Feedback
Table Of Contents
Establishing a Console Connection on the ACE
Sessioning and Logging In to the ACE
Changing the Administrative Password
Resetting the Administrator Account Password
Configuring an ACE Inactivity Timeout
Configuring a Message-of-the-Day Banner
Adjusting for Daylight Saving Time
Viewing the System Clock Settings
Configuring Terminal Display Attributes
Configuring Terminal Line Settings
Configuring Console Line Settings
Configuring Virtual Terminal Line Settings
Modifying the Boot Configuration
Setting the Boot Method from the Configuration Register
Booting the ACE from the rommon Prompt
Setting the BOOT Environment Variable
Displaying the ACE Boot Configuration
Restarting the ACE from the CLI
Restarting the ACE from the Catalyst CLI
Setting Up the ACE
This chapter describes how to initially configure basic settings on the Cisco Application Control Engine (ACE) module in the Catalyst 6500 series switches. It contains the following major sections:
•
Establishing a Console Connection on the ACE
•
•
•
•
•
•
•
For details on assigning VLANs to the ACE, configuring VLAN interfaces on the ACE, and configuring a default or static route on the ACE, see the Cisco Application Control Engine Module Routing and Bridging Configuration Guide.
Establishing a Console Connection on the ACE
You can establish a direct serial connection between your terminal and the ACE by making a serial connection to the console port on the front of the ACE. The console port is an asynchronous RS-232 serial port with an RJ-45 connector. Any device connected to this port must be capable of asynchronous transmission. Connection requires a terminal configured as 9600 baud, 8 data bits, 1 stop bit, no parity.
Note
Once connected, use any terminal communications application to access the ACE CLI. The following procedure uses HyperTerminal for Windows.
To access the ACE by using a direct serial connection, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
•
•
•
•
•
Step 7
Step 8
switch login:
See the "Sessioning and Logging In to the ACE" section for details on logging in and entering the configuration mode to configure the ACE.
Once a session is created, choose Save As from the File menu to save the connection description. Saving the connection description has the following two advantages:
•
•
Sessioning and Logging In to the ACE
This section describes how to connect (session) to the ACE as the default user from either the ACE console port or from the Catalyst 6500 series CLI. Once you connect to the ACE as the default user, you can then log in and enter the configuration mode to configure the ACE.
The ACE creates two default user accounts at startup: admin and www. The admin user is the global administrator and cannot be deleted. The ACE uses the www user account for the XML interface.
Note
Later, when you configure interfaces and IP addresses on the ACE itself, you can remotely access the ACE CLI through an ACE interface by using the Catalyst console port or by a Telnet or SSH session. To configure remote access to the ACE CLI, see Chapter 2, Enabling Remote Access to the ACE. For details on configuring interfaces on the ACE, see the Cisco Application Control Engine Module Routing and Bridging Configuration Guide.
You can configure the ACE to provide a higher level of security for users accessing the ACE. For information about configuring user authentication for login access, see the Cisco Application Control Engine Module Security Configuration Guide.
To session into the ACE and access configuration mode to perform initial configuration, perform the following steps:
Step 1
•
•
Cat6k-switch# session slot mod_num processor 0The mod_num argument identifies the slot number in the Catalyst 6500 series chassis where the ACE is installed.
Note
Step 2
switch login: adminPassword: adminBy default, both the username and password are admin.
The prompt changes to the following:
switch/Admin#To change the default login username and password, see the "Changing the Administrative Password" section for details.
Caution
Step 3
switch/Admin# configureEnter configuration commands, one per line. End with CNTL/ZThe prompt changes to the following:
switch/Admin(config)#
Changing the Administrative Password
During the initial login process to the ACE, you enter the default user name admin and the default password admin in lowercase text. You cannot modify or delete the default administrative username; however, for security reasons, you must change the default administrative password. If you do not change the password, then security on your ACE can be compromised because the administrative username and password are configured to be the same for every ACE shipped from Cisco Systems.
Caution
The administrative username and password are stored in Flash memory. Each time that you reboot the ACE, it reads the username and password from Flash memory. Global administrative status is assigned to the administrative username by default.
