Table Of Contents
Cisco Anomaly Guard Module and Traffic Anomaly Detector Module Installation Note
Environmental and System Requirements
Supported Hardware and Software
Preparing to Install the Modules
Obtaining Documentation, Obtaining Support, and Security Guidelines
Cisco Anomaly Guard Module and Traffic Anomaly Detector Module Installation Note
Product Number: WS-SVC-AGM-1-K9, WS-SVC-ADM-1-K9
This document describes how to install the Cisco Anomaly Guard Module (Guard module) and the
Cisco Traffic Anomaly Detector Module (Detector module) into the Catalyst 6500 series switch. This document applies to both modules.The Cisco Catalyst 6500 Series Switch and the 7600 Series Router support the Guard module and Detector module.
•
The Catalyst 6500 requires IOS 12.2(18)SXD3 or later and a SUP720 or a SUP2 with an MSFC2 to support the Detector module.
•
The 7600 Series Router require IOS 12.2(18)SXE or later and a SUP720 to support the Detector module.
The Guard module is a denial-of-service (DDoS) mitigation product that receives traffic diverted from attacked targets, cleans this traffic, and forwards the cleaned traffic to its original path.
The Detector module is a denial-of-service (DDoS) detection product that receives a copy of the traffic on the switch, analyzes that traffic, and sends out an alert when it detects a DDoS attack. The Detector module can also activate a configured Guard module to mitigate these attacks.
Contents
This publication contains the following sections:
•
Environmental and System Requirements
•
Preparing to Install the Modules
•
Obtaining Documentation, Obtaining Support, and Security Guidelines
Safety Overview
Front Panel Description
This section describes the physical attributes of the Guard module and the Detector module. The front panel for the Guard module and the Detector module are identical.
Figure 1 shows the front panel of the Guard module.
Figure 1 The Front Panel
LEDs
When the Guard module and the Detector module power up, they initialize various hardware components and communicate with the supervisor engine. The Status LED indicates the supervisor engine operations and the initialization results. During the normal initialization sequence, the status LED changes from off to red, orange, and green.
Note
For more information on the supervisor engine LEDs, refer to the Catalyst 6500 Series Switch Module Installation Guide.
Table 1 describes the Status LED operation.
Table 1 Cisco Anomaly Guard Module and Cisco Traffic Anomaly Detector Module LEDs
LED Color DescriptionStatus
Off
•
The module is waiting for the supervisor engine to provide power.
•
The module is offline.
•
The module is not receiving power, which may be caused by one of the following:
–
Power is not available to the module.
–
Module temperature is over the limit1 .
Red
•
The module is released from reset by the supervisor engine and is booting.
•
The boot code failed to run.
Orange
•
The module is initializing hardware or communicating with the supervisor engine.
•
A fault occurred during the initialization sequence.
•
The module has failed to download its Field Programmable Gate Arrays (FPGAs) at startup. The module continues with the remainder of the initialization sequence and provides the module online status from the supervisor engine.
•
The module has not received module online status from the supervisor engine. This problem may be caused by the supervisor engine detecting a failure in an external loopback test that it issued to the module.
Green
•
The module is operational; the supervisor engine has provided module online status.
Green to Orange
•
The module is disabled through the supervisor engine command line interface (CLI) using the no power enable command.
1 Enter the show environment temperature mod command to display the temperature of each of the four sensors on the module.
Environmental and System Requirements
The following sections describe the environmental and system requirements:
•
Supported Hardware and Software
Environmental Requirements
Table 2 lists the environmental requirements for the modules.
System Requirements
Before you install the modules in the Catalyst 6500 series switch or a 7600 Series Router, make sure that the switch meets the following hardware and software requirements:
•
Supervisor Engine 2 with Cisco IOS software with a Multilayer Switch Feature Card (MSFC2)
•
Anomaly Guard Module or the Traffic Anomaly Detector Module with pre-loaded software
For more information, refer to the Catalyst 6500 Series Switch Installation Guide at this URL:
http://www.cisco.com/univercd/home/home.htm.
CautionYou can use the MSFC2, internal to the Catalyst 6500 series switch, to route traffic on either the client side or the server side of the modules, but not both simultaneously (unless policy-based routing is used).
Memory Requirements
The Guard module and the Detector module memory is not configurable.
Power Requirements
The modules operate on power supplied by the chassis.
Supported Hardware and Software
Before you can use the 7600 Series Router or Catalyst 6500 series modules, you must have a Supervisor Engine 2 with an MSFC2, and any module that has ports to connect to the server and client networks.
For information on the maximum number of modules supported in a Catalyst 6500 series switch, refer to the Release Note for the Cisco Anomaly Guard Module and the Release Note for the Cisco Traffic Anomaly Detector Module located at http://www.cisco.com/univercd/home/home.htm.
