-
Cisco CMTS Feature Guide
-
Title Pages
-
Preface
-
Admission Control for the Cisco Cable Modem Termination System
-
Cable Duplicate MAC Address Reject for the Cisco CMTS
-
Cable Interface Bundling and Virtual Interface Bundling for the Cisco CMTS
-
Cable Monitor and Intercept Features on the Cisco CMTS
-
COPS Engine Operation on the Cisco CMTS
-
DHCP, ToD, and TFTP Services for the Cisco Cable Modem Termination System
-
DOCSIS 1.1 for the Cisco CMTS
-
DOCSIS 2.0 A-TDMA Services on the Cisco CMTS
-
Internal DOCSIS Configurator File Generator for the Cisco CMTS
-
EtherChannel on the Cisco Cable Modem Termination System
-
Flap List Troubleshooting for the Cisco CMTS
-
Maximum CPE or Host Parameters for the Cisco Cable Modem Termination System
-
N+1 Redundancy for the Cisco Cable Modem Termination System
-
PacketCable and PacketCable Multimedia for the Cisco CMTS
-
Point-to-Point Protocol over Ethernet Support on the Cisco CMTS
-
Service Flow Admission Control for the Cisco CMTS
-
Service Flow Mapping to MPLS-VPN on the Cisco CMTS
-
Spectrum Management and Advanced Spectrum Management for the Cisco CMTS
-
Telco Return for the Cisco CMTS
-
Time-of-Day Server for the Cisco CMTS
-
Unique Device Identifier Retrieval for the Cisco CMTS
-
Upstream Scheduler Mode for the Cisco CMTS
-
Glossary
-
Table Of Contents
Prerequisites for DOCSIS 1.1 Operations
Restrictions for DOCSIS 1.1 Operations
Baseline Privacy Interface Plus
Packet Header Suppression Rules
How to Configure the Cisco CMTS for DOCSIS 1.1 Operations
Configuring Baseline Privacy Interface (optional)
Downloading the DOCSIS Root Certificate to the CMTS (required)
Adding a Manufacturer's Certificate as a Trusted Certificate (optional)
Adding a Certificate as a Trusted Certificate Using the Command Line Interface
Adding a Certificate as a Trusted Certificate Using SNMP Commands
Adding a Manufacturer's or CM Certificate to the Hotlist (required)
Adding a Certificate to the Hotlist Using the Command Line Interface
Adding a Certificate to the Hotlist Using SNMP Commands
Enabling Concatenation (optional)
Enabling DOCSIS Fragmentation (optional)
Using Enhanced Rate Bandwidth Allocation (ERBA) Support for DOCSIS 1.0 Cable Modems
Configuring Downstream ERBA Settings for DOCSIS 1.0 Cable Modems
Enabling DOCSIS 1.1 Downstream Maximum Transmit Burst on the Cisco uBR10012 Router with PRE2 Modules
Displaying the Status of Cable Modems
Displaying a Summary Report for the Cable Modems
Displaying the Capabilities of the Cable Modems
Displaying Detailed Information About a Particular Cable Modem
Monitoring the RF Network and Cable Interfaces
Displaying Information About the Mac Scheduler
Displaying Information About QoS Parameter Sets
Displaying Information About Service Flows
Displaying Information About Service IDs
Displaying the Current BPI+ State of Cable Modems
Displaying the BPI+ Timer Values on the CMTS
Displaying the Certificate List on the CMTS
Configuration Examples for DOCSIS 1.1 Operations
DOCSIS 1.1 Configuration for Cisco uBR7246VXR Router (without BPI+)
DOCSIS 1.1 Configuration for Cisco uBR7246VXR Router (with BPI+)
DOCSIS 1.1 Configuration for Cisco uBR10012 Router (with BPI+)
DOCSIS 1.1 for the Cisco CMTS
Revised: June 6, 2007, 0L-1467-08
This document describes how to configure the Cisco CMTS router for Data-over-Cable Service Interface Specifications (DOCSIS) 1.1 operations.
Feature Specifications for DOCSIS 1.1 Operations
12.1(4)CX
DOCSIS 1.1 support was introduced for Cisco uBR7200 series routers.