Note
To change the default username and password, use the username command in configuration mode. The syntax of this command is as follows:
username name1 [password [0 | 5] {password}]
The keywords, arguments, and options are as follows:
•
•
•
•
•
Note
The ACE supports the following special characters in a password:
, . / = + - ^ @ ! % ~ # $ * ( )
Note that the ACE encrypts clear text passwords in the running-config.
For example, to create a user named user1 that uses the clear text password mysecret_801, enter:
switch/Admin(config)# username Admin password 0 mysecret_801Resetting the Administrator Account Password
If you forget the password for the ACE administrator account and cannot access the ACE, you can recover the admin password during the initial bootup sequence of the ACE. You must have access to the ACE through the console port to be able to reset the password for the Admin user back to the factory default value of admin.
Note
To reset the password that allows the Admin user access to the ACE, perform the following steps:
Step 1
Step 2
Step 3
Step 4
IXP polling timeout interval: 120map_pci_xram_to_uspace[149] :: mapping 4096 bytes from 0x58800000map_pci_xram_to_uspace[149] :: mapping 4096 bytes from 0x5a800000................................................IXP's are up... <Sec 48 :Status of IXP1 7, IXP2 7>map_pci_xram_to_uspace[149] :: mapping 102400 bytes from 0x4fd68000map_pci_xram_to_usenabling intb 57 interruptspace[149] :: mapping 102400 bytes from 0x57d68000Starting lcpfw process...inserting IPCP klmWarning: loading /itasca/klm/klm_session.klm will taint the kernel: no licenseSee http://www.tux.org/lkml/#export-tainted for information about tainted modulesModule klm_session.klm loaded, with warningsinserting cpu_util klmcreate dev node as 'mknod /dev/cpu_util c 236 0'getting cpu_util dev major nummaking new cpu_util dev nodeSession Agent waiting for packets .Waiting for 3 seconds to enter setup mode...Entering setup sequence...Reset Admin password [y/n] (default: n): yResetting admin password to factory default...XR Serial driver version 1.0 (2004-11-08) with no serial options enabledttyXR major device number: 235Create a dev file with 'mknod /dev/ttyXR c 235 [0-1]'cux major device number: 234Create a dev file with 'mknod /dev/cux c 234 [0-1]'ttyXR0 at 0x10c00000 (irq = 59) is a 16550AttyXR1 at 0x10c00008 (irq = 59) is a 16550ANo licenses installed...Loading.. Please wait...Done!!!Step 5
The boot process continues as normal and you are able to enter the admin password at the login prompt.
Assigning a Name to the ACE
The hostname is used to identify the ACE and for the command-line prompts. If you establish sessions to multiple devices, the hostname helps you track where you enter commands. By default, the hostname for the ACE is "switch." To specify a hostname for the ACE, use the hostname configuration mode command. To specify a hostname for the peer ACE in a redundant configuration, use the peer hostname command.
The syntaxes of these commands are as follows:
hostname name
peer hostname name
The name argument specifies a new hostname for the ACE. Enter a case-sensitive text string that contains from 1 to 32 alphanumeric characters.
For example, to change the hostname of the ACE from switch to ACE_1, enter:
switch/Admin(config)# hostname ACE_1ACE_1/Admin(config)#Configuring an ACE Inactivity Timeout
By default, the inactivity timeout value is 5 minutes. You can modify the length of time that can occur before the ACE automatically logs off an inactive user by using the login timeout command in configuration mode. This command specifies the length of time that a user session can be idle before the ACE terminates the console, Telnet, or SSH session.
Note
The syntax of this command is as follows:
login timeout minutes
The minutes argument specifies the length of time that a user can be idle before the ACE terminates the session. Valid entries are from 0 to 60 minutes. A value of 0 instructs the ACE never to timeout. The default is 5 minutes.
