> Getting Started
> The system is shipped with no active configuration file. As a result, you must configure the software after the hardware is fully installed and the installation verified.
> This chapter provides instructions for connecting to the console port and for creating the initial Local context management configuration. It includes the following sections:

> • | Configuration

> • | Using the Quick Setup Wizard

> • | Using the CLI for Initial Configuration

> • | Configuring the System for Remote Access

> • | Configuring the SPIO Management Interface with a Second IP Address

> Configuration
> The first time power is applied to the system, the Switch Processor Card (SPC) or System Management Card (SMC) installed in chassis slot 8 automatically launches a Quick Setup Wizard on its console port.
> The console port is located at the upper-rear of the chassis on the Switch Processor Input/Output (SPIO) Line Card installed in slot 24. The purpose of this wizard is to guide you through the initial configuration of the system.
> You can choose not to use the wizard and perform the initial configuration by issuing commands to the command line interface (CLI).
> The following sections describe how to configure the system.
> Using the Quick Setup Wizard
> The Quick Setup Wizard consists of three parts:

> • | Configuring a context-level security administrator and hostname

> • | Configuring the Ethernet interface for out-of-band (OOB) management on the SPIO installed in slot 24

> • | Configuring the system for remote CLI access via Telnet, Secure Shell (SSH), or File Transfer Protocol (FTP)

> The following figure and table provides a flow diagram that shows the logic of the wizard and additional information and notes.
> System Quick Setup Wizard Logic Diagram
> System Quick Setup Wizard Logic Diagram Callout Descriptions

> Callout | Description/Notes
> A | Enter or exit the wizard.
> • | Enter no at the prompt to automatically be directed to the system’s CLI. Proceed to the Using the CLI for Initial Configuration section for instructions on performing an initial system configuration with the CLI.
> • | Enter setup at the command prompt to re-invoke the wizard.
> B | Configure an administrative username/password and the a hostname for the system.
> • | The name of the default administrative user configured through the wizard is admin.
> • | Administrative user names can be up to 32 alpha and/or numeric characters and are case sensitive.
> • | Administrative user passwords can be up to 63 alpha and/or numeric characters and are case sensitive.
> • | Configure a valid, non-null hostname. The hostname can consist of up to 63 alpha and/or numeric characters and is case sensitive.
> C | Configure a single Switch Processor Input/Output (SPIO) out-of-band management interface for out-of-band system management.
> • | Traffic on the management LAN is not transferred over the same media as user data and control signaling.
> • | For security reasons, it is recommended that management functions be maintained on a separate network from user data and control signaling.
> • | Depending on the medium being used to access the network, Ethernet or fiber:
> • | SPIO1 represents either the Ethernet 1 or SFP 1 interface on the SPIO, as shown in the figure below. SPIO1 is the default.
> • | SPIO2 represents either the Ethernet 2 or SFP 2 interface on the SPIO.
> • | Use the RJ-45 interfaces to connect the system to the management network with CAT3 or CAT5 Ethernet cable. Use the SFP interfaces to connect the system to the management network with 1000Base-SX optical fiber cable. The default is rj-45.
> • | Configure an IP address, subnet mask, and gateway for the interface.
> • | Instructions for configuring the second management interface on the SPIO can be found in Configuring System Settings.
> D | Enable various remote access protocols for accessing the system.
> • | Secure Shell (SSH) uses TCP port number 22 by default, if enabled.
> • | SSH V1 and/or V2 are supported.
> • | If SSH is enabled, you can also enable SSH File Transfer Protocol (SFTP) server functionality.
> • | Telnet uses TCP port number 23 by default, if enabled.
> • | The File Transfer Protocol (FTP) uses TCP port number 21 by default, if enabled.
> Important: For maximum security, it is recommended that you use only SSH v2.
> E | Review and/or modify the configuration of previous prompts.
> 1. | Enter the number of the prompt to be modified.
> 2. | Configure the parameter.
> 3. | Optional. Repeat step 1 and step 2 to modify additional settings.
> 4. | Enter “done” when you have completed all changes.
> F | Review the configure script created by the wizard based on your inputs. An example of a created script is displayed in the example below. Variables are displayed in italics (variable).
> G | Apply the configuration file to the system. Once applied, the parameter configuration is automatically saved to the system.cfg file stored on the primary SPC/SMC compact flash card.