12.1(7)CX1
Several DOCSIS 1.1 MIBs were updated, reflecting changes in the DOCSIS 1.1 specification. The cable submgmt default command was also added, to set the default value of the attributes in DOCS-SUBMGT-MIB.
12.2(4)XF1
12.2(4)BC1DOCSIS 1.1 support was introduced for the Cisco uBR7100 series, Cisco uBR7200 series, and Cisco uBR10012 routers on the Release 12.2 BC train.
12.2(4)BC1b
N+1 redundancy during DOCSIS 1.1 operations was supported on the Cisco uBR10012 router.
12.2(8)BC2
The show cable modem mac command was enhanced to show the DOCSIS capabilities and provisioned state of each cable modem.
12.2(11)BC1
N+1 redundancy during DOCSIS 1.1 operations was supported on the Cisco uBR7200 series router.
12.2(11)BC2
The packetcable authorize vanilla-docsis-mta command was supported to allow DOCSIS 1.1 cable modems to use UGS service flows when PacketCable operations have been enabled.
12.3(13a)BC
Added support for Enhanced Rate Bandwidth Allocation (ERBA) for DOCSIS 1.0 cable modems, to include the following new configuration command and show command enhancement:
•
cable qos pro max-ds-burst burst-size
•
Refer to the "Using Enhanced Rate Bandwidth Allocation (ERBA) Support for DOCSIS 1.0 Cable Modems" section.
12.3(21)BC
Added support for an enhanced version of ERBA on the Cisco uBR10012 router. Refer to the "Using Enhanced Rate Bandwidth Allocation (ERBA) Support for DOCSIS 1.0 Cable Modems" section.
Cisco uBR7100 series, Cisco uBR7200 series, Cisco uBR10012 universal broadband routers.
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
•
•
•
Prerequisites for DOCSIS 1.1 Operations
To support DOCSIS 1.1 operations, the CMTS must be running Cisco IOS Release 12.1(4)BC1 or later Cisco IOS 12.2 BC Release, and the cable modem must also support the DOCSIS 1.1 feature set. In addition, before you power on and configure the Cisco CMTS, check the following points:
•
•
•
•
•
•
•
After these prerequisites are met, you are ready to configure the Cisco CMTS. This includes, at a minimum, configuring a host name and password for the Cisco CMTS and configuring the Cisco CMTS to support IP over the cable plant and network backbone.
Caution
Restrictions for DOCSIS 1.1 Operations
DOCSIS 1.1 operations includes the following restrictions:
Baseline Privacy Interface Plus Requirements
BPI+ encryption and authentication must be supported and enabled by both the cable modem and CMTS. In addition, the cable modem must contain a digital certificate that conforms to the DOCSIS 1.1 and BPI+ specifications.
Also, ensure that the system clocks on the CMTS and on the time-of-day (ToD) servers are synchronized. If this does not occur, the clocks on the CMs will not match the clocks on the CMTS, which could interfere with BPI+ operations. In particular, this could prevent the proper verification of the digital certificates on the CM.
Note
BPI+-Encrypted Multicast Not Supported with Bundled Subinterfaces on the Cisco uBR10012 Router
The current Cisco IOS releases do not support using BPI+ encrypted multicast on bundled cable subinterfaces on the Cisco uBR10012 router. Encrypted multicast is supported on bundled cable interfaces or on non-bundled cable subinterfaces, but not when a subinterface is bundled on the Cisco uBR10012 router. This restriction does not apply to Cisco uBR7200 series routers.
BPI+ Not Supported with High Availability Configurations
The current Cisco IOS releases do not support using BPI+ encrypted multicast on a cable interface when the interface has also been configured for N+1 (1:n) High Availability or Remote Processor Redundancy Plus (RPR+) High Availability redundancy.
In addition, BPI+ is not automatically supported after a switchover from the Working cable interface to the Protect cable interface, because the cable interface configurations that are required for BPI+ encryption are not automatically synchronized between the two interfaces. A workaround for this is to manually configure the Protect cable interfaces with the required configurations.
