Guest

Cisco IOS Software Releases 12.0 Special and Early Deployments

Cisco uBR924 - Cisco IOS Release 12.0 XR3

Table Of Contents

Release Notes for Cisco uBR924
Cable Access Router for Cisco IOS Release 12.0(7)XR3

Contents

Introduction

Early Deployment Releases

System Requirements

Memory Requirements

Headend Interoperability

Voice

Advanced Data Feature Sets

Hardware Supported

Determining the Software Version

Upgrading to a New Software Release

Feature Set Tables

New and Changed Information

No New Hardware Features in Release 12.0(7)XR3

New Software Features in Release 12.0(7)XR3

DOCSIS 1.0+ Extensions—Dynamic Multi-SID Assignment and Concatenation

Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(7)T

VPN Enhancement—Dynamic Crypto Map

NetRanger Support—Cisco IOS Intrusion Detection

Firewall (Phase II)—Cisco Secure Integrated Software

Simple Gateway Control Protocol 1.1

SGCP MIB

Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(5)T1

Fax

Enhanced Bridging

DOCSIS Baseline Privacy

IPSec Network Security

Triple DES (Phase I)

Layer 2 Tunneling Protocol

Firewall (Phase I)—Cisco Secure Integrated Software

Baseline Privacy Management Information Base

Hardware Features in Release 12.0(7)XR3 Inherited from Release 12.0(4)XI1

Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(4)XI1

Full and DOCSIS-Compliant Bridging

Easy IP

Routing (RIP V2)

Voice Support

Cable Device MIB

Cisco Standard MIBs

Cisco Voice MIBs

Radio Frequency Interface MIB

Limitations and Restrictions

Using Multiple PCs with a Cisco uBR924 Cable Access Router

Layer 2 Tunneling Protocol

Important Notes

Last Maintenance Release of Cisco IOS Release 12.0 T

Supplemental and Corrected Text for the Online Feature Module

Supported MIBs

Cable-Specific MIBs

Deprecated MIBs

Caveats

Resolved Caveats—Release 12.0(7)XR3

Open Caveats—Release 12.0(7)XR3

Related Documentation

Release-Specific Documents

Platform-Specific Documents

Feature Modules

Cisco IOS Software Documentation Set

Documentation Modules

Release 12.0 Documentation Set

Service and Support

Software Configuration Tips on the Cisco Technical Assistance Center Home Page

Cisco Connection Online

Documentation CD-ROM


Release Notes for Cisco uBR924
Cable Access Router for Cisco IOS Release 12.0(7)XR3


November 8, 2000

These release notes for the Cisco uBR924 cable access router support Cisco IOS Release 12.0(7)XR3. These release notes are updated as needed to describe new features, memory requirements, hardware support, software platform deferrals, and changes to the microcode or modem code and related documents.

For a list of software caveats that apply to Release 12.0(7)XR3, see the "Caveats" section and Caveats for Cisco IOS Release 12.0 T. The caveats document is updated for every maintenance release and is located on Cisco Connection Online (CCO).

Use these release notes with Cross-Platform Release Notes for Cisco IOS Release 12.0 located on CCO.

Contents

These release notes describe the following topics:

Introduction

System Requirements

New and Changed Information

Limitations and Restrictions

Important Notes

Caveats

Related Documentation

Service and Support

Cisco Connection Online

Documentation CD-ROM

Introduction

The Cisco uBR924 cable access router gives residential or small office/home office (SOHO) subscribers high-speed Internet or Intranet access and packet telephone services via a shared two-way cable system and IP backbone network. The router connects computers, telephone or fax equipment, and other customer premises devices at a subscriber site to the service provider's cable and IP backbone network.

The router is based on Data-Over-Cable Service Interface Specifications (DOCSIS) and interoperates with any bidirectional, DOCSIS-qualified Cable Modem Termination System (CMTS). The router ships from the Cisco factory with a Cisco IOS software image stored in nonvolatile memory (NVRAM) that supports DOCSIS-compliant bridging data operations. The Cisco uBR924 cable access router functions as a cable modem—a modulator/demodulator at a subscriber site to convey data communications on the cable television system.

Based on the feature licenses your company purchased, other Cisco IOS images can be downloaded from Cisco Connection Online (CCO). Each Cisco uBR924 cable access router in your network can then be configured to support Voice over IP (VoIP) and/or other special operating modes based on your service offering and the practices in place for your network. The Cisco uBR924 cable access router can function as an advanced router, providing wide area network (WAN) data connectivity in a variety of configurations.


Note   Starting with Cisco IOS Release 12.0(5)T1, all Cisco uBR924 cable access router images, including Cisco IOS Release 12.0(7)XR3 images, support DOCSIS Baseline Privacy (BPI) encryption/decryption. BPI is subject to export restrictions.


Early Deployment Releases

These release notes describe the Cisco uBR924 cable access router for Release 12.0(7)XR3. Release 12.0(7)XR3 is an Early Deployment (ED) release based on Release 12.0 T and announces fixes to software caveats and support for new Cisco hardware.

For information about features in Release 12.0, see Cross-Platform Release Notes for Cisco IOS Release 12.0 on CCO.

For information about features in other ED releases, see .

For information about features in other platforms, see Release Notes for Cisco IOS Release 12.0 on CCO.

Table 1 Early Deployment Releases for the Cisco uBR924 Cable Access Router 

ED Release
Maintenance Release
Availability
Additional Software Features

Release 12.0 XR3

(7)

Now

DOCSIS 1.0+ Extensions—Dynamic Multi-SID Assignment and Concatenation (includes support for SGCP and H.323 protocols for voice)

Note   Excludes VPN, Firewall (Phase II) and Triple DES found in 12.0(7)T.

