Cisco Model-Based AAA: User & Service Manual PDF

Initial Operation

Model Based AAA The NETCONF and RESTCONF interfaces implement the NETCONF Access Control Model (NACM). NACM is a form of role-based access control (RBAC) specified in RFC 6536. Model Based AAA, on page 1 Additional References for Model Based AAA, on page 7 Feature Information for Model-Based AAA, on page 7 Model Based AAA Prerequisites for Model Based AAA Working with the model based AAA feature requires prior understanding of the following : • NETCONF-YANG • NETCONF-YANG kill-session • RFC 6536:

Network Configuration Protocol (NETCONF) Access Control Model Initial Operation Upon enabling the NETCONF and/or RESTCONF services, a device that has no prior configuration of the /nacm subtree will deny read, write, and execute access to all operations and data other than the users of privilege level 15. This is described in the following configuration of the /nacm subtree: xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm"> true deny deny deny true admin PRIV15 permit-all * * permit Model Based AAA 1

Page 1

Group Membership

Group Membership The group membership of a user can come from two sources- first, from the privilege level of the user as configured on the AAA server used for authorization, and second, from those configured in the /nacm/groups subtree. The names of the groups that correspond to each privilege level are as follows: Traditional IOS command authorization, such as those based on privilege level, does not apply to NETCONF or RESTCONF. Note Note Access granted to a NACM group based on a privilege level do not inherently apply to NACM groups with higher privilege level. For example, rules that apply to PRIV10 do not automatically apply to PRIV11, PRIV12, PRIV13, PRIV14, and PRIV15 as well.

Model Based AAA Group Membership Privilege level NACM group name 0 PRIV00 1 PRIV01 2 PRIV02 3 PRIV03 4 PRIV04 5 PRIV05 6 PRIV06 7 PRIV07 8 PRIV08 9 PRIV09 10 PRIV10 11 PRIV11 12 PRIV12 13 PRIV13 14 PRIV14 15 PRIV15 Model Based AAA 2

Page 2

Sample NACM Configuration

NACM Privilege Level Dependencies If the AAA configuration is configured with no aaa new-model , the privilege level locally configured for the user is used. If the AAA configuration is configured with aaa new-model , the privilege level is determined by the AAA servers associated with the method list aaa authorization exec default . NACM Configuration Management and Persistance The NACM configuration can be modified using NETCONF or RESTCONF. In order for a user to be able to acccess the NCAM configuration, they must have explicit permission to do so, that is, through a NACM rule.

Configuration under the /nacm subtree persists when the copy running-config startup-config EXEC command is issued, or the cisco-ia:save-config RPC is issued. message-id="101" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="http://cisco.com/yang/cisco-ia"/> Note The NACM rules that apply to a NETCONF session are those that are configured in the /nacm subtree at the time of session establishment. Modifying the /nacm subtree has no effect on NETCONF sessions as they are already established. The RPC or the clear netconf-yang session EXEC command can be used to forcibly end an unwanted NETCONF session. See NETCONF Kill Session .

Note Care should be taken when crafting rules to deny access to certain data as the same data may be exposed through multiple YANG modules and data node paths. For example, interface configuration is exposed through both Cisco-IOS-XE-native and ietf-interface . Rules that may apply to one representation of the same underlying data may not apply to other representations of that data. Resetting the NACM Configuration Use the following command to reset the /nacm subtree configuration to the initial configuration (see Initial Operation ). Router#request platform software yang-management nacm reset-config Sample NACM Configuration The examples in this section are for illustrative purposes only.

Note The following is a sample for groups configuration. xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm"> administrators admin root Model Based AAA NACM Privilege Level Dependencies Model Based AAA 3

Page 3

Sample NACM Configuration

limited-permission alice bob Table 1: Description of the Configuration Paramenters for Groups Configuration The following is a sample for creating module rules. xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm"> only-ietf-interfaces limited-permission deny-native Cisco-IOS-XE-native * deny allow-ietf-interfaces ietf-interfaces * permit Table 2: Description of the Configuration Paramenters for Creating Module Rules The following is a sample for creating protocol operation rules.

Model Based AAA Sample NACM Configuration Parameter Description administrators Group name admin User name root User name Parameter Description only-ietf-interfaces Unique rule-list name limited-permission Groups that rule-list applies to deny-native Unique rule name Cisco-IOS-XE-native Name of the YANG module * CRUDx operation types deny Permit/deny Model Based AAA 4

Page 4