Cable Interface Cards
DOCSIS 1.1 traffic is supported on Cisco uBR-MC1XC and Cisco uBR-MC28C cable interface line cards. The Cisco uBR-MC11 (FPGA) and Cisco uBR-MC16B line cards do not support DOCSIS 1.1.
Cable Privacy Hotlist CLI Not Supported on Cisco uBR10012 Router
The cable privacy hotlist command is not supported on the Cisco uBR10012 router. To add a manufacturer's or CM certificate to the hotlist on the Cisco uBR10012 router, use SNMP commands to set the appropriate attributes in DOCS-BPI-PLUS-MIB. See the "Adding a Certificate to the Hotlist Using SNMP Commands" section.
DOCSIS Root Certificates
The Cisco CMTS supports only one DOCSIS Root CA certificate.
Maximum Burst Size
Previously, the maximum concatenated burst size parameter could be set to zero to specify an unlimited value. In a DOCSIS 1.1 environment, this parameter should be set to a nonzero value, with a maximum value of 1522 bytes for DOCSIS 1.0 cable modems.
If a cable modem attempts to register with a maximum concatenation burst size of zero, the DOCSIS 1.1 CMTS refuses to allow the cable modem to come online. This avoids the possibility that a DOCSIS 1.0 cable modem could interfere with voice traffic on the upstream by sending extremely large data packets. Since DOCSIS 1.0 does not support fragmentation, transmitting such data packets could result in unwanted jitter in the voice traffic.
In addition, DOCSIS 1.1 requires that the maximum transmit burst size be set to either 1522 bytes or the maximum concatenated burst size, whichever is larger. Do not set the maximum concatenation burst size to values larger than 1522 bytes for DOCSIS 1.0 cable modems.
Note
Performance
DOCSIS 1.0 cable modems lack the ability to explicitly request and provide scheduling parameters for advanced DOCSIS 1.1 scheduling mechanisms, such as unsolicited grants and real-time polling. DOCSIS 1.1 cable modems on the same upstream channel can benefit from the advanced scheduling mechanisms and a DOCSIS 1.1 CMTS can still adequately support voice traffic from DOCSIS 1.1 cable modems with DOCSIS 1.0 cable modems on the same upstream channel.
Provisioning
The format and content of the TFTP configuration file for a DOCSIS 1.1 cable modem are significantly different from the file for a DOCSIS 1.0 cable modem. A dual-mode configuration file editor is used to generate a DOCSIS 1.0 style configuration file for DOCSIS 1.0 cable modems and a DOCSIS 1.1 configuration file for DOCSIS 1.1 cable modems.
Registration
A DOCSIS 1.1 CMTS must handle the existing registration Type/Length/Value parameters from DOCSIS 1.0 cable modems as well as the new type TLVs from DOCSIS 1.1 cable modems. A DOCSIS 1.0 and DOCSIS 1.1 cable modem can successfully register with the same DOCSIS 1.1 CMTS.
A DOCSIS 1.1 cable modem can be configured to make an indirect reference to a service class that has been statically defined at the CMTS instead of explicitly asking for the service class parameters. When this registration request is received by a DOCSIS 1.1 CMTS, it encodes the actual parameters of the service class in the registration response and expects a DOCSIS 1.1-specific registration-acknowledge MAC message from the cable modem.
When a DOCSIS 1.0 cable modem registers with a DOCSIS 1.1 CMTS, the registration request explicitly requests all nondefault service-class parameters in the registration. The absence of an indirect service class reference eliminates the need for the DOCSIS 1.1 TLVs and eliminates the need to establish a local registration acknowledge wait state.
When a DOCSIS 1.1 CMTS receives a registration request from a DOCSIS 1.0 cable modem, it responds with the DOCSIS 1.0 style registration response and does not expect the cable modem to send the registration-acknowledge MAC message.
Information about DOCSIS 1.1
•
Feature Overview
DOCSIS 1.1 is the first major revision of the initial DOCSIS 1.0 standard for cable networks. Although the initial standard provided quality data traffic over the coaxial cable network, the demands of real-time traffic such as voice and video required many changes to the DOCSIS specification.