For example, to specify a timeout period of 10 minutes, enter:
host1/Admin(config)# login timeout 10To restore the default timeout value of 5 minutes, enter the following command:
host1/Admin(config)# no login timeoutTo display the configured login time value, use the show login timeout command in Exec mode. For example, enter:
host1/Admin# show login timeoutLogin Timeout 10 minutes.Configuring a Message-of-the-Day Banner
You can configure a message in configuration mode to display as the message-of-
the-day banner when a user connects to the ACE. Once connected to the ACE, the message-of-the-day banner appears, followed by the login banner and Exec mode prompt.The syntax of this command is as follows:
banner motd text
The text argument is a line of message text to be displayed as the message-of-
the-day banner. The text string consists of all characters that follow the first space until the end of the line (carriage return or line feed).The pound (#) character functions as the delimiting character for each line. For the banner text, spaces are allowed but tabs cannot be entered at the CLI. To instruct the ACE to display multiple lines in a message-of-the-day banner, enter a new banner motd command for each line that you want to appear.
The banner message is a maximum of 80 characters per line, up to a maximum of 3000 characters (3000 bytes) for a message-of-the-day banner. This maximum value includes all line feeds and the last delimiting character in the message.
To add multiple lines to an existing a message-of-the-day banner, precede each line by using the banner motd command. The ACE appends each line to the end of the existing banner. If the text is empty, the ACE adds a carriage return (CR) to the banner.
You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. For example, enter:
•
•
To use the $(hostname) in a single line banner motd input, you must include double quotes (") around the $(hostname) so that the $ is interpreted as a special character at the beginning of a variable in the single line. For example, enter:
switch/Admin(config)# banner motd #Welcome to "$(hostname)"...#Do not use the double quote character (") or the percent sign character (%) as a delimiting character in a single line message string.
For multi-line input, double quotes (") are not required for the token because the input mode is different from signal-line mode. When you operate in multi-line mode, the ACE interprets the double quote character (") literally. The following example shows how to span multiple lines and use tokens to configure the banner message:
switch/Admin(config)# banner motd #Enter TEXT message. End with the character '#'.================================Welcome to Admin Context--------------------------------Hostname: $(hostname)Tty Line: $(line)=================================#To replace a banner or a line in a multi-line banner, use the no banner motd command before adding the new lines.
To display the configured banner message, use the show banner motd command in Exec mode. For example, enter:
host1/Admin# show banner motdConfiguring the Date and Time
The ACE time and date are synchronized with the clock from the Catalyst 6500 series supervisor engine. You may configure the time zone and daylight saving time of the ACE for display purposes. See the Cisco 6500 Series Switch Cisco IOS Software Configuration Guide for details on setting the system clock on the switch.
This section contains the following topics:
•
•
Configuring the Time Zone
To set the time zone of the ACE, use the clock timezone command in configuration mode. The ACE keeps time internally in Universal Time Coordinated (UTC) offset.
The syntax of this command is as follows:
clock timezone {zone_name{+ | -} hours minutes} | {standard timezone}
The keywords, arguments, and options are as follows:
•
•
•
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
Table 1-1 lists common time zone acronyms that you can specify for the zone_name argument.
For example, to set the time zone to PST and to set an UTC offset of -8 hours, enter:
host1/Admin(config)# clock timezone PST -8 0To remove the clock timezone setting, use the no form of this command. For example, enter:
host1/Admin(config)# no clock timezoneAdjusting for Daylight Saving Time
To configure the ACE to change the time automatically to summer time (daylight saving time), use the clock summer-time command in configuration mode.
The first part of the command specifies when summer time begins, and the second part of the command specifies when summer time ends. All times are relative to the local time zone; the start time is relative to standard time and the end time is relative to summer time. If the starting month is after the ending month, the ACE assumes that you are located in the Southern Hemisphere.