VPN Enhancements—Dynamic Crypto Map

NetRanger Support—Cisco IOS Intrusion Detection

Firewall (Phase II)—Cisco Secure Integrated Software

SGCP 1.1

SGCP MIB

Release 12.0 T

(7)

Now

VPN Enhancements—Dynamic Crypto Map

NetRanger Support—Cisco IOS Intrusion Detection

Firewall (Phase II)—Cisco Secure Integrated Software

SGCP 1.1

SGCP MIB

Release 12.0 T

(5)

Now

Fax support over the cable network

Advanced data feature sets:

DOCSIS Baseline Privacy (BPI)

IPSec—56-bit encryption/decryption at network layer (Phase I)

3DES—Triple DES (Phase I): 168-bit encryption/decryption at network layer (Phase I)

L2TP—Layer 2 tunneling protocol (Phase I)

Firewall (Phase I)—Cisco Secure Integrated Software

Enhanced VoIP feature integration

Enhanced bridging functionality

Release 12.0 XI1

(4)

Now

Full and DOCSIS-compliant bridging

Network address translation and port address translation (NAT/PAT)

Radio frequency interface

Routing (RIP V2)


System Requirements

This section describes the system requirements for Cisco IOS Releases 12.0(7)XR3:

Memory Requirements

Headend Interoperability

Hardware Supported

Determining the Software Version

Upgrading to a New Software Release

Feature Set Tables

Memory Requirements

Table 2 Memory Requirements for the Cisco uBR924 Voice and Data Images in Cisco IOS Release 12.0(7)XR3 

Feature Set Matrix Term
Image Name
Minimum
Flash
Memory
Minimum
DRAM
Memory
Runs
From
Feature
Status
IP Routing Standard Feature Sets
12.0(7)XR3 images

Base IP Bridging/Voice
(SGCP and H.323)

ubr920-k1v4-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/ decryption image (targeted for residential users) added in Release 12.0(7)XR

Supports bridging only operations with manual provisioning (no Easy IP)

Home Office Voice
(SGCP and H.323)

ubr920-k1v4y5-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/decryption image added in Release 12.0(7)T

Small Office/Voice/FW1/IDS
(SGCP and H.323)

ubr920-k1o3v4y5-mz

4 MB Flash

16 MB DRAM

RAM

Firewall (Phase II) encryption/decryption image added in Release 12.0(7)T

Telecommuter+/ Voice/IPSec 3DES
(SGCP and H.323)

ubr920-k1k2sv4y5-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/decryption image added in Release 12.0(7)T

1FW—Firewall—Cisco Secure Integrated Software


Table 3 Memory Requirements for the Cisco uBR924 Data-Only Images in Cisco IOS Release 12.0(7)XR3

Feature Set Matrix Term
Image Name
Minimum
Flash
Memory
Minimum
DRAM
Memory
Runs
From
Feature
Status
IP Routing Standard Feature Sets
12.0(7)XR3 images

Base IP Bridging

ubr920-k1-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/ decryption image (targeted for residential users) added in Release 12.0(7)XR

Supports bridging-only operations with manual provisioning (no Easy IP)

Home Office

ubr920-k1y5-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/decryption image added in Release 12.0(5)T1

Supports bridging and routing operations, Easy IP, and automated provisioning

Small Office FW1/IDS

ubr920-k1o3y5-mz

4 MB Flash

16 MB DRAM

RAM

Firewall (Phase II) encryption/decryption image added in Release 12.0(7)T

Telecommuter+/IPSec 3DES

ubr920-k1k2sy5-mz

4 MB Flash

16 MB DRAM

RAM

Encryption/decryption image added in Release 12.0(5)T1

1FW—Firewall—Cisco Secure Integrated Software


The image subset legend for Table 2 and is as follows:

y5=Reduced IP image with easy IP functionality (PAT/NAT/DHCP server)

v4=Voice set

s=Plus set includes L2TP

o3=Firewall (Phase II) feature set

k1=DOCSIS baseline privacy

k2=Triple DES (Phase I)

Headend Interoperability

Voice

Cisco IOS Release 12.0(7)XR3 images support DOCSIS 1.0+ Extensions that allow dynamic multi-SID assignment and concatenation. Dynamic multi-SID assignment enables you to dynamically and automatically add, delete, and modify multiple SIDs to have the parameters (such as QoS) required for the type of traffic passed over the data flow—typically voice, which requires a higher priority to ensure optimum voice quality. With dynamic multi-SIDs, high-bandwidth data streams can be created and eliminated as needed. Concatenation enables you to combine multiple upstream packets into one packet to reduce packet overhead and overall latency, as well as increase transmission efficiency.


Note   In order to use the dynamic multi-SID and concatenation feature, both the Cisco uBR924 cable access router and the CMTS router must have dynamic multi-SID support. If you are using the Cisco uBR7200 series headend equipment as the CMTS router, Cisco IOS Release 12.0(7)XR3 is required on both the Cisco uBR924 cable access router and the CMTS router to ensure these features are activated.


In Cisco IOS Release 12.0(7)T, Simple Gateway Control Protocol (SGCP) was introduced. SGCP is an alternative to the H.323 protocol that provides signaling and feature negotiation via a remote Call Agent (CA). SGCP eliminates the need for a dial plan mapper. It also eliminates the need for static configuration on the router to map IP addresses to telephone numbers because this function is provided by the remote CA.

To configure the Cisco uBR924 cable access router to support multiple classes of service, use either the Cisco Subscriber Registration Center (CSRC) tool or the configuration file editor of your choice. DOCSIS configuration files can contain multiple classes of service (CoS) to support voice. The first CoS is used for data (and voice if no other CoS is defined), and a second CoS can be defined to give higher priority for voice traffic. Lower-priority traffic can then be fragmented to avoid interfering with the timeslots allocated for voice traffic.