Table 3 lists the supported hardware and software for the modules.
Software Requirements
To operate the Guard module and the Detector module in a Catalyst 6500 series switch or 7600 Series Router, the switch must must be running Cisco IOS Release 12.2(18)SXD3 or higher.
The Catalyst operating system does not support the Guard module or the Detector module.
The software release that is listed in Table 4 is the minimum release required to support the modules with a given supervisor engine to perform basic module configuration.
Table 4 lists the software versions for the modules.
Preparing to Install the Modules
Before installing the modules, make sure that the following items are available:
•
Catalyst 6500 series switch chassis
•
Management station available through a Telnet or a console connection to perform the configuration tasks
You require the following tools to install the modules in the Catalyst 6500 series switch:
•
Phillips-head screwdriver
•
Wrist strap or other grounding device
•
Antistatic mat or antistatic foam
Whenever you handle the modules, always use a wrist strap or other grounding device to prevent electrostatic discharge (ESD).
CautionDuring this procedure, wear grounding wrist straps to avoid ESD damage to the modules.
CautionDo not directly touch the backplane with your hand or any metal tool or you may shock yourself.
All Catalyst 6500 series switches support hot swapping, allowing you to install, remove and replace modules without turning off chassis power. For more information on removing the modules from a switch, see the "Installing a Module" section.
When the software detects that a module has been installed or removed, it automatically runs diagnostic and discovery routines, acknowledges the presence or absence of the module, and resumes switch operation.
The Catalyst 6506 switch chassis has six slots, the Catalyst 6509 switch chassis has nine slots, and the Catalyst 6513 switch chassis has 13 slots.
•
Slot 1 is reserved for the supervisor engine.
•
Slot 2 can be used for a redundant supervisor engine if the supervisor engine in slot 1 fails.
•
If a redundant supervisor engine is not required, the following slots are available for modules:
–
Slots 2 through 6 on the 6-slot chassis
–
Slots 2 through 9 on the 9-slot chassis
–
Slots 2 through 13 on the 13-slot chassis
•
Empty slots require filler panels to maintain consistent airflow through the switch chassis.
Installing a Module
This section describes how to install a module in the Catalyst 6500 series switches.
CautionTo prevent ESD damage, handle modules by the carrier edges only.
CautionDuring this procedure, wear grounding wrist straps to avoid ESD damage to the module. Do not directly touch the backplane with your hand or any metal tool, or you could shock yourself.
Warning
Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments.
To install a module in the chassis, perform these steps:
Step 1
Choose a slot for the module.
Step 2
Verify that there is enough clearance to accommodate any interface equipment that you will connect directly to the module ports. If possible, place the modules between the empty slots that contain only the module filler panels.
Step 3
Verify that the captive installation screws are tightened on all modules installed in the chassis.
This action ensures that the EMI gaskets on all modules are fully compressed to maximize the opening space for the replacement module.
Note
If the captive installation screws are loose, the EMI gaskets on the installed modules push adjacent modules toward the open slot, reducing the opening size and making it difficult to install the replacement module.
Step 4
Remove the filler panel by removing the two Phillips pan-head screws from the filler panel.
Step 5
Open both ejector levers fully on the module (see Figure 2).
Figure 2 Positioning the Module in a Horizontal Slot Chassis
Step 6
Depending on the orientation of the slots in the chassis (horizontal or vertical), perform one of the following sets of substeps:
Horizontal slots
a.
Position the module in the slot. Make sure that you align the sides of the module carrier with the slot guides on each side of the slot (see Figure 2).
b.
Carefully slide the module into the slot until the EMI gasket along the top edge of the module makes contact with the module in the slot above it and both ejector levers have closed to approximately
45 degrees with respect to the module faceplate (see Figure 3).Figure 3 Clearing the EMI Gasket in a Horizontal Slot Chassis
c.
Using the thumb and forefinger of each hand, grasp the two ejector levers and press down to create a small (0.040 inch [1 mm]) gap between the EMI gasket and the module above it (see Figure 3).
CautionDo not press down too firmly on the levers because you may bend or damage them.
d.
While pressing down on the left and right ejector levers, simultaneously close them to fully seat the module in the backplane connector. The ejector levers are fully closed when they are flush with the module faceplate (see Figure 4).
Figure 4 Ejector Levers Fully Closed in a Horizontal Slot Chassis
Note
Failure to fully seat the module in the backplane connector may result in error messages.
e.
Tighten the two captive installation screws on the module.Make sure that the ejector levers are fully closed before tightening the captive installation screws.
When you install a module into the Catalyst 6500 series switch or a 7600 Series Router, it goes through a startup sequence that requires no intervention. At the successful conclusion of the startup sequence, the green Status LED lights and remains on. If the Status LED does not show green, or if it shows a different color, see Table 1 to determine module status.
Vertical slots
a.