The DOCSIS 1.1 specification provides the following feature enhancements over DOCSIS 1.0 networks:
•
Baseline Privacy Interface Plus
DOCSIS 1.0 introduced a Baseline Privacy Interface (BPI) to protect user data privacy across the shared-medium cable network and to prevent unauthorized access to DOCSIS-based data transport services across the cable network. BPI encrypts traffic across the RF interface between the cable modem and CMTS, and also includes authentication, authorization, and accounting (AAA) features.
BPI supports access control lists (ACLs), tunnels, filtering, protection against spoofing, and commands to configure source IP filtering on RF subnets to prevent subscribers from using source IP addresses that are not valid. DOCSIS 1.1 enhances these security features with BPI Plus (BPI+), which includes the following enhancements:
•
•
•
•
•
Note
Concatenation
Concatenation allows a cable modem to make a single time-slice request for multiple upstream packets, sending all of the packets in a single large burst on the upstream. Concatenation can send multiple upstream packets as part of one larger MAC data frame, allowing the cable modem to make only one time-slot request for the entire concatenated MAC frame, reducing the delay in transmitting the packets on the upstream channel. This avoids wasting upstream bandwidth when sending a number of very small packets, such as TCP acknowledgement packets.
Dynamic MAC Messages
Dynamic Service MAC messages allow the cable modem to dynamically create service flows on demand. These messages are DOCSIS link layer equivalents of the higher layer messages that create, tear down, and modify a service flow.
The DOCSIS 1.1 dynamic services state machine supports the following messages:
•
•
•
Note
Enhanced Quality of Service
DOCSIS 1.1 provides enhanced quality of service (QoS) capabilities to give priority for real-time traffic such as voice and video:
•
•
•
•
–
–
–
–
–
Fragmentation
DOCSIS fragmentation allows the upstream MAC scheduler to slice large data requests to fit into the scheduling gaps between UGS (voice slots). This prevents large data packets from affecting real-time traffic, such as voice and video.
Fragmentation reduces the run-time jitter experienced by the UGS slots when large data grants preempt the UGS slots. Disabling fragmentation increases the run-time jitter, but also reduces the fragmentation reassembly overhead for fragmented MAC frames.
Note
Interoperability
DOCSIS 1.1 cable modems can coexist with DOCSIS 1.0 and 1.0+ cable modems in the same network. The Cisco CMTS provides the levels of service that are appropriate for each cable modem.
Payload Header Suppression
Payload header suppression (PHS) conserves link-layer bandwidth by suppressing repetitive or redundant packet headers on both upstream and downstream service flows. PHS is enabled or disabled per service flow, and each service flow can support a separate set of PHS rules that determine which parts of the header are suppressed. This ensures that PHS is done in the most efficient manner for each service flow and its particular type of application.
DOCSIS 1.1 Quality of Service
The DOCSIS 1.1 QoS framework is based on the following objects:
•
•
•
•
See the following sections for more information on these components.
Service Flow
In DOCSIS 1.1, the basic unit of QoS is the service flow, which is a unidirectional sequence of packets transported across the RF interface between the cable modem and CMTS. A service flow defines a set of QoS parameters such as latency, jitter, and throughput assurances, and these parameters can be applied independently to the upstream and downstream traffic flows. This is a major difference from DOCSIS 1.0 networks, where the same QoS parameters were applied to both the downstream and upstream flows.
Note
Every cable modem establishes primary service flows for the upstream and downstream directions, with a separate SFID for the upstream and the downstream flows. The primary flows maintain connectivity between the cable modem and CMTS, allowing the CMTS to send MAC management messages at all times to the cable modem.
In addition, a DOCSIS 1.1 cable modem can establish multiple secondary service flows. The secondary service flows either can be permanently created (by configuring them in the DOCSIS configuration file that is downloaded to the cable modem), or the service flows can be created dynamically to meet the needs of the on-demand traffic, such as voice calls. Permanent service flows remain in effect, even if they are not being used, while dynamic service flows are deleted when they are no longer needed.