When configured to support voice in Cisco IOS Releases 12.0(7)XR3, the Cisco uBR924 cable access router packetizes and transports voice in compliance with the H.323 protocol. H.323v2 is integrated in Cisco gatekeeper/gateway products, such as the Cisco 2600 series and Cisco 3600 series, using Cisco IOS Release 12.0(5)T1 or higher interim images. The gatekeeper must be running Cisco IOS Release 12.0(5)T1 or higher in order to support registration of the full E.164 address for each Cisco uBR924 cable access router port.


Note   If you are using Cisco uBR7200 series equipment, the CMTS images in Cisco IOS Release 12.0(5)T1 support static multi-SID. Static multi-SID provides better-than-best-effort transmission of either data and voice or a combination of data and voice packets.


Advanced Data Feature Sets


Note   Starting with Cisco IOS Release 12.0(5)T1, all Cisco uBR924 cable access router images support DOCSIS Baseline Privacy (BPI) encryption/decryption. BPI is subject to export restrictions.


To support encryption/decryption, Cisco IOS images must contain encryption/decryption software at both the CMTS router and the Cisco uBR924 cable access router. Both the CMTS router and the Cisco uBR924 cable access router must be enabled and configured per the software feature set.

If you are using Cisco 7200 series equipment, also refer to applicable release notes for the corresponding images at the headend that support the encryption/decryption software and the VPN solution set.

Hardware Supported

The Cisco uBR924 cable access router contains:

A single F-connector interface to the cable system.

Four RJ-45 (10BaseT Ethernet) hub ports to connect:

Up to three computers directly to the four Ethernet hub ports at the rear of the Cisco uBR924 cable access router when operating in bridging mode using Cisco IOS Release 12.0(4)XI or higher interim images. When operating in routing mode, all four Ethernet hub ports can be connected directly to four computers.


Note   When using Cisco IOS Release 12.0(5)T1 or higher, including Cisco IOS Release 12.0(7)XR3, four computers can be connected directly to the four Ethernet hub ports in bridging mode.


One of the four Ethernet hub ports at the rear of the Cisco uBR924 cable access router can be connected to an Ethernet hub, which then connects additional computers or devices at the site when operating in routing or bridging mode using Cisco IOS Release 12.0(5)T1 or higher.

Two RJ-11 Foreign Exchange Station (FXS) ports to connect telephones and fax devices to the cable system and IP backbone; the router ships from the Cisco factory with the voice ports disabled. FXS ports on the Cisco uBR924 cable access router are to be connected to analog telephones or fax machines and not used for PBX extensions.

One RJ-11 port to connect to a standard, analog telephone line (optional) to provide a backup Plain Old Telephone Service (POTS) connection to the Public Switched Telephone Network (PSTN) should the Cisco uBR924 cable access router lose power.

One RJ-45 console port (optional) to connect to a laptop computer or console terminal when locally configuring the Cisco uBR924 cable access router; the router ships from the Cisco factory with the console port enabled.

Determining the Software Version

To determine the version of Cisco IOS software running on your Cisco uBR924 cable access router, log in to the Cisco uBR924 cable access router and enter the show version EXEC command:

router#show ver
Cisco Internetwork Operating System Software 
IOS (tm) 920 Software (UBR920-Y5-M), Version 12.0(7)XR3, EARLY DEPLOYMENT RELEASE 
SOFTWARE (fc2)
TAC:Home:SW:IOS:Specials for info
Copyright (c) 1986-2000 by cisco Systems, Inc.

Upgrading to a New Software Release

For information about upgrading to a new software release, see the product bulletin Cisco IOS Software Release 12.0 T Upgrade Paths and Packaging Simplification (#819: 1/99) on CCO at:

Service & Support: Software Center: Cisco IOS Software: Product Bulletins: Software

Under Cisco IOS 12.0, click Cisco IOS Software Release 12.0 T Upgrade (#819: 1/99)


Note   The Cisco IOS Software Release 12.0 T Upgrade Paths and Packaging Simplification can also be found at the following URL:
http://www.cisco.com/kobayashi/library/12.0/120MigrPaths.pdf.
You must have an account on CCO to access this URL.


Feature Set Tables

The Cisco IOS software is packaged in feature sets consisting of software images—depending on the platform. Each feature set contains a specific set of Cisco IOS features. (See .)

Release 12.0(7)XR3 supports the same feature sets as Release 12.0, but Release 12.0(7)XR3 can include new features supported by the Cisco uBR924 cable access router.

The Cisco uBR924 cable access router IP routing capabilities conserve IP addresses by using port-level multiplexed Network Address Translation (NAT) and Port Address Translation (PAT). Dynamic Host Configuration Protocol (DHCP) is used to distribute these or real IP addresses to the devices the Cisco uBR924 cable access router supports. NAT/PAT is bundled with DHCP server into a feature referred to as "Easy IP."


Caution   
Cisco IOS images with strong encryption (including, but not limited to, 168-bit [3DES] data encryption feature sets) are subject to United States government export controls and have limited distribution. Strong encryption images to be installed outside the United States may require an export license. Customer orders may be denied or subject to delay due to United States government regulations. When applicable, the purchaser or user must obtain local import and use authorizations for all encryption strengths. Contact your sales representative or distributor for more information, or send an e-mail to export@cisco.com.

lists the features and feature sets supported by the Cisco uBR924 cable access router in Cisco IOS Release 12.0(7)XR3, including the features inherited from Release 12.0(7)T, Release 12.(5)T1, and Release 12.0(4)XI1, and uses the following conventions:

Yes—The feature is supported in the feature set.

No—The feature is not supported in the feature set.

In—The number in the "In" column indicates the Cisco IOS release in which the feature was first introduced.


Note   This feature set table only contains a selected list of features. This table is not cumulative— nor does it list all the features in each image.


Both and list the Cisco IOS software images by feature sets. lists the voice and data software images; lists the data-only software images.

