•
The Exec mode
configure
command now supports a keyword that allows an LI administrator to load
only encrypted Lawful Intercept configuration from a saved configuration file (for example,
configure
encrypted <url>
). The
encrypted
keyword can only be executed by an LI Administrator.
•
If you are running a system with encrypted Lawful Intercept configuration (segregated LI), the output
of the
show boot initial-config
command contains a line indicating whether it needed to run the second
pass or not during the initial boot. This line displays "encrypted li" if the encrypted Lawful Intercept
configuration was processed. If the line reads "encrypted li errors" then the second pass was not successful,
or gave some output which was not expected or informational in nature.
•
A user with li-administration privileges can view the boot config output for the encrypted Lawful Intercept
configuration with the
show logs encrypted-li
command.
For a detailed description of the Global Configuration mode
require segregated li-configuration
and associated
commands, see the
Lawful Intercept CLI Commands
appendix in the
Lawful Intercept Configuration Guide
.
The
Lawful Intercept Configuration Guide
is not available on www.cisco.com. Contact your Cisco account
representative to obtain a copy of this guide.
Note
In Release 21.4 and higher (Trusted builds only):
•
Users can only access the system through their respective context interface.
•
If the user attempts to log in to their respective context through a different context interface, that user
will be rejected.
•
Irrespective of whether the users are configured in any context with 'authorized-keys' or 'allowusers',
with this feature these users will be rejected if they attempt to log in via any other context interface other
than their own context interface.
•
Users configured in any non-local context are required to specify which context they are trying to log
in to. For example:
ssh username@ctx_name@ctx_ip_addrs
Verifying Context-level Administrative User Configuration
Verify that the configuration was successful by entering the following command:
show configuration context local
This command displays all of the configuration parameters you modified within the Local context during this
session. The following displays sample output for this command. In this example, a security administrator
named
testadmin
was configured.
config
context local
interface mgmt1
ip address 192.168.1.10 255.255.255.0
#exit
subscriber default
#exit
administrator testadmin encrypted password fd01268373c5da85
inspector testinspector encrypted password 148661a0bb12cd59
exit
port ethernet 5/1
bind interface mgmt1 local
#exit
ASR 5500 System Administration Guide, StarOS Release 21.5
36
System Settings
Configuring Context-level Administrative Users
