System Management Guide

Event and Accounting Logs

Log Filter Entry Commands

config

— log

—

[

no

]

filter

filter-id

—

[

no

]

entry

entry-id

—

action

{

drop

|

forward

}

— no

action

—

description

description-string

— no

description

Log Filter Entry Match Commands

config

— log

—

[

no

]

filter

filter-id

—

[

no

]

entry

entry-id

—

[

no

]

match

—

application

{

eq

|

neq

}

application-id

— no

application

—

number

{

eq | neq | lt | lte | gt | gte

}

event-id

— no

number

—

router

{

eq

|

neq

}

router-instance

[

regexp

]

— no

router

—

severity

{

eq | neq | lt | lte | gt | gte

}

severity-level

— no

severity

—

subject

{

eq | neq

}

subject

[

regexp

]

— no

subject

Syslog Commands

config

— log

—

[

no

]

syslog

syslog-id

—

address

ip-address

— no

address

—

description

description-string

— no

description

—

facility

syslog-facility

— no

facility

—

level

syslog-level

— no

level

—

log-prefix

log-prefix-string

— no

log-prefix

—

port

port

— no

port

7705 SAR OS System Management Guide Page 247

Log Command Reference

Logging Destination Commands

config

— log

—

log-id

—

[

no

]

to console

log-id

—

description

description-string

— no

description

—

log-id

filter-id

— no

log-id

—

from

{[

main

] [

security

] [

change

] [

debug-trace

]}

— no

from

—

[

no

]

shutdown

—

time-format

{

local

|

utc

}

—

to console

—

to file

log-file-id

—

to memory

[

size

]

—

to session

—

to snmp

[

size

]

—

to syslog

syslog-id

SNMP Trap Groups

config

— log

—

[

no

]

snmp-trap-group

log-id

—

description

description-string

— no

description

—

trap-target

name

[

address

ip-address

] [

port

port

] [

snmpv1

|

snmpv2c

|

snmpv3

]

notify-community

{

communityName

|

snmpv3SecurityName

}[

security-level

{

noauth-no-privacy

|

auth-no-privacy

|

privacy

}]

— no

trap-target

name

Show Commands

show

— log

—

accounting-policy

[acct-

policy-id

]

access

—

accounting-records

—

applications

—

event-control

[

application-id

] [

event-name

|

event-number

]]

—

file-id

[log-

file-id

]

—

filter-id

[

filter-id

]

—

log-collector

—

log-id

[

log-id

] [

severity

severity-level

] [

application

application

] [

sequence

from-seq

[

toseq

]] [

count

count

] [

subject

subject

] [

ascending

|

descending

]

—

snmp-trap-group

[

log-id

]

—

syslog

[

syslog-id

]

Page 248 7705 SAR OS System Management Guide

Clear Commands

clear

—

log

log-id

Event and Accounting Logs

7705 SAR OS System Management Guide Page 249

Log Command Reference

Command Descriptions

•

Configuration Commands on page 251

•

Show Commands on page 286

•

Clear Commands on page 305

Page 250 7705 SAR OS System Management Guide

Configuration Commands

•

Generic Commands on page 252

•

Accounting Policy Commands on page 254

•

Event Control on page 257

•

Log File Commands on page 260

•

Log Filter Commands on page 264

•

Log Filter Entry Commands on page 265

•

Log Filter Entry Match Commands on page 267

•

Syslog Commands on page 272

•

Logging Destination Commands on page 277

•

SNMP Trap Groups on page 283

Event and Accounting Logs

7705 SAR OS System Management Guide Page 251

Log Command Reference

Generic Commands description

Syntax description

string

no description

Context

config>log>filter

filter-id

config>log>filter

filter-id

>entry

entry-id

config>log>log-id

log-id

config>log>accounting-policy

policy-id

config>log>file-id

file-id

config>log>syslog

syslog-id

config>log>snmp-trap-group

Description

This command creates a text description stored in the configuration file for a configuration context.

The command associates a text string with a configuration context to help identify the content in the configuration file.

The

no

form of the command removes the string from the configuration.

Default

No text description is associated with this configuration.

Parameters

string —

The description can contain a string of up to 80 characters composed of printable, 7-bit

ASCII characters. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.

shutdown

Syntax

[

no

]

shutdown

Context

config>log>log-id

log-id

config>log>accounting-policy

policy-id

Description

This command administratively disables an entity. When disabled, an entity does not change, reset, or remove any configuration settings or statistics.

The operational state of the entity is disabled as well as the operational state of any entities contained within. Many objects must be shut down before they can be deleted.

The

no

form of this command administratively enables an entity.

Default no shutdown

Page 252 7705 SAR OS System Management Guide

Event and Accounting Logs

Special Cases

log-id —

When a

log-id

is shut down, no events are collected for the entity. This leads to the loss of event data.

policy-id —

When an accounting policy is shut down, no accounting data is written to the destination log ID. Counters in the billing data reflect totals, not increments, so when the policy is re-enabled

(

no shutdown

) the counters include the data collected during the period the policy was shut down.

7705 SAR OS System Management Guide Page 253

Log Command Reference

Accounting Policy Commands accounting-policy

Syntax accounting-policy

policy-id

[

interval

minutes

]

no accounting-policy

policy-id

Context

config>log

Description

This command creates an access accounting policy.

An accounting policy defines the accounting records that are created.

Access accounting policies are policies that can be applied to one or more service access points

(SAPs). Changes made to an existing policy, using any of the sub-commands, are applied immediately to all SAPs where this policy is applied.

If an accounting policy is not specified on a SAP, then accounting records are produced in accordance with the access policy designated as the default. For more information, see the

default

command.

The

no

form of the command deletes the policy from the configuration. The accounting policy cannot be removed unless it is removed from all the SAPs or channels where the policy is applied.

Default

No default accounting policy is defined.

Parameters

policy-id —

the policy ID that uniquely identifies the accounting policy, expressed as a decimal integer

Values

1 to 99

interval

minutes —

the interval, in minutes, in which statistics are collected and written to their destination

The default interval for each record type is defined in the

record

record-name

description.

Default

As defined in the record name description.

Values

5 to 120

Page 254 7705 SAR OS System Management Guide

Event and Accounting Logs

default

Syntax

[

no

]

default

Context

config>log>accounting-policy

policy-id

This command adds the designation that the accounting policy ID is the default access accounting policy to be used with all SAPs without a specified accounting policy.

If no access accounting policy is defined on a SAP, accounting records are produced in accordance with the default access policy. If no default access policy is created, no accounting records will be collected other than the records for the accounting policies that are explicitly configured.

Only one access accounting policy ID can be designated as the default access policy.

The record name must be specified prior to assigning an accounting policy as default.

If a policy is configured as the default policy, then a

no default

command must be issued before a new default policy can be configured.

The

no

form of the command removes the default policy designation from the policy ID. The accounting policy will be removed from all SAPs that do not have this policy explicitly defined.

record

Syntax

[

no

]

record

record-name

Context

config>log>accounting-policy

policy-id

Description

This command adds the accounting record type to the accounting policy to be forwarded to the configured accounting file. Each accounting policy can only contain one record name. To obtain a list of all record types that can be configured, use the

show log accounting-records

command.

ALU-12>config>log# show log accounting-records

==========================================================

Accounting Policy Records

==========================================================

Record # Record Name Def. Interval

----------------------------------------------------------

1 service-ingress-octets 5

2 service-egress-octets 5

3 service-ingress-packets 5

4 service-egress-packets 5

==========================================================

ALU-12>config>log#

To configure an accounting policy for access ports, select a service record (for example, serviceingress-octets). To change the record name to another service record, re-enter the

record

command with the new record name and it will replace the old record name.

7705 SAR OS System Management Guide Page 255

Log Command Reference

Only one record may be configured in a single accounting policy.

Note:

Collecting excessive statistics can adversely affect the CPU utilization and take up large amounts of storage space.

The

no

form of the command removes the record type from the policy.

Default

No accounting record is defined.

Parameters

record-name —

the accounting record name

Table 32

lists the accounting record names available and the default collection interval.

Table 32: Accounting Record Names

Record Type Accounting Record Name

3

4

1

2 service-ingress-octets service-egress-octets service-ingress-packets service-egress-packets

Default Interval

5 minutes

5 minutes

5 minutes

5 minutes

to file

Syntax to file

file-id

Context

config>log>accounting-policy

policy-id

This command specifies the destination for the accounting records selected for the accounting policy.

Default

No destination is specified.

Parameters

file-id —

the

file-id

option specifies the destination for the accounting records asociated with this accounting policy. The characteristics of the file-id, such as rollover and retention intervals, must have already been defined in the

config

>

log

>

file-id

context. A file-id can only be used once.

The file is generated when the file ID is referenced. This command identifies the type of accounting file to be created. If the

to

command is executed while the accounting policy is in operation, then it becomes active during the next collection interval.

Values

1 to 99

Page 256 7705 SAR OS System Management Guide

Event and Accounting Logs

Event Control event-control

Syntax event-control

application-id

[

event-name

|

event-number

]

generate

[

severity-level

]

[

throttle

]

event-control

application-id

[

event-name

|

event-number

]

suppress no event-control

application-id

[

event-name

|

event-number

]

Context

config>log

Description

This command is used to specify that a particular event, or all events associated with an application, are either generated or suppressed.

Events are generated by an application and contain an event number and description explaining the cause of the event. Each event has a default designation that directs it to be generated or suppressed.

Events are generated with a default severity level that can be modified by using the

severity-level

option.

For example, to change event reporting for an external alarm output on the chassis:

• specify the application: config>log>event-control>

chassis

• specify the event name or number (to display a list of events, use the

show>log>eventcontrol

command):config>log>event-control>chassis>

extAlarmInput1Detected

• specify whether the event is generated or suppressed: config>log>eventcontrol>chassis>extAlarmInput1Detected>

generate

• change the severity level (for this event, the default is critical): config>log>eventcontrol>chassis>extAlarmInput1Detected>generate>

major

Events that are suppressed by default are typically used for debugging purposes. Events are suppressed at the time the application requests the event’s generation. No event log entry is generated regardless of the destination. While this feature can save processor resources, there may be a negative effect on the ability to troubleshoot problems if the logging entries are not generated. In reverse, the generation of too many events may cause excessive overhead.

The rate is set with the

throttle-rate

command. The

throttle

parameter enables event throttling for these events.