Table 4 Feature List by Feature Set for the Cisco uBR924 Cable Access Router
Voice and Data 

 
Software Images by Feature Set Matrix Term
Features
In
Base IP Bridging/Voice
Home Office Voice
Small Office Voice/FW/ IDS
Small Office+ Voice/FW/ IDS/ IPSec 56
Small Office+ Voice/FW/ IPSec 3DES
Telecom-muter/ Voice/ IPSec 56
Telecom-muter+ Voice/ IPSec 3DES

Full and DOCSIS-Compliant Bridging

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DOCSIS Baseline Privacy (BPI)

(5)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DOCSIS 1.0+ Extensions (Dynamic Multi-SID Assignment and Concatenation)

(7)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Easy IP

(4)

No

Yes

Yes

Yes

Yes

Yes

Yes

Triple DES (Phase I) (3DES)

(5)

No

No

No

No

Yes

No

Yes

IPSec Network Security (IPSec)

(5)

No

No

No

Yes

Yes

Yes

Yes

Layer 2 Tunneling Protocol (L2TP)

(5)

No

No

No

Yes

Yes

Yes

Yes

Routing (RIP V2)

(4)

No

Yes

Yes

Yes

Yes

Yes

Yes

H.323 Protocol

(5)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Simple Gateway Control Protocol (SGCP)

(7)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Network Management

DOCSIS 1.0 Baseline Privacy MIB

(5)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cable Device MIB

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cisco Standard MIBs

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cisco Voice MIBs

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Radio Frequency Interface MIB

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

SGCP MIB

(7)

Yes

Yes

Yes

Yes

Yes

Yes

Yes


Table 5 Feature List by Feature Set for the Cisco uBR924 Cable Access Router
Data Only 

 
Software Images by Feature Set Matrix Term
Features
In
Base IP Bridg- ing
Home Office
Small Office FW/ IDS
Small Office+ FW/IDS/ IPSec 56
Small Office+ FW/IPSec 3DES
Small Office+/ FW/IDS/ IPSec 3DES
Telecom-muter/ IPSec 56
Telecom-muter+/ IPSec 3DES

Full and DOCSIS-Compliant Bridging

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DOCSIS Baseline Privacy (BPI)

(5)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DOCSIS 1.0+ Extensions (Dynamic Multi-SID Assignment and Concatenation)

(7)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Easy IP

(4)

No

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Triple DES (Phase I) (3DES)

(5)

No

No

No

No

Yes

Yes

No

Yes

IPSec Network Security (IPSec)

(5)

No

No

No

Yes

Yes

Yes

Yes

Yes

Layer 2 Tunneling Protocol (L2TP)

(5)

No

No

No

Yes

Yes

Yes

Yes

Yes

Routing (RIP V2)

(4)

No

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Network Management

DOCSIS 1.0 Baseline Privacy MIB

(5)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cable Device MIB

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cisco Standard MIBs

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Cisco Voice MIBs

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Radio Frequency Interface MIB

(4)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

SGCP MIB

(7)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes


New and Changed Information

The following sections list the new hardware and software features supported by the Cisco uBR924 cable access router.

No New Hardware Features in Release 12.0(7)XR3

There are no new hardware features supported by the Cisco uBR924 cable access router in Cisco IOS Release 12.0(7)XR3.

New Software Features in Release 12.0(7)XR3

Cisco IOS Release 12.0(7)XR3 consolidates all new software features added in earlier 12.0(7)XR releases and Release 12.0(7)T, Release 12.0(5)T1, and Release 12.0(4)XI1. Cisco IOS Release 12.0(7)XR3 includes 3 DES and Firewall (Phase II) support, but does not include 56-bit IPSec support found in Cisco IOS Release 12.0(7)T.

The following new software features are supported by the Cisco uBR924 cable access router for Release 12.0(7)XR3.

DOCSIS 1.0+ Extensions—Dynamic Multi-SID Assignment and Concatenation

The following are Cisco uBR924 cable access router DOCSIS 1.0+ extensions that are supported in Cisco IOS Release 12.0(7)XR3:

Dynamic Multi-SID AssignmentNew MAC messages are introduced to dynamically add, delete, and modify SIDs to have the parameters (such as QoS) required for the type of traffic that will be passed over the data flow. The new MAC messages (SID_ADD, SID_CHANGE, and SID_DELETE) can be used to ensure that the Cisco uBR924 cable access router has the required bandwidth to process its voice traffic, and that it is not requesting more bandwidth than is required for processing its voice traffic. Without dynamic multi-SID assignment and QoS, the Cisco uBR924 cable access router would be required to statically configure two high-priority SIDs even if they were never used. With these new messages, high-bandwidth data streams can be created and eliminated as needed.

Concatenation—DOCSIS concatenation combines multiple upstream packets into one packet to reduce packet overhead and overall latency, as well as increase transmission efficiency. Using concatenation, a DOCSIS cable modem needs to make only one bandwidth request for a concatenated packet, as opposed to making a different bandwidth request for each individual packet; this technique is especially effective for bursty real-time traffic, such as voice calls.


Note   In order to use the dynamic multi-SID and concatenation feature, both the Cisco uBR924 cable access router and the CMTS router must have dynamic multi-SID support. If you are using the Cisco uBR7200 series headend equipment as the CMTS router, Cisco IOS Release 12.0(7)XR3 is required on both the Cisco uBR924 cable access router and the CMTS router to ensure these features are activated.


Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(7)T

The following software features are inherited from Cisco IOS Release 12.0(7)T and are supported by the Cisco uBR924 cable access router for Release 12.0(7)XR3.

VPN Enhancement—Dynamic Crypto Map

Dynamic crypto map is one of the PIX IPSec network security commands. IPSec provides security for transmission of sensitive information over unprotected networks such as the Internet.

