Cisco ASR 5000 Instruction Manual

ASR 5000 System Administration Guide, StarOS Release 21.1

First Published: 2017-01-26

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://

www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

CONTENTS

Preface

About this Guide xxvii

Conventions Used xxvii

Related Documentation xxviii

Contacting Customer Support xxviii

CHAPTER 1

System Operation and Configuration 1

System Management Overview 1

Terminology 3

Contexts 3

Ports 3

Logical Interfaces 3

Management Interface 4

Bindings 4

Services 4

AAA Servers 5

Subscribers 5

Trusted Builds 6

How the System Selects Contexts 6

Context Selection for Context-level Administrative User Sessions 7

Context Selection for Subscriber Sessions 9

Understanding the ASR 5000 Boot Process 9

Understanding Configuration Files 11

IP Address Notation 12

IPv4 Dotted-Decimal Notation 13

IPv6 Colon-Separated-Hexadecimal Notation 13

CIDR Notation 13

Alphanumeric Strings 14

ASR 5000 System Administration Guide, StarOS Release 21.1

iii

Character Set 14

Quoted Strings 15

CHAPTER 2

Getting Started 17

ASR 5000 Configuration 17

Using the ASR 5000 Quick Setup Wizard 17

The Quick Setup Wizard 18

Using the CLI for Initial Configuration 22

Configuring the System for Remote Access 24

Configuring SSH Options 27

SSH Keys 27

Setting SSH Key Size 27

Configuring SSH Key Generation Wait Time 28

Specifying SSH Encryption Ciphers 28

Generating SSH Keys 29

Setting SSH Key Pair 29

Authorized SSH User Access 30

Authorizing SSH User Access 30

SSH User Login Restrictions 30

Creating an Allowed Users List 31

SSH User Login Authentication 31

Secure Session Logout 32

Changing Default sshd Secure Session Logout Parameters 33

SSH Client Login to External Servers 33

Generating SSH Client Key Pair 33

Pushing an SSH Client Public Key to an External Server 34

Configuring the Management Interface with a Second IP Address 35

CHAPTER 3

System Settings 37

Configuring a Second Management Interface 38

Verifying and Saving Your Interface and Port Configuration 38

Configuring System Timing 39

Setting the System Clock and Time Zone 39

Verifying and Saving Your Clock and Time Zone Configuration 40

Configuring Network Time Protocol Support 40

ASR 5000 System Administration Guide, StarOS Release 21.1

Contents

Configuring NTP Servers with Local Sources 41

Using a Load Balancer 41

Verifying the NTP Configuration 42

Configuring Transmit Timing Source 43

Configure BITS as the Timing Source 43

Configure Line-timing as the Timing Source 44

Configure Both BITS and Line as Timing Sources 44

Confirming the Timing Source 44

Enabling CLI Timestamping 45

Configuring CLI Confirmation Prompts 45

Enabling Automatic Confirmation 45

Requiring Confirmation for autoconfirm and configure Commands 46

Requiring Confirmation for Specific Exec Mode Commands 46

Configuring System Administrative Users 47

Configuring Context-level Administrative Users 48

Configuring Context-level Security Administrators 48

Configuring Context-level Administrators 48

Configuring Context-level Operators 49

Configuring Context-level Inspectors 49

Configuring LI Administrators 50

Verifying Context-level Administrative User Configuration 50

Configuring Local-User Administrative Users 50

Verifying Local-User Configuration 51

Updating Local-User Database 51

Updating and Downgrading the local-user Database 51

Provisioning Lawful Intercept 52

Restricting User Access to a Specified Root Directory 53

Configuring an SFTP root Directory 54

Associating an SFTP root Directory with a Local User 54

Associating an SFTP root Directory with an Administrator 54

Associating an SFTP root Directory with a Config Administrator 54

Configuring TACACS+ for System Administrative Users 54

Operation 55

User Account Requirements 55

TACACS+ User Account Requirements 55

ASR 5000 System Administration Guide, StarOS Release 21.1

