• Adapter Type: Select an adapter type from those available and currently installed in Crosswork Hierarchical Controller.

• Adapter Name: Enter a unique name for this adapter type instance. Multiple instances of the same adapter type are allowed.

• Crosswork Network Controller adapter:

  Note	API version for Crosswork Network Controller must be version 2.

  

  Note	The Full Data Fetch Interval must be set to 300 seconds or higher in a production network.

  These parameters must be configured for Crosswork Network Controller notifications and collection.

  

  

• IOS-XR adapter

  

  Note	The Polling Cycle must be 300 seconds or higher in a production network. Concurrency can be increased. Set the Logging Level to Info when everything is working correctly.

  These collection parameters must be configured. These parameters collect optical power values for the link assurance application.

  

  Note	Check the Enable collection of optics and coherent DSP Statistics parameter only when using Automation Starter Solution.

  The status of the devices must be ok in the Devices tab after the addition and completion of a successful collection cycle.

  

  To add routers to Crosswork Hierarchical Controller, click the Managed Devices tab and then + Add Device.

  

  Use the hostname+hco (ron-8201-1-hco) or the device IP address. Assign the device to a site for display in Explorer UI.

  Assign both the IOS-XR adapter type and the Crosswork Network Controller adapter type to the device. Do not enable discovery for the Crosswork Network Controller adapter.

  

• Cisco Optical Network Controller adapter

  The Polling cycle must be set to 300s or higher in a production network. Polling retrieves TAPI SIPs, topology, and connectivity services.

  The URL in this figure is for the Cisco Optical Network Controller 3.1.

  

  Cisco Optical Network Controller automatically discovers optical nodes. Assign a site to the nodes to display them in the Explorer UI.

  

• Crosswork Network Controller Crosswork Data Gateway adapter

  Crosswork Network Controller Crosswork Data Gateway adapter is used to collect telemetry data through gNMI (gRPC Network Management Interface) to the router. In Crosswork Network Controller, the routers must be configured with the gNMI protocol with the encoding type set to “PROTO” and the gNMI capability enabled. In IOS XR, the routers must be configured for gRPC so that Crosswork Data Gateway can create gNMI telemetry subscriptions.

  

  The Crosswork Data Gateway adapter is configured to connect to Crosswork Network Controller controlling Crosswork Data Gateway instance. It can be the same as the Crosswork Network Controller used for the topology or a different Crosswork Network Controller. The collection parameters describe the supported telemetry collection jobs. The statistics show up in the physical interface statistics and in the Link Assurance application.

  

• The device name in Cisco Crosswork Hierarchical Controller must match the device name in Crosswork Network Controller for successful deployment. If successful, you will see Cisco Crosswork Hierarchical Controller as a new destination in Crosswork Network Controller. This is automatically set up by Cisco Crosswork Hierarchical Controller. As Crosswork Data Gateway is enabled on devices, new collection jobs are populated. A single collection job is available for each router collecting multiple KPIs.

  

  

• NSO adapter In Hierarchical Controller

  In Hierarchical Controller 8.0 there is an embedded NSO installed when Hierarchical Controller 8.0 is installed. The NSO adapter can use the internal NSO or an external NSO instance. To provision devices using the NSO adapter, add the NSO adapter to the devices.

  Use the NSO adapter when you use the Automation starter solution and full solution.

  Note	If using the internal NSO, the Routed Optical Networking 3.0 Core Function Pack must be installed on the NSO instance. If using the internal NSO, devices must be added to that NSO, since adding them to Hierarchical Controller does not automatically onboard them into the internal NSO.

  

  Begin configuring your NSO and IOS-XR adapters.

  

1. Click Settings > Security > SAML Configuration.

   Enter the required information:

   • Login URL: Visit https://<CNC_IP_address>:<port>/crosswork/sso/idp/profile/SAML2/Redirect/SSO

   • Entity ID: Visit https://<CNC_IP_address>/idp

   • Signing Certificate: Copy the metadata from Crosswork Network Controller at https://<CNC_IP_address>:<port>crosswork/sso/idp/metadata

   • Groups Attribute Name: Type authenticationMethod.

   

2. Click Settings > Security > Permission Mapping.

   

3. Add a Match condition for SAML Group of QueryDatabaseAuthenticationHandler with a permission of permission/admin.

   

The metadata is at https://<HCO_IP_address>:<port>/sso/metadata. This file is a sample.

<EntityDescriptor entityID="https://172.29.11.83:8443" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:assertion="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://172.29.11.83:8443/sso/logout">
    </SingleLogoutService>
    <AssertionConsumerService index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://172.29.11.83:8443/sso/acs">
    </AssertionConsumerService>
    </SPSSODescriptor>
</EntityDescriptor>

1. Log in to Crosswork Network Controller and click Administration > AAA > SSO.

   

2. Click + and enter the required information:

   • Enter a name.

