Network Security · Topic 6 of 8

Secure Network Management with SNMPv3, NETCONF, RESTCONF, Syslog and NTP

Secure device management with SNMPv3 authentication and privacy, NETCONF, RESTCONF, APIs, secure syslog and authenticated NTP on Cisco devices.

5 min
Includes a diagram

In a nutshell

SNMPv3 authPriv gives authentication and encryption. v1 and v2c use clear text community strings.
NETCONF uses SSH on TCP 830, with XML and YANG models.
RESTCONF uses HTTPS with GET, POST, PUT, PATCH and DELETE, and JSON or XML.

What it is

Secure management means every protocol you use to monitor or change a device is authenticated, encrypted and restricted.

Management traffic is powerful. It can read configuration, change policy and report events. Older protocols such as SNMPv1, SNMPv2c, Telnet and plain syslog send data in clear text or with weak authentication.

How it works

A router managed by an NMS at 10.1.1.20 over SNMPv3 authPriv, NETCONF on TCP 830 and RESTCONF over HTTPS, sending syslog over TLS to a log server at 10.1.1.30 and taking authenticated time from an NTP server at 10.1.1.40. For each management function, pick the protocol variant that adds authentication and encryption.

SNMPv3

SNMPv1 and v2c use a community string, which is a clear text password. SNMPv3 adds real user authentication and optional encryption. It has three security levels.

Level	Authentication	Encryption
noAuthNoPriv	Username only	No
authNoPriv	Yes, with MD5 or SHA	No
authPriv	Yes	Yes, such as AES

The priv level gives both integrity and confidentiality, so it is the best choice.

Router(config)# snmp-server group MONGROUP v3 priv
Router(config)# snmp-server user MONUSER MONGROUP v3 auth sha AUTHPASS priv aes 128 PRIVPASS
Router(config)# snmp-server host 10.1.1.20 version 3 priv MONUSER

Router# show snmp user
Router# show snmp group

An ACL on the group limits which managers may query the device. Use SHA rather than MD5 where the platform allows it.

NETCONF

NETCONF is a network management protocol that runs over SSH, and it uses TCP port 830. It exchanges XML messages, and the data structure is described by YANG models. Operations such as get-config and edit-config read and change the configuration.

Depending on the platform, NETCONF can use a candidate configuration and a commit, so a change is applied as one unit. On IOS XE you enable it with the netconf-yang command. Access is checked by the same AAA system as other management access.

RESTCONF

RESTCONF offers a REST style interface to the same YANG data, over HTTPS. It uses standard methods and can return JSON or XML. A request path names a YANG resource, for example GET /restconf/data/ietf-interfaces:interfaces.

Method	Action
GET	Read data
POST	Create a resource
PUT	Replace a resource
PATCH	Merge changes into a resource
DELETE	Remove a resource

Router(config)# ip http secure-server
Router(config)# restconf

RESTCONF needs the secure HTTP server, so the traffic is protected by TLS. Use AAA based accounts and avoid shared default credentials.

Other APIs

Many security platforms, such as Cisco Secure Firewall Management Center and ISE, expose REST APIs. Protect them in the same way: use HTTPS, use least privilege accounts, restrict source addresses, and protect tokens. A script is only as safe as the secret it holds, so keep secrets in a vault.

Secure syslog

Classic syslog sends messages in clear text over UDP port 514, with no guarantee of delivery. Messages can be read, altered or dropped on the way. Syslog over TLS uses TCP, commonly port 6514, and protects confidentiality and integrity, but support depends on the platform and release.

Router(config)# logging host 10.1.1.30
Router(config)# logging trap informational
Router(config)# logging source-interface Loopback0

Send logs to a central server on a protected network, so an attacker who takes over a device cannot erase the evidence. Set a severity level so that the volume stays useful.

NTP with authentication

Accurate time is vital for correlating logs and validating certificates. An attacker who feeds false time can break certificates and hide events. NTP authentication uses a key so that a client accepts time only from a trusted server.

Router(config)# ntp authenticate
Router(config)# ntp authentication-key 1 md5 NTPKEYSTRING
Router(config)# ntp trusted-key 1
Router(config)# ntp server 10.1.1.40 key 1

Router# show ntp status
Router# show ntp associations

The key number and string must match on the client and the server. The trusted-key command tells the client which keys it will accept.

What to remember for the exam

Seven facts cover most questions on this topic.

SNMPv3 authPriv gives authentication and encryption. v1 and v2c use clear text community strings.
NETCONF uses SSH on TCP 830, with XML and YANG models.
RESTCONF uses HTTPS with GET, POST, PUT, PATCH and DELETE, and JSON or XML.
RESTCONF on IOS XE needs the secure HTTP server enabled.
Classic syslog is UDP 514 and clear text. TLS syslog protects it.
NTP authentication needs ntp authenticate, a key, a trusted key and a key on the server line.
Restrict management to trusted sources, and send logs to a central server.

Exam tip

When a question asks for the most secure SNMP option, choose SNMPv3 with authentication and privacy.

Common mistakes

These four mistakes appear often.

Using a community string and calling it secure. Community strings travel in clear text.

Forgetting ntp trusted-key. Without it the client does not accept the authenticated server.

Enabling RESTCONF with plain HTTP. Use the secure server so credentials and data are encrypted.

Keeping logs only on the device. An attacker can wipe them, so use a remote log server.

Watch out

Do not reuse the same password for the SNMPv3 authentication and privacy keys, or for other accounts.

Check yourself

Work through these three questions.

What does SNMPv3 authPriv add over authNoPriv?
It adds encryption of the message, so the data has confidentiality as well as authentication.
Which port and transport does NETCONF use?
NETCONF runs over SSH on TCP port 830, and exchanges XML described by YANG models.
Why authenticate NTP?
So that clients accept time only from a trusted server, because false time breaks log correlation and certificate checks.

Topic 6 of 8 in Network Security

Test yourself on Network Security

The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.