The syntax of this command is as follows:
clock summer-time {daylight_timezone_name start_week start_day start_month start_time end_week end_day end_month end_time daylight_offset | standard timezone}
The keywords, arguments, and options are as follows:
•
•
•
•
•
•
•
–
–
–
–
–
–
For example, to specify that summer time begins on the first Sunday in April at 02:00 and ends on the last Sunday in October at 02:00, with a daylight offset of 60 minutes, enter:
host1/Admin(config)# clock summer-time Pacific 1 Sun Apr 02:00 5 Sun Oct 02:00 60To remove the clock summer-time setting, use the no form of this command. For example, enter:
host1/Admin(config)# no clock summer-timeViewing the System Clock Settings
To display the system clock of the ACE, use the show clock command in Exec mode.
The syntax of this command is as follows:
show clock
The following sample output shows the current clock settings:
host1/Admin# show clockMon Mar 6 18:26:55 UTC 2006Configuring Terminal Settings
You can access the ACE CLI by using one of the following methods:
•
•
Note
This section contains the following topics:
•
•
For details on configuring remote access to the ACE CLI using SSH or Telnet, see Chapter 2, Enabling Remote Access to the ACE.
Configuring Terminal Display Attributes
You can specify the number of lines and the width for displaying information on a terminal during a console session. The maximum number of displayed screen lines is 511 columns. To configure the terminal display settings, use the terminal command in Exec mode. The terminal command allows you to set the width for displaying command output.
The syntax of the command is as follows:
terminal {length lines | monitor | session-timeout minutes | terminal-type text | width characters}
The keywords, arguments, and options are as follows:
•
•
•
Note
•
•
For example, to specify the VT200 terminal, set the number of screen lines to 35, and set the number of characters to 250, enter:
host1/Admin# terminal terminal-type vt200host1/Admin# terminal length 35host1/Admin# terminal width 250For example, to specify a terminal timeout of 600 minutes for the current session, enter:
host1/Admin# terminal session-timeout 600To reset a terminal setting to its default value, such as the screen line length, use the no form of the command:
host1/Admin# terminal no widthFor example, to start the current terminal monitoring session, enter:
host1/Admin# terminal monitorhost/Admin# %ACE-7-111009: User 'admin' executed cmd: terminal monitor%ACE-7-111009: User 'admin' executed cmd: terminal monitor......To stop the current terminal monitoring session, enter:
host1/Admin# terminal no monitorTo display the console terminal settings, use the show terminal Exec mode command. For example, enter:
host1/Admin# show terminalTTY: /dev/pts/0 Type: "vt100"Length: 25 lines, Width: 80 columnsSession Timeout: 60 minutesConfiguring Terminal Line Settings
This section describes how to configure the terminal line settings for accessing the ACE by a console or a virtual terminal and contains the following topics:
•
•
Configuring Console Line Settings
The console port is an asynchronous serial port on the ACE that allows you to directly access the module to perform an initial configuration through a standard RS-232 port with an RJ-45 connector. Any device connected to this port must be capable of asynchronous transmission. Connection requires a terminal configured as 9600 baud, 8 data bits, 1 stop bit, no parity.
Use the line console configuration mode command to configure the console interface settings. The CLI displays the console configuration mode.
To configure the line console settings from the console configuration mode, specify one or more of the following commands:
•
•
•
•
For example, to configure the console line settings for the ACE, enter:
host1/Admin# configEnter configuration commands, one per line. End with CNTL/Zhost1/Admin(config)#host1/Admin(config)# line consolehost1/Admin(config-console)# databits 6host1/Admin(config-console)# parity evenhost1/Admin(config-console)# speed 19200host1/Admin(config-console)# stopbits 1To disable a setting for the configured console line, use the no form of the command. For example, enter:
host1/Admin(config-console)# no stopbits 1Use the show line console Exec mode command to verify the configured console settings for the ACE.
The syntax of this command is as follows:
show line console [connected]
The optional connected keyword displays the physical connection status.
For example, to display the configured console settings, enter:
host1/Admin# show line consoleline Console:Speed: 9600 baudsDatabits: 8 bits per byteStopbits: 1 bit(s)Parity: noneConfiguring Virtual Terminal Line Settings
Virtual terminal lines allow remote access to the ACE. A virtual terminal line is not associated with the console port; instead, it is a virtual port on the Catalyst 6500 series switch that allows you to access the ACE.