Contents

StarOS User Account Requirements 56

Configuring TACACS+ AAA Services 56

Configuring TACACS+ for Non-local VPN Authentication 57

Verifying the TACACS+ Configuration 57

Separating Authentication Methods 58

Disable TACACS+ Authentication for Console 59

Disable AAA-based Authentication for Console 59

Disable TACACS+ Authentication at the Context Level 59

Limit local-user Login on Console/vty Lines 60

Limit Console Access for AAA-based Users 60

Verify Configuration Changes 61

Configuring a Chassis Key 61

Overview 61

Configuring a New Chassis Key Value 62

CLI Commands 62

Quick Setup Wizard 63

Configuring Virtual MAC Addresses 63

Verifying Virtual MAC Address Configuration 64

Configuring Packet Processing and Line Card Availability 64

Verifying Packet Processing and Line Card Configurations 65

Configuring Line Card and SPIO Port Redundancy 65

Enabling Line Card and SPIO Port Redundancy 68

Verifying Line Card and SPIO Port Redundancy 69

Configuring Line Card and SPIO Port Redundancy Auto-Recovery 69

Verifying Line Card and SPIO Port Redundancy Auto-Recovery 70

Configuring ASR 5000 Link Aggregation 70

LAG and Master Port 71

LAG and Port Redundancy 71

LAG and Multiple Switches 71

Multiple Switches without L2 Redundancy 71

Multiple Switches with L2 Redundancy 72

Port States for Auto-Switch 73

Hold Time 73

Preferred Slot 73

Auto-Switch Criteria 73

ASR 5000 System Administration Guide, StarOS Release 21.1

Contents

Distribution Option 74

show Commands 74

Suppressing SPOF Alarm for XGLC 74

QGLC Link Aggregation 75

Requirements 75

Operation 75

XGLC Link Aggregation 76

Link Aggregation Control 76

Redundancy Options 78

Distribution Option 78

Toggle Link 78

Horizontal Link Aggregation with Two Ethernet Switches 78

Link Aggregation Status 79

Configuring a Demux Card 79

Overview 79

Configuration 79

Configuring Flow Control on XGLCs 79

CHAPTER 4

Config Mode Lock Mechanisms 81

Overview of Config Mode Locking 81

Requesting an Exclusive-Lock 82

Effect of Config Lock on URL Scripts 83

Saving a Configuration File 84

Reload and Shutdown Commands 84

show administrators Command 85

CHAPTER 5

Management Settings 87

ORBEM 87

Configuring ORBEM Client and Port Parameters 88

Configuring IIOP Transport Parameters 88

Verifying ORBEM Parameters 89

SNMP MIB Browser 89

SNMP Support 92

Configuring SNMP and Alarm Server Parameters 92

Verifying SNMP Parameters 93

ASR 5000 System Administration Guide, StarOS Release 21.1

vii

Contents

Controlling SNMP Trap Generation 94

CHAPTER 6

Verifying and Saving Your Configuration 95

Verifying the Configuration 95

Feature Configuration 95

Service Configuration 96

Context Configuration 96

System Configuration 96

Finding Configuration Errors 96

Synchronizing File Systems 97

Saving the Configuration 97

CHAPTER 7

System Interfaces and Ports 99

Contexts 99

Creating Contexts 99

Viewing and Verifying Contexts 100

Ethernet Interfaces and Ports 100

Creating an Interface 101

Configuring a Port and Binding It to an Interface 101

Configuring a Static Route for an Interface 102

Viewing and Verifying Port Configuration 102

ATM Interfaces and Ports 103

Enabling the OLC (ATM) Line Card 104

Creating an IP Interface for Use with an ATM Port 104

Configuring an ATM Port to Use an IP Interface 104

Configuring an ATM Port for an SS7 Link 105

Binding an SS7 Link to an ATM Port 105

Verifying Port and Interface Configuration 105

Frame Relay Interfaces and Ports 106

Setting the Characteristics of the Channelized Line Card 107

Configuring the Channel Characteristics 107

Binding a DLCI 107

Verifying the Frame Relay Interface Configuration and Status 108

Display Port and DLCI Configuration Details 108

Display Port and DLCI Configuration and Status 108

ASR 5000 System Administration Guide, StarOS Release 21.1

viii

Contents

CHAPTER 8

System Security 111

Per-Chassis Key Identifier 111