The dynamic crypto map command is used to create policy templates that are used when processing negotiation requests for new security associations from a remote IPSec peer, even if you do not know all of the crypto map parameters required to communicate with the remote peer (such as the peer's IP address). The dynamic crypto map allows you to accept requests for new security associations from previously unknown peers. These requests, however, are not processed until the ISAKMP (IKE) authentication has completed successfully.

When the firewall receives a negotiation request via IKE from another IPSec peer, the request is examined to see if it matches a crypto map entry. If the negotiation does not match any explicit crypto map entry, it will be rejected unless the crypto map set includes a reference to a dynamic crypto map.

If the firewall accepts the peer's request, at the point that it installs the new IPSec security associations, it also installs a temporary crypto map entry. This entry is filled in with the results of the negotiation. At this point, the firewall performs normal processing, using this temporary crypto map entry as a normal entry, even requesting new security associations if the current ones are expiring (based on the policy specified in the temporary crypto map entry). After all of the corresponding security associations expire, the temporary crypto map entry is removed.

Dynamic crypto map sets are not used for initiating IPSec security associations. However, they are used for determining whether or not traffic should be protected.


Note   The only parameter required in a dynamic crypto map is the set transform-set. All other parameters are optional.


NetRanger Support—Cisco IOS Intrusion Detection

Cisco IOS Release 12.0(7)XR3 supports NetRanger programming. NetRanger is an Intrusion Detection System (IDS) composed of three parts:

A management console (director) that is used to view the alarms as well as to manage the sensors.

A sensor that monitors traffic. This traffic is matched against a list of known signatures to detect misuse of the network. This is usually in the form of scanning for vulnerabilities or of attacking systems. When a signature is matched, the sensor can track certain actions. In the case of the appliance sensor, it can reset (via TCP/rst) sessions, or enable "shuns" of further traffic. In the case of the IOS-IDS, it can drop traffic. In all cases, the sensor can send alarms to the director.

Communications through automated report generation of standardized and customizable reports and QoS/CoS monitoring capabilities.

Firewall (Phase II)—Cisco Secure Integrated Software

Cisco IOS Release 12.0(7)XR3 enhances the Cisco IOS Firewall feature set with the Cisco IOS Firewall (Phase II) set of features:

Context-Based Access Control (CBAC) that intelligently filters TCP and UDP packets based on the application-layer protocol. This includes Java applets, which can be blocked completely or allowed only from known and trusted sources.

Detection and prevention of the most common denial of service (DoS) attacks, such as ICMP and UDP echo packet flooding, SYN packet flooding, half-open or other unusual TCP connections, and deliberate mis-fragmentation of IP packets.

Support for a broad range of commonly used protocols, including H.323 and NetMeeting, FTP, HTTP, MS Netshow, RPC, SMTP, SQL*Net, and TFTP.

Authentication Proxy for authentication and authorization of web clients on a per-user basis.

Dynamic port mapping that maps the default port numbers for well-known applications to other port numbers. This can be done on a host-by-host basis or for an entire subnet, providing a large degree of control over which users can access different applications.

Configurable alerts and audit trail.

Intrusion Detection System (IDS) that recognizes the signatures of 59 common attack profiles. When an intrusion is detected, IDS can either send an alarm to a syslog server or to NetRanger Director, drop the packet, or reset the TCP connection.

User-configurable audit rules.

Configurable real-time alerts and audit trail logs.

For general information, see the description of the Cisco IOS Firewall Feature Set in the Cisco Product Catalog. For detailed information, see the Cisco IOS Firewall Feature Set documentation set, as well as the sections on Traffic Filtering and Firewalls in the Security Configuration Guide and Security Command Reference (available on the Documentation CD-ROM and CCO).

Simple Gateway Control Protocol 1.1

The Cisco uBR924 cable access router supports Simple Gateway Control Protocol (SGCP). SGCP is an out-of-band signaling protocol that interacts with the external Call Agent (CA) to establish telephone calls. SGCP eliminates the need for a dial plan mapper and static configuration on the router to map IP addresses to telephone numbers because this function is provided by the external CA.

The Cisco uBR924 cable access router supports SGCP residential gateway (RGW), as opposed to trunking gateway (TGW), which controls the telephone call.

SGCP MIB

The Simple Gateway Control Protocol (SGCP) Management Information Base (MIB) supports configuration, performance, and fault management of the SGCP interface. The SGCP MIB components are as follows:

xgcplnBadVersions—Number of incoming messages delivered to the protocol entity and that are for an unsupported protocol version

xgcpRequestTimeOut—Timeout value used for retransmitting an unacknowledged message

xgcpRequestRetries—Number of retries for a request that exceeds timeout

xgcpAdminStatus—Desired state of the protocol entity

xgcpOperStatus—Current operational status of the protocol entity

xgcpUnRecognizedPackets—Number of unrecognized packets since reset

xgcpMsgStatTable—Table that contains SGCP statistics information since reset

xgcpMsgStatEntry—Row in the xgcpMsgStatTable that contains information about SGCP message statistics per IP address of the Media Gateway Controller (MGC)

xgcpIPAddress—IP address of the MGC

xgcpSuccessMessages—Number of successful messages that communicate with the MGC on that IP address

xgcpFailMessages—Number of failed messages that communicate with the MGC on that IP address

xgcpUpDownNotification—Notification sent when the protocol status changes between up and down

Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(5)T1

The following software features are inherited from Cisco IOS Release 12.0(5)T1 and are supported by the Cisco uBR924 cable access router for Release 12.0(7)XR3.

Fax

Fax is supported in Cisco IOS Release 12.0(7)XR3 images that support voice. The two Cisco uBR924 cable access router VoIP ports can now be connected to telephone or fax devices. Also refer to Hardware Features in Release 12.0(7)XR3 Inherited from Release 12.0(4)XI1.