   • Enter a unique evaluation order number.

   • Upload the metadata file of HCO in XML format.

   

3. Click Save.

Troubleshooting Cisco Crosswork Hierarchical Controller SSO

• Use the sedo logs security audit in the Crosswork Hierarchical Controller to get the logs.

• Ensure that the time between Cisco Crosswork Hierarchical Controller and Cisco Crosswork Network Controller is synchronized

• If there is an error related to QueryDatabaseAuthenticationHandler, add the SAML group mapping in Crosswork Hierarchical Controller configuration and map to group Admin.

1. Click Links > IGP .

2. Hover over the source device or the destination device. Click the ellipsis and then click IGP device at Crosswork Network Controller.

   

   This operation displays router traffic engineering information in Crosswork Network Controller.

   

1. Click Connections > SR Policy.

2. Hover over a policy, and click the ellipsis to open cross launch.

   

   This operation displays detailed policy information in Crosswork Network Controller.

   

1. Click Devices > ONS.

2. Hover over a device, click the ellipsis, and then click Optical Node at COSM.

   

1. Click Ports > OTS.

2. Hover over a port, click the ellipsis, and then click Optical Port at COSM.

   

1. Click Link Assurance > Inspect links.

2. Hover over a node, click the ellipsis, and then click Optical Node at COSM.

   

   This operation displays the node functional view in Cisco Optical Site Manager for NCS 1000 series devices or in SVO for NCS 2000 series devices.

   

1. Click Link Assurance > Inspect links.

2. Hover over a port, click the ellipsis, and click Optical Port at COSM.

   

1. In the Device manager, click the + to add a new device. Specify a name for the new device and click Confirm.

   

2. After creating the new device, click its name. Then, enter both required and optional parameters. In this screen, you must provide the authgroup and the IP address of the device.

   

3. Scroll down in the device configuration screen. Click 'device-type' to open the device type selection screen. The supported device type for Routed Optical Networking ML FP is IOS-XR CLI NED.

   

4. Click NETCONF to select the appropriate NED. The Routed Optical Networking ML FP requires the use of the cisco-iosxr-nc-7.3 NED.

   

5. Click the Commit manager to view the NSO CLI configuration being applied. Click Commit to save the device configuration to NSO.

   

Note

Next we add the multilayer end-to-end service to configure and provision both the optical line system and routers. We recommend you to click check-sync in the Device manager to ensure that the device configuration is properly in sync with NSO before provisioning. Initial provisioning fails if the device is out of sync.

1. In the Service manager, select the inter-layer-link service point from the drop-down list.

   

2. Specify the end-point-device and the line port. These are required values. The endpoint device is the 8201 router. Specify the router optics port that is connected to the optical line system add-drop port in the line port field. Click Confirm.

   

3. In the Configuration editor, edit the inter-layer-link service by clicking the newly created draft service to complete the information required. In this example, we add the site name, optical add-drop network element, and the optical add-drop port. The optical controller field specifies which Optical Network Controller instance is used for provisioning. This parameter is optional if a global instance is defined. A global Cisco Optical Network Controller instance can be set in NSO and will be used if the field is not populated. The add-drop port uses the inventory ID of the physical port on the NCS1K-MD-64-C multiplexer for frequency XXXX.YY. The add-drop reference includes both RX and TX directions. In addition to specifying the network-element and add-drop in R/S/I/P form, a TAPI SIP can also be used to identify the add-drop port.

   

   These elements are the only required elements in the inter-layer-link service type.

4. Perform Ols-domain optical-service-interface configuration.

   • Optical-controller specifies the Cisco Optical Network Controller instance managing the OLS.

   • Network-element specifies the optical element name as shown in TAPI topology.

   • Optical-add-drop specifies the port to be used on the optical network element.

     

   • The optical-service-interface can also be added as a TAPI SIP UUID.

     

5. Click the config tab in the Commit manager to see the NSO CLI configuration that will be committed to NSO.

   

6. Click Commit in the upper right corner to commit the service. An end-to-end service requires two inter-layer-links, one for each router connected to its optical line system add-drop port.

   

Note

Next we add the multilayer end-to-end service to configure and provision both the optical line system and routers. We recommend you to click check-sync in the Device manager to ensure that the device configuration is properly in sync with NSO before provisioning. If the device is out of sync, initial provisioning fails.

1. In the Service manager, select the Routed Optical Networking ML service point from the drop-down list. When we create the new Routed Optical Networking ML service, the required components are the service name, mode of the service (transponder or muxponder), and the bandwidth. The bandwidth corresponds to the line rate of the ZR or ZR+ optics. Click Confirm.

   

2. In the Configuration editor, click the newly created service name for editing the additional parameters that are required for the service. In this example, set the circuit-id name in the global parameters. The frequency is set by the optical controller based on the specified optical add-drop port. The dac-rate is set to the default value.

