Configuring Lock-and-Key Security (Dynamic Access Lists)

Benefits of Lock-and-Key
Lock-and-key provides the same benefits as standard and static extended access lists (these benefits are discussed in the chapter "Access Control Lists: Overview and Guidelines"). However, lock-and-key also has the following security benefits over standard and static extended access lists:

• Lock-and-key uses a challenge mechanism to authenticate individual users.
• Lock-and-key provides simpler management in large internetworks.
• In many cases, lock-and-key reduces the amount of router processing required for access lists.
• Lock-and-key reduces the opportunity for network break-ins by network hackers.
  

With lock-and-key, you can specify which users are permitted access to which source and destination hosts. These users must pass a user authentication process before they are permitted access to their designated hosts. Lock-and-key creates dynamic user access through a firewall, without compromising other configured security restrictions.

When to Use Lock-and-Key
Two examples of when you might use lock-and-key follow:

• When you want a specific remote user (or group of remote users) to be able to access a host within your network, connecting from their remote hosts via the Internet. Lock-and-key authenticates the user, then permits limited access through your firewall router for the individual's host or subnet, for a finite period of time.
• When you want a subset of hosts on a local network to access a host on a remote network protected by a firewall. With lock-and-key, you can enable access to the remote host only for the desired set of local user's hosts. Lock-and-key require the users to authenticate through a TACACS+ server, or other security server, before allowing their hosts to access the remote hosts.

How Lock-and-Key Works
The following process describes the lock-and-key access operation:

1. A user opens a Telnet session to a border (firewall) router configured for lock-and-key. The user connects via the virtual terminal port on the router.
2. The Cisco IOS software receives the Telnet packet, opens a Telnet session, prompts for a password, and performs a user authentication process. The user must pass authentication before access through the router is allowed. The authentication process can be done by the router or by a central access security server such as a TACACS+ or RADIUS server.
3. When the user passes authentication, they are logged out of the Telnet session, and the software creates a temporary entry in the dynamic access list. (Per your configuration, this temporary entry can limit the range of networks to which the user is given temporary access.)
4. The user exchanges data through the firewall.
5. The software deletes the temporary access list entry when a configured timeout is reached, or when the system administrator manually clears it. The configured timeout can either be an idle timeout or an absolute timeout.

Prerequisites to Configuring Lock-and-Key
Lock-and-key uses IP extended access lists. You must have a solid understanding of how access lists are used to filter traffic, before you attempt to configure lock-and-key. Access lists are described in the chapter "Access Control Lists: Overview and Guidelines."

Lock-and-key employs user authentication and authorization as implemented in Cisco's authentication, authorization, and accounting (AAA) paradigm. You must understand how to configure AAA user authentication and authorization before you configure lock-and-key. User authentication and authorization is explained in the "Authentication, Authorization, and Accounting (AAA)" part of this document.

Lock-and-key uses the autocommand command, which you should understand. This command is described in the "Modem Support and Asynchronous Device Commands" chapter of the Cisco IOS Dial Technologies Command Reference.

Lock-and-Key Configuration Guidelines

Dynamic Access Lists
Use the following guidelines for configuring dynamic access lists:

• Do not create more than one dynamic access list for any one access list. The software only refers to the first dynamic access list defined.
• Do not assign the same dynamic-name to another access list. Doing so instructs the software to reuse the existing list. All named entries must be globally unique within the configuration.
• Assign attributes to the dynamic access list in the same way you assign attributes for a static access list. The temporary access list entries inherit the attributes assigned to this list.
• Configure Telnet as the protocol so that users must open a Telnet session into the router to be authenticated before they can gain access through the router.
• Either define an idle timeout now with the timeout keyword in the access-enable command in the autocommand command, or define an absolute timeout value later with the access-list command. You must define either an idle timeout or an absolute timeout—otherwise, the temporary access list entry will remain configured indefinitely on the interface (even after the user has terminated their session) until the entry is removed manually by an administrator. (You could configure both idle and absolute timeouts if you wish.)
• If you configure an idle timeout, the idle timeout value should be equal to the WAN idle timeout value.
• If you configure both idle and absolute timeouts, the idle timeout value must be less than the absolute timeout value.
• If you realize that a job will run past the ACL's absolute timer, use the access-list dynamic-extend command to extend the absolute timer of the dynamic ACL by six minutes. This command allows you to open a new Telnet session into the router to re-authentication yourself using lock-and-key.
• The only values replaced in the temporary entry are the source or destination address, depending whether the access list was in the input access list or output access list. All other attributes, such as port, are inherited from the main dynamic access list.
• Each addition to the dynamic list is always put at the beginning of the dynamic list. You cannot specify the order of temporary access list entries.
• Temporary access list entries are never written to NVRAM.
• To manually clear or to display dynamic access lists, refer to the section " Maintaining Lock-and-Key" later in this chapter.

Lock-and-Key Authentication
There are three possible methods to configure an authentication query process. These three methods are described in this section.