Note   Only one voice call (telephone or fax) per VoIP line is active at a time.


Enhanced Bridging

The Cisco uBR924 cable access router contains four RJ-45 (10BaseT Ethernet) hub ports. Using Cisco IOS Release 12.0(5)T1 or higher interim images, these hub ports can be connected to four computers directly or one of the four ports to an Ethernet hub. The Ethernet hub connects additional computers or devices at the site. A maximum of 254 devices can be bridged using Cisco IOS 12.0(5)T1 or higher interim images. (No limit exists in routing mode.)

DOCSIS Baseline Privacy

The DOCSIS Baseline Privacy feature is based on the DOCSIS Baseline Privacy Interface Specification. It provides data privacy across the HFC network by encrypting traffic flows between the Cisco uBR924 cable access router and the cable operator's Cable Modem Termination System (CMTS).

Baseline Privacy security services are defined as a set of extended services within the DOCSIS MAC sublayer. Two new MAC management message types, BPKM-REQ and BPKM-RSP, are employed to support the Baseline Privacy Key Management (BPKM) protocol.

The BPKM protocol does not use authentication mechanisms such as passwords or digital signatures; it provides basic protection of service by ensuring that a cable modem, uniquely identified by its 48-bit IEEE MAC address, can only obtain keying material for services it is authorized to access. The Cisco uBR924 cable access router is able to obtain two types of keys from the CMTS: the Traffic Exchange Key (TEK), which is used to encrypt and decrypt data packets, and the Key Exchange Key (KEK), which is used to decrypt the TEK.

For more information on this feature, refer to the DOCSIS Baseline Privacy Interface Specification (SP-BPI-IO1-970922).

IPSec Network Security

IPSec Network Security (IPSec) is an IP security feature that provides robust authentications and encryption of IP packets. IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF). IPSec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating IPSec devices ("peers") such as the Cisco uBR924 cable access router.

IPSec provides the following network security services:

Privacy—IPSec can encrypt packets before transmitting them across a network.

Integrity—IPSec authenticates packets at the destination peer to ensure that the data has not been altered during transmission.

Authentication—Peers authenticate the source of all IPSec-protected packets.

Anti-replay protection—Prevents capture and replay of packets; helps protect against denial-of-service attacks.

Triple DES (Phase I)

Data Encryption Standard (DES) is a standard cryptographic algorithm developed by the United States National Bureau of Standards. The Triple DES (3DES) images increase the encryption/decryption from the 56-bit IPSec feature set to 168 bit.

Layer 2 Tunneling Protocol

Layer 2 Tunneling Protocol (L2TP) is an emerging Internet Engineering Task Force (IETF) standard that combines Cisco's Layer 2 Forwarding (L2F) and Microsoft's Point-to-Point Tunneling Protocol (PPTP). L2TP is an extension of the Point-to-Point Protocol (PPP), which is an important component for Access Virtual Private Networks (VPNs).

Traditional dial-up networking services only supported registered IP addresses, which limited the types of applications that could be implemented over VPNs. L2TP supports multiple protocols and unregistered and privately administered IP addresses over the Internet. This allows the existing access infrastructure, such as the Internet, modems, access servers, and ISDN terminal adapters (TAs), to be used.

L2TP can be initiated wherever PPTP or L2F is currently deployed and can be operated as a client initiated tunnel, such as PPTP, or a network access server (NAS) initiated tunnel, such as L2F.

Refer to the Limitations and Restrictions section for information regarding the functionality of the Cisco uBR924 cable access router in L2TP applications.

Firewall (Phase I)—Cisco Secure Integrated Software

The Firewall (Phase I) feature set extends the security technology currently available in Cisco IOS software to the Cisco uBR924 cable access router, providing firewall-specific capabilities. Firewall (Phase I) features include stateful, application-based filtering, dynamic per-user authentication and authorization, defense against network attacks, Java blocking, and real-time alerts. Firewall (Phase I) is interoperable with Cisco IOS software features including NAT, VPN tunneling protocols, Cisco Express Forwarding (CEF), AAA extensions, Cisco encryption technology, and Cisco IOS IPSec.

Baseline Privacy Management Information Base

The Baseline Privacy Management Information Base (MIB), as currently defined, is available in Cisco IOS Release 12.0(7)XR3 code. BPI allows an SNMP manager to monitor and manage the Cisco uBR924 cable access router's BPI configuration, including whether BPI is enabled, status of current authorization keys, current timeout values, real-time status counters, and additional information about authorization errors.


Note   The SNMP manager must load the DOCSIS-BPI-MIB.my MIB to access the BPI attributes.


Hardware Features in Release 12.0(7)XR3 Inherited from Release 12.0(4)XI1

The following hardware features are inherited from Cisco IOS Release 12.0(4)XI1 and are supported by the Cisco uBR924 cable access router for Release 12.0(7)XR3.

The Cisco uBR924 cable access router contains two FXS VoIP ports that are labeled V1+V2 and V2 at the rear of the unit. These ports can be connected directly to telephones or to adapters that allow multiple telephones to be connected to each of the two VoIP telephone lines. The Ringer Equivalence Number (REN) determines how many telephones can be connected to a telephone line.


Note   In most areas, the sum of the RENs of all devices on any one line should not exceed 5. If too many devices are attached, they may not ring properly.


Between 5 and 10 voice devices can be connected to each of the two VoIP telephone lines, provided each telephone line does not exceed the 5 REN limit. Typical length of the 26-gauge telephone wire is 3,000 feet or more.

The Cisco uBR924 cable access router can support the number of telephones typically found in small businesses.

Software Features in Release 12.0(7)XR3 Inherited from Release 12.0(4)XI1

The following software features are inherited from Cisco IOS Release 12.0(4)XI1 and are supported by the Cisco uBR924 cable access router for Release 12.0(7)XR3.

