Cisco IOS networking equipment (SSH)
Connector name |
|
Connector type | PSLang script |
Type (UI field value) | Cisco IOS networking equipment (SSH) |
Target system versions supported | The agtcisco-ios connector is known to work with the following versions of Cisco IOS; other versions may work.
|
Connector status / support | Customer-Verified Clients may contact Bravura Security support for assistance with this connector. Troubleshooting and testing must be completed in the client's test environment as Bravura Security does not maintain internal test environments for the associated target system. |
Installation / setup | Bravura Security Fabric performs operations on Cisco IOS networking equipment using the |
The following Bravura Security Fabric operations are supported by this connector (depending on your product license and version):
user verify password
verify+reset password
create account
delete account
get server information
List:
accounts
attributes
For a full list and explanation of each connector operation, see connector operations.
See also
Alternatively, the
agtcisco-ios-telnet.confile associates the script with the Telnet connector (agttelnet) to access Cisco IOS via Telnet. See Cisco IOS networking equipment (Telnet) for details about this method.See Secure Shell for details about
agtssh.
Targeting the Cisco IOS networking equipment system
For each Cisco IOS networking equipment system, add a target system in Bravura Security Fabric (Manage the System > Resources > Target systems).
Type is Cisco IOS networking equipment (SSH) .
Address uses options described in the table below.
The full list of target parameters is explained in Target System Options .
Option | Description |
|---|---|
Options marked with a | |
Script file | Must be set to agtcisco-ios.psl (key: script) |
Server | The IP address/domain name of the Cisco IOS networking equipment. (key: server) |
Target system’s internal hostname | This is the internally-defined host name that, along with the logged in user’s name, comprises the Cisco IOS prompt. The script generates the expected prompt using this value, then uses the generated prompt to know when commands have completed. (key: name) |
Save target system configuration | Select this to commit changes made to this target to permanent storage on the router, otherwise it will be stored in memory. This is selected by default. (key: docommit) |
Enter administrative mode with ’login’ (otherwise ’enable’) | Select this to enter the administrative configuration mode with the login password, otherwise the system (enable) password will be used. (key: adminuser) |
User and password prompt expected (otherwise password) | Select this if the Cisco IOS target expects a user and password prompt when connecting, otherwise only the password will be entered. This is selected by default. (key: connlogin) |
Hashed MD5 passwords (’secret’) supported | Select this if the Cisco IOS target supports hashed MD5 targets. This is selected by default. (key: advencrypt) |
Advanced | |
Port | TCP Port number. Default is 22. (key: port) |
Compression | Select to enable data compression for SSH connections. Default is false. (key: compression) |
Action for host keys | Select AllowAppend (default) or DenyUnmatch. For new targets, AllowAppend is recommended. AllowAppend connects to SSH hosts whose public host keys have been previously recorded and have not been changed, and to SSH hosts whose keys have not been previously recorded. It will reject SSH hosts whose keys were previously recorded but have changed. DenyUnmatch only connects to SSH hosts whose public host keys have been previously recorded and have not been changed. It will reject SSH hosts whose keys have not been previously recorded or were previously recorded but have changed. (key: hostkeys) |
Host keys file | Specify the name of the public host key file. It must be located in the \<instance>\script\ directory. The file consists of a KVGroup with an entry that contains the host information as the key and the hostkey as the value. This information can be extracted from the PuTTY registry entries (HKEY_CURRENT_USER \Software\SimonTatham\PuTTY\SshHostKeys) where "Name" corresponds to the key and "Data" corresponds to the value. (key: file) |
Authentication key file | This is a generic SSH target field that is ignored for Cisco IOS target systems. The administrative credentials must consist of a connect user and password, as well as an system password on the Cisco IOS networking equipment. |
Timeout for connection | Amount of time the connector will wait for a response. (key: timeout) |
Setting up a target system administrator
Bravura Security Fabric requires two administrative credentials on Cisco IOS to perform Bravura Security Fabric operations. This includes credentials to connect to the Cisco IOS router, as well as a system (enable) password for elevated privileges.
System passwords do not have an administrator ID, however when defining the credentials for the Cisco IOS target, an administrator ID is required. You can specify an arbitrary value for the administrator ID as this will not be validated. You must also ensure that this credential is identified as a System password .
If auto-enable is enabled on the Cisco IOS target, an administrator account that can login directly into privilege mode can be used for the administrative credentials instead, and a system password is not required.
Creating a template account
Bravura Security Fabric uses template accounts as models or "blueprints" for creating new accounts on Cisco IOS networking equipment.
Consult the documentation included with your specific application to learn how to create an account to use as a template in Bravura Security Fabric . You can then add account attributes to determine how new accounts should be created based on the template account’s parameters.
Note that Bravura Security Fabric still requires a template account, even though attributes may or may not be copied from the template account, for example, if the configured action for all account attributes is Set .