The

no

form of the command reverts the parameters to the default setting for events for the application or a specific event within the application. The severity, generate, and suppress options will also be reset to the initial values.

Default

Each event has a default suppress or generate state. To display a list of all events and the current configuration use the event control command.

7705 SAR OS System Management Guide Page 257

Log Command Reference

Parameters

application-id —

the application whose events are affected by this event control filter

Default

None, this parameter must be explicitly specified.

Values

A valid application name. To display a list of valid application names, use the

applications

command. Valid applications are: atm, chassis, debug, dot1ag, efm_oam, filter, ip, isis, ldp, logger, mpls, ntp, oam, ospf, port, ppp, ptp, qos, route_policy, rsvp, security, snmp, stp, svcmgr, system, user, vrtr

event-name | event-number —

to generate, suppress, or revert to default for a single event, enter the specific number or event short name. If no event number or name is specified, the command applies to all events in the application. To display a list of all event short names use the

show>log>event-control

command.

Default

Values

none

A valid event name or event number.

generate

—

specifies that logger event is created when this event occurs. The generate keyword can be used with two optional parameters,

severity-level

and

throttle

.

Default

generate

severity-level —

An ASCII string representing the severity level to associate with the specified generated events

Default

Values

The system assigned severity level

One of: cleared, indeterminate, critical, major, minor, warning

throttle —

specifies whether events of this type will be throttled.

By default, event throttling is off for each specific event type. It must be explicitly enabled for each event type where throttling is desired. This makes backwards compatability easier to manage.

suppress —

indicates that the specified events will not be logged. If the

suppress

keyword is not specified, then the events are generated by default.

Default

generate

Page 258 7705 SAR OS System Management Guide

Event and Accounting Logs

throttle-rate

Syntax throttle-rate

events

[

interval

seconds

]

no throttle-rate

Context

config>log

Description

This command configures an event throttling rate.

Parameters

events —

specifies the number of log events that can be logged within the specified interval for a specific event. Once the limit has been reached, any additional events of that type will be dropped, and the event drop count will be incremented. At the end of the throttle interval, if any events have been dropped, a trap notification will be sent.

Values

10 to 20000

Default

500

interval

seconds —

specifies the number of seconds that an event throttling interval lasts

Values

1 to 60

Default

1

7705 SAR OS System Management Guide Page 259

Log Command Reference

Log File Commands file-id

Syntax

[

no

]

file-id

file-id

Context

config>log

Description

This command creates the context to configure a file ID template to be used as a destination for an event log or billing file.

This command defines the file location and characteristics that are to be used as the destination for a log event message stream or accounting and billing information. The file defined in this context is subsequently specified in the

to

command under

log-id

or

accounting-policy

to direct specific logging or billing source streams to the file destination.

A file ID can only be assigned to either one

log-id

or one

accounting-policy

. It cannot be reused for multiple instances. A file ID and associated file definition must exist for each log and billing file that must be stored in the file system.

A file is created when the file ID defined by this command is selected as the destination type for a specific log or accounting record. Log files are collected in a “log” directory. Accounting files are collected in an “act” directory.

The file names for a log are created by the system as summarized in the table below:

File Type

Log File

Accounting File

File Name

log act

llff aaff

-

-

timestamp timestamp

where:

•

ll

is the

log-id

•

aa

is the accounting

policy-id

•

ff

is the file-id

• the

timestamp

is the actual timestamp when the file is created. The format for the timestamp is

yyyymmdd

-

hhmmss

where:

-

yyyy

is the year (for example, 2007)

-

mm

is the month number (for example, 12 for December)

-

dd

is the day of the month (for example, 03 for the 3rd of the month)

-

hh

is the hour of the day in 24-hour format (for example, 04 for 4 a.m.)

-

mm

is the minutes (for example, 30 for 30 minutes past the hour)

-

ss

is the number of seconds (for example, 14 for 14 seconds)

Page 260 7705 SAR OS System Management Guide

Event and Accounting Logs

• the accounting file is compressed and has a gz extension

When initialized, each file will contain:

• the

log-id

description

• the time the file was opened

• the reason the file was created

• the sequence number of the last event stored on the log (if the event log file was closed properly)

If the process of writing to a log file fails (for example, the compact flash card is full) and if a backup location is not specified or fails, the log file will not become operational even if the compact flash card is replaced. Enter a

clear log

command or a

shutdown/no shutdown

command to reinitialize the file.

If the primary location fails (for example, the compact flash card fills up during the write process), a trap is sent and logging continues to the specified backup location. This can result in truncated files in different locations.

The

no

form of the command removes the

file-id

from the configuration. A

file-id

can only be removed from the configuration if the file is not the designated output for a log destination. The actual file remains on the file system.

Default

No default file IDs are defined.

Parameters

file-id —

the file identification number for the file, expressed as a decimal integer

Values

1 to 99

location

Syntax location

cflash-id

no location

Context

config>log>file

file-id

Description

This command specifies the primary location where the log or billing file will be created.

The

location

command is optional. If the location command is not explicitly configured, log and accounting files will be created on cf3: without overflow onto other devices.

When multiple location commands are entered in a single file ID context, the last command overwrites the previous command.

When the location of a file ID that is associated with an active log ID is changed, the log events are not immediately written to the new location. The new location does not take affect until the log is rolled over, either because the rollover period has expired or a

clear log log-id

command is entered to manually roll over the log file.

7705 SAR OS System Management Guide Page 261

Log Command Reference

When creating files, the primary location is used as long as there is available space. If no space is available, an attempt is made to delete unnecessary files that are past their retention date.

If sufficient space is not available, an attempt is made to remove the oldest to newest closed log or accounting files. After each file is deleted, the system attempts to create the new file.

A medium severity trap is issued to indicate that the compact flash is either not available or that no space is available on the specified flash and that the backup location is being used.

A high-priority alarm condition is raised if the compact flash device for this file ID is not present or if there is insufficient space available. If space does becomes available, then the alarm condition will be cleared.

Use the

no

form of this command to revert to default settings.

Default

Log and accounting files are created on cf3:

Parameters

cflash-id —

specifies the primary location

Values

cflash-id: cf3: | cf3-A: | cf3-B:

rollover

Syntax rollover

minutes

[

retention

hours

]

no rollover

Context

config>log>file

file-id

Description

This command configures how often an event or accounting log is rolled over or partitioned into a new file.

An event or accounting log is actually composed of multiple individual files. The system creates a new file for the log based on the

rollover

time, expressed in minutes.

The

retention

option, expressed in hours, allows you to modify the default time to keep the file in the system. The retention time is based on the rollover time of the file. The retention time is used as a factor to determine which files should be deleted first as the file space becomes full.

When multiple

rollover

commands for a

file-id

are entered, the last command overwrites the previous command.

Default rollover 720 retention 12

Parameters rollover

minutes —

the rollover time, in minutes

Values

60 to 2880

Page 262 7705 SAR OS System Management Guide

Event and Accounting Logs

retention

hours —

the retention period in hours, expressed as a decimal integer. The retention time is based on the creation time of the file. The file becomes a candidate for removal once the creation datestamp + rollover time + retention time is less than the current timestamp.

Default

12

Values

1 to 500

7705 SAR OS System Management Guide Page 263

Log Command Reference

Log Filter Commands filter

Syntax

[

no

]

filter

filter-id

Context

config>log

Description

This command creates a context for an event filter. An event filter specifies whether to forward or drop an event or trap based on the match criteria.

Filters are configured in the

filter

filter-id

context and then applied to a log in the

log-id

log-id

context. Only events for the configured log source streams destined for the log ID where the filter is applied are filtered.

Any changes made to an existing filter, using any of the sub-commands, are immediately applied to the destinations where the filter is applied.

The

no

form of the command removes the filter association from log IDs, which causes those logs to forward all events.

Default

No event filters are defined.

Parameters

filter-id — uniquely identifies the filter

Values

1 to 1000

default-action

Syntax default-action

{

drop

|

forward

}

no default-action

Context

config>log>filter

filter-id

Description

The default action specifies the action that is applied to events when no action is specified in the event filter entries or when an event does not match the specified criteria.

When multiple

default-action

commands are entered, the last command overwrites the previous command.

The

no

form of the command reverts the default action to the default value.

Default default-action forward

Parameters drop —

the events that are not explicitly forwarded by an event filter match are dropped

forward —

the events that are not explicitly dropped by an event filter match are forwarded

Page 264 7705 SAR OS System Management Guide

Event and Accounting Logs

Log Filter Entry Commands action

Syntax action

{

drop

|

forward

}

no action

Context

config>log>filter

filter-id

>entry

entry-id

Description

This command specifies a drop or forward action associated with the filter entry.

If neither

drop

nor

forward

is specified, the

default-action

will be used for traffic that conforms to the match criteria. This could be considered a No-Op filter entry used to explicitly exit a set of filter entries without modifying previous actions.

When multiple

action

commands are entered, the last command will overwrite the previous command.

The

no

form of the command removes the specified action

statement.

Default no action

Parameters drop —

specifies that packets matching the entry criteria will be dropped

forward —

specifies that packets matching the entry criteria will be forwarded

entry

Syntax

[

no

]

entry

entry-id

Context

config>log>filter

filter-id

Description

This command is used to create or edit an event filter entry. Multiple entries may be created using unique

entry-id

numbers. The TiMOS implementation exits the filter on the first match found and executes the action in accordance with the action command.

Comparisons are performed in an ascending entry ID order. When entries are created, they should be arranged sequentially from the most explicit entry to the least explicit. Matching ceases when a packet matches an entry. The entry action is performed on the packet, either drop or forward. To be considered a match, the packet must meet all the conditions defined in the entry.

An entry may have no match criteria defined (in which case, everything matches) but must have at least the

action

keyword for it to be considered complete. Entries without the

action

keyword will be considered incomplete and are rendered inactive.

The

no

form of the command removes the specified entry from the event filter. Entries removed from the event filter are immediately removed from all log IDs where the filter is applied.

7705 SAR OS System Management Guide Page 265

Log Command Reference

Default

No event filter entries are defined. An entry must be explicitly configured.

Parameters

entry-id —

uniquely identifies a set of match criteria corresponding action within a filter. Entry ID values should be configured in staggered increments so you can insert a new entry in an existing policy without renumbering the existing entries.