At any given time, a service flow might be in one of three states (provisioned, admitted, or active). Only active flows are allowed to pass traffic on the DOCSIS network. Every service flow is identified by an SFID, while upstream service flows in the admitted and active state have an extra Layer 2 SID associated with them. The SID is the identifier used by the MAC scheduler when specifying time-slot scheduling for different service flows.
Service Class
Each service flow is associated with a service class, which defines a particular class of service and its QoS characteristics, such as the maximum bandwidth for the service flow and the priority of its traffic. The service class attributes can be inherited from a preconfigured CMTS local service class (class-based flows), or they can be individually specified when a cable modem dynamically requests a service flow and the CMTS creates it.
The DOCSIS 1.1 service class also defines the MAC-layer scheduling type for the service flow. The schedule type defines the type of data burst requests that the cable modem can make, and how often it can make those requests. The following types of schedule types are supported:
•
•
•
•
•
Each service flow is assigned a single service class, but the same service class can be assigned to multiple service flows. Also, a cable modem can be assigned multiple service flows, allowing it to have multiple traffic flows that use different service classes.
Packet Classifiers
In DOCSIS 1.0 networks, a cable modem used only one set of QoS parameters for all of its traffic, so the CMTS simply had to route packets to and from the appropriate cable modems. In DOCSIS 1.1 networks, however, cable modems can be using multiple service flows, and each service flow can be given a different level of service. To quickly assign upstream and downstream packets to their proper service flows, the CMTS uses the concept of packet classifiers.
Each packet classifier specifies one or more packet header attributes, such as source MAC address, destination IP address, or protocol type. The classifier also specifies the service flow to be used when a packet matches this particular combination of headers. Separate classifiers are used for downstream and upstream service flows.
When the CMTS receives downstream and upstream packets, it compares each packet's headers to the contents of each packet classifier. When the CMTS matches the packet to a classifier, the CMTS then assigns the proper SFID to the packet and transmits the packet to or from the cable modem. This ensures that the packet is assigned its proper service flow, and thus its proper QoS parameters.
Figure 7-1 illustrates the mapping of packet classifiers.
Figure 7-1 Classification Within the MAC Layer
Packet Header Suppression Rules
Because many data and real-time applications may use fixed values in their packet header fields, DOCSIS 1.1 supports PHS to suppress the duplicate portions of the packet headers when a group of packets is transmitted during a session. Each service flow can support a separate set of PHS rules that determine which parts of the header are suppressed.
When PHS is being used, the transmitting CMTS suppresses the specified headers in all the packets for that service flow. The receiving CMTS then restores the missing headers before forwarding the packets on to their ultimate destination.
Proper use of PHS can increase the efficiency of packetized transmissions, especially for real-time data that is encapsulated by other protocols, such as VoIP traffic.
Quality of Service Comparison
This section summarizes the differences in QoS between DOCSIS 1.0, DOCSIS 1.0+, and DOCSIS 1.1 networks.
Note
DOCSIS 1.0
DOCSIS1.0 uses a static QoS model that is based on a class of service (CoS) that is preprovisioned in the DOCSIS configuration file that is downloaded to the cable modem. The CoS is a bidirectional QoS profile that applies to both the upstream and downstream directions, and that has limited control, such as peak rate limits in either direction, and relative priority on the upstream.
DOCSIS 1.0 defines the concept of a service identifier (SID), which identifies the cable modems that are allowed to transmit on the network. In DOCSIS 1.0 networks, each cable modem is assigned only one SID for both the upstream and downstream directions, creating a one-to-one correspondence between a cable modem and its SID. All traffic originating from, or destined for, a cable modem is mapped to that particular SID.
Typically, a DOCSIS 1.0 cable modem has one CoS and treats all traffic the same, which means that data traffic on a cable modem can interfere with the quality of a voice call in progress. The CMTS, however, has a limited ability to prioritize downstream traffic based on IP precedent type-of-service (ToS) bits.
For example, voice calls using higher IP precedence bits receive a higher queueing priority (but without a guaranteed bandwidth or rate of service). A DOCSIS 1.0 cable modem could increase voice call quality by permanently reserving bandwidth for voice calls, but then that bandwidth would be wasted whenever a voice call is not in progress.
DOCSIS 1.0+
In response to the limitations of DOCSIS 1.0 networks in handling real-time traffic, such as voice calls, Cisco created the DOCSIS 1.0+ extensions to provide the more important QoS enhancements that were expected in DOCSIS 1.1. In particular, the DOCSIS 1.0+ enhancements provide basic Voice-over-IP (VoIP) service over the DOCSIS link.
Cisco's DOCSIS 1.0+ extensions include the following DOCSIS 1.1 features:
•
•
•
•
•
Caution
Interoperability with Different Versions of DOCSIS Networks
DOCSIS 1.1 cable modems have additional features and better performance than earlier DOCSIS 1.0 and 1.0+ models, but all three models can coexist in the same network. DOCSIS 1.0 and 1.0+ cable modems will not hamper the performance of a DOCSIS 1.1 CMTS, nor will they interfere with operation of DOCSIS 1.1 features.
Table 7-1 shows the interoperability of a DOCSIS 1.1 CMTS with different versions of cable modems.
Benefits
DOCSIS 1.1 includes a rich set of features that provide advanced and flexible QoS capabilities for various types of traffic (voice, data, and video) over the cable network. It also provides enhanced security and authentication features.
Baseline Privacy Interface Plus Enhancement
The Plus (+) version of the Baseline Privacy Interface (BPI+) in DOCSIS 1.1 provides a set of extended services within the MAC sublayer that increase performance and system security. Digital certificates provide secure authentication for each cable modem, to prevent identity theft on the basis of MAC and IP addresses. Advanced encryption provides a secure channel between the cable modem and CMTS, and secure software download allows a service provider to upgrade the software on cable modems, without the threat of interception, interference, or alteration of the software code.
Dynamic Service Flows
The dynamic creation, modification, and deletion of service flows allows for on-demand reservation on Layer 2 bandwidth resources. The CMTS can now provide special QoS to the cable modem dynamically for the duration of a voice call or video session, as opposed to the static provisioning and reservation of resources at the time of cable modem registration. This provides a more efficient use of the available bandwidth.
Concatenation
The cable modem concatenates multiple upstream packets into one larger MAC data frame, allowing the cable modem to make only one time-slot request for the entire concatenated MAC frame, as opposed to requesting a time slot for each packet. This reduces the delay in transferring the packet burst upstream.
Enhanced QoS
Extensive scheduling parameters allow the CMTS and the cable modem to communicate QoS requirements and achieve more sophisticated QoS on a per service-flow level.
Different new time-slot scheduling disciplines help in providing guaranteed delay and jitter bound on shared upstream. Activity detection helps to conserve link bandwidth by not issuing time slots for an inactive service flow. The conserved bandwidth can then be reused for other best-effort data slots.
Packet classification helps the CMTS and cable modem to isolate different types of traffic into different DOCSIS service flows. Each flow could be receiving a different QoS service from CMTS.
Fragmentation
Fragmentation splits large data packets so that they fit into the smaller time slots inbetween UGS slots. This reduces the jitter experienced by voice packets when large data packets are transmitted on the shared upstream channel and preempt the UGS slots used for voice.
Multiple Subflows per SID
This feature allows the cable modem to have multiple calls on a single hardware queue. This approach scales much better than requiring a separate SID hardware queue on the cable modem for each voice call.
Payload Header Suppression
Payload Header Suppression (PHS) allows the CMTS and cable modem to suppress repetitive or redundant portions in packet headers before transmitting on the DOCSIS link. This conserves link bandwidth, especially with types of traffic such as voice, where the header size tends to be as large as the size of the actual packet.
Service Classes
The use of the service class provides the following benefits for a DOCSIS 1.1 network:
•
•
•
Note
How to Configure the Cisco CMTS for DOCSIS 1.1 Operations
See the following sections for the configuration tasks for DOCSIS 1.1 operations. Each task in the list is identified as either required or optional.
•
•
•
•
•
•
•
Note
Configuring Baseline Privacy Interface (optional)
BPI+ encryption is by default enabled for 56-bit DES encryption on all cable interfaces. If BPI+ encryption has been previously disabled, or if you want to reconfigure BPI+ encryption on a cable interface on the CMTS, use the following procedure.