Full and DOCSIS-Compliant Bridging

Full and DOCSIS-Compliant Bridging allows the Cisco uBR924 cable access router to operate with any DOCSIS-qualified CMTS.

The ability of the Cisco uBR924 cable access router to grant access to Customer Premises Equipment (CPE) devices is controlled by the "MAX CPE" field in the DOCSIS configuration file. The Cisco uBR924 cable access router defaults to one MAX CPE address unless this option is set to a higher number. In Cisco IOS Release 12.0(7)XR3 images, the valid MAX CPE address range is 1 to 254 for bridging operation.

Easy IP

Dynamic Host Configuration Protocol (DHCP) Server:

With Easy IP, Cisco IOS Release 12.0(7)XR3 supports Intelligent DHCP Relay and DHCP Client functionality. A DHCP Relay Agent is any host that forwards DHCP packets between clients and servers. A DHCP Relay Agent enables the client and server to reside on separate subnets. If the Cisco IOS DHCP server cannot satisfy a DHCP request from its own database, it can forward the DHCP request to one or more secondary DHCP servers defined by the network administrator using standard Cisco IOS IP helper-address functionality.

Network Address Translation and Port Address Translation (NAT/PAT):

Allows customers to maintain their own private networks while giving them full Internet access through the use of one or more global IP addresses

Allows several private IP addresses to use the same global IP address by using address overloading

Facilitates configuration and permits a large network of users to reach the network by using one Cisco uBR924 cable access router and the same DOCSIS cable interface IP address

Eliminates the need to readdress all hosts with existing private network addresses (one-to-one translation) or by enabling all internal hosts to share a single registered IP address (many-to-one translation, also known as Port Address Translation [PAT])

Enables packets to be routed correctly to and from the outside world by using the Cisco uBR924 cable access router

Allows personal computers on the Ethernet interface to have IP addresses to be mapped to the cable interface's IP address

Routing protocols will run on the Ethernet interface instead of the cable interface, and all packets received will be routed out the Ethernet interface or use the default gateway to reach the CMTS. This eliminates the need to run RIP on the cable interface.

To implement NAT on the Cisco uBR924 cable access router, the Ethernet interface is configured with an "inside" address and the cable interface is configured with an "outside" address. The Cisco uBR924 cable access router also supports configuration of static connections, dynamic connections, and address pools.

Routing (RIP V2)

A routing configuration for the Cisco uBR924 cable access router is most likely used when the cable access router is being added to an existing personal computer network. When configured in routing mode, the Cisco uBR924 cable access router will automatically configure the headend's IP address as its IP default gateway. When the IP host-routing is being configured, this automatic configuration of the headend's IP address as its IP default gateway will allow the Cisco uBR924 cable access router to send packets not intended for the Ethernet interface to the headend.

RIP V2 routing is useful for small internetworks in that it enables optimization of Network Interface Center (NIC)-assigned IP addresses by defining VLSMs for network addresses, and it allows Classless Interdomain Routing (CIDR) addressing schema.

Voice Support

Acceptable voice quality and reduction in network bandwidth usage are achieved by using several voice processing techniques. Digital Signal Processors (DSPs), in combination with DSP firmware in the Cisco uBR924 cable access router, provide the stream-to-packet and packet-to-stream conversion, as well as voice processing capabilities. Typical voice processing services include echo cancellation, voice compression, Voice Activity Detection (VAD) or silence compression and Dual Tone Multi-Frequency (DTMF) tone detection and generation. Supported vocoders include:

G.711 A Law 64000 bps

G.711 u Law 64000 bps

G.723.1 5300 bps

G.723.1 6300 bps

G.726 16000 bps

G.726 24000 bps

G.726 32000 bps

G.728 16000 bps

G.729 Annex-A 8000 bps

G.729 8000 bps—Default CODEC for telephone calls

Use of the H.323 protocol typically involves a dial plan and mapper at the headend to map IP addresses to telephone numbers. You can also set static routes. Use dial peer commands to define local and remote peers. For the backup POTS port, define port and E.164 addresses. For remote peers, define remote peers' IP addresses and E.164 addresses.


Note   If you have Cisco Network Registrar (CNR) version 3.0 with the extension scripts relay.tci and setrouter.tci, you can assign E.164 addresses to local ports and use a gatekeeper to resolve the remote peers' IP addresses. CNR uses the DHCP option (merit dump file) containing an ASCII string that defines the E.164 address-to-port assignments. The Cisco uBR924 cable access router software creates dial peers, starts H.323 RAS gateway support, and registers the E.164 addresses with the gatekeeper. Functionality is augmented in Cisco IOS Release 12.0(5)T1 and higher.


Cable Device MIB

The Cable Device MIB is for DOCSIS-compliant cable modems and CMTS. The Cable Device MIB records statistics related to the configuration and status of the cable modem. Statistics include an events log and device status. The following list details the components of the Cable Device MIB:

docsDevBase group extends the MIB-II "system" group with objects needed for cable device system management.

docsDevNmAccess group provides a minimum level of SNMP access security.

docsDevSoftware group provides information for network downloadable software upgrades.

docsDevServer group provides information about the progress of interaction with various provisioning servers.

docsDevEvent group provides information about the progress of reporting.

docsDevFilter group configures filters at link layer and IP layer for bridge data traffic.

The Cable Device MIB is very similar to the RFI MIB in that both allow access to statistics; they are different in that the Cable Device MIB reports statistics on the cable modem, and the RFI MIB reports statistics on the radio frequency transmissions over the cable television line.