Values

1 to 999

Page 266 7705 SAR OS System Management Guide

Event and Accounting Logs

Log Filter Entry Match Commands match

Syntax

[

no

]

match

Context

config>log>filter

filter-id

>entry

entry-id

Description

This command creates the context to enter or edit match criteria for a filter entry. When the match criteria is satisfied, the action associated with the entry is executed.

If more than one match parameter (within one match statement) is specified, then all the criteria must be satisfied and functional before the action associated with the match is executed.

Use the

applications

command to display a list of the valid applications.

Match context can consist of multiple match parameters (application, event-number, severity, subject), but multiple

match

statements cannot be entered per entry.

The

no

form of the command removes the match criteria for the

entry-id

.

Default

No match context is defined.

application

Syntax application

{

eq | neq

}

application-id

no application

Context

config>log>filter

filter-id

>entry

entry-id

>match

Description

This command adds a TiMOS application as an event filter match criterion.

A TiMOS application is the software entity that reports the event. Examples of applications include:

IP, MPLS, CLI, and SERVICES. Only one application can be specified per entry.

When multiple

application

commands are entered, the last command will overwrite the previous command.

The

no

form of the command removes the application as a match criterion.

Default no application

7705 SAR OS System Management Guide Page 267

Log Command Reference

Parameters eq

|

neq —

the operator specifying the type of match. Valid operators are listed in the table below.

Operator

eq neq

Notes

Equal to

Not equal to

application-id —

the application name string

Values

atm, chassis, debug, dot1ag, efm_oam, filter, ip, isis, ldp, logger, mpls, ntp, oam, ospf, port, ppp, ptp, qos, route_policy, rsvp, security, snmp, stp, svcmgr, system, user, vrtr

number

Syntax number

{

eq | neq | lt | lte | gt | gte

}

event-id

no number

Context

config>log>filter

filter-id

>entry

entry-id

>match

Description

This command adds a TiMOS application event number as a match criterion.

TiMOS event numbers uniquely identify a specific logging event within an application.

Only one

number

command can be entered per event filter entry. If multiple

number

commands are entered, the last command overwrites the previous command.

The

no

form of the command removes the event number as a match criterion.

Default no event-number

Parameters eq | neq | lt | lte | gt | gte —

this operator specifies the type of match. Valid operators are listed in the table below.

Operator

eq neq lt lte gt gte

Notes

Equal to

Not equal to

Less than

Less than or equal to

Greater than

Greater than or equal to

Page 268 7705 SAR OS System Management Guide

Event and Accounting Logs

event-id —

the event ID, expressed as a decimal integer

Values

1 to 4294967295

router

Syntax router

{

eq

|

neq

}

router-instance

[

regexp

]

no router

Context

config>log>filter>entry>match

Description

This command specifies the log event matches for the router.

Parameters eq —

determines if the matching criteria should be equal to the specified value

neq —

determines if the matching criteria should not be equal to the specified value

router-instance —

specifies a router name up to 32 characters to be used in the match criteria

regexp —

specifies the type of string comparison to use to determine if the log event matches the value of

router

command parameters. When the

regexp

keyword is specified, the string in the

router

command is a regular expression string that will be matched against the subject string in the log event being filtered.

When

regexp

keyword is not specified, the subject command string is matched exactly by the event filter.

severity

Syntax severity

{

eq | neq | lt | lte | gt | gte

}

severity-level

no severity

Context

config>log>filter>entry>match

Description

This command adds an event severity level as a match criterion.

Only one severity command can be entered per event filter entry. When multiple

severity

commands are entered, the last command overwrites the previous command.

The

no

form of the command removes the severity match criterion.

Default no severity

7705 SAR OS System Management Guide Page 269

Log Command Reference

Parameters eq | neq | lt | lte | gt | gte —

this operator specifies the type of match. Valid operators are listed in the table below.

Operator

eq neq lt lte gt gte

Notes

Equal to

Not equal to

Less than

Less than or equal to

Greater than

Greater than or equal to

severity-level —

the ITU severity level number. The following table lists severity levels and corresponding numbers per ITU standards M.3100 X.733 & X.21 severity levels.

Severity Number

3

4

1

2

5

6

Severity Level

cleared indeterminate (info) critical major minor warning

subject

Syntax subject

{

eq | neq

}

subject

[

regexp

]

no subject

Context

config>log>filter

filter-id

>entry

entry-id

>match

Description

This command adds an event subject as a match criterion.

The subject is the entity for which the event is reported, such as a port. In this case, the port-id string would be the subject.

Only one

subject

command can be entered per event filter entry. When multiple

subject

commands are entered, the last command overwrites the previous command.

The

no

form of the command removes the subject match criterion.

Page 270 7705 SAR OS System Management Guide

Event and Accounting Logs

Default no subject

Parameters eq

|

neq —

this operator specifies the type of match. Valid operators are listed in the following table:

Operator

eq neq

Notes

Equal to

Not equal to

subject —

a string used as the subject match criterion.

regexp —

specifies the type of string comparison to use to determine if the log event matches the value of subject command parameters. When the

regexp

keyword is specified, the string in the subject command is a regular expression string that will be matched against the subject string in the log event being filtered.

When

regexp

keyword is not specified, the subject command string is matched exactly by the event filter.

7705 SAR OS System Management Guide Page 271

Log Command Reference

Syslog Commands syslog

Syntax

[

no

]

syslog

syslog-id

Context

config>log

Description

This command creates the context to configure a syslog target host that is capable of receiving selected syslog messages from the 7705 SAR.

A valid

syslog-id

must have the target syslog host address configured.

A maximum of 10 syslog IDs can be configured.

No log events are sent to a syslog target address until the syslog-id has been configured as the log destination (

to

) in the log-id node.

Default

No syslog IDs are defined.

Parameters

syslog-id —

the syslog ID number for the syslog destination, expressed as a decimal integer

Values

1 to 10

address

Syntax address

ip-address

no address

Context

config>log>syslog

syslog-id

Description

This command associates the syslog target host IP address with the syslog ID.

This parameter is mandatory. If no

address

is configured, syslog data cannot be forwarded to the syslog target host.

Only one address can be associated with a

syslog-id

. If multiple addresses are entered, the last address entered overwrites the previous address.

The same syslog target host can be used by multiple log IDs.

The

no

form of the command removes the syslog target host IP address.

Default no address

Parameters

ip-address —

the IP address of the syslog target host in dotted decimal notation

Values

1.0.0.0 to 223.255.255.255

Page 272 7705 SAR OS System Management Guide

Event and Accounting Logs

facility

Syntax facility

syslog-facility

no facility

Context

config>log>syslog

syslog-id

Description

This command configures the facility code for messages sent to the syslog target host.

Multiple syslog IDs can be created with the same target host but each syslog ID can only have one facility code. If multiple facility codes are entered, the last facility code entered overwrites the previous facility code.

If multiple facilities need to be generated for a single syslog target host, then multiple

log-id

entries must be created, each with its own filter criteria to select the events to be sent to the syslog target host with a given facility code.

The

no

form of the command reverts to the default value.

Default local7

Parameters

syslog-facility —

the syslog facility name represents a specific numeric facility code. The code should be entered in accordance with the syslog RFC. However, the software will not confirm whether the facility code is valid or invalid for the event type being sent to the syslog target host.

Values

kernel | user | mail | systemd | auth | syslogd | printer | netnews | uucp | cron | authpriv | ftp | ntp | logaudit | logalert | cron2 | local0 | local1 | local2 | local3 | local4

| local5 | local6 | local7

Valid codes per RFC 3164,

The BSD syslog Protocol,

are listed in the

Table 33

.

Table 33: Valid Facility Codes

Numerical Code

6

7

4

5

8

9

2

3

0

1

Facility Code

kernel user mail systemd auth syslogd printer net-news uucp cron

7705 SAR OS System Management Guide Page 273

Log Command Reference

Values

0 to 23

Table 33: Valid Facility Codes (Continued)

Numerical Code

18

19

20

21

22

23

14

15

16

17

10

11

12

13

Facility Code

local2 local3 local4 local5 local6 local7 auth-priv ftp ntp log-audit log-alert cron2 local0 local1

level

Syntax level

syslog-level

no level

Context

config>log>syslog

syslog-id

Description

This command configures the syslog message severity level threshold. All messages with severity level equal to or higher than the threshold are sent to the syslog target host.

Only a single threshold level can be specified. If multiple

level

commands are entered, the last command will overwrite the previous command.

The

no

form of the command reverts to the default value.

Page 274 7705 SAR OS System Management Guide

Event and Accounting Logs

Parameters

syslog-level —

the threshold severity level name. Values are described in

Table 34

.

Values

emergency, alert, critical, error, warning, notice, info, debug

7705 SAR

Severity Level

3 critical

4 major

5 minor

6 warning

1 cleared

2 indeterminate

Table 34: Threshold Severity Level Values

Syslog Severity

Level

(highest to lowest)

0

1

2

3

4

5

6

7

Configured

Severity

emergency alert critical error warning notice info debug

Definition

System is unusable

Action must be taken immediately

Critical condition

Error condition

Warning condition

Normal but significant condition

Informational messages

Debug-level messages

Values

0 to 7

log-prefix

Syntax log-prefix

log-prefix-string

no log-prefix

Context

config>log>syslog

syslog-id

Description

This command adds the string prepended to every syslog message sent to the syslog host.

RFC 3164,

The BSD syslog Protocol,

allows an alphanumeric string (tag) to be prepended to the content of every log message sent to the syslog host. This alphanumeric string can, for example, be used to identify the node that generates the log entry. The software appends a colon (:) and a space to the string and it is inserted in the syslog message after the date stamp and before the syslog message content.

Only one string can be entered. If multiple strings are entered, the last string overwrites the previous string. The alphanumeric string can contain lowercase (a-z), uppercase (A-Z) and numeric (0-9) characters.

The

no

form of the command removes the log prefix string.

Default no log-prefix

7705 SAR OS System Management Guide Page 275

Log Command Reference

Parameters

log-prefix-string —

an alphanumeric string of up to 32 characters. Special charcters (#, $, spaces, etc.) cannot be used in the string.

port

Syntax port

value

no port

Context

config>log>syslog

syslog-id

Description

This command configures the UDP port that will be used to send syslog messages to the syslog target host.

The port configuration is needed if the syslog target host uses a port other than the standard UDP syslog port 514.

Only one port can be configured. If multiple

port

commands are entered, the last entered port overwrites the previously entered ports.

