Ssd Management Channels - Cisco 350XG series Administration Manual

Security: Secure Sensitive Data Management

SSD Management Channels

NOTE
SSD Management Channels
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
• Enforce the integrity of the file content
• Include the secure, authentication configuration commands and SSD rules
that properly control and secure the access to devices and the sensitive
data
If the configuration file was generated with a user passphrase and SSD file
passphrase control is Restricted, the resulting configuration file can be auto-
configured to the desired target devices. However, for auto configuration to
succeed with a user-defined passphrase, the target devices must be manually
pre-configured with the same passphrase as the device that generates the files,
which is not zero touch.
If the device creating the configuration file is in Unrestricted passphrase control
mode, the device includes the passphrase in the file. As a result, the user can auto
configure the target devices, including devices that are out-of-the-box or in factory
default, with the configuration file without manually pre-configuring the target
devices with the passphrase. This is zero touch because the target devices learn
the passphrase directly from the configuration file.
Devices that are out-of-the-box or in factory default states use the default
anonymous user to access the SCP server.
Devices can be managed over management channels such as telnet, SSH, and
web. SSD categories the channels into the following types based on their security
and/or protocols: secured, insecure, secure-XML-SNMP, and insecure-XML-SNMP.
The following describes whether SSD considers each management channel to be
secure or insecure. If it is insecure, the table indicates the parallel secure channel.
Management Channel
Console
Telnet
SSH
GUI/HTTP
GUI/HTTPS
SSD Management
Channel Type
Secure
Insecure
Secure
Insecure
Secure
21
Parallel Secured
Management Channel
SSH
GUI/HTTPS
478