Continuing on the IOS-XR saga, this is the newest bunch of things that don't "work as expected" (© Cisco). Well, as expected by me, not by Cisco.
Everything started while trying to configure a primary and backup aaa login method on an ASR9k, when i realized that...
1) having a backup aaa login method with the same tacacs servers as the ones in the primary aaa login method (which is using the management vrf) doesn't work
Imagine the following aaa configuration:
! tacacs source-interface MgmtEth0/RSP0/CPU0/0 vrf MGMT tacacs source-interface Loopback0 vrf default ! aaa group server tacacs+ TACACS-AAA-GROUP server x.x.x.x server y.y.y.y ! aaa group server tacacs+ TACACS-VRF-AAA-GROUP server x.x.x.x server y.y.y.y vrf MGMT ! aaa authentication login default group TACACS-VRF-AAA-GROUP group TACACS-AAA-GROUP local !
This is supposed to work in the following way:
As long as at least one mgmt interface is up (i'm using a virtual-ip for the mgmt interfaces), tacacs communication should happen through the out-of-band mgmt interfaces. If all mgmt interfaces are down, then tacacs communication should happen through an inband interface.
Guess what! There seems to be an issue with the above scenario, because in the 2nd case (where all mgmt interfaces are down) tacacs communication doesn't happen at all. Looking at the debugs, it's like the router isn't even trying to use the second (global) tacacs group. This has already been opened as SR (according to tac this should work, so let's hope it's just a bug), so i'm waiting for developers' feedback right now.
In order to overcome the above problem, i thought of using different vty templates, each one with a different access method.
In IOS you can have the following vty configuration and then access vtys 11-15 by either using "telnet x.x.x.x 3001" or "telnet x.x.x.x 2000+y" where y is the tty number displayed by using the command "show line".
! line vty 11 15 login authentication BACKUP-AAA rotary 1 !
Since the "rotary" command is not supported in IOS-XR, this is what you can do:
! line default login authentication default ! line template VTY-TEMPLATE login authentication BACKUP-AAA ! vty-pool default 0 10 vty-pool VTY-POOL 11 20 line-template VTY-TEMPLATE !
And this is the point you realize that you can't choose a vty, because...
2) specific vtys can be accessed only through a combination of a line template and a specific ACL
First shock: You cannot easily access a specific vty line in IOS-XR. Vtys in IOS-XR work in a very different way in comparison to the IOS ones. According to the BU, when you do a telnet/ssh to the router, the router starts a scanning from the first vty (0) to the last vty (including all custom configured ones). When a free (available) vty is found, the vty ACL is checked in order to verify whether its permit conditions are met. If the vty ACL allows this specific access, then the session is opened.
Second shock: If the vty ACL doesn't allow access, then scanning for free vtys continues until one vty is found that has an ACL that allows this specific access. So, the only to way to access a specific vty is to apply a specific and unique ACL under that vty that allows your i.e. source ip. In order to access another vty, you'll have to use another source ip, and so on. Still wondering why Cisco chose such an implementation.
So i tried the following:
! line default login authentication default access-class ingress HOST1-ACL transport input telnet ssh ! line template LINE-TEMPLATE login authentication BACKUP-AAA access-class ingress HOST2-ACL transport input telnet ssh ! vty-pool default 0 10 vty-pool VTY-POOL 11 20 line-template LINE-TEMPLATE ! ipv4 access-list HOST1-ACL 10 permit ipv4 host x.x.x.x any 20 deny ipv4 any any log ! ipv4 access-list HOST2-ACL 10 permit ipv4 host y.y.y.y any 20 deny ipv4 any any log !
...and this is what i got when i tried to telnet from HOST2 to the router
HOST2$ telnet router Trying z.z.z.z... Connected to router. Escape character is '^]'. Connection to router closed by foreign host. ipv4_acl_mgr[267]: %ACL-IPV4_ACL-6-IPACCESSLOGP : access-list HOST1-ACL (20) deny tcp y.y.y.y(46387) -> z.z.z.z(23), 1 packet
So i didn't manage to telnet into vtys 11-20, because my telnet session was dropped by HOST1-ACL. Is this another bug? Who knows...
And when i thought i had met every possible issue, i also found out that vty ACLs are useless for ssh sessions, because...
3) ssh sessions get established before hitting the vty ACLs
Yeap, that's another shock (3rd in a row). When you do a ssh session to an IOS-XR router, the vty (the one that the ssh session will use) is consumed regardless of your vty ACL. That means that the vty is occupied during the whole time the router is waiting for you to enter your password. It's only after you enter your password that you get disconnected because of the vty ACL. And that's a nice way to dos attack an IOS-XR router.
%SECURITY-SSHD-6-INFO_GENERAL : Incoming SSH session rate limit exceeded %SECURITY-SSHD-3-ERR_GENERAL : Failed to allocate pty
Note: the same happens with telnet, but since the username is asked after the ACL check, the time while telnet session remains open is limited.
But wait; isn't that supposed to be solved by Management Plane Protection (MPP)? Sure it is, but...
4) MMP configuration doesn't support ACLs
Who would have though of that! MPP configuration expects you to configure hosts and networks in a Juniper kind of way (although Juniper allows you to reuse the "clients" section).
RP/0/RSP0/CPU0:router(config-telnet-peer)#address ipv4 ? A.B.C.D Enter IPv4 address A.B.C.D/length Enter IPv4 address with prefix RP/0/RSP0/CPU0:router(config-telnet-peer)#address ipv6 ? X:X::X Enter IPv6 address X:X::X/length Enter IPv6 address with prefix
So, if you happen to have already defined ACLs for your NMS/OSS/whatever, which are already being used somewhere else, you can't reuse those ones, but you have to reconfigure all hosts and networks under the MPP section (something that makes mass router config changes even more difficult). You can't even reuse the same hosts/networks under different interfaces!
!
control-plane
management-plane
inband
!
interface GigabitEthernet0/3/0/0
allow SSH peer
address ipv6 2001:db8::69/64
!
!
interface GigabitEthernet0/3/0/1
allow SSH peer
address ipv6 2001:db8::69/64
!
!
And that's surely a nice way to further "expand" your configuration (not to mention BGP dynamic neighbors that are not supported either, but's that's another story).
That's 4 in a row Cisco. Bingo!!!
Note: Many thanks to Arie for helping me with the 2nd issue (once again).
Question to the public:
Is there a character in IOS-XR that fully resembles "!" as a starting comment indicator, like in IOS?
IOS
router(config-line)#login authentication BACKUP-AAA ! backup router(config-line)#
IOS-XR
RP/0/RSP0/CPU0:router(config-line)#login authentication BACKUP-AAA ! backup
^
% Invalid input detected at '^' marker.
In IOS-XR, "!" works only when it is the first character in the line.
Posts