Chassis Synchronization 112

Protection of Passwords 112

Secure Password Encryption 113

Support for Non-Current Encryptions and Decryptions 113

Support for ICSR Configurations 114

Encrypted SNMP Community Strings 114

Lawful Intercept Restrictions 114

LI Server Addresses 114

Modifying Intercepts 115

Adding, Modifying and Removing Users 115

Notification of Users Being Added or Deleted 115

Notification of Changes in Privilege Levels 115

User Access to Operating System Shell 116

Test-Commands 116

Enabling cli test-commands Mode 116

Enabling Password for Access to CLI-test commands 116

Exec Mode cli test-commands 117

Configuration Mode cli test-commands 117

CHAPTER 9

Software Management Operations 119

Understanding the Local File System 119

File Types Used by the Local File System 120

Understanding the boot.sys File 120

Maintaining the Local File System 121

File System Management Commands 121

Synchronizing the File System 121

Creating Directories 121

Renaming Files and Directories 121

Copying Files 122

Deleting Files 122

Removing Directories 122

Formatting Local Devices 123

ASR 5000 System Administration Guide, StarOS Release 21.1

Contents

Applying Pre-existing CLI Configuration Files 123

Viewing Files on the Local File System 123

Viewing the Contents of a Local Device 124

Viewing CLI Configuration and boot.sys Files 124

Validating an Operating System File 124

Configuring the Boot Stack 125

System Boot Methods 125

Viewing the Current Boot Stack 125

Adding a New Boot Stack Entry 127

Deleting a Boot Stack Entry 127

Network Booting Configuration Requirements 127

Configuring the Boot Interface 127

Configuring the Boot Network 128

Configuring Boot Network Delay Time 129

Configuring a Boot Nameserver 129

Upgrading the Operating System Software 129

Identifying OS Release Version and Build Number 130

Verify Free Space on the /flash Device 130

Download the Software Image from the Support Site 131

Transfer StarOS Image to /flash on the Chassis 131

Saving a Copy of the Current Configuration File 131

Preparing for a Software Downgrade 132

Downgrading from Release 12.2 to 12.0 132

Downgrading from Release 15.0 to 14.0 132

Downgrading from Release 20.0 133

Software Upgrade Methods 133

On-Line Software Upgrade 134

System Requirements to Support the On-line Software Upgrade Method 134

CLI Verification and System Preparation 134

Stage 1 - Soft Busy-out 135

Stage 2 - Stand-alone Operation 135

Stage 3 - Management Card Upgrade 136

Stage 4 - Reboot All Packet Processing Cards 136

Stage 5 - Return System to Normal Operation 137

Performing an On-line Software Upgrade 137

ASR 5000 System Administration Guide, StarOS Release 21.1

Contents

Other manuals for ASR 5000

Table of contents

Other Cisco Network Hardware manuals

Cisco

Cisco Cisco ONS 15600 SDH User manual

Cisco

Cisco Aironet 1400 Series User manual

Cisco

Cisco PC4000 User manual

Cisco

Cisco ISE - Line Card ISE User manual

Cisco

Cisco ATA 191 User manual

Cisco

Cisco MultiRIP Ethernet Card User manual

Cisco

Cisco NCS 1004 User manual

Cisco

Cisco MDS 9500 Series Manual

Cisco

Cisco ONS 15310-MA SDH Manual

Cisco

Cisco Performance Routing Engine 5 Manual

Cisco

Cisco Catalyst X6148 User manual

Cisco

Cisco Rack-Mount and Cable Mgmt. 7505/7010 User manual

Cisco

Cisco ONS 15310-CL User manual

Cisco

Cisco NCS 1002 User manual

Cisco

Cisco RSP4+ Bootflash Memory Upgrade to 16MB... Operator's manual

Cisco

Cisco 8011-2X2XP4L Manual

Cisco

Cisco Wide Area Virtualization Engine 274 Manual

Cisco

Cisco WS-CE500 - Catalyst Express 500-24PC Instruction Manual

Cisco

Cisco 2610 - Router - EN User manual

Cisco

Cisco SCE8000 GBE Operator's manual

Cisco

Cisco NCS 1010 Instruction sheet

Cisco

Cisco MC3810 Series User manual

Cisco

Cisco Network Adapter VIP-FE-TX/4E Operator's manual

Cisco

Cisco ASR 5000 User manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide