-
Cisco SCE8000 10GBE Software Configuration Guide, Release 3.7.x
-
About this Guide
-
Cisco Service Control Overview
-
Command Line Interface
-
Basic Cisco SCE8000 Platform Operations
-
Utilities
-
Configuring the Management Interface and Security
-
Global Configuration
-
Configuring the Line Interface
-
Configuring the Connection
-
Raw Data Formatting: The RDR Formatter and NetFlow Exporting
-
Managing Subscribers
-
Redundancy and Fail-Over
-
Identifying and Preventing Distributed-Denial-Of-Service Attacks
-
Managing the SCMP
-
Intelligent Traffic Mirroring
-
Cisco Service Control MIBs
-
Monitoring SCE Platform Utilization
-
SCE8000 Licensing Information
-
Feedback
Table Of Contents
Configuring the IP Routing Table
How to Configure the Default Gateway
How to Add an Entry to the IP Routing Table
How to Display the IP Routing Table
How to Display the Current IP Advertising Configuration
Configuring Time Clocks and Time Zone
Displaying the System Time: Example
Displaying the Calendar Time: Example
Setting the System Clock: Example
Setting the Time Zone: Example
Removing the Current Time Zone Setting
Configuring Daylight Saving Time
How to Define Recurring Daylight Saving Time Transitions
How to Define Non-Recurring Daylight Saving Time Transitions
How to Cancel the Daylight Saving Time Configuration
How to Display the Current Daylight Saving Time Configuration
How to Enable the SNTP Multicast Client
How to Disable the SNTP Multicast Client
How to Enable the SNTP Unicast Client
Enabling SNTP Unicast Client: Example
Disabling the SNTP Unicast Client
How to Disable the SNTP Unicast Client and Remove All Servers
How to Define the SNTP Unicast Update Interval
How to Display SNTP Information
Domain Name Server (DNS) Settings
How to Define Domain Name Servers
How to Remove a Domain Name Server
How to Remove All Domain Name Servers
How to Add a Host to the Host Table
Adding Hosts to Removing them from the Host Table: Example
How to Display Current DNS Settings
Displaying Current DNS Settings: Example
Configuring Cisco Discovery Protocol
Cisco Discovery Protocol on the Cisco SCE8000 Platform
CDP Operational Modes on the Cisco SCE8000
CDP Limitations on the Cisco SCE8000
Configuring CDP on the Cisco SCE8000 Platform
Enabling CDP on a Specific Traffic Interface
Monitoring and Maintaining CDP
Example: Monitoring and Maintaining CDP
Enabling the CLI Interface Warning Banner
OS Fingerprinting and NAT Detection
Global Configuration
Revised: September 27, 2012, OL-24150-06Introduction
This chapter explains how to perform global configuration tasks, including IP routing and clock and time zone settings.
•
Configuring Time Clocks and Time Zone
•
•
•
•
IP Routing Configuration
•
Configuring the IP Routing Table
•
•
•
For handling IP packets on the out-of-band MNG port, the SCE platform maintains a static routing table. When a packet is sent, the system checks the routing table for proper routing, and forwards the packet accordingly. In cases where the SCE platform cannot determine where to route a packet, it sends the packet to the default gateway.
SCE platform supports the configuration of the default gateway as the default next hop router, as well as the configuration of the routing table to provide different next hop routers for different subnets (for maximum configuration of 100 subnets).
The following sections illustrate how to use CLI commands to configure various parameters.
The following commands are relevant to IP routing tables:
•
•
•
•
•
•
•
How to Configure the Default Gateway
Options
The following option is available:
•
From the SCE(config)# prompt, type:
Configuring the Default Gateway: Example
The following example shows how to set the default gateway IP of the SCE platform to 10.1.1.1.
SCE(config)#ip default-gateway 10.1.1.1How to Add an Entry to the IP Routing Table
Options
The following options are available:
•
•
•
Must be within the MNG interface subnet.
From the SCE(config)# prompt, type:
ip route prefix mask next-hop
Adds the specified IP routing entry to the routing table.
How to Add an Entry to the IP Routing Table: Example
The following example shows how to set the router 10.1.1.250 as the next hop to subnet 10.2.0.0.
SCE(config)#ip route 10.2.0.0 255.255.0.0 10.1.1.250How to Display the IP Routing Table
•
•
How to Display the Entire IP Routing Table
From the SCE# prompt, type:
show ip route
Displays the entire routing table and the destination of last resort (default-gateway).
Displaying the Entire IP Routing Table: Example
This example shows how to display the routing table.
SCE#show ip route gateway of last resort is 10.1.1.1 | prefix | mask | next hop | |-----------------|------------------|-----------------| | 10.2.0.0 | 255.255.0.0 | 10.1.1.250 | | 10.3.0.0 | 255.255.0.0 | 10.1.1.253 | | 198.0.0.0 | 255.0.0.0 | 10.1.1.251 | | 10.1.60.0 | 255.255.255.0 | 10.1.1.5 |How to Display the IP Routing Table for a Specified Subnet
Options
The following options are available:
•
•
From the SCE# prompt, type:
show ip route prefix mask
Displays the routing table for the specified subnet (prefix/mask).
Displaying the IP Routing Table for a Specified Subnet: Example
This example shows how to display the routing table for a specified subnet.
SCE#show ip route 10.1.60.0 255.255.255.0 | prefix | mask | next hop | |-----------------|-----------------|-----------------| | 10.1.60.0 | 255.255.255.0 | 10.1.1.5 | sce#IP Advertising
•
IP advertising is the act of periodically sending ping requests to a configured address at configured intervals. This maintains the SCE platform IP/MAC addresses in the memory of adaptive network elements, such as switches, even during a long period of inactivity.
The following commands are relevant to IP advertising:
•
•
•
•
•
•
•
•
Configuring IP Advertising
To configure IP advertising, you must first enable IP advertising. You may then specify a destination address to which the ping request is to be sent and/or the frequency of the ping requests (interval). If no destination or interval is explicitly configured, the default values are assumed.
Options
The following options are available in the IP advertising commands:
•
default interval = 300 seconds
•
default destination = 127.0.0.1
How to Enable IP Advertising
From the SCE(config)# prompt, type:
How to Configure the IP Advertising Destination
From the SCE(config)# prompt, type:
ip advertising destination destination
Configures the destination for the IP advertising pings.
How to Configure the IP Advertising Interval
From the SCE(config)# prompt, type:
ip advertising interval interval
Configures the frequency of the IP advertising pings.
Configuring IP Advertising: Example
The following example shows how to configure IP advertising, specifying 10.1.1.1 as the destination and an interval of 240 seconds.
SCE(config)#ip advertising destination 10.1.1.1SCE(config)#ip advertising interval 240How to Display the Current IP Advertising Configuration
From the SCE# prompt, type:
show ip advertising
Displays the status of IP advertising (enabled or disabled), the configured destination, and the configured interval.
Configuring Time Clocks and Time Zone
•
•
The SCE platform has three types of time settings, which can be configured: the clock, the calendar, and the time zone. It is important to synchronize the clock and calendar to the local time, and to set the time zone properly. The SCE platform does not track Daylight Saving Time automatically, so you must update the time zone when the time changes bi-annually.
The SCE platform has the following two time sources:
•
•
It does not matter which clock you set first, as long as you use the clock and calendar read commands to ensure they are synchronized.
The time zone settings are important because they allow the system to communicate properly with other systems in other time zones. The system is configured based on Coordinated Universal Time (UTC), which is standard in the industry for coordination with other manufacturers' hardware and software. For example, Pacific Standard Time would be written as PST-10, meaning that the name of the time zone is PST, which is 10 hours behind Universal Time.
When setting and showing the time, the time is always typed or displayed according to the local time zone configured.
Displaying the System Time
From the SCE(config)# prompt, type:
Displaying the System Time: Example
The following example shows the current system clock.
SCE#show clock 12:50:03 UTC MON November 13 2001 sce#Displaying the Calendar Time
From the SCE(config)# prompt, type:
Displaying the Calendar Time: Example
The following example shows the current system calendar.
SCE#show calendar 12:50:03 UTC MON May 11 2007 sce#Setting the System Clock
Options
The following option is available:
•
hh:mm:ss day month year
From the SCE# prompt, type:
Setting the System Clock: Example
The following example shows how to set the clock to 20 minutes past 10 AM, May 13, 2007, updates the calendar and then displays the time.
SCE#clock set 10:20:00 13 may 2007 SCE#clock update-calendar SCE#show clock 10:21:10 UTC THU May 13 2007Setting the Calendar
The calendar is a system clock that continues functioning even when the system shuts down.
Options
The following option is available:
•
hh:mm:ss day month year
Step 1
Sets the system calendar to the specified time and date.
The time specified in this command is relative to the configured time zone.
Step 2
Synchronizes the system clock with the calendar time you just set .
Setting the Calendar: Example
The following example shows that the calendar is set to 10:20 AM, May 13, 2007. The clock is then synchronized with the calendar setting.
SCE#calendar set 10:20:00 13 may 20017 SCE#clock read-calendar SCE#show calendar 10:21:06 UTC THU May 13 2007Setting the Time Zone
Options
The following options are available:
•
default = GMT
•
default = 0
•
default = 0
From the SCE(config)# prompt, type:
clock timezone zone hours minutes
Sets the timezone to the specified timezone name with the configured offset in hours and minutes.
Setting the Time Zone: Example
The following example shows how to set the time zone to Pacific Standard Time with an offset of 10 hours behind UTC.
SCE(config)#clock timezone PST -10 SCE(config)#Removing the Current Time Zone Setting
From the SCE(config)# prompt, type:
no clock timezone
Removes the timezone configuration and resets the timezone to the default value (UTC).
Configuring Daylight Saving Time
The SCE platform can be configured to automatically switch to daylight saving time on a specified date, and also to switch back to standard time. In addition, the time zone code can be configured to vary with daylight saving time if required. (For instance, in the eastern United States, standard time is designated EST, and daylight saving time is designated EDT).
•
•
•
•
Options
The transition times into and out of daylight saving time may be configured in one of two ways, depending on how the dates for the beginning and end of daylight saving time are determined for the particular location:
•
•
The day on which the transition takes place may be defined in several ways:
•
•
•
The following options are available:
•
•
•
•
•
•
•
Default = 60 minutes
Guidelines
General guidelines for configuring daylight saving time transitions:
•
•
•
•
–
–
•
•
–
–
•
–
–
How to Define Recurring Daylight Saving Time Transitions
From the SCE(config)# prompt, type:
clock summer-time zone recurring [week1 day1 month1 time1 week2 day2 month2 time2 [offset ]]
Configures daylight saving time to start and stop on the specified days every year.
Defining Recurring Daylight Saving Time Transitions: Example
The following example shows how to configure recurring daylight saving time for a time zone designated "DST" as follows:
•
•
•
SCE(config)# clock summer-time DST recurring last Sunday March 00:00 4 Saturday November 23:59How to Define Non-Recurring Daylight Saving Time Transitions
From the SCE(config)# prompt, type:
clock summer-time zone [date1 month1 year1 time1 date2 month2 year2 time2 [offset ]]
Defines non-recurring daylight saving time transitions.
Defining Non-Recurring Daylight Saving Time Transitions: Example
The following example shows how to configure non-recurring daylight saving time for a time zone designated "DST" as follows:
•
•
•
SCE(config)# clock summer-time DST April 16 2004 00:00 October 23 2004 23:59How to Cancel the Daylight Saving Time Configuration
From the SCE(config)# prompt, type:
How to Display the Current Daylight Saving Time Configuration
From the SCE# prompt, type:
show timezone
Displays the current time zone and daylight saving time configuration.
Configuring SNTP
•
•
•
•
•
•
The Simple Network Timing Protocol (SNTP) is a simple solution to the problem of synchronizing the clocks in the various elements of the network. SNTP provides access to a time source via the network. The system clock and calendar are then set in accordance with this external source.
There are two options for the SNTP client. These functions are independent, and the system employ either one or both.
•
•
Note
The following commands are relevant to SNTP configuration:
•
•
•
•
•
How to Enable the SNTP Multicast Client
From the SCE(config)# prompt, type:
sntp broadcast client
Enables the SNTP multicast client. It will accept time updates from any broadcast server.
How to Disable the SNTP Multicast Client
From the SCE(config)# prompt, type:
no sntp broadcast client
Disables the SNTP multicast client. It will not accept any broadcast time updates.
How to Enable the SNTP Unicast Client
Options
The following option is available:
•
From the SCE(config)# prompt, type:
sntp server ip-address
Defines the SNTP unicast server so that SNTP client is able to query that server.
Enabling SNTP Unicast Client: Example
The following example shows how to enable an SNTP server at IP address 128.182.58.100.
SCE(config)# sntp server 128.182.58.100Disabling the SNTP Unicast Client
How to Disable the SNTP Unicast Client and Remove All Servers
From the SCE(config)# prompt, type:
How to Remove One SNTP Server
Options
The following option is available:
•
From the SCE(config)# prompt, type:
s
How to Define the SNTP Unicast Update Interval
Options
The following option is available:
•
default interval = 64 seconds
From the SCE(config)# prompt, type;
sntp update-interval interval
Configures the SNTP unicast client to query the server at the defined intervals.
Example
The following example shows how to set the SNTP update interval for 100 seconds.
SCE(config)# sntp update-interval 100How to Display SNTP Information
From the SCE> prompt, type:
show sntp
Displays the configuration of both the SNTP unicast client and the SNTP multicast client.
Example
This example illustrates how to use this command.
SCE# show sntp SNTP broadcast client: disabled last update time: not available SNTP unicast client: enabled SNTP unicast server: 128.182.58.100 last update time: Feb 10 2002, 14:06:41 update interval: 100 secondsDomain Name Server (DNS) Settings
•
•
When a name of a host is given as a parameter to a CLI command that expects a host name or an IP address, the system translates the name to an IP address according to the following:
1.
2.
3.
4.
The following commands are relevant to DNS settings:
•
•
•
•
•
Configuring DNS Lookup
How to Enable DNS Lookup
From the SCE(config)# prompt, type:
How to Disable DNS Lookup
From the SCE(config)# prompt, type:
Configuring Name Servers
•
•
•
Options
The following options are available:
•
How to Define Domain Name Servers
Use this command to specify the address of one or more name servers to use for name and address resolution.
From the SCE(config)# prompt, type:
ip name-server server-address1 [server-address2 [server-address3]]
Defines the servers at the specified addresses as domain name servers.
Defining Domain Name Servers: Example
The following example shows how to configure the two name server (DNS) IP addresses.
SCE(config)#ip name-server 10.1.1.60 10.1.1.61How to Remove a Domain Name Server
From the SCE(config)# prompt, type:
no ip name-server server-address1 [server-address2 [server-address3]]
Removes the specified server from the DNS list.
Removing a Domain Name Server: Example
The following example shows how to remove name server (DNS) IP addresses.
SCE(config)#no ip name-server 10.1.1.60 10.1.1.61How to Remove All Domain Name Servers
From the SCE(config)# prompt, type:
How to Add a Host to the Host Table
Options
The following options are available:
•
•
From the SCE(config)# prompt, type:
Adding Hosts to Removing them from the Host Table: Example
The following example shows how to add a host to the host table.
SCE(config)#ip host PC85 10.1.1.61The following example shows how to remove a hostname together with all its IP mappings.
SCE(config)#no ip host PC85How to Display Current DNS Settings
From the SCE# prompt, type:
Displaying Current DNS Settings: Example
The following example shows how to display current DNS information.
SCE#show hosts Default domain is Cisco.com Name/address lookup uses domain service Name servers are 10.1.1.60, 10.1.1.61 Host Address ---- ------- PC85 10.1.1.61 sce#Configuring Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) is a device discovery protocol that runs on Cisco manufactured equipment, and is now supported on the Cisco SCE8000 platform.
•
•
•
Cisco Discovery Protocol
CDP is primarily used to obtain protocol addresses of neighboring devices and discover the platform of those devices. It is media- and protocol-independent, and runs on all equipment manufactured by Cisco, including routers, bridges, access servers, and switches.
CDP runs on all media that support Subnetwork Access Protocol (SNAP), including LAN, Frame Relay, and ATM physical media. CDP runs over the data link layer only. Therefore, two systems that support different network-layer protocols can learn about each other.
Each device configured for CDP sends periodic messages, known as advertisements, to a multicast address. Each device advertises at least one address where it can receive SNMP messages. The advertisements also contain time-to-live, or holdtime, information, which indicates the length of time a receiving device should hold CDP information before discarding it. Each device also listens to the periodic CDP messages sent by others in order to learn about neighboring devices and determine when their interfaces to the media go up or down.
CDP Version-2 (CDPv2) is the most recent release of the protocol and provides more intelligent device tracking features. These features include a reporting mechanism that allows for more rapid error tracking, thereby reducing costly downtime. Reported error messages can be sent to the console or to a logging server, and include instances of native VLAN IDs (IEEE 802.1Q) on connecting ports that do not match, and port duplex states between connecting devices that do not match.
Type-Length-Value fields (TLVs) are blocks of information embedded in CDP advertisements. Table 6-1 summarizes the TLV definitions for CDP advertisements.
Cisco Discovery Protocol on the Cisco SCE8000 Platform
Because the Cisco SCE8000 platform functions differently from a router or a switch, there are several unique features of CDP as supported on this device.
CDP Operational Modes on the Cisco SCE8000
With a typical Cisco device, CDP is either enabled or disabled. When enabled, CDP packets are received and transmitted. When disabled, CDP packets are discarded and no packets are transmitted.
The Cisco SCE8000 is not a typical Cisco device. It is usually installed as a bump-in-the-wire device, and transparently forwards packets from one interface to the corresponding interface. This behavior conflicts with typical Cisco CDP packet processing; a typical Cisco device never forwards CDP packets from one interface to another interface. To accommodate this behavior, the Cisco SCE8000 extends the enabled state with three different CDP modes:
•
In this mode CDP functions as it does on a typical Cisco device. This mode should be used in most cases, even though it is not the default mode.
•
In this mode, "bump-in-the-wire" behavior is applied to CDP packets. This is the backward-compatible mode, equivalent to not having CDP support.
•
In this mode "bump-in-the-wire" behavior is applied to CDP packets. This mode may be confusing to operators and network management tools, because it is contrary to the concept of CDP as a physical link protocol.
Table 6-2 summarizes the CDP state and modes behavior in the Cisco SCE8000.
Note
CDP Limitations on the Cisco SCE8000
CDP as currently supported on the Cisco SCE8000 has the following limitations:
•
•
•
Configuring CDP on the Cisco SCE8000 Platform
To configure CDP, perform the tasks in the following sections:
•
Enabling CDP Globally
By default, CDP is enabled on the Cisco SCE8000. If you prefer not to use the CDP device discovery capability, use the following command to disable it.
From the SCE(config)# prompt, type:
To reenable CDP after disabling it, use the following command.
From the SCE(config)# prompt, type:
Note
Setting CDP Mode
The Cisco SCE8000 is usually installed as a bump-in-the-wire device, and therefore forwards packets (including CDP packets) from one interface to the corresponding interface, whereas a typical Cisco device never forwards CDP packets from one interface to another interface. Therefore, the Cisco SCE8000 extends the enabled state with the following three CDP modes:
•
•
•
(See CDP Operational Modes on the Cisco SCE8000 for a description of the different CDP modes.)
Caution
By default, the CDP mode is set to bypass.
To reset the CDP mode to the default mode (bypass) use the default cdp mode command.
To change the CDP mode, use the following command in global configuration mode.
From the SCE(config)# prompt, type:
Enabling CDP on a Specific Traffic Interface
By default, CDP is enabled on all traffic interfaces (see CDP Limitations on the Cisco SCE8000).
To disable CDP on a specific interface, use the no cdp enable command in the appropriate interface configuration mode.
To reenable CDP on a specific interface after disabling it, use the following command in the appropriate interface configuration mode. CDP must be enabled globally on the SCE8000 platform (cdp run command) in order to enable a specific interface.
From the SCE(config if)# prompt, type:
Tip
Setting the Hold Time
Use this command to set the mount of time the receiving device should hold a CDP packet from your router before discarding it. Use either the no or the default form of the command to restore the holdtime to the default value.
Options
The following option is available:
•
default = 180 seconds
From the SCE(config)# prompt, type:
Setting the Timer
Use this command to configure how often the SCE8000 platform sends CDP updates. Use either the no or the default form of the command to restore the timer to the default value.
Options
The following option is available:
•
default = 60 seconds
From the SCE(config)# prompt, type:
Monitoring and Maintaining CDP
To monitor and maintain CDP on the Cisco SCE8000, use one or more of the following commands.
The clear commands are in privileged EXEC mode. The show commands are in viewer mode.
CDP Configuration Examples
Example: Setting the CDP Mode
The following example illustrates how to configure CDP mode to `standard'.
Caution
The show command verifies that the CDP configuration has been correctly updated.
sce(config)# cdp mode standardsce(config)# do show cdpGlobal CDP information:Sending CDP packets every 60 secondsSending a holdtime value of 180 secondsSending CDPv2 advertisements is enabledstandard mode - CDP packets are received and processed. CDP packets are generated.Example: Monitoring and Maintaining CDP
The following example shows a typical series of steps for viewing information about CDP neighbors.
Table 6-3 describes the significant fields shown in the output of the show cdp neighbors command.
sce> show cdpGlobal CDP information:Sending CDP packets every 60 secondsSending a holdtime value of 180 secondsSending CDPv2 advertisements is enabledstandard mode - CDP packets are received and processed. CDP packets are generated.sce> show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - PhoneDevice ID Local Intrfce Holdtme Capability Platform Port IDLab-Router Ten 3/0/0 169 R S I CISCO7604 Ten 3/1Lab-Router Ten 3/1/0 169 R S I CISCO7604 Ten 3/2Lab-Router Ten 3/2/0 169 R S I CISCO7604 Ten 3/3Lab-Router Ten 3/3/0 169 R S I CISCO7604 Ten 3/4sce>
Enabling the CLI Interface Warning Banner
A warning banner is a message displayed when the user connects to the SCE using either Telnet or the console connection. It serves as a security warning for unauthorized users trying to connect to SCE platform. It can also provide device details, as well as information about the service and application.
By default the banner is disabled. You do not have to shutdown the SCE platform in order to enable or disable the banner.
From the SCE(config)# prompt, type:
OS Fingerprinting and NAT Detection
OS fingerprinting is the process of determining the identity of a remote host operating system by analyzing packets from that host. It detects the operating system used by the subscriber and whether the subscriber is present in a NAT environment by analyzing subscriber traffic. NAT detection is based on whether the same subscriber is connecting using multiple operating systems.
An encrypted fingerprint file that has the list of OS signatures is packaged with each SCOS release. Signature files are updated as needed, and the updated signature files are available on cisco.com.
The detected OS type is reported using the following mechanisms:
•
•
•
•
Restrictions and Limitations
Due to the nature of the SCE platform, there are certain limitations to the scope of the OS fingerprinting and NAT detection feature:
•
•
•
•
–
–
–
•
•
•
Configuring OS Fingerprinting
By default, the OS fingerprinting feature is disabled. When OS fingerprinting is enabled, you can also configure the following OS fingerprinting parameters:
•
•
OS fingerprinting is done for "sampling window" seconds every "sampling interval" minutes.
•
•
•
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Monitoring OS Fingerprinting
To monitor OS fingerprinting, use one or more of the following commands.
These commands are in viewer mode.