Use the line vty configuration mode command to configure the virtual terminal line settings. The CLI displays the line configuration mode. Use the session-limit command to configure the maximum number of terminal sessions per line.
The syntax of this command is as follows:
session-limit number
The number argument configures the maximum number of terminal sessions per line. The range is from 1 to 251.
For example, to configure a virtual terminal line, enter:
host1/Admin# configEnter configuration commands, one per line. End with CNTL/Zhost1/Admin(config)#host1/Admin(config)# line vtyhost1/Admin(config-line)# session-limit 23To disable a setting for the configured virtual terminal line, use the no form of the command. For example, enter:
host1/Admin(config-line)# no session-limit 23Use the clear line command in Exec mode to close a specified vty session. The syntax of this command is as follows:
clear line vty_name
The vty_name argument specifies the name of the VTY session. Enter a maximum of 64 characters for the name of the virtual terminal.
For example, to close a specified vty session, enter:
host1/Admin# clear line vty vty1Modifying the Boot Configuration
You can control how the ACE performs its boot process through ROMMON mode. ROMMON is the ROM-resident code that starts executing as soon as you power up or reset the ACE. Two user-configurable parameters determine how theACE boots: the boot field in the configuration register and the BOOT environment variable.
This section describes how to modify the boot configuration of the ACE and contains the following topics:
•
•
•
Setting the Boot Method from the Configuration Register
The ROMMON code executes upon power up, reset, or when a fatal exception occurs. The ACE enters ROMMON mode if it does not find a valid system image, if the Flash memory configuration is corrupted, or if the configuration register is set to enter ROMMON mode.
Note
You can modify the boot method that the ACE uses at the next startup by setting the boot field in the software configuration register. The configuration register identifies how the ACE should boot and where the system image is stored. You can modify the boot field to force the ACE to boot a particular system image at startup instead of using the default system image.
To change the configuration register settings, use the config-register configuration command. This command affects only the configuration register bits that control the boot field and leaves the remaining bits unaltered.
The syntax of this command is as follows:
config-register value
The value argument represents the configuration register value that you want to use the next time that you restart the ACE. The supported value entries are as follows:
•
•
See the "Booting the ACE from the rommon Prompt" section for details on booting the ACE from the rommon prompt.
For example, to set the boot field in the configuration register to boot the system image identified in the BOOT environment variable upon reboot, enter:
host1/Admin(config)# config-register 1Booting the ACE from the rommon Prompt
If you specify a value of 0 for the config-register command, this configuration register setting forces the ACE to enter the ROMMON mode upon a reload or power cycle of the ACE. The ACE remains in ROMMON mode until you identify the location of an image file to boot.
The ACE supports two methods of booting the module from the rommon prompt:
•
•
To instruct the ACE to manually boot from a particular system image, use the confreg command and specify a configuration register value of 1. Identify the name of the system image file that the ACE uses to boot.
A confreg value of 0 instructs the ACE to boot to the rommon prompt.
For example, to use the confreg command at the rommon prompt to instruct the ACE to boot from the c6ace-t1k9-mzg.3.0.0_A0_2.48.bin system image, enter:
rommon 11 > confreg 1rommon 12 > BOOT=disk0:c6ace-t1k9-mzg.3.0.0_A0_2.48.binrommon 13 > syncTo instruct the ACE to automatically boot from the image specified in the BOOT variable (see the "Setting the BOOT Environment Variable" section), use the confreg command without specifying a configuration register value to launch the Configuration Summary menu-based utility. You can then instruct the ACE to boot from the system image identified in the BOOT environment variable (see the "Setting the BOOT Environment Variable" section).