   Note	User configuration global options are frequency and dac-rate. Dac-rate controls the TX shaping parameters: 1x1.25 = enabled, 1x1 = disabled. If you leave this field blank, the system uses the default setting of enabled. Modulation of 16 QAM is available for 2x100G muxponder mode.

3. After the ols-domain is added, you must add end-points to the circuit. Two end-points are always required. The end-points are the routers with ZR/ZR+ optics.

   

4. Add the end-point-device to the service. Click Confirm.

   

   After the end-point is created, click the end-point to edit the end-point parameters. The line port is a required parameter and refers to the optics port on the router. In this example, the line port for the end-point matches the value specified in the inter-layer-link service.

   

   The transmit-power is an optional parameter for end-to-end provisioning. If you omit this parameter, the Cisco Optical Network Controller provides the transmit power.Transmit power sets the transmit power, the value is calculated as 100 times the value in 0.1 dBm increments. For example, a value of –100 equals –10 dBm. If you do not specify a value, the system uses a default of –10 dBm for QDD-400G-ZR-S or QDD-400G-ZRP-S, and 0 dBm for DP04QSDD-HE0 (Bright ZR+). The transceiver-capability field specifies the optic type and is only required if no packet layer configuration is being performed. In this example, you are performing packet layer provisioning so specifying the transceiver capability is not required.

   Add the line port of 0/0/0/20 to the Routed Optical Networking ML service.

   

5. Click endpoint to return to the top-level endpoint configuration, click terminal-device-packet to configure Ethernet/IP parameters

   

   Note

   Ethernet and IP configuration is optional. Bundle configuration adds an interface to an existing bundle or creates a new bundle and adds the newly created IP interface to it. Interface configuration is used for configuring IP address parameters on newly created Ethernet interfaces. In this example, we add a new Bundle and assign an IP address to the Bundle.

6. Click the plus sign next to the bundle to create a bundle with the identifier 500. This action creates a bundle interface, Bundle-Ether 500, on the endpoint router.

   The interface index for a bundle use case is always 0. In a non-bundle configuration in muxponder mode, the index can be 0 to 3, representing the number of interfaces created as part of the muxponder configuration.

   

7. Click the bundle number and ip-address to configure an IP address on the bundle.

   

8. Return to the top-level endpoint configuration. Select index 0 that you created previously, and click membership to add the interface to the bundle.

   

   Note	Bundle-id selects the previously created bundle. Mode sets the bundle LAG signaling mode. Active=LACP, passive=LACP listener only, on=No active signaling, inherit=Inherit signaling from Bundle interface configuration. Default is active.

9. Return to the top level of the service configuration. Then configure the second endpoint in the same manner.

   

10. Click SRLG to perform SRLG configuration

    

    Note

    Configuration options are to specify a preconfigured group, a list of numeric SRLG values, or a list of SRLG names associated with preconfigured name:value pairs. Each type can be populated in the same configuration. In this example we specify a list of explicit numeric values. An index is used along with the numeric value.

You can verify the status by inspecting the plan associated with the service. You can find the plan under the main ron-ml configuration which you can access by clicking the top portion of the service configuration. An example is highlighted in this image.

1. Inspect the plan by clicking on the newly created service

   

   If all steps are green and complete, the service has been properly deployed to the network

   

2. Inspect router configuration.

   The show configuration commit changes last 1 command shows the CLI config applied to the device during the NSO provisioning.

   The show optics controller 0/0/0/20 command verifies the operational status.

   

Crosswork Hierarchical Controller 8.0 in Routed Optical Networking 3.0 also supports “router only” provisioning. This type of provisioning applies optical parameters to the router optics port and IP layer parameters, but does not provision the optical line system.

1. Select Link Manager application.

   

   The initial view displays a list of cross links.

   

2. Click Add Cross Link.

   

3. Select the NMC cross-link type. Cross Link Manager supports ETH and NMC cross links.

   

4. ou can select either the router DCO port or the optical add-drop port first using the Link Manager application. In this example, port filtering is performed by the router device used for the NMC cross-link.

   

5. The filtered list shows that the router, ron-poc-8201-1, has a single ZR+ optics port. Select this port and click OK.

   

6. Select the second port, which is the optical add-drop port. To filter for the add-drop port, set the device to ron-poc-ols-1 and the name to 194.000.

   

7. Select the two ports, Ethernet and OCH, in your NMC cross-link. Click Add Cross Link.

   (Optional) Add a description.

   

8. Click the added cross-link to see its attributes.

   

9. To view the added cross-link in the explorer app, click the link.

   

10. Create the second NMC cross-link using the same process as in the previous steps.

    

11. View the end-to-end network with both cross-links in the Explorer app.

    

• Cross-link connectivity verification is supported on all router platforms and on NCS 1010 with MD-32 and BRK-24 modules.