> ‌
> SPIO Interfaces
> config
> system hostname <hostname>
> context local
> administrator <admin_name> password <passwd>
> interface spio1
> ip address <ip_address> subnet
> #exit
> ip route 0.0.0.0 0.0.0.0 <gw_address> spio1
> ssh key <v1_key>
> ssh key <v2_rsa_key>
> ssh key <v2_dsa_key>
> server sshd
> subsystem sftp
> #exit
> no server telnetd
> server ftpd
> no server telnetd
> #exit
> port ethernet 24/1
> bind interface spio1 local
> no shutdown
> media rj45
> #exit
> end
> Important: Once configuration using the wizard is complete, proceed to instructions on configuring other system parameters.
> Using the CLI for Initial Configuration
> The initial configuration consists of the following:

> • | Configuring a context-level security administrator and hostname

> • | Configuring the Ethernet interface(s) on the SPIO that is installed behind the primary SPC/SMC

> • | Configuring the system for remote CLI access via Telnet, SSH, or FTP (secured or unsecured)

> This section provides instructions for performing these tasks using the CLI.

> Step 1 | At the [local]host_name prompt enter:

> configure
> The following prompt appears:
> [local]host_name(config)#

> Step 2 | Enter the context configuration mode by entering the following command:

> context local
> The local context is the system’s management context. Contexts allow you to logically group services or interfaces. A single context can consist of multiple services and can be bound to multiple interfaces.
> The following prompt appears:
> [local]host_name(config-ctx)#

> Step 3 | Enter the following command to configure a context-level security administrator for the system:

> administrator <name> { password <password> | encrypted password <enc_password> } [ ftp ] [ no-cli ] [ timeout-absolute <absolute_time> ] [ timeout-idle <idle_time> ]

> Keyword/Variable | Description
> <name> | Specifies the security administrator’s name. The name can be between 1 and 32 alpha and/or numeric characters and is case sensitive.
> password <password> | Specifies the password for the security administrator. The password can be between 1 and 63 alpha and/or numeric characters and is case sensitive.
> encrypted password | Specifies the encrypted password for the security administrator. The keyword is only used by the system when you save configuration scripts. The system displays the encrypted keyword in the configuration file as a flag indicating that the variable following the keyword is the encrypted version of the plain text password. Only the encrypted password is saved as part of the configuration file.
> ftp | Specifies that the security administrator is allowed to access the system with the File Transfer Protocol (FTP). This option is useful to upload files (configuration or software images) to the system’s CompactFlash or PC-card Flash modules.
> no-cli | Specifies that the security administrator cannot access the system’s command line interface (CLI). Important: Use this keyword in conjunction with the ftp keyword to allow access to the system with FTP only.
> timeout-absolute | Specifies the maximum amount of time that the operator can maintain a session with the system. The absolute_time is measured in seconds. Use any integer value between 0 and 300000000. The default absolute_time is 0. In the event that the absolute timeout value is reached, the operator session is automatically terminated.
> timeout-idle | Specifies the maximum amount of time that an operator session can remain idle before being automatically terminated. The idle_time is measured in seconds. Use any integer value between 0 and 300000000. The default idle_time is 0.

> ‌
> Important: You must configure a context-level security administrator during the initial configuration. After you complete the initial configuration process and end the CLI session, if you have not configured a security administrator, CLI access will be locked.

> Step 4 | Enter the following command at the prompt to exit the context configuration mode:

> exit
> The following prompt appears:
> [local]host_name(config)#

> Step 5 | Enter the following command to configure a hostname by which the system will be recognized on the network:

> system hostname <host_name>
> <host_name> is the name by which the system will be recognized on the network. The hostname can be up to 63 alpha and/or numeric characters and is case sensitive.

