02-Local_Auth.md

Configure a Common Criteria Policy and Local Users

Your Active Directory enforces password compliance. Your IOS XE box can too!

IOS XE supports Common Criteria Policies that allow Network Engineers to configure options such as minimum and maximum password lengths, max number of times a character can be consecutively repeated, and force use of upper, lower, numeric, and special characters.

In this task, we will view and run a playbook that will create a Common Criteria Policy and a local user with a compliant password.

Create a Common Criteria Policy Based on Business Requirements

1. View the Playbook that will Create the Common Criteria Policy

cat playbooks/02a-add-common-criteria-policy.yaml





2. Run the Playbook that will Create the Common Criteria Policy

ansible-playbook -i inventories/devnet-switches.yaml playbooks/02a-add-common-criteria-policy.yaml --ask-vault-pass





3. View the Common Criterial Policy on the Switch

show runn | sec aaa common-criteria






Create a Local User, with Priv 15, whose password complies with Common Criteria

4. View the Playbook that will Create the IOS XE Local User

cat playbooks/02b-add-common-criteria-users.yaml





5. Run the Playbook that will Create the IOS XE Local User

ansible-playbook -i inventories/devnet-switches.yaml playbooks/02b-add-common-criteria-users.yaml --ask-vault-pass





6. View the Local User
Notice how some users need to have the Common Criteria applied and that the one we just created does have it applied.
show runn | inc username





7. View the Playbook that will Configure Login Block

cat playbooks/02c-config-login-block.yaml





8. Run the Playbook that will Configure Login Block

ansible-playbook -i inventories/devnet-switches.yaml playbooks/02c-config-login-block.yaml --ask-vault-pass





9. View the Login Block Configuration

sh runn | inc login block

sh runn | inc login on

Click here to move on to the next section. Configuring Type 6 Password Encryption.