Configuration Guide for Cisco NCS 1001, IOS XR Release 25.x.x

TCP/IP ACLs for span loss and OTDR autoscan traffic

Updated: July 27, 2026

Want to summarize with AI?

This section explains how optional TCP/IP access control lists (ACLs) restrict span loss calculation and OTDR autoscan traffic between Cisco NCS 1001 nodes.

TCP/IP ACLs for span loss and OTDR autoscan traffic are optional security controls that

control bidirectional traffic between Cisco NCS 1001 nodes,
restrict traffic on TCP port 30000 for span loss calculation and TCP port 30010 for OTDR autoscan, and
limit node-to-node communication to the management network where the Cisco NCS 1001 nodes are located.

The span loss calculation and OTDR autoscan features operate without ACL configuration. In production environments, configure ACLs to restrict the communication path to the local node private subnet or the management network.

ACL traffic requirements

Permit both ingress and egress traffic on TCP ports 30000 and 30010 to support bidirectional communication between nodes.

Table 1. Port usage for span loss and OTDR autoscan
TCP port	Application traffic
30000	Span loss calculation data
30010	OTDR autoscan data

Table 2. ACL address roles
Traffic direction	Source address	Destination address
Ingress	Remote node	Local management address
Egress	Local node	Remote node

Permit both ingress and egress traffic on ports 30000 and 30010 for proper bidirectional communication between nodes.

Configure span loss and OTDR autoscan ACLs

Restrict bidirectional span loss calculation and OTDR autoscan traffic between Cisco NCS 1001 nodes to the required management subnets.

Before you begin

Identify the local node subnet, remote node subnet, wildcard masks for IPv4, prefix lengths for IPv6, and the management interface where the ACLs must be applied.

Note

ACL configuration is optional. Span loss calculation and OTDR autoscan can operate without ACL restrictions, but ACLs are recommended in production environments to enhance network security. Allow TCP ports 30000 and 30010 in both ingress and egress directions.

Follow these steps to configure span loss and OTDR autoscan ACLs:

Procedure

Create the IPv4 ACL and permit traffic on TCP ports 30000 and 30010.

Example:


RP/0/RP0/CPU0:ios(config)# ipv4 access-list span-loss-otdr-acl
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp <remote-node-subnet> <wildcard-mask> <local-node-subnet> <wildcard-mask> eq 30000
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp <remote-node-subnet> <wildcard-mask> <local-node-subnet> <wildcard-mask> eq 30010
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp <local-node-subnet> <wildcard-mask> <remote-node-subnet> <wildcard-mask> eq 30000
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp <local-node-subnet> <wildcard-mask> <remote-node-subnet> <wildcard-mask> eq 30010

This example permits traffic within the 192.0.2.0/24 subnet.


RP/0/RP0/CPU0:ios(config)# ipv4 access-list span-loss-otdr-acl
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 eq 30000
RP/0/RP0/CPU0:ios(config-ipv4-acl)# permit tcp 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 eq 30010

Create the IPv6 ACL and permit traffic on TCP ports 30000 and 30010.

Example:


RP/0/RP0/CPU0:ios(config)# ipv6 access-list span-loss-otdr-acl-v6
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp <remote-node-subnet>/<prefix-length> <local-node-subnet>/<prefix-length> eq 30000
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp <remote-node-subnet>/<prefix-length> <local-node-subnet>/<prefix-length> eq 30010
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp <local-node-subnet>/<prefix-length> <remote-node-subnet>/<prefix-length> eq 30000
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp <local-node-subnet>/<prefix-length> <remote-node-subnet>/<prefix-length> eq 30010

This example permits traffic within the 2001:DB8::/32 subnet.


RP/0/RP0/CPU0:ios(config)# ipv6 access-list span-loss-otdr-acl-v6
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp 2001:DB8:4491:2000::/64 2001:DB8:4491:2000::/64 eq 30000
RP/0/RP0/CPU0:ios(config-ipv6-acl)# permit tcp 2001:DB8:4491:2000::/64 2001:DB8:4491:2000::/64 eq 30010

Apply the ACL to the management interface.

After creating the ACL, apply it to the appropriate management interface to control bidirectional span loss calculation and OTDR autoscan traffic between nodes. Apply the ACL in both ingress and egress directions.

This example applies the IPv4 ACL to MgmtEth0/RP0/CPU0/0 .


RP/0/RP0/CPU0:ios# configure terminal
RP/0/RP0/CPU0:ios(config)# interface MgmtEth0/RP0/CPU0/0
RP/0/RP0/CPU0:ios(config-if)# ipv4 access-group span-loss-otdr-acl ingress
RP/0/RP0/CPU0:ios(config-if)# ipv4 access-group span-loss-otdr-acl egress
RP/0/RP0/CPU0:ios(config-if)# commit
RP/0/RP0/CPU0:ios(config-if)# end

This example applies the IPv6 ACL to MgmtEth0/RP0/CPU0/0 .


RP/0/RP0/CPU0:ios# configure terminal
RP/0/RP0/CPU0:ios(config)# interface MgmtEth0/RP0/CPU0/0
RP/0/RP0/CPU0:ios(config-if)# ipv6 access-group span-loss-otdr-acl-v6 ingress
RP/0/RP0/CPU0:ios(config-if)# ipv6 access-group span-loss-otdr-acl-v6 egress
RP/0/RP0/CPU0:ios(config-if)# commit
RP/0/RP0/CPU0:ios(config-if)# end

The management interface permits span loss calculation and OTDR autoscan traffic only through the configured IPv4 and IPv6 ACL rules.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.