> Step 6 | Configure the network interfaces on the SPIO using the following instructions:

> Step a | Enter the context configuration mode by entering the following commands:

> context local
> The following prompt appears:
> [local]host_name(config-ctx)#

> Step b | Enter the following command to specify a name for the interface:

> interface <interface_name>
> <interface_name> is the name of the interface. The interface name can be between 1 and 79 alpha and/or numeric characters and is case sensitive.
> The following prompt appears as the system enters the Ethernet Interface Configuration mode:
> [local]host_name(config-if-eth)#

> Step c | Configure an IP address for the interface configured in the previous step by entering the following command:

> ip address <ipaddress> <subnetmask>

> Variable | Description
> ipaddress | Specifies the IP address for the interface.
> subnetmask | Specifies the subnet mask for the interface.

> ‌
> Important: If you are executing this command to correct an address or subnet that was mis-configured with the Quick Setup Wizard, you must verify the default route and port binding configuration. Use step 11 and step 6 of this procedure. If there are issues, perform steps 7e through 7k to reconfigure the information.

> Step d | Enter the following command to exit the Ethernet interface configuration mode:

> exit
> The following prompt appears:
> [local]host_name(config-ctx)#

> Step e | Configure a static route, if required, to point the system to a default gateway. Entering the following command:

> ip route 0.0.0.0 0.0.0.0 <gw_address> <interface_name>

> Variable | Description
> gw_address | Specifies the IP address of the default gateway.
> interface_name | Specifies the name of the interface that was configured in step 7b.

> ‌

> Step f | Enter the following to exit from the context configuration mode:

> exit
> The following prompt appears:
> [local]host_name(config)#

> Step g | Enter the Ethernet Port Configuration mode:

> port ethernet <slot#>/<port#>

> Variable | Description
> slot# | The actual chassis slot in which the line card is installed. This could be either slot number 24 or 25.
> port# | The physical port on the line card that will be used. For the SPIO, this will be either port 1 or 2. Port 1 represents the top most port (either RJ-45 or SFP).

> ‌
> The following prompt appears:
> [local]host_name(config-port-<slot#/port#>)#

> Step h | Bind the port to the interface that you created in step 7b. Binding associates the port and all of its settings to the interface. Enter the following command:

> bind interface <interface_name> local
> no shutdown
> <interface_name> is the name of the interface that you configured in step 7b.

> Step i | Specify which Ethernet media you are using. Enter the following:

> media [ rj45 | sfp ]
> The SPIO is equipped with dual RJ-45 and dual SFP interfaces. The RJ-45 interfaces connect the system to the management network with CAT3 or CAT5 Ethernet cable. The SFP interfaces connect the system to the management network with 1000Base-SX optical fiber cable.

> Step j | Configure the port speed, if needed, by entering the following command:

> medium { auto | speed { 10 | 100 | 1000 } duplex { full | half } }

> Keyword/Variable | Description
> auto | Configures the system to auto detect the port speed. This is the default setting.
> speed | Specifies the port speed for the port itself. When manually configuring the port speed, you must ensure that the network server configuration supports the speed and duplex configuration. The possible rates are:
> • | 10 specifies 10 Mbps
> • | 100 specifies 100 Mbps
> • | 1000 specifies 1000 Mbps
> Important: Use 1000 Mbps only for the SFP ports on the Ethernet 1000 or SPIO Line Cards. In addition, if you manually configure the port speed, you must also configure the duplex mode.
> duplex | If you manually configure the speed, you must also use this parameter to configure the duplex mode. You can implement either a full or half duplex mode. Important: Ethernet networking rules dictate that if a device whose interface is configured to auto-negotiate is communicating with a device that is manually configured to support full duplex mode, the first device negotiates with the manually configured speed of the second device, but only communicates in half duplex mode.

> ‌

> Step k | Exit the Ethernet Interface Configuration mode by entering the command:

> exit
> The following prompt appears:
> [local]host_name(config)#
> Important: Refer below for instructions on configuring the SPIO management interface with a second IP address.
> Configuring the System for Remote Access
> Configure the system for remote access. An administrative user may access the system from a remote location over a local area network (LAN) or wide area network (WAN):

> • | Telnet

> • | Secure Shell (SSH)

> • | File Transfer Protocol (FTP) (secured or unsecured)

> • | Trivial File Transfer Protocol (TFTP)

> Important: For maximum security, use SSH v2.