The

no

form of the command reverts to default value.

Default no port

Parameters

value —

the configured UDP port number used when sending syslog messages

Values

1 to 65535

Page 276 7705 SAR OS System Management Guide

Event and Accounting Logs

Logging Destination Commands log-id

Syntax

[

no

]

log-id

log-id

Context

config>log

Description

This command creates a context to configure destinations for event streams.

The

log-id

context is used to direct events, alarms/traps, and debug information to respective destinations.

A maximum of 10 logs can be configured.

Before an event can be associated with this

log-id

, the

from

command identifying the source of the event must be configured.

Only one destination can be specified for a

log-id

. The destination of an event stream can be an inmemory buffer, console, session, snmp-trap-group, syslog, or file.

Use the

event-control

command to suppress the generation of events, alarms, and traps for all log destinations.

An event filter policy can be applied in the

log-id

context to limit which events, alarms, and traps are sent to the specified

log-id

.

Log-IDs 99 and 100 are created by the agent. Log-ID 99 captures all log messages. Log-ID 100 captures log messages with a severity level of major and above.

The

no

form of the command deletes the log destination ID from the configuration.

Default

No log destinations are defined.

Parameters

log-id —

the log ID number, expressed as a decimal integer

Values

1 to 100

filter

Syntax filter

filter-id

no filter

Context

config>log>log-id

log-id

Description

This command associates an event filter policy with the log destination.

The

filter

command is optional. If no event filter is configured, all events, alarms and traps generated by the source stream will be forwarded to the destination.

7705 SAR OS System Management Guide Page 277

Log Command Reference

An event filter policy defines (limits) the events that are forwarded to the destination configured in the

log-id

. The event filter policy can also be used to select the alarms and traps to be forwarded to a destination

snmp-trap-group

.

The application of filters for debug messages is limited to application and subject only.

Accounting records cannot be filtered using the

filter

command.

Only one

filter-id

can be configured per log destination.

The

no

form of the command removes the specified event filter from the

log-id

.

Default no filter

Parameters

filter-id —

the event filter policy ID is used to associate the filter with the

log-id

configuration. The event filter policy ID must already be defined in

config>log>filter

filter-id

.

Values

1 to 1000

from

Syntax from

{[

main

] [

security

] [

change

] [

debug-trace

]}

no from

Context

config>log>log-id

log-id

Description

This command selects the source stream to be sent to a log destination.

One or more source streams must be specified. The source of the data stream must be identified using the

from

command before you can configure the destination using the

to

command. The

from

command can identify multiple source streams in a single statement (for example:

from main change debug-trace

).

Only one

from

command may be entered for a single

log-id

. If multiple

from

commands are entered, then the last command entered overwrites the previous command.

The

no

form of the command removes all previously configured source streams.

Default no from

Parameters main —

instructs all events in the main event stream to be sent to the destination defined in the

to

command for this destination

log-id

. The main event stream contains the events that are not explicitly directed to any other event stream. To limit the events forwarded to the destination, configure filters using the

filter

(log destination) command.

Page 278 7705 SAR OS System Management Guide

Event and Accounting Logs

security —

instructs all events in the security event stream to be sent to the destination defined in the

to

command for this destination

log-id

. The security stream contains all events that affect attempts to breach system security such as failed login attempts, attempts to access MIB tables to which the user is not granted access, or attempts to enter a branch of the CLI to which access has not been granted. To limit the events forwarded to the destination, configure filters using the

filter

(log destination) command.

change —

instructs all events in the user activity stream to be sent to the destination configured in the

to

command for this destination

log-id

. The change event stream contains all events that directly affect the configuration or operation of this node. To limit the events forwarded to the change stream destination, configure filters using the

filter

(log destination) command.

debug-trace —

instructs all debug-trace messages in the debug stream to be sent to the destination configured in the

to

command for this destination

log-id

. Filters applied to debug messages are limited to application and subject.

to console

Syntax to console

Context

config>log>log-id

log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the events selected for the log ID to be directed to the console. If the console is not connected, then all entries are dropped.

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered. If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

to file

Syntax to file

log-file-id

Context

config>log>log-id

log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the events selected for the log ID to be directed to a specified file.

7705 SAR OS System Management Guide Page 279

Log Command Reference

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered. If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

Parameters

log-file-id —

instructs the events selected for the log ID to be directed to the

log-file-id

. The characteristics of the

log-file-id

referenced here must have already been defined in the

config>log>file

log-file-id

context.

Values

1 to 99

to memory

Syntax to memory

[

size

]

Context

config>log>log-id

log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the events selected for the log ID to be directed to a memory log. A memory file is a circular buffer. Once the file is full, each new entry replaces the oldest entry in the log.

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered.If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

Parameters

size —

indicates the number of events that can be stored in the memory

Default

100

Values

50 to 1024

Page 280 7705 SAR OS System Management Guide

Event and Accounting Logs

to session

Syntax to session

Context

config>log>log-id

log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the events selected for the log ID to be directed to the current console or telnet session. This command is only valid for the duration of the session. When the session is terminated, the log ID is removed. A log ID with a

session

destination is not saved in the configuration file.

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered. If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

to snmp

Syntax to snmp

[

size

]

Context

config>log>log-id

log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the alarms and traps to be directed to the

snmp-trap-group

associated with

log-id

.

A local circular memory log is always maintained for SNMP notifications sent to the specified snmptrap-group for the

log-id

.

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered. If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

7705 SAR OS System Management Guide Page 281

Log Command Reference

Parameters

size —

defines the number of events stored in this memory log

Default

100

Values

50 to 1024

to syslog

Syntax to syslog

syslog-id

Context

config>log>log-id

Description

This is one of the commands used to specify the log ID destination. This parameter is mandatory when configuring a log destination.

This command instructs the alarms and traps to be directed to a specified syslog. To remain consistent with the standards governing syslog, messages to syslog are truncated to 1 kbytes.

The source of the data stream must be specified in the

from

command prior to configuring the destination with the

to

command.

The

to

command cannot be modified or re-entered. If the log destination needs to be changed or if the maximum size of an SNMP log or memory log needs to be modified, the log ID must be removed then recreated.

Default

No destination is specified.

Parameters

syslog-id —

instructs the events selected for the log ID to be directed to the

syslog-id

. The characteristics of the

syslog-id

referenced here must have been defined in the

config>log>syslog

syslog-id

context.

Values

1 to 10

time-format

Syntax time-format {local | utc}

Context

config>log>log-id

Description

This command specifies whether the time should be displayed in local or Coordinated Universal Time

(UTC) format.

Default utc

Parameters local —

specifies that timestamps are written in the system’s local time

utc —

specifies that timestamps are written using the UTC value. This was formerly called

Greenwich Mean Time (GMT) and Zulu time.

Page 282 7705 SAR OS System Management Guide

Event and Accounting Logs

SNMP Trap Groups snmp-trap-group

Syntax

[

no

]

snmp-trap-group

log-id

Context

config>log

Description

This command creates the context to configure a group of SNMP trap receivers and their operational parameters for a given

log-id

.

A trap group specifies the types of SNMP traps and specifies the log ID that will receive the group of

SNMP traps. A trap group must be configured in order for SNMP traps to be sent.

To suppress the generation of all alarms and traps, see the

event-control

command. To suppress

alarms and traps that are sent to this

log-id

, see the

filter

(log destination) command. Once alarms and

traps are generated, they can be directed to one or more SNMP trap groups. Logger events that can be forwarded as SNMP traps are always defined on the main event source.

The

no

form of the command deletes the SNMP trap group.

Default

There are no default SNMP trap groups.

Parameters

log-id —

the log ID value of a log configured in the to snmp

context. Alarms and traps cannot be sent

to the trap receivers until a valid

log-id

exists.

Values

1 to 99

trap-target

Syntax trap-target

name

[

address

ip-address

] [

port

port

] [

snmpv1

|

snmpv2c

|

snmpv3

]

notifycommunity

{

communityName

|

snmpv3SecurityName

} [

security-level

{

no-auth-noprivacy

|

auth-no-privacy

|

privacy

}]

no trap-target

name

Context

config>log>snmp-trap-group

log-id

Description

This command adds or modifies a trap receiver and configures the operational parameters for the trap receiver.

Before an SNMP trap can be issued to a trap receiver, the

to console

,

snmp-trap-group

, and at least

one trap-target must be configured.

7705 SAR OS System Management Guide Page 283

Log Command Reference

The trap-target command is used to add or remove a trap receiver from an

operational parameters specified in the command include:

snmp-trap-group

. The

• the IP address of the trap receiver

• the UDP port used to send the SNMP trap

• SNMP version

• SNMP community name for SNMPv1 and SNMPv2c receivers

• security name and level for SNMPv3 trap receivers

A single

snmp-trap-group

log-id

can have multiple trap receivers. Each trap receiver can have different operational parameters.

An address can be configured as a trap receiver more than once as long as a different port is used for each instance.

To prevent resource limitations, only configure a maximum of 10 trap receivers.

Note:

If the same

trap-target

name

port

port

parameter value is specified in more than one SNMP trap group, each trap destination should be configured with a different

notify-community

value. This allows a trap receiving an application, such as NMS, to reconcile a separate event sequence number stream for each 7705 SAR event log when multiple event logs are directed to the same IP address and port destination.

The

no

form of the command removes the SNMP trap receiver from the SNMP trap group.

Default

No SNMP trap targets are defined.

Parameters

name —

specifies the name of the trap target, up to 28 characters in length

address

ip-address

—

the IP address of the trap receiver in dotted decimal notation. Only one IP address destination can be specified per trap destination group.

Values

1.0.0.0 to 223.255.255.255

port

port —

the destination UDP port used for sending traps to the destination, expressed as a decimal integer. Only one port can be specified per

trap-target

statement. If multiple traps need to be issued to the same address, multiple ports must be configured.

Default

162

Values

1 to 65535

snmpv1 | snmpv2c | snmpv3 —

specifies the SNMP version format to use for traps sent to the trap receiver

The keyword

snmpv1

selects the SNMP version 1 format. When specifying

snmpv1

, the

notifycommunity

parameter must be configured for the proper SNMP community string that the trap receiver expects to be present in alarms and traps messages. If the SNMP version is changed from

snmpv3

to

snmpv1,

then the

notify-community

parameter must be changed to reflect the community string rather than the snmpv3

securityName

that is used by

snmpv3

.