Method 1—Configuring a Security Server
Use a network access security server such as TACACS+ server. This method requires additional configuration steps on the TACACS+ server but allows for stricter authentication queries and more sophisticated tracking capabilities.
Router(config-line)# login tacacs

Method 2—Configuring the username Command
Use the username command. This method is more effective because authentication is determined on a user basis.
Router(config)# username name {nopassword password {mutual-password encryption-type
encryption-password}}

Method 3—Configuring the password and login Commands
Use the password and login commands. This method is less effective because the password is configured for the port, not for the user. Therefore, any user who knows the password can authenticate successfully.
Router(config-line)# password password
Router(config-line)# login local

The autocommand Command
Use the following guidelines for configuring the autocommand command:

• If you use a TACACS+ server to authenticate the user, you should configure the autocommand command on the TACACS+ server as a per-user autocommand. If you use local authentication, use the autocommand command on the line.
• Configure all virtual terminal (VTY) ports with the same autocommand command. Omitting an autocommand command on a VTY port allows a random host to gain EXEC mode access to the router and does not create a temporary access list entry in the dynamic access list.
• If you did not previously define an idle timeout with the autocommand access-enable command, you must define an absolute timeout now with the access-list command. You must define either an idle timeout or an absolute timeout—otherwise, the temporary access list entry will remain configured indefinitely on the interface (even after the user has terminated their session) until the entry is removed manually by an administrator. (You could configure both idle and absolute timeouts if you wish.)
• If you configure both idle and absolute timeouts, the absolute timeout value must be greater than the idle timeout value.

Verifying Lock-and-Key Configuration
You can verify that lock-and-key is successfully configured on the router by asking a user to test the connection. The user should be at a host that is permitted in the dynamic access list, and the user should have AAA authentication and authorization configured.
To test the connection, the user should Telnet to the router, allow the Telnet session to close, and then attempt to access a host on the other side of the router. This host must be one that is permitted by the dynamic access list. The user should access the host with an application that uses the IP protocol.
The following sample display illustrates what end-users might see if they are successfully authenticated. Notice that the Telnet connection is closed immediately after the password is entered and authenticated. The temporary access list entry is then created, and the host that initiated the Telnet session now has access inside the firewall.
Router% telnet corporate

Trying 172.21.52.1 ...

Connected to corporate.example.com.

Escape character is `^]'.

User Access Verification

Password:Connection closed by foreign host.

You can then use the show access-lists command at the router to view the dynamic access lists, which should include an additional entry permitting the user access through the router.

Lock-and-Key with Local Authentication Example
This example shows how to configure lock-and-key access, with authentication occurring locally at the router. Lock-and-key is configured on the Ethernet 0 interface.
interface ethernet0

ip address 172.18.23.9 255.255.255.0

ip access-group 101 in

access-list 101 permit tcp any host 172.18.21.2 eq telnet

access-list 101 dynamic mytestlist timeout 120 permit ip any any

line vty 0

login local

autocommand access-enable timeout 5

The first access-list entry allows only Telnet into the router. The second access-list entry is always ignored until lock-and-key is triggered.
In the access-list command, the timeout is the absolute timeout. In this example, the lifetime of the mytestlist ACL is 120 minutes; that is, when a user logs in and enable the access-enable command, a dynamic ACL is created for 120 minutes (the maximum absolute time). The session is closed after 120 minutes, whether or not anyone is using it.
In the autocommand command, the timeout is the idle timeout. In this example, each time the user logs in or authenticates there is a 5-minute session. If there is no activity, the session closes in 5 minutes and the user has to reauthenticate. If the user uses the connection, the absolute time takes affect and the session closes in 120 minutes.
After a user opens a Telnet session into the router, the router will attempt to authenticate the user. If authentication is successful, the autocommand executes and the Telnet session terminates. The autocommand creates a temporary inbound access list entry at the Ethernet 0 interface, based on the second access-list entry (mytestlist). This temporary entry will expire after 5 minutes, as specified by the timeout.

Lock-and-Key with TACACS+ Authentication Example
The following example shows how to configure lock-and-key access, with authentication on a TACACS+ server. Lock-and-key access is configured on the BRI0 interface. Four VTY ports are defined with the password "cisco".
aaa authentication login default group tacacs+ enable

aaa accounting exec stop-only group tacacs+

aaa accounting network stop-only group tacacs+

enable password ciscotac

!

isdn switch-type basic-dms100

!

interface ethernet0

ip address 172.18.23.9 255.255.255.0

!

interface BRI0

ip address 172.18.21.1 255.255.255.0

encapsulation ppp

dialer idle-timeout 3600

dialer wait-for-carrier-time 100

dialer map ip 172.18.21.2 name diana

dialer-group 1

isdn spid1 2036333715291

isdn spid2 2036339371566

ppp authentication chap

ip access-group 102 in

!

access-list 102 permit tcp any host 172.18.21.2 eq telnet

access-list 102 dynamic testlist timeout 5 permit ip any any

!

!

ip route 172.18.250.0 255.255.255.0 172.18.21.2

priority-list 1 interface BRI0 high

tacacs-server host 172.18.23.21

tacacs-server host 172.18.23.14

tacacs-server key test1

tftp-server rom alias all

!

dialer-list 1 protocol ip permit

!

line con 0

password cisco

line aux 0

line VTY 0 4

autocommand access-enable timeout 5

password cisco

!