> Step 1 | Enter the context configuration mode by entering the following command:

> context local
> The following prompt appears:
> [local]host_name(config-ctx)#

> Step 2 | Configure the system to allow Telnet access, if desired:

> server telnetd

> Step 3 | Configure the system to allow SSH access, if desired:

> ssh generate key [ type { v1-rsa | v2-rsa | v2-dsa } ]
> Important: v2-rsa is the recommended key type.
> server sshd

> Step 4 | Configure the system to allow FTP access, if desired, by entering the following command:

> server ftpd

> Step 5 | Configure the system to allow TFTP access, if desired:

> server tftpd

> Step 6 | Exit the context configuration mode by entering the following command:

> exit
> The following prompt appears:
> [local]host_name(config)#

> Step 7 | Exit the configuration mode by entering the following command:

> end
> The following prompt appears:
> [local]host_name#

> Step 8 | Verify the configuration by entering the following command:

> show configuration
> The CLI output should be similar to the sample output:
> context local
> interface <interface_name>
> ip address <ipaddress> <subnetmask>
> #exit
> subscriber default
> #exit
> administrator <admin_name> password <admin_password>
> server telnetd
> server ftpd
> ssh generate key
> server sshd
> #exit
> port ethernet 24/1
> bind interface <interface_name> local
> #exit
> port ethernet 24/1
> no shutdown
> #exit
> snmp engine-id local 800007e580ed826c191ded2d3d
> end

> Step 9 | Verify the configuration of the IP routes by entering the following command:

> show ip route
> The CLI output should be similar to the sample output:
> "*" indicates the Best or Used route.
> Destination Nexthop Protocol Prec Cost Interface
> *0.0.0.0/0 <ipaddress> static 1 0 spio1
> *<network> 0.0.0.0 connected 0 0 spio1

> Step 10 | Verify the interface binding by entering the following command:

> show ip interface name <interface_name>
> <interface_name> is the name of the interface that was configured in step 7b.
> The CLI output should be similar to the sample output:
> Intf Name: spio1Intf Type: Broadcast
> Description:
> IP State: UP (Bound to 24/1 untagged, ifIndex 402718721)
> IP Address: <ipaddress> Subnet Mask: <subnetmask>
> Bcast Address: <bcastaddress> MTU: 1500
> Resoln Type: ARP ARP timeout: 3600 secs
> L3 monitor LC-port switchover: Disabled
> Number of Secondary Addresses: 0

> Step 11 | Save your configuration as described in the Verifying and Saving Your Configuration chapter.

> Configuring the SPIO Management Interface with a Second IP Address
> If necessary, you can configure a second IP address on the SPIO management interface.

> Step 1 | Enter the configuration mode by entering the following command at the prompt:

> configure
> The following prompt appears:
> [local]host_name(config)#

> Step 2 | Enter the following to enter the context configuration mode:

> context local
> The following prompt appears:
> [local]host-name(config-ctx)#

> Step 3 | Enter the interface slot number and port number by entering the following command:

> [local]host_name(config-ctx)# 24/1
> The following prompt appears:
> [local]host_name(config-if-eth)#

> Step 4 | Enter the secondary IP address and subnet mask by entering the following command:

> [local]host_name(config-if-eth)#ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx secondary

> Step 5 | Exit the configuration mode by entering the following command:

> [local_host]host_name(config-if-eth)#end

> Step 6 | Confirm the interface ip addresses by entering the following command:

> [local_host]# show config context local
> The CLI output should look similar to this example:
> config
> context local
> interface <interface_name>
> ip address <ipaddress> <subnetmask>
> ip address <ipaddress> <subnetmask> secondary
> #exit

> Step 7 | Save your configuration as described in the Verifying and Saving Your Configuration chapter.

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883