Page 284 7705 SAR OS System Management Guide

Event and Accounting Logs

The keyword

snmpv2c

selects the SNMP version 2c format. When specifying

snmpv2c

, the

notify-community

parameter must be configured for the proper SNMP community string that the trap receiver expects to be present in alarms and traps messages. If the SNMP version is changed from

snmpv3

to

snmpv2c,

then the

notify-community

parameter must be changed to reflect the community string rather than the

security-name

that is used by

snmpv3

.

The keyword

snmpv3

selects the SNMP version 3 format. When specifying

snmpv3

, the

notifycommunity

parameter must be configured for the SNMP

security-name

. If the SNMP version is changed from

snmpv1

or

snmpv2c

to

snmpv3

, then the

notify-community

parameter must be changed to reflect the

security-name

rather than the community string used by

snmpv1

or

snmpv2c

.

Default

snmpv3

Values

snmpv1, snmpv2c, snmpv3

notify-community

communityName

|

snmpv3SecurityName —

specifies the community string for

snmpv1

or

snmpv2c,

or the

snmpv3

security-name

. If no

notify-community

is configured, then no alarms or traps will be issued for the trap destination. If the SNMP version is modified, the

notify-community

must be changed to the proper form for the SNMP version.

community —

the community string as required by the

snmpv1

or

snmpv2c

trap receiver. The community string can be an ASCII string up to 32 characters in length.

security-name —

the

security-name

as defined in the

config>system>security>user

context for

SNMP v3. The

security-name

can be an ASCII string up to 32 characters in length.

security-level

{

no-auth-no-privacy

|

auth-no-privacy

|

privacy

}

—

specifies the required authentication and privacy levels required to access the views configured on this node when configuring an

snmpv3

trap receiver.

The keyword

no-auth-no-privacy

specifies that no authentication and no privacy (encryption) are required.

The keyword

auth-no-privacy

specifies that authentication is required but no privacy

(encryption) is required. When this option is configured, the

security-name

must be configured for

authentication

.

The keyword

privacy

specifies that both authentication and privacy (encryption) are required.

When this option is configured, the

security-name

must be configured for

authentication

and

privacy

.

Default

No default. The security level must be specified when configuring an SNMPv3 trap reciever.

Values

no-auth-no-privacy, auth-no-privacy, privacy

7705 SAR OS System Management Guide Page 285

Log Command Reference

Show Commands

accounting-policy

Syntax accounting-policy

[

acct-policy-id

]

access

Context

show>log

Description

This command displays accounting policy information.

Parameters

acct-policy-id —

the policy ID that uniquely identifies the accounting policy, expressed as a decimal integer

Values

1 to 99

access —

only displays access accounting policies

Output

The following output is an example of accounting policy information, and fields.

Table 35

describes the

Sample Output

A:ALU-1#

show log accounting-policy

==============================================================================

Accounting Policies

==============================================================================

Policy Type Def Admin Oper Intvl File Record Name

Id State State Id

------------------------------------------------------------------------------

1 access No Up Up 15 1 service-ingress-packets

2 access Yes Up Up 15 2 service-ingress-octets

==============================================================================

A:ALU-1#

A:ALU-1#

show log accounting-policy 10

==============================================================================

Accounting Policies

==============================================================================

Policy Type Def Admin Oper Intvl File Record Name

Id State State Id

------------------------------------------------------------------------------

10 access Yes Up Up 5 3 service-ingress-packets

Description : (Not Specified)

This policy is applied to:

Svc Id: 100 SAP : 1/1/8:0 Collect-Stats

Svc Id: 101 SAP : 1/1/8:1 Collect-Stats

Svc Id: 102 SAP : 1/1/8:2 Collect-Stats

Svc Id: 106 SAP : 1/1/8:6 Collect-Stats

Svc Id: 107 SAP : 1/1/8:7 Collect-Stats

Svc Id: 108 SAP : 1/1/8:8 Collect-Stats

Page 286 7705 SAR OS System Management Guide

Event and Accounting Logs

Svc Id: 109 SAP : 1/1/8:9 Collect-Stats

...

==============================================================================

A:ALU-1#

A:ALU-1#

show log accounting-policy access

==============================================================================

Accounting Policies

==============================================================================

Policy Type Def Admin Oper Intvl File Record Name

Id State State Id

------------------------------------------------------------------------------

10 access Yes Up Up 5 3 service-ingress-packets

==============================================================================

A:ALU-1#

Label

Policy ID

Type

Def

Admin State

Oper State

Intvl

File ID

Record Name

This policy is applied to

Table 35: Accounting Policy Output Fields

Description

The identifying value assigned to a specific policy

Identifies the accounting record type forwarded to the configured accounting file access — indicates that the policy is an access accounting policy none — indicates no accounting record types assigned

Yes — indicates that the policy is a default access policy

No — indicates that the policy is not a default access policy

Displays the administrative state of the policy

Up — indicates that the policy is administratively enabled

Down — indicates that the policy is administratively disabled

Displays the operational state of the policy

Up — indicates that the policy is operationally up

Down — indicates that the policy is operationally down

Displays the interval, in minutes, in which statistics are collected and written to their destination. The default depends on the record name type.

The log destination

The accounting record name that represents the configured record type

Specifies the entities that the accounting policy is applied to

7705 SAR OS System Management Guide Page 287

Log Command Reference

accounting-records

Syntax accounting-records

Context

show>log

Description

This command displays accounting policy record names.

Output

The following output is an example of accounting policy record information, and the fields.

Table 36

describes

Sample Output

A: ALU-1# show log accounting-records

==========================================================

Accounting Policy Records

==========================================================

Record # Record Name Def. Interval

----------------------------------------------------------

1 service-ingress-octets 5

2 service-egress-octets 5

3 service-ingress-packets 5

4 service-egress-packets 5

==========================================================

A:ALU-1#

Label

Record #

Record Name

Def. Interval

Table 36: Accounting Records Output Fields

Description

The record ID that uniquely identifies the accounting policy, expressed as a decimal integer

The accounting record name

The default interval, in minutes, in which statistics are collected and written to their destination

Page 288 7705 SAR OS System Management Guide

Event and Accounting Logs

applications

Syntax applications

Context

show>log

Description

This command displays a list of all application names that can be used in event-control and filter commands.

Output

Sample Output

A:ALU-1# show log applications

==================================

Log Event Application Names

==================================

Application Name

----------------------------------

ATM

CHASSIS

CPMHWFILTER

DEBUG

DOT1AG

EFM_OAM

FILTER

IP

ISIS

LDP

LOGGER

MPLS

NTP

OAM

OSPF

PORT

PPP

PTP

QOS

ROUTE_POLICY

RSVP

SECURITY

SNMP

STP

SVCMGR

SYSTEM

TIP

USER

VRTR

==================================

A:ALU-1#

7705 SAR OS System Management Guide Page 289

Log Command Reference

event-control

Syntax event-control

[

application-id

] [

event-name

|

event-number

]]

Context

show>log

Description

This command displays event control settings for events, including whether the event is suppressed or generated and the severity level for the event.

If no options are specified, all events, alarms and traps are listed.

Parameters

application-id —

displays event control for the specified application only

Default

All applications

Values

atm, chassis, debug, dot1ag, efm_oam, filter, ip, isis, ldp, logger, mpls, ntp, oam, ospf, port, ppp, ptp, qos, route_policy, rsvp, security, snmp, stp, svcmgr, system, user, vrtr

event-name —

displays event control for the named application event only

Default

All events for the application

event-number —

displays event control for the specified application event number only

Default

All events for the application

Output

The following output is an example of event control information, and

Table 37

Because the output is very large, only a sample of the events are shown here.

describes the fields.

Sample Output

A:gal171# show log event-control

=======================================================================

Log Events

=======================================================================

Application

ID# Event Name P g/s Logged Dropped

-----------------------------------------------------------------------

ATM:

2004 tAtmTcSubLayerDown MI gen 0 0

2005 tAtmTcSubLayerClear MI gen 0 0

L 2006 atmVclStatusChange WA gen 0 0

...

CHASSIS:

2001 cardFailure MA gen 4 0

2002 cardInserted MI gen 3 0

2003 cardRemoved MI gen 8 0

2004 cardWrong MI gen 0 0

2005 EnvTemperatureTooHigh MA gen 0 0

2007 powerSupplyOverTemp CR gen 0 0

2008 powerSupplyAcFailure CR gen 0 0

2009 powerSupplyDcFailure CR gen 0 0

2010 powerSupplyInserted MA gen 0 0

2011 powerSupplyRemoved MA gen 0 0

2012 redPrimaryCPMFail CR gen 0 0

2016 clearNotification MA gen 0 0

Page 290 7705 SAR OS System Management Guide

Event and Accounting Logs

2017 syncIfTimingHoldover CR gen 0 0

2018 syncIfTimingHoldoverClear CR gen 0 0

2019 syncIfTimingRef1Alarm MI gen 0 0

2020 syncIfTimingRef1AlarmClear MI gen 0 0

2021 syncIfTimingRef2Alarm MI gen 0 0

2022 syncIfTimingRef2AlarmClear MI gen 0 0

2023 flashDataLoss MA gen 0 0

2024 flashDiskFull MA gen 0 0

2025 softwareMismatch MA gen 0 0

2026 softwareLoadFailed MA gen 0 0

2027 bootloaderMismatch MA gen 0 0

2028 bootromMismatch MA gen 0 0

2029 fpgaMismatch MA gen 0 0

2030 syncIfTimingBITSAlarm MI gen 0 0

2031 syncIfTimingBITSAlarmClear MI gen 0 0

2032 cardUpgraded MA gen 0 0

2033 cardUpgradeInProgress MA gen 0 0

2034 cardUpgradeComplete MA gen 0 0

2050 powerSupplyInputFailure CR gen 0 0

2051 powerSupplyOutputFailure CR gen 0 0

2052 mdaHiBwMulticastAlarm MI gen 0 0

2056 mdaCfgNotCompatible MA gen 0 0

2057 extAlarmInput1Detected CR gen 0 0

2058 extAlarmInput2Detected MA gen 0 0

2059 extAlarmInput3Detected MA gen 0 0

2060 extAlarmInput4Detected MI gen 0 0

2061 extAlarmCleared MA gen 0 0

2062 syncIfTimingExternAlarm MI gen 0 0

2063 syncIfTimingExternAlarmClear MI gen 0 0

2064 cardBgDiagsFault MI gen 0 0

2065 fanCriticalFailure CR gen 0 0

2066 fanMinorFailure MI gen 0 0

2067 cardSyncFileNotPresent MI gen 0 0

2058 tmnxEqMdaXplError MI sup 0 0

...