Note
Prerequisites
BPI+ encryption is supported on all Cisco CMTS images that include "k1", "k8", or "k9" in its file name or BPI in the feature set description. All BPI images support 40-bit and 56-bit DES encryption.
By default, BPI+ encryption is enabled for 56-bit DES encryption. Also, when a cable modem is running DOCSIS 1.1 software, BPI+ encryption is enabled by default, unless the service provider has disabled it by setting the Privacy Enable field (TLV 29) in the DOCSIS configuration file to 0. Therefore, both the CMTS and cable modem are set to use BPI+ encryption when using the default configurations.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
Caution
7.
8.
9.
10.
11.
12.
13.
14.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Router#
Enables privileged EXEC mode. Enter your password if prompted.
Step 2
configure terminal
Example:Router# configure terminal
Router(config)#
Enters global configuration mode.
Step 3
interface cable x/y
Example:Router(config)# interface cable 6/0
Router(config-if)#
Enters interface configuration mode for the cable interface line card at this particular slot.
Step 4
cable privacy
Example:Router(config-if)# cable privacy
Router(config-if)#
(Optional) Enables BPI+ 56-bit DES encryption on the cable interface (default).
Step 5
cable privacy 40-bit-des
Example:Router(config-if)# cable privacy 48-bit-des
Router(config-if)#
(Optional) Enables BPI+ 40-bit DES encryption on the cable interface. Cisco does not recommend this option for production systems because 40-bit encryption is not as secure as the 56-bit DES or 168-bit 3DES encryption algorithms.
Step 6
cable privacy accept-self-signed-certificate
Example:Router(config-if)# cable privacy accept-self-signed-certificate
Router(config-if)#
(Optional) Allows cable modems to register using self-signed manufacturer certificates, as opposed to the default of allowing only manufacturer's certificates that are chained to the DOCSIS root certificate.
Caution
Note
Step 7
cable privacy authenticate-modem
Example:Router(config-if)# cable privacy authenticate-modem
Router(config-if)#
(Optional) Enables BPI+ encryption on the cable interface and uses the Cisco IOS Authentication, Authorization and Accounting (AAA) service together with BPI to authenticate the CMs.
Step 8
cable privacy authorize-multicast
Example:Router(config-if)# cable privacy authorize-multicast
Router(config-if)#
(Optional) Enables BPI+ encryption on the cable interface and uses AAA protocols to authorize all multicast stream (IGMP) join requests.
Note
Step 9
cable privacy mandatory
Example:Router(config-if)# cable privacy mandatory
Router(config-if)#
(Optional) Enables BPI+ encryption on the cable interface and requires baseline privacy for all CMs. If a CM does not enable BPI or BPI+ encryption in its DOCSIS configuration file, it will not be allowed to come online.
Step 10
cable privacy oaep-support
Example:Router(config-if)# cable privacy oaep-support
Router(config-if)#
(Optional) Enables BPI+ encryption on the cable interface and enables Optimal Asymmetric Encryption Padding (OAEP). This option is enabled by default. Disabling this option could have a performance impact.
Step 11
cable privacy kek {grace-time seconds | life-time seconds}
Example:Router(config-if)# cable privacy kek grace-time 480
Router(config-if)# cable privacy kek life-time 302400
Router(config-if)#
(Optional) Configures the grace-time and life-time values for the key encryption keys (KEKs) for BPI+ operations on all cable interfaces.
•
•
Step 12
cable privacy tek {grace-time seconds | life-time seconds}
Example:Router(config-if)# cable privacy tek grace-time 1800
Router(config-if)# cable privacy tek life-time 86400
Router(config-if)#
(Optional) Configures the grace-time and life-time values for the traffic encryption keys (TEKs) for BPI+ operations on all cable interfaces.
•
•
Step 13
exit
Example:Router(config-if)# exit
Router(config)#
Exits interface configuration mode.
Note
Step 14
exit
Example:Router(config)# exit
Router#
Exits global configuration mode.
