Configuration Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

PDF

Configuration Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

Headless mode

Updated: June 18, 2026

Want to summarize with AI?

Log in

This section explains how headless mode enables uninterrupted traffic flow on the NCS 1014 during control plane disruptions.

A headless mode is a system operation mode that

  • enables Cisco NCS 1014 to continue forwarding traffic when the controller card is absent, failed, or being restarted

  • allows fault propagation for client and trunk ports, and

  • maintains errorless operation unless there is any line-level activity or the traffic is encrypted and the keys have expired beyond a predefined maximum duration.

During headless mode, the control plane will be unavailable. You cannot provision new configurations, view operational data, or perform performance monitoring without a functional controller.

Extended headless modes

An extended headless mode is a secure operational capability that

  • allows a card that supports encryption to continue encrypted traffic for up to 28+ days without control plane intervention,

  • enables an automated backup key mechanism that securely stores and manages the backup key on the line card, and

  • triggers the backup key when the keylifetime crosses a threshold to prevent traffic disruption, during prolonged control plane outages.

From Release 26.2.1, extended headless mode is enabled by default for the cards NCS1K14-2.4TAL-K9, NCS1K14-2.4T-K9, and NCS1K14-2.4TX-K9.

The additional backup key takes charge when the control plane is down for more than 14 days. With the new backup key mechanism enabled, the “Key Expiring” critical alarm is raised only after the last back up key crosses the threshold.

Table 1. Feature History

Feature Name

Release Information

Feature Description

Extended headless mode

 Cisco IOS-XR Release 26.2.1

Extended headless mode is activated by default on these cards: NCS1K14-2.4TAL-K9, NCS1K14-2.4T-K9, and NCS1K14-2.4T-X-K9. In this mode, backup keys are created and stored in the line card (LC). These backup keys are utilized during prolonged control plane outages to maintain uninterrupted encrypted traffic for over 28 days.

This feature mitigates the risk of traffic disruption during extended events such as RP replacements, reduces operational risk, and minimizes the need for manual intervention, ensuring secure and seamless network operations even when the control plane is unavailable.

CLI:

The command otnsec disable-headless-negotiation is introduced to disable the extended headless mode.

Data models enhanced:

  • Cisco-IOS-XR-otnsec-cfg.yang

  • Cisco-IOS-XR-otnsec-oper.yang

Example output from odu-flex controller in extended headless mode

This sample shows the controller output when extended headless mode is enabled on a card:

RP/0/RP0/CPU0:ios#show controllers odu-flex 0/0/0/0/1 otnsec
Thu Jun  4 11:38:15.773 IST
Controller Name          : ODU-FLEX 0/0/0/0/1
Source ip                : 192.168.1.0
Destination ip           : 192.168.1.1
Session id               : 1

Fips mode                : Enabled
Headless State           : Enabled
IKEv2 profile            : LC0_0
Session State            : SECURED

Otnsec policy name       : otnsec_policy
  cipher-suite           : AES-GCM-256
  security-policy        : Must Secure
  sak-rekey-interval     : 28800
Time to rekey            : 24019
Time to Expire           : 1329816

Programming Status       :
  Inbound SA(Rx)         :
    AN[1]                :
        SPI              : 0x101
  Outbound SA(Tx)        :
    AN[0]                :
        SPI              : 0x100

Disable extended headless mode for OTNSec

Prevent the backup key mechanism and extended headless mode from activating automatically in OTNSec unless you explicitly enable them.

By default, if the capability exists, the backup key mechanism is automatically activated. To change this behavior, configure the system to disable it explicitly. This setting applies at the global chassis level. You cannot configure headless or non-headless support per line card.

Procedure

1.

Enter the global configuration mode.

Example:

RP/0/RP0/CPU0:iso#configure
2.

Disable automatic activation of the extended headless mode, and commit.

Example:

RP/0/RP0/CPU0:iso(config)#otnsec disable-headless-negotiation
RP/0/RP0/CPU0:iso(config)#commit
Note

This setting applies globally to the entire chassis. Individual line card configuration for headless mode support does not apply.

3.

(Optional) To re-enable the backup key mechanism and headless mode, remove the disable command and commit the configuration again.

Extended headless mode for OTNSec is disabled at the chassis level, and the backup key mechanism will not activate automatically.