DEBUG:

L 2001 traceEvent MI gen 0 0

DOT1AG:

2001 dot1agCfmFaultAlarm MI gen 0 0

EFM_OAM:

2001 tmnxDot3OamPeerChanged MI gen 0 0

2002 tmnxDot3OamLoopDetected MI gen 0 0

2003 tmnxDot3OamLoopCleared MI gen 0 0

FILTER:

2001 tIPFilterPBRPacketsDrop WA gen 0 0

2002 tFilterEntryActivationFailed WA gen 0 0

2003 tFilterEntryActivationRestored WA gen 0 0

IP:

L 2001 clearRTMError MI gen 0 0

L 2002 ipEtherBroadcast MI gen 0 0

L 2003 ipDuplicateAddress MI gen 0 0

L 2004 ipArpInfoOverwritten MI gen 0 0

L 2005 fibAddFailed MA gen 0 0

L 2006 qosNetworkPolicyMallocFailed MA gen 0 0

L 2007 ipArpBadInterface MI gen 0 0

L 2008 ipArpDuplicateIpAddress MI gen 0 0

L 2009 ipArpDuplicateMacAddress MI gen 0 0

....

7705 SAR OS System Management Guide Page 291

Log Command Reference

USER:

L 2001 cli_user_login MI gen 2 0

L 2002 cli_user_logout MI gen 1 0

L 2003 cli_user_login_failed MI gen 0 0

L 2004 cli_user_login_max_attempts MI gen 0 0

L 2005 ftp_user_login MI gen 0 0

L 2006 ftp_user_logout MI gen 0 0

L 2007 ftp_user_login_failed MI gen 0 0

L 2008 ftp_user_login_max_attempts MI gen 0 0

L 2009 cli_user_io MI sup 0 48

L 2010 snmp_user_set MI sup 0 0

L 2011 cli_config_io MI gen 4357 0

=======================================================================

A:ALU-1#

Label

Application

ID#

Event Name

P g/s

Logged

Dropped

Table 37: Event Control Output Fields

Description

The application name

The event ID number within the application

L ID# — an “L” in front of an ID represents event types that do not generate an associated SNMP notification. Most events do generate a notification; only the exceptions are marked with a preceding “L”.

The event name

CL — the event has a cleared severity/priority

CR — the event has critical severity/priority

IN — the event has indeterminate severity/priority

MA — the event has major severity/priority

MI — the event has minor severity/priority

WA — the event has warning severity/priority gen — the event will be generated/logged by event control sup — the event will be suppressed/dropped by event control thr — specifies that throttling is enabled

The number of events logged/generated

The number of events dropped/suppressed

Page 292 7705 SAR OS System Management Guide

Event and Accounting Logs

file-id

Syntax file-id

[

log-file-id

]

Context

show>log

Description

This command displays event log file information.

If no command line parameters are specified, a summary output of all event log files is displayed.

Specifying a file ID displays detailed information on the event log file.

Parameters

log-file-id —

displays detailed information on the specified event log file.

Output

The following output is an example of event log file information, and

Table 38

describes the fields.

Sample Output

A:ALU-1# show log file-id

=============================================================

File Id List

============================================================= file-id rollover retention admin backup oper

location location location

-------------------------------------------------------------

1 60 4 cf3: none none

2 60 3 cf3: none none

3 1440 12 cf3: none none

10 1440 12 cf3: none none

11 1440 12 cf3: none none

15 1440 12 cf3: none none

20 1440 12 cf3: none none

=============================================================

A:ALU-1#

A:ALU-1# show log file-id 10

=============================================================

File Id List

============================================================= file-id rollover retention admin backup oper

location location location

-------------------------------------------------------------

10 1440 12 cf3: none none

Description : Main

=============================================================

===============================================================

File Id 10 Location cf3:

=============================================================== file name expired state

--------------------------------------------------------------cf3:\log\log0302-20060501-012205 yes complete cf3:\log\log0302-20060501-014049 yes complete cf3:\log\log0302-20060501-015344 yes complete cf3:\log\log0302-20060501-015547 yes in progress

=============================================================

7705 SAR OS System Management Guide Page 293

Log Command Reference

Table 38: Log File Summary Output Fields

Label Description

file-id rollover

The log file ID

The rollover time for the log file, which is the amount of time before the file is partitioned into a new file.

retention admin location

The retention time for the file in the system, which is how long the file should be retained in the file system

The primary flash device specified for the file location none — indicates no specific flash device was specified backup location

The secondary flash device specified for the file location if the admin location is not available oper location file name expired state none — indicates that no backup flash device was specified

The actual flash device on which the log file exists

The complete pathname of the file associated with the log ID

Indicates whether or not the retention period for this file has passed in progress — indicates the current open log file complete — indicates the old log file

filter-id

Syntax filter-id

[

filter-id

]

Context

show>log

Description

This command displays event log filter policy information. If you specify a filter ID, the command also displays the filter match criteria.

Parameters

filter-id —

displays detailed information on the specified event filter policy ID

Output

The following outputs are examples of event log filter policy information:

•

filter ID summary information (

Sample Output

,

Table 39

)

• filter ID information with match criteria specified (

Sample Output

,

Table 40

)

Page 294 7705 SAR OS System Management Guide

Event and Accounting Logs

Sample Output

*A:ALU-48>config>log# show log filter-id

=============================================================================

Log Filters

=============================================================================

Filter Applied Default Description

Id Action

-----------------------------------------------------------------------------

1 no forward

5 no forward

10 no forward

1001 yes drop Collect events for Serious Errors Log

=============================================================================

*A:ALU-48>config>log#

Label

Filter Id

Applied

Default Action

Description

Table 39: Filter ID Summary Output Fields

Description

The event log filter ID no — the event log filter is not currently in use by a log ID yes — the event log filter is currently in use by a log ID drop — the default action for the event log filter is to drop events not matching filter entries forward — the default action for the event log filter is to forward events not matching filter entries

The description string for the filter ID

Sample Output

*A:ALU-48>config>log# show log filter-id 1001

==========================================================================

Log Filter

==========================================================================

Filter-id : 1001 Applied : yes Default Action: drop

Description : Collect events for Serious Errors Log

--------------------------------------------------------------------------

Log Filter Match Criteria

--------------------------------------------------------------------------

Entry-id : 10 Action : forward

Application : Operator : off

Event Number : 0 Operator : off

Severity : major Operator : greaterThanOrEqual

Subject : Operator : off

Match Type : exact string :

Router : Operator : off

Match Type : exact string :

Description : Collect only events of major severity or higher

--------------------------------------------------------------------------

==========================================================================

*A:ALU-48>config>log#

7705 SAR OS System Management Guide Page 295

Log Command Reference

Label

Entry-id

Action

Description

(Entry-id)

Application

Event Number

Severity

Subject

Router

Operator

Table 40: Filter ID Match Criteria Output Fields

Description

The event log filter entry ID default — there is no explicit action for the event log filter entry and the filter’s default action is used on matching events drop — the action for the event log filter entry is to drop matching events forward — the action for the event log filter entry is to forward matching events

The description string for the event log filter entry

The event log filter entry application match criterion

The event log filter event ID match criterion cleared — the event log filter severity match is cleared indeterminate — the event log filter entry application event severity indeterminate match criterion critical — the event log filter entry application event severity critical match criterion major — the event log filter entry application event severity cleared match criterion minor — the event log filter entry application event severity minor match criterion warning — the event log filter entry application event severity warning match criterion

Displays the event log filter entry subject string match criterion

Displays the event log filter entry

router

router-instance

string match criterion

There is an operator field for each match criteria: application, event number, severity, and subject equal — matches when equal to the match criterion

Page 296 7705 SAR OS System Management Guide

Event and Accounting Logs

Label

Table 40: Filter ID Match Criteria Output Fields (Continued)

Description

greaterThan — matches when greater than the match criterion greaterThanOrEqual — matches when greater than or equal to the match criterion lessThan — matches when less than the match criterion lessThanOrEqual — matches when less than or equal to the match criterion notEqual — matches when not equal to the match criterion off — no operator specified for the match criterion

log-collector

Syntax log-collector

Context

show>log

Description

This command displays log collector statistics for the main, security, change and debug log collectors.

Output

The following output is an example of log collector statistics, and

Table 41

describes the fields.

Sample Output

A:ALU-1# show log log-collector

===============================================================================

Log Collectors

===============================================================================

Main Logged : 1224 Dropped : 0

Dest Log Id: 99 Filter Id: 0 Status: enabled Dest Type: memory

Dest Log Id: 100 Filter Id: 1001 Status: enabled Dest Type: memory

Security Logged : 3 Dropped : 0

Change Logged : 3896 Dropped : 0

Debug Logged : 0 Dropped : 0

===============================================================================

A:ALU-1#

7705 SAR OS System Management Guide Page 297

Log Command Reference

Label

<Collector

Name>

Dest. Log ID

Filter ID

Status

Dest. Type

Table 41: Log Collector Output Fields

Description

Main — the main event stream contains the events that are not explicitly directed to any other event stream

Security — the security stream contains all events that affect attempts to breach system security, such as failed login attempts, attempts to access MIB tables to which the user is not granted access or attempts to enter a branch of the CLI to which access has not been granted

Change — the change event stream contains all events that directly affect the configuration or operation of this node

Debug — the debug-trace stream contains all messages in the debug stream

Specifies the event log stream destination

The value is the index to the entry that defines the filter to be applied to this log's source event stream to limit the events output to this log's destination. If the value is 0, then all events in the source log are forwarded to the destination.

Enabled — logging is enabled

Disabled — logging is disabled

Console — a log created with the console type destination displays events to the physical console device

Events are displayed to the console screen whether a user is logged in to the console or not.

A user logged in to the console device or connected to the CLI via a remote telnet or SSH session can also create a log with a destination type of 'session'. Events are displayed to the session device until the user logs off. When the user logs off, the 'session' type log is deleted.

