Network Security Fundamentals [Electronic resources]

Lock-and-Key Feature

The lock-and-key feature uses dynamic access lists to create specific temporary openings in the network in response to a user authentication success. Chapter 8, "Router Security," briefly discusses the usage of a dynamic access list; this chapter contains more detail.

Lock-and-key is a traffic-filtering security feature that dynamically filters IP protocol traffic to grant access per user to a specific source/destination host. Lock-and-key is configured using IP dynamic extended access lists. It is the dynamic functionality that makes this feature so interesting. Access lists are typically created and maintained by manually defining the lists and then distributing or deploying them to all other devices in the network. This feature can be used in conjunction with other standard access lists and static extended access lists. It is recommended to use the lock-and-key feature in combination with a AAA server (either TACACS+ or RADIUS) to provide authentication, authorization, and accounting services. Although the lock-and-key is server independent, it is ideally designed for the TACACS+ server. TACACS+ has three components to provide authentication, authorization, and accounting services: protocol support within access servers and routers, protocol specification, and a centralized security database.

The following example, which includes Figures 11-7 and 11-8 as well as sample configurations, demonstrates the advantages of having the TACACS+ server in combination with the lock-and-key feature.

Figure 11-7 displays the scenario for a remote user trying to use FTP to access a corporate fileserver (FileServer1) with the IP address 144.2.2.2.

Using this lock-and-key feature to log in to systems is easy. In Figure 11-7, a remote worker (sales manager) needs to upload weekly sales data onto an FTP server. The network administrator has set up Router1 as the lock-and-key router. Therefore, the sales manager is required to log in to Router1 to connect to the corporate network. When a user logs in from the PC (140.6.6.6), the lock-and-key challenges the user for a preconfigured test such as username and password. This username/password pair is defined in the database of the TACACS+ server. Figure 11-8 illustrates the user settings for sales manager Gert on the TACACS+ server.

When the user responds, the login information is checked against the data stored in the TACACS+ database, which is set up and maintained by the network system administrator. Finally, a connection is dynamically made that allows data to be securely transmitted from the sales manager's PC to FileServer1. All these steps are explained and clarified using configuration examples and some

show commands.

To force the users to create a dynamic access list, the network administrator sets up Router1 in such a way that users logging in are prompted to authenticate with the TACACS+ server automatically. Therefore, the following configuration is required under vty 0 4 line:

line vty 0 4 
login local 
autocommand access-enable host timeout 10 

Then you can define an extended access list that is applied when a user (any user) logs in to the router and the

access-enable command is issued. The name "salesmanagers" is used as a reference for the access list.

access-list 101 dynamic salesmanagers permit ip any any 

A second access list needs to block everything except the ability to use FTP to access FileServer1.

access-list 101 permit tcp any host 144.2.2.2 eq ftp 

After applying the access list to the interface on which users are coming in, the lock-and-key feature is activated.

interface FastEthernet0/0 
ip access-group 101 in 

If users now use Telnet to access the router, they must provide their usernames and passwords to open the hole:

C:\>
telnet 142.2.65.6 
Trying 142.2.65.6 ... Open
User Access Verification
Username: Gert
Password:
[Connection to 142.2.65.6 closed by foreign host]
C:\>

When you use the

show access-lists command, the access list looks like this before any user has used Telnet to reach the router:

Router1#
show access-lists 
Extended IP access list 101
Dynamic salesmanagers permit ip any any
permit tcp any host 144.2.2.2 eq ftp
Router1#

Now take a look at the access list again after the user Gert used Telnet to reach Router1 from 140.6.6.6:

Router1#
show access-list 
Extended IP access list 101
Dynamic salesmanagers permit ip any any
permit ip host 144.2.2.2 any (4 matches) (time left 586)
permit tcp any host 144.2.2.2 eq ftp (40 matches)
Router1#

A hole has been created in the access list, and users should now be able to have complete IP access to any destination IP address from their source address. In this case, the hole is created for accessing FileServer1 with IP address 144.2.2.2.

The temporary entry is removed after a specified idle timeout or absolute timeout period configured by the system manager. Depending on the template defined by the network administrator, the new lock-and-key access lists can be configured to authenticate a single user or multiple users and devices on a remote LAN.