Cisco Standard MIBs

The Cisco Standard MIBs consist of the following components:

CISCO-PRODUCT-MIB

CISCO-SYSLOG-MIB

CISCO-FLASH-MIB

BRIDGE-MIB

IF-MIB

CiscoWorks/CiscoView


Note   The Cisco Management Information Base (MIB) User Quick Reference publication is no longer published. For the latest list of MIBs supported by Cisco, see the Cisco Network Management Toolkit on Cisco Connection Online (CCO). From the CCO home page, click on this path: Service & Support: Software Center: Network Mgmt Products: Cisco Network Management Toolkit: Cisco MIB


Cisco Voice MIBs

The Cisco Voice MIBs consist of the following components:

VOICE-IF-MIB

VOICE-DIAL-CONTROL-MIB

VOICE-ANALOG-MIB

DIAL-CONTROL-MIB

CISCO-DIAL-MIB

SGCP-MIB

Radio Frequency Interface MIB

The Radio Frequency Interface (RFI) MIB module is for DOCSIS-compliant radio frequency interfaces in cable modems and CMTS. On the cable modem, RFI MIB entries provide:

Upstream and downstream channel characteristics

Class of service attributes

Physical signal quality of the downstream channels

Attributes of cable access router MAC interface

Status of several MAC layer counters

The RFI MIB includes tables describing both the CMTS and the cable modem side of the cable interface. All cable modem tables are implemented.

With IPSec, data can be transmitted across a public network without fear of observation, modification, or spoofing. This enables applications such as VPNs, extranets, and remote user access.

IPSec services are similar to those provided by Cisco Encryption Technology, a proprietary security solution introduced in Cisco IOS Software Release 11.2. However, IPSec provides a more robust security solution, and is standards based.

Limitations and Restrictions

This section describes warnings and cautions about using Cisco IOS Release 12.0(7)XR3 software.

Using Multiple PCs with a Cisco uBR924 Cable Access Router

The MAX CPE parameter in a Cisco uBR924 cable access router's DOCSIS configuration file determines how many PCs (or other CPE devices) are supported by that Cisco uBR924 cable access router. The default value for the MAX CPE parameter is 1, which means only one PC can be connected to the Cisco uBR924 cable access router.

The DOCSIS 1.0 specification states that a CMTS cannot age-out MAC addresses for CPE devices, so the first PC that is connected to a Cisco uBR924 cable access router is normally the only one that the CMTS recognizes as valid. If a subscriber replaces an existing PC or changes its network interface card (NIC) to one that has a different MAC address, the CMTS will refuse to let the PC come online because this would exceed the maximum number of CPE devices specified by the MAX CPE parameter.

To allow a subscriber to replace an existing PC or NIC, the following workarounds are possible:

If using a Cisco uBR7200 series router as the CMTS, enter the clear cable host MAC address command on the Cisco uBR7200 series router to remove the PC's MAC address from the router's internal address tables. The PC's MAC address will be rediscovered and associated with the correct Cisco uBR924 cable access router during the next DHCP lease cycle.

Increase the value of the MAX CPE parameter in the Cisco uBR924 cable access router's DOCSIS configuration file so that it can accommodate the desired number of PCs. Reset the Cisco uBR924 cable access router to force it to load the new configuration file.

Layer 2 Tunneling Protocol

Implementation of L2TP in Cisco IOS Release 12.0(7)XR3 is dependent on a PPP connection supported on one of the directly attached interfaces. A dial-up PPP connection is required in order to initiate an L2TP Tunnel connection. This is a requirement of the L2TP Access Concentrator (LAC). In Cisco IOS Release 12.0(7)XR3, the Cisco uBR924 cable access router cannot function as the LAC; it can only function as the L2TP Network Server (LNS), which terminates a tunnel created elsewhere in the network.

Important Notes

This section contains important information about using Cisco IOS Release 12.0 T software.

Last Maintenance Release of Cisco IOS Release 12.0 T

Cisco IOS Release 12.0(6)T has been renamed 12.0(7)T to align this release with the 12.0(7) mainline release. The closed caveats for Release 12.0(7)T are identical to the caveats closed in the 12.0(7) mainline release. There was no change in the feature content of the renamed release—the features in 12.0(6)T are the same as 12.0(7)T. Release 12.0(7)T is the last maintenance release of the 12.0 T release train.

Customers needing closure of caveats for the 12.0 T features should migrate to the 12.1 mainline release, which has the complete feature content of Release 12.0 T and will eventually reach General Deployment (GD). Release 12.0 T is a superset of the 12.0 mainline release, so all caveats closed in the 12.0 mainline are also closed in 12.0 T.

Supplemental and Corrected Text for the Online Feature Module

Troubleshooting Tips for the uBR924 Cable Access Router, page 15, indicates: "Some CATV systems use alternative frequency plans such as the IRC (Incrementally Related Carrier) and HRC (Harmonically Related Carrier) plans. Most of the IRC channel slots overlap the EIA plan. The HRC plan is not supported by Cisco's cable access routers since so few cable plants are using this plan."

The correction should read: "For the Cisco uBR924 cable access router, both the IRC (Incrementally Related Carrier) and HRC (Harmonically Related Carrier) plans are supported. Most of the IRC channel slots overlap the EIA plan. For the Cisco uBR924 cable access router, both the IRC and HRC plans are supported.

The list of downstream search bands added for HRC have appropriate center frequencies and step values for an HRC channel plan. The expanded search band list may increase the amount of time required by the Cisco uBR924 cable access router to acquire the downstream signal on the HRC channel plan, which can add to the total time for complete registration of the modem the very first time it is added to the cable system."

Supported MIBs

The Cisco uBR924 cable access router supports the following categories of MIBs:

SNMP standard MIBs—These are the MIBs required by any agent supporting SNMPv1 or SNMPv2 network management.

Cisco's platform and network-layer enterprise MIBs—These MIBs are common across most of Cisco's router platforms. If your network management applications are already configured to support other Cisco routers, such as the Cisco 2600 series or Cisco 7200 series, no further configuration is needed unless the version of Cisco IOS software being used has updated these MIBs.

<