Syslog — all selected log events are sent to the syslog address

SNMP traps — events defined as SNMP traps are sent to the configured SNMP trap destinations and are logged in NOTIFICATION-

LOG-MIB tables

File — all selected log events are directed to a file on the CSM’s compact flash disk

Memory — all selected log events are directed to an in-memory storage area

Page 298 7705 SAR OS System Management Guide

Event and Accounting Logs

log-id

Syntax log-id

[

log-id

] [

severity

severity-level

] [

application

application

] [

sequence

from-seq

[

toseq

]] [

count

count

] [

router

router-instance

[

expression

]] [

subject

subject

[

regexp

]]

[

ascending

|

descending

]

Context

show>log

Description

This command displays an event log summary with settings and statistics or the contents of a specific log file, SNMP log, or memory log.

If the command is specified with no command line options, a summary of the defined system logs is displayed. The summary includes log settings and statistics.

If the log ID of a memory, SNMP, or file event log is specified, the command displays the contents of the log. Additional command line options control what and how the contents are displayed.

Contents of logs with console, session or syslog destinations cannot be displayed. The actual events can only be viewed on the receiving syslog or console device.

Parameters

log-id —

displays the contents of the specified log file or memory log ID. The log ID must have a destination of an SNMP or log file or a memory log for this parameter to be used.

Default

Displays the event log summary

Values

1 to 99

severity

severity-level —

displays only events with the specified and higher severity

Default

All severity levels

Values

cleared, indeterminate, critical, major, minor, and warning

application

application —

displays only events generated by the specified application

Default

All applications

Values

atm, chassis, debug, efm_oam, filter, gsmp, ip, ldp, logger, mpls, ntp, oam, port, ppp, qos, route_policy, security, snmp, stp, svcmgr, system, tip, tod, user, user_db, vrtr

sequence

from-seq

[

to-seq

]

—

displays the log entry numbers from a particular entry sequence number (

from-seq

) to another sequence number (

to-seq

). The

to-seq

value must be larger than the

from-seq

value.

If the

to-seq

number is not provided, the log contents to the end of the log are displayed unless the

count

parameter is present, in which case the number of entries displayed is limited by the

count

.

Default

All sequence numbers

Values

1 to 4294967295

count

count —

limits the number of log entries displayed to the number specified

Default

All log entries

Values

1 to 4294967295

7705 SAR OS System Management Guide Page 299

Log Command Reference

Output

router-instance —

specifies a router name up to 32 characters to be used in the display criteria

expression —

specifies to use a regular expression as match criteria for the router instance string

subject

subject —

displays only log entries matching the specified text

subject

string. The subject is the object affected by the event; for example, the port-id would be the subject for a link-up or link-down event.

regexp —

specifies to use a regular expression as parameters with the specified

subject

string

ascending

|

descending

—

specifies the log sort direction. Logs are normally shown from the newest entry to the oldest in

descending

sequence number order on the screen. When using the

ascending

parameter, the log will be shown from the oldest to the newest entry.

Default

Descending

The following output is an example of event log summary information, and

Table 42

describes the

fields.

Sample Output

A:ALU-1# show log log-id

=====================================================================

Event Logs

=====================================================================

Log Source Filter Admin Oper Logged Dropped Dest Dest Size

Id Id State State Type Id

--------------------------------------------------------------------

1 none none up down 52 0 file 10 N/A

2 C none up up 41 0 syslog 1 N/A

99 M none up up 2135 0 memory 500

=====================================================================

A:ALU-1#

Label

Log Id

Source

Filter ID

Admin State

Table 42: Log ID Output Fields

Description

An event log destination no — the event log filter is not currently in use by a log ID yes — the event log filter is currently in use by a log ID

The value is the index to the entry that defines the filter to be applied to this log's source event stream to limit the events output to this log's destination. If the value is 0, then all events in the source log are forwarded to the destination.

Up — indicates that the administrative state is up

Down — indicates that the administrative state is down

Page 300 7705 SAR OS System Management Guide

Event and Accounting Logs

Label

Oper State

Logged

Dropped

Dest. Type

Dest ID

Size

Time format

Table 42: Log ID Output Fields (Continued)

Description

Up — indicates that the operational state is up

Down — indicates that the operational state is down

The number of events that have been sent to the log source(s) that were forwarded to the log destination

The number of events that have been sent to the log source(s) that were not forwarded to the log destination because they were filtered out by the log filter

Console — all selected log events are directed to the system console.

If the console is not connected, then all entries are dropped.

Syslog — all selected log events are sent to the syslog address

SNMP traps — events defined as SNMP traps are sent to the configured SNMP trap destinations and are logged in NOTIFICATION-

LOG-MIB tables

File — all selected log events are directed to a file on the CSM's compact flash disk

Memory — all selected log events are directed to an in-memory storage area

The event log stream destination

The allocated memory size for the log

The time format specifies the type of timestamp format for events sent to logs where the log ID destination is either syslog or file.

When the time format is UTC, timestamps are written using the

Coordinated Universal Time value.

When the time format is local, timestamps are written in the system's local time.

7705 SAR OS System Management Guide Page 301

Log Command Reference

Sample Memory or File Event Log Contents Output

A:gal171# show log log-id 99

===============================================================================

Event Log 99

===============================================================================

Description : Default System Log

Memory Log contents [size=500 next event=3722 (wrapped)]

3721 2008/02/07 09:14:06.69 UTC WARNING: SYSTEM #2006 Base LOGGER

"Log File Id 2 configuration modified"

3720 2008/02/07 09:13:18.86 UTC WARNING: SYSTEM #2006 Base LOGGER

"Log File Id 2 configuration modified"

3719 2008/02/01 11:54:15.67 UTC MINOR: IP #2004 management PIP MANAGEMENT

"ARP information overwritten for 138.120.52.253 by 00:e0:52:d4:a5:00"

3718 2008/02/01 11:54:15.40 UTC MINOR: IP #2004 management PIP MANAGEMENT

"ARP information overwritten for 138.120.52.253 by 00:e0:5e:00:a5:00"

...

===============================================================================

A:gal171

snmp-trap-group

Syntax snmp-trap-group

[

log-id

]

Context

show>log

Description

This command displays SNMP trap group configuration information.

Parameters

log-id —

displays only SNMP trap group information for the specified trap group log ID

Values

1 to 99

Output

The following output is an example of SNMP trap group information, and fields.

Table 43

describes the

Sample Output

*A:ALU-48>config>log# show log snmp-trap-group

===============================================================================

SNMP Trap Groups

=============================================================================== id name

port address

-------------------------------------------------------------------------------

29 name

162 10.20.30.10

===============================================================================

*A:ALU-48>config>log#

Page 302 7705 SAR OS System Management Guide

Event and Accounting Logs

Label

Log-ID

Address

Port

Version

Community

Security-Level

Table 43: SNMP Trap Group Output Fields

Description

The log destination ID for an event stream

The IP address of the trap receiver

The destination UDP port used for sending traps to the destination, expressed as a decimal integer

Specifies the SNMP version format to use for traps sent to the trap receiver. Valid values are snmpv1, snmpv2c, snmpv3.

The community string required by

snmpv1

or

snmpv2c

trap receivers

The required authentication and privacy levels required to access the views on this node

syslog

Syntax syslog

[

syslog-id

]

Context

show>log

Description

This command displays syslog event log destination summary information or detailed information on a specific syslog destination.

Parameters

syslog-id —

displays detailed information on the specified syslog event log destination

Values

1 to 10

Output

The following output is an example of syslog event log destination summary information, and

Table 44

describes the fields.

Sample Output

*A:ALU-48>config>log# show log syslog

===============================================================================

Syslog Target Hosts

===============================================================================

Id Ip Address Port Sev Level

Below Level Drop Facility Pfx Level

-------------------------------------------------------------------------------

2 unknown 514 info

0 local7 yes

3 unknown 514 info

0 mail yes

===============================================================================

*A:ALU-48>config>log#

7705 SAR OS System Management Guide Page 303

Log Command Reference

*A:ALU-48>config>log# show log syslog 1

===============================================================================

Syslog Target 1

===============================================================================

IP Address : 192.168.15.22

Port : 514

Log-ids : none

Prefix : Sr12

Facility : mail

Severity Level : info

Prefix Level : yes

Below Level Drop : 0

Description : Linux Station Springsteen

===============================================================================

*A:ALU-48>config>log#

Label

Syslog ID

IP Address

Port

Facility

Severity Level

Below Level

Dropped

Prefix Present

Description

LogPrefix

Log-id

Table 44: Syslog Output Fields

Description

The syslog ID number for the syslog destination

The IP address of the syslog target host

The configured UDP port number used when sending syslog messages

The facility code for messages sent to the syslog target host

The syslog message severity level threshold

A count of messages not sent to the syslog collector target because the severity level of the message was above the configured severity. The higher the level, the lower the severity.

Yes — a log prefix was prepended to the syslog message sent to the syslog host

No — a log prefix was not prepended to the syslog message sent to the syslog host

A text description stored in the configuration file for a configuration context

The prefix string prepended to the syslog message

Events are directed to this destination

Page 304 7705 SAR OS System Management Guide

Event and Accounting Logs

Clear Commands

log

Syntax log

log-id

Context

clear

Description

This command reinitializes/rolls over the specified memory log or log file. Memory logs are reinitialized and cleared of contents. Log files are manually rolled over by this command.

This command is only applicable to event logs that are directed to file destinations and memory destinations.

SNMP, syslog and console/session logs are not affected by this command.

