RSA Soft Tokens for RME -

[getwithrob]

Does anyone know if RSA has a soft token available that can be installed and used on RME to perform coniguration backups when telnet is the protocol used?

[Joe Clarke]

RME does not have any plug-ins for RSA tokens at this time. However, there is a feature called job based passwords that you could use in conjunction with an RSA token generator. It won't allow you to do automated jobs (unfortunately), but it would definitely let RME operate in an OTP environment.

[getwithrob]

When you say "automated jobs"; are you referring to the scheduled daily backups RME performs?

[Joe Clarke]

Yes. Job based passwords allows you to archive configs or deploy changes using ad hoc manually scheduled jobs, but automated jobs are not possible since token generation cannot happen dynamically.

[getwithrob]

Help me understand "User Configurable"

RME 3.5-

Under RME> Adminstration> Configuraton Mgmt> Configuration Job Setup, Password Policy tab"

I'm currently have the Enable Password policy check box selected so that when running Netconfig jobs, you have to enter a valid ID and password...

[getwithrob]

Also, please expand on what you stated above in "using in conjunction with an RSA token generator. It won't allow you to do automated jobs (unfortunately), but it would definitely let RME operate in an OTP environment"

[Joe Clarke]

RME will not generate a token for you. You will have to type in the current token at the time you schedule the job. This password will then only be good for that job. Therefore, scheduling jobs to run in the future or repeatedly is not supported with job-based passwords (at least not OTP).

[Joe Clarke]

That's the way you should have it for RSA-based rotating token device access. If you select User Configurable the user has the option when creating the job to use or not use Job Based passwords. If they choose not to use JBP, then RME will use the credentials it has in its database when communicating with the device(s).

[getwithrob]

You say "This password will then only be good for that job". What if I have a Netconfig job that is setup to issue a command on 50 IOS based switches?

So you're saying I will only need to enter the digits displayed on the token and it will telnet to those 50 devices and enter the command on 50 devices with the same token password?

[Joe Clarke · Accepted solution]

This will also not work in the OTP RSA case. Since the RSA token is only good for one login on one device for a period of 60 or so seconds, this will force you to create 50 jobs (for the above example). This is clearly non-optimal.

There had been some talk about somehow improving this, but I'm not sure how feasible that would be unless we had some kind of token generator in CiscoWorks as you suggest. And I'm not sure how feasible THAT would be. Certainly this would be something to drive with your account team. Perhaps they can build a business case and PERS for this feature.

[getwithrob]

Gotcha.

Thanks for your input. I have a call into RSA and I'll let this forum know what comes out of it....