• Connectivity verification uses NSO CLI NED to modify router port state and transmit power, and is service-affecting.

• When validation starts, Crosswork Hierarchical Controller continuously checks the RX power on the optical add-drop port while performing connectivity verification in the background.

1. Configure NMC validation settings to control validation. Set the Wait period to receive samples while on to 180 seconds. Set the Wait period to receive samples while off to 50 seconds.

   

2. Select a link and click Validate Link. Alternatively, you can click Validate All Manual Links to perform connectivity verification for all the links.

   

3. After validation completes, inspect the evidence of successful or unsuccessful verification. This image shows a successful verification. The status changes from Unknown to Validated By Shut No Shut. It typically takes 60 to 80 seconds for the ZR or ZR+ interface to start transmitting after the no shut command is issued.

   

   This image shows a failed verification. There is no change in the optical device port power levels after the no shut operation.

   

1. In the applications bar in the Crosswork Hierarchical Controller, click the Services Manager icon.

   

   The Service Manager application shows you a list of services.

   

2. Select the Point to Point tab and click IP Link from the Create New P2P drop-down list to create end-to-end service between router DCO ports.

   

   The IP Link Creation wizard appears.

3. Enter the Cisco Crosswork Hierarchical Controller service name, description of the router optical controller, and the Link Rate Mode in the General tab.

   • Here, we are creating a 1x400G link. In 2x100G, 3x100G, and 4x100G modes, you can choose to create separate IP links or create a Bundle with each channel link added as a member.

     

   Alternatively

   • To create a 200G 16-QAM link, select the 200G–2x100G link rate mode.

     200G 16-QAM allows the use of 200G signals on 50Ghz optical line systems. The default value for 200G is QPSK at 60.1Ghz.

     

   Alternatively

   • To create a Bundle interface, Select a bundle option from the link rate mode drop down list.

     ou can create a 400G bundle interface (400G Member). You can also create a 300G bundle (3x100G Members) or a 200G bundle (2x100G Members).

     

   (Optional) Check the Router Configuration Only check box to configure only the router optical controller and IP information and not the optical line system. This configuration is used when the OCHNC is created outside Cisco Crosswork Hierarchical Controller.

4. Select the two router ports in the service. This is done by selecting the site and port. ​The transmit power for each endpoint is an optional parameter. The default transmit power is used if no value is provided.

   

5. Click the magnifying glass icon to select the first router port.

   The router interface selection displays interfaces on the router that satisfy these criteria:

   • is a ZR or ZR+ interface,

   • has no existing optics configuration, and

   • has a proper NMC cross-connect configured.

   This page lists all the available ZR and ZR+ ports currently unused on all the devices. Select the ron-poc-8201-1 Optics0/0/0/22 port.

   

6. Similar to the previous step, choose ron-poc-57b1-1 Optics 0/0/0/24 as the second router port.

7. (Optional) Set the transmit power in dBm on each port. If OLS provisioning is being performed, the OLS controller returns the optical power. If the OLS controller does not return the optical power or router only provisioning is being used, the router default power is used.

8. (Optional) Enter the IP address information for interfaces. If IP addresses are not entered, ZR and ZR+ router optical configuration happens; however, IP addresses are not configured.

9. Click Next to move to Advanced configuration.

   

10. (Optional) Set the frequency. If optical provisioning is being performed, the OLS controller can return the frequency to be used, and it may be omitted. If router only provisioning is being performed, the frequency must be specified.

11. (Optional) Set the DAC rate. A DAC rate setting can be used to enable OpenZR+ compatibility mode, disabling TX shaping and enhanced modem mode.

    

12. (Optional) Set links or nodes to include or exclude in the optical path. This setting is not available in router only provisioning.

13. (Optional) To add the new link or set of links to an existing Bundle LAG interface configured on the routers, choose the bundle from the Add to existing LAG drop-down.

    

14. (Optional) If you are configuring a 200G 16-QAM link, set the DAC rate to 1 x 1.25.

    200G link rate mode enables the Modulation selection drop-down. Modulation selection is not available in any other mode. Select the 16 QAM (30GHz) modulation.

    

15. Click Next to review the final configuration. Verify the router endpoint and optical line system parameters. Click Finish to start provisioning, or click Save to save for later provisioning.

    

    This image shows a sample summary for a 200G 16-QAM link.

    

16. Go to Services Manager to view provisioning progress​.

    Click the Operations > Logs tab to view the provisioning API calls used and responses. The logs show API calls and responses for both optical line system provisioning through Cisco Optical Network Controller and router provisioning through Crosswork Network Controller.

    

    If the provisioning is successful, the Configuration State field changes to INSTALLED state and the Operational State