Parameters

log-id —

the event log ID to be initialized/rolled over

Values

1 to 100

7705 SAR OS System Management Guide Page 305

Log Command Reference

Page 306 7705 SAR OS System Management Guide

Standards and Protocol Support

Standards Compliance

IEEE 802.1ag

Service Layer OAM

IEEE 802.1p/q VLAN Tagging

IEEE 802.3 10BaseT

IEEE 802.3ah

IEEE 802.3u

IEEE 802.3x

IEEE 802.3z

Ethernet OAM

100BaseTX

Flow Control

1000BaseSX/LX

IEEE 802.3-2008 Revised base standard

Protocol Support

ATM

RFC 2514 Definitions of Textual Conventions and

OBJECT_IDENTITIES for ATM

Management, February 1999

RFC 2515 Definition of Managed Objects for ATM

Management, February 1999

RFC 2684 Multiprotocol Encapsulation over ATM

Adaptation Layer 5 af-tm-0121.000 Traffic Management Specification

Version 4.1, March 1999

ITU-T Recommendation I.610 - B-ISDN Operation and Maintenance Principles and Functions version

11/95

ITU-T Recommendation I.432.1 - B-ISDN usernetwork interface - Physical layer specification:

General characteristics

GR-1248-CORE - Generic Requirements for

Operations of ATM Network Elements (NEs). Issue

3 June 1996

GR-1113-CORE - Bellcore, Asynchronous Transfer

Mode (ATM) and ATM Adaptation Layer (AAL)

Protocols Generic Requirements, Issue 1, July 1994

GR-253-CORE - SONET Transport Systems:

Common Generic Criteria. Issue 3,

September 2000

AF-PHY-0086.001 Inverse Multiplexing for ATM

(IMA)

DIFFERENTIATED SERVICES

RFC 2474 Definition of the DS Field in the IPv4 and IPv6 Headers

RFC 2597 Assured Forwarding PHB Group

RFC 2598 An Expedited Forwarding PHB

RFC 3140 Per-Hop Behavior Identification Codes

DIGITAL DATA NETWORK MANAGEMENT

V.35

RS-232 (also known as EIA/TIA-232)

LDP

RFC 5036 LDP Specification

IS-IS

RFC 1142 OSI IS-IS Intra-domain Routing

Protocol (ISO 10589)

RFC 1195 Use of OSI IS-IS for routing in TCP/IP

& dual environments

RFC 2763 Dynamic Hostname Exchange for IS-IS

RFC 2966 Domain-wide Prefix Distribution with

Two-Level IS-IS

RFC 2973 IS-IS Mesh Groups

RFC 3373 Three-Way Handshake for Intermediate

System to Intermediate System (IS-IS)

Point-to-Point Adjacencies

RFC 3567 Intermediate System to Intermediate

System (IS-IS) Cryptographic

Authentication

RFC 3719 Recommendations for Interoperable

Networks using IS-IS

RFC 3784 Intermediate System to Intermediate

System (IS-IS) Extensions for Traffic

Engineering (TE)

RFC 3787 Recommendations for Interoperable IP

Networks

RFC 5309 Point-to-Point Operation over LAN in

Link State Routing Protocols

7705 SAR OS System Management Guide Page 307

Standards and Protocol Support

Page 308

MPLS

RFC 3031 MPLS Architecture

RFC 3032 MPLS Label Stack Encoding

RFC 3815 Definitions of Managed Objects for the

Multiprotocol Label Switching (MPLS),

Label Distribution Protocol (LDP)

RFC 4379 Detecting Multi-Protocol Label

Switched (MPLS) Data Plane Failures

NETWORK MANAGEMENT

ITU-T X.721: Information technology- OSI-Structure of Management Information

ITU-T X.734: Information technology- OSI-Systems

Management: Event Report Management Function

M.3100/3120 Equipment and Connection Models

TMF 509/613 Network Connectivity Model

RFC 1157 SNMPv1

RFC 1305 Network Time Protocol (Version 3)

Specification, Implementation and Analysis

RFC 1850 OSPF-MIB

RFC 1907 SNMPv2-MIB

RFC 2011 IP-MIB

RFC 2012 TCP-MIB

RFC 2013 UDP-MIB

RFC 2030 Simple Network Time Protocol (SNTP)

Version 4 for IPv4, IPv6 and OSI

RFC 2096 IP-FORWARD-MIB

RFC 2138 RADIUS

RFC 2206 RSVP-MIB

RFC 2571 SNMP-FRAMEWORKMIB

RFC 2572 SNMP-MPD-MIB

RFC 2573 SNMP-TARGET-&-

NOTIFICATION-MIB

RFC 2574 SNMP-USER-BASED-SMMIB

RFC 2575 SNMP-VIEW-BASED ACM-

MIB

RFC 2576 SNMP-COMMUNITY-MIB

RFC 2588 SONET-MIB

RFC 2665 EtherLike-MIB

RFC 2819 RMON-MIB

RFC 2863 IF-MIB

RFC 2864 INVERTED-STACK-MIB

RFC 3014 NOTIFICATION-LOG MIB

RFC 3164 The BSD Syslog Protocol

RFC 3273 HCRMON-MIB

RFC 3411 An Architecture for Describing Simple

Network Management Protocol (SNMP)

Management Frameworks

RFC 3412 Message Processing and Dispatching for the Simple Network Management Protocol

(SNMP)

RFC 3413 Simple Network Management Protocol

(SNMP) Applications

RFC 3414 User-based Security Model (USM) for version 3 of the Simple Network

Management Protocol (SNMPv3)

RFC 3418 SNMP MIB draft-ietf-disman-alarm-mib-04.txt

draft-ietf-mpls-ldp-mib-07.txt

draft-ietf-ospf-mib-update-04.txt

draft-ietf-mpls-lsr-mib-06.txt

draft-ietf-mpls-te-mib-04.txt

IANA-IFType-MIB

OSPF

RFC 1765 OSPF Database Overflow

RFC 2328 OSPF Version 2

RFC 2370 Opaque LSA Support

RFC 3101 OSPF NSSA Option

RFC 3630 Traffic Engineering (TE) Extensions to

OSPF

PPP

RFC 1332 PPP IPCP

RFC 1570 PPP LCP Extensions

RFC 1619 PPP over SONET/SDH

RFC 1661 PPP

RFC 1662 PPP in HDLC-like Framing

RFC 1989 PPP Link Quality Monitoring

RFC 1990 The PPP Multilink Protocol (MP)

RFC 2686 The Multi-Class Extension to Multi-

Link PPP

PSEUDOWIRES

RFC 3550 RTP: A Transport Protocol for Real-

Time Applications

RFC 3985 Pseudo Wire Emulation Edge-to-Edge

(PWE3) Architecture

RFC 4385 Pseudowire Emulation Edge-to-Edge

(PWE3) Control Word for Use over an

MPLS PSN

RFC 4446 IANA Allocation for PWE3

RFC 4447 Pseudowire Setup and Maintenance

Using the Label Distribution Protocol (LDP)

RFC 4448 Encapsulation Methods for Transport of

Ethernet over MPLS Networks

RFC 4553 Structure-Agnostic Time Division

Multiplexing (TDM) over Packet (SAToP)

RFC 4717 Encapsulation Methods for Transport of

Asynchronous Transfer Mode (ATM) over

MPLS Networks

7705 SAR OS System Management Guide

Standards and Protocol Support

RFC 5086 Structure-Aware Time Division

Multiplexed (TDM) Circuit Emulation

Service over Packet Switched Network

(CESoPSN)

RFC 5085 Pseudowire Virtual Circuit Connectivity

Verification (VCCV): A Control Channel for

Pseudowires draft-ietf-pwe3-redundancy-01 Pseudowire (PW)

Redundancy

RADIUS

RFC 2865 Remote Authentication Dial In User

Service

RFC 2866 RADIUS Accounting

RSVP-TE and FRR

RFC 2430 A Provider Architecture for DiffServ &

TE

RFC 2961 RSVP Refresh Overhead Reduction

Extensions

RFC 3209 Extensions to RSVP for LSP Tunnels

RFC 3210 Applicability Statement for Extensions to RSVP for LSP Tunnels

RFC 4090 Fast Reroute Extensions to RSVP-TE for

LSP Tunnels

SONET/SDH

GR-253-CORE SONET Transport Systems: Common

Generic Criteria. Issue 3, September 2000

ITU-G.841 Telecommunication Standardization

Section of ITU, Types and Characteristics of SDH

Networks Protection Architecture, issued in October

1998 and as augmented by Corrigendum1 issued in

July 2002

GR-253-CORE - SONET Transport Systems:

Common Generic Criteria. Issue 3, September 2000

SSH

draft-ietf-secsh-architecture.txt SSH Protocol

Architecture draft-ietf-secsh-userauth.txt SSH Authentication

Protocol draft-ietf-secsh-transport.txt SSH Transport Layer

Protocol draft-ietf-secsh-connection.txt SSH Connection

Protocol draft-ietf-secsh- newmodes.txt SSH Transport Layer

Encryption Modes

SYNCHRONIZATION

G.813 Timing characteristics of SDH equipment slave clocks (SEC)

G.8261 Timing and synchronization aspects in packet networks

G.8262 Timing characteristics of synchronous

Ethernet equipment slave clock

GR 1244 CORE Clocks for the Synchronized

Network: Common Generic Criteria

IEEE 1588v2 1588 PTP 2008

TACACS+

draft-grant-tacacs-02.txt The TACACS+ Protocol

TCP/IP

RFC 768 UDP

RFC 791 IP

RFC 792 ICMP

RFC 793 TCP

RFC 826 ARP

RFC 854 Telnet

RFC 1350 The TFTP Protocol (Rev. 2)

RFC 1812 Requirements for IPv4 Routers

Proprietary MIBs

TIMETRA-ATM-MIB.mib

TIMETRA-CAPABILITY-7705-V1.mib

TIMETRA-CFLOWD-MIB.mib

TIMETRA-CHASSIS-MIB.mib

TIMETRA-CLEAR-MIB.mib

TIMETRA-FILTER-MIB.mib

TIMETRA-GLOBAL-MIB.mib

TIMETRA-LDP-MIB.mib

TIMETRA-LOG-MIB.mib

TIMETRA-MPLS-MIB.mib

TIMETRA-OAM-TEST-MIB.mib

TIMETRA-PORT-MIB.mib

TIMETRA-PPP-MIB.mib

TIMETRA-QOS-MIB.mib

TIMETRA-ROUTE-POLICY-MIB.mib

TIMETRA-RSVP-MIB.mib

TIMETRA-SAP-MIB.mib

TIMETRA-SDP-MIB.mib

TIMETRA-SECURITY-MIB.mib

TIMETRA-SERV-MIB.mib

TIMETRA-SYSTEM-MIB.mib

TIMETRA-TC-MIB.mib

7705 SAR OS System Management Guide Page 309

Standards and Protocol Support

Page 310 7705 SAR OS System Management Guide

Customer documentation and product support

Customer documentation

http://www.alcatel-lucent.com/myaccess

Product manuals and documentation updates are available at alcatel-lucent.com. If you are a new user and require access to this service, please contact your Alcatel-Lucent sales representative.

Technical Support

http://www.alcatel-lucent.com/support

Documentation feedback

[email protected]

© 2009 Alcatel-Lucent. All rights reserved.

3HE 04955 AAAA TQZZA Edition 01