1 The KEK and TEK grace-time values apply only to DOCSIS 1.0 cable modems using BPI encryption. Cable modems that are running DOCSIS 1.1 software configure the grace-time values in their DOCSIS configuration files, and those values automatically override the CMTS settings. If a DOCSIS 1.1 configuration file does not specifically contain the grace-time values, the cable modem defaults to 600 seconds, which is the value that the CMTS then uses for the modem.
You can also configure the following additional timers for BPI+ operations in the DOCSIS configuration file for each cable modem. As a general rule, you do not need to specify these timers in the DOCSIS configuration file unless you have a specific reason for changing them from their default values.
Downloading the DOCSIS Root Certificate to the CMTS (required)
DOCSIS 1.1 allows cable modems to identify themselves using a manufacturer's chained X.509 digital certificate that is chained to the DOCSIS root certificate. To enable the use of these digital certificates in the DOCSIS network, you must download the DOCSIS root certificate from the Verisign website and copy it to the bootflash on the Cisco CMTS router.
Tip
http://www.verisign.com/products/cable/index.html
Note
In prior Cisco IOS Releases, with the prior limitation, EuroDOCSIS or PacketCable devices could still come online, however, if they used self-signed manufacturer's digital certificates.To download the DOCSIS root certificate to the Cisco CMTS, which is required if any cable modems on the network are using chained certificates, use the following procedure:
Step 1
http://www.verisign.com/products/cable/root.htmlStep 2
Tip
Step 3
Router> enablePassword: <password>Router#Step 4
Router# dir bootflash:Directory of bootflash:/1 -rw- 3229188 Dec 30 2002 15:53:23 ubr7200-boot-mz.122-11.BC2.bin3407872 bytes total (250824 bytes free)Router#
Tip
Step 5
Router# copy tftp bootflash:Address or name of remote host []? tftp-server-ip-addressSource filename []? CableLabs_DOCSIS.509Destination filename [CableLabs_DOCSIS.509]? root-certLoading CableLabs_DOCSIS.509 from tftp-server-ip-address (via FastEthernet0/0): ![OK - 996/1024 bytes]996 bytes copied in 4.104 secs (249 bytes/sec)Router#
Tip
Step 6
Router# dir bootflash:Directory of bootflash:/1 -rw- 3229188 Dec 30 2002 15:53:23 ubr7200-boot-mz.122-11.BC2.bin2 -rw- 996 Mar 06 2002 16:03:46 root-cert3408876 bytes total (248696 zxbytes free)Router#Step 7
Note
Router# show crypto ca trustpointsRoot certificateStatus: AvailableCertificate Serial Number: D54BB68FE934324F6B8FD0E41A65D867Key Usage: General PurposeIssuer:CN = DOCSIS Cable Modem Root Certificate AuthorityOU = Cable ModemsO = Data Over Cable Service Interface SpecificationsC = USSubject Name:CN = "BPI Cable Modem Root Certificate Authority "OU = DOCSISO = BPIC = USValidity Date:start date: 07:00:00 UTC Mar 27 2001end date: 06:59:59 UTC Jan 1 2007
Tip
Adding a Manufacturer's Certificate as a Trusted Certificate (optional)
To DOCSIS specifications allow operators to control which manufacturer's and CM certificates are allowed on each CMTS by marking them as either trusted or untrusted. You can add a certificate to the list of trusted certificates on the Cisco CMTS using either CLI commands or SNMP commands, as described in the following sections:
•
•
Note
Adding a Certificate as a Trusted Certificate Using the Command Line Interface
To add a manufacturer's certificate to the list of trusted certificates on the CMTS, use the following procedure:
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Adding a Certificate as a Trusted Certificate Using SNMP Commands
You can also use an SNMP manager to create and add certificates to the CMTS list of trusted certificates by manipulating the tables and attributes in the DOCS-BPI-PLUS-MIB. To add a manufacturer's certificate, add an entry to the docsBpi2CmtsCACertTable table. Specify the following attributes for each entry:
•
•
•
Similarly, to add a CM certificate to the list of trusted certificates, add an entry to the docsBpi2CmtsProvisionedCmCertTable table. Specify the following attributes for each entry:
•
•
•