Position the module in the slot (see Figure 5). Make sure that you align the sides of the module carrier with the slot guides on the top and bottom of the slot.
Figure 5 Positioning the Module in a Vertical Slot Chassis
b.
Carefully slide the module into the slot until the EMI gasket along the right edge of the module makes contact with the module in the slot adjacent to it. Close both ejector levers to approximately 45 degrees with respect to the module faceplate (see Figure 6).
c.
Using the thumb and forefinger of each hand, grasp the two ejector levers and exert a slight pressure to the left, deflecting the module approximately 0.040 inches (1 mm) to create a small gap between the modules EMI gasket and the module adjacent to it (see Figure 6).
Figure 6 Clearing the EMI Gasket in a Vertical Slot Chassis
CautionDo not exert too much pressure on the ejector levers because you may bend or damage them.
d.
While pressing on the ejector levers, simultaneously close them to fully seat the module in the backplane connector. The ejector levers are fully closed when they are flush with the module faceplate (see Figure 7).
Figure 7 Ejector Levers Fully Closed in a Vertical Slot Chassis
e.
Tighten the two captive installation screws on the module.Make sure that the ejector levers are fully closed before tightening the captive installation screws.
When you install a module into the Catalyst 6500 series switch or a 7600 Series Router, it goes through a startup sequence that requires no intervention. At the successful conclusion of the startup sequence, the green Status LED lights and remains on. If the Status LED does not show green, or if it shows a different color, see Table 1 to determine module status.
Removing the Module
This section describes how to remove an existing module from a chassis slot.
CautionDuring this procedure, wear grounding wrist straps to avoid ESD damage to the module.
CautionDo not directly touch the backplane with your hand or any metal tool or you may shock yourself.
CautionBefore you remove the module from the chassis, use the no power enable command or the hw-module module mod shutdown command to shut down the module properly to prevent data loss.
Warning
Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments.
To remove a module from the chassis, perform these steps:
Step 1
Verify that the captive installation screws on all of the modules in the chassis are tight.
This step assures that the space that is created by the removed module is maintained.
Note
If the captive installation screws are loose, the electromagnetic interference (EMI) gaskets on the installed modules push the modules toward the open slot, reducing the opening size and making it difficult to install the replacement module.
Step 2
Loosen the two captive installation screws on the module.
Step 3
Depending on the orientation of the slots in the chassis (horizontal or vertical), perform one of the following sets of substeps:
Horizontal slots
a.
Place your thumbs on the left and right ejector levers, and simultaneously rotate the levers outward to unseat the module from the backplane connector.
b.
Grasp the front edge of the module with one hand, and slide the module part of the way out of the slot. Place your other hand under the module to support its weight. Do not touch the module circuitry.
Vertical slots
a.
Place your thumbs on the ejector levers that are located at the top and bottom of the module, and simultaneously rotate the levers outward to unseat the module from the backplane connector.
b.
Grasp the edges of the module, and slide the module straight out of the slot. Do not touch the module circuitry.
Step 4
Place the module on an antistatic mat or antistatic foam, or immediately reinstall it in another slot.
Step 5
If the slot from which you removed the module is to remain empty, install a filler panel to keep dust out of the chassis and to maintain proper airflow through the chassis.
Warning
Blank faceplates (filler panels) serve three important functions: they prevent exposure to hazardous voltages and currents inside the chassis; they contain electromagnetic interference (EMI) that might disrupt other equipment; and they direct the flow of cooling air through the chassis. Do not operate the system unless all cards and faceplates are in place.
Using the CLI
Unless your switch is located in a fully-trusted environment, we recommend that you configure the module through a Secure Shell (SSH) connection.
You can session into a module from the switch console and configure it. If you are connected through a Telnet session, use the terminal monitor command to display console messages.
You can also make an SSH connection into the module from a specified host. Configure and enable SSH support for a host from the module console.
Related Documentation
For information on caveats for the Guard module and the maximum number of modules supported in a Catalyst 6500 series switch, refer to the Release Note for the Cisco Anomaly Guard Module.
For information on caveats for the Detector module and the maximum number of modules supported in a Catalyst 6500 series switch, refer to the Release Note for the Cisco Traffic Anomaly Detector Module.
For configuration information on the Guard module, refer to the following publications:
•
Cisco Anomaly Guard Module Configuration Guide
•
Cisco Anomaly Guard Module Web-Based Manager Configuration Guide
For configuration information on the Detector module, refer to the following publications:
•
Cisco Traffic Anomaly Detector Module Configuration Guide
•
Cisco Traffic Anomaly Detector Module Web-Based Manager Configuration Guide
Translated Safety Warnings
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Copyright © 2005 Cisco Systems, Inc. All rights reserved.













