For example, to use the confreg command to display the onscreen prompts for changing the boot characteristics of the ACE, enter:
rommon 11 > confregConfiguration Summary(Virtual Configuration Register: 0x1)enabled are:break/abort has effectconsole baud: 9600boot: the ROM monitordo you wish to change the configuration? y/n [n]: ydisable "break/abort has effect"? y/n [n]:enable "ignore system config info"? y/n [n]:change the boot characteristics? y/n [n]: yenter to boot:0 = ROM Monitor1 = boot file specified in BOOT variable[1]: 1For example, to use the confreg command to instruct the ACE to boot from the c6ace-t1k9-mzg.3.0.0_A0_2.48.bin system image, enter:
rommon 11 > confregConfiguration Summary(Virtual Configuration Register: 0x1)enabled are:break/abort has effectconsole baud: 9600boot: the ROM monitordo you wish to change the configuration? y/n [n]: nrommon 12 > BOOT=disk0:c6ace-t1k9-mzg.3.0.0_A0_2.48.binrommon 13 > syncSetting the BOOT Environment Variable
The BOOT environment variable specifies a list of image files on various devices from which the ACE can boot at startup. You can add several images to the BOOT environment variable to provide a fail-safe boot configuration. If the first file fails to boot the ACE, subsequent images that are specified in the BOOT environment variable are tried until the ACE boots or there are no additional images to attempt to boot. If there is no valid image to boot, the ACE enters ROMMON mode where you can manually specify an image to boot.
The ACE stores and executes images in the order in which you added them to the BOOT environment variable. If you want to change the order in which images are tried at startup, you can either prepend and clear images from the BOOT environment variable to attain the desired order or you can clear the entire BOOT environment variable and then redefine the list in the desired order.
To set the BOOT environment variable, use the boot system image: command. The syntax of this command is as follows:
boot system image:image_name
The image_name argument specifies the name of the system image file. If the file does not exist (for example, if you entered the wrong filename), then the filename is appended to the bootstring, and this message displays, "Warning: File not found but still added in the bootstring." If the file does exist, but is not a valid image, the file is not added to the bootstring, and this message displays, "Warning: file found but it is not a valid boot image."
For example, to set the BOOT environment variable, enter:
host1/Admin(config)# boot system image:c6ace-t1k9-mzg.3.0.0_A0_2.48.binDisplaying the ACE Boot Configuration
To display the current BOOT environment variable and configuration register setting, use the show bootvar command in Exec mode.
For example, to display the BOOT environment variable settings, enter:
host1/Admin# show bootvarBOOT variable = "disk0:c6ace-t1k9-mzg.3.0.0_A0_2.48.bin"Configuration register is 0x1Restarting the ACE
You can reload the ACE directly from its CLI or reboot it by using the Catalyst 6500 series CLI. You may need to reboot the ACE from the Catalyst CLI if you cannot reach the ACE through its CLI or by using an external Telnet session.
This section contains the following topics:
•
•
Restarting the ACE from the CLI
To reboot the ACE directly from its CLI and reload the configuration, use the reload command in Exec mode. The reload command reboots the ACE and performs a full power cycle of both the hardware and software. The reset process can take several minutes. Any open connections with the ACE are dropped after you enter the reload command.
Caution
When you specify reload, the ACE prompts you for confirmation and performs a cold restart of the ACE:
host1/Admin# reloadThis command will reboot the systemSave configurations for all the contexts. Save? [yes/no]: [yes]Restarting the ACE from the Catalyst CLI
To restart the ACE from the Catalyst 6500 series CLI, use the hw-module command. The syntax of this command is as follows:
hw-module module mod_num reset
The arguments and keywords are as follows:
•
•
For example, to use the Catalyst 6500 series CLI to reset the ACE located in slot 3 of the chassis, enter:
Cat6k-switch# hw-module module 3 resetProceed with reload of module?[confirm]% reset issued for module 3Press Enter to confirm the restart operation.
Shutting Down the ACE
Caution
To avoid corrupting the ACE, you must correctly shut down the module before you disconnect the power or remove it from the Catalyst 6500 series chassis. To properly shut down the ACE, enter the no power enable module command in configuration mode at the Catalyst 6500 series CLI.
If the ACE fails to respond to this command, shut down the module by using a small, pointed object (such as a paper clip) to access the recessed Shutdown button on the front panel of the ACE. The shutdown procedure may take several minutes. The Status LED turns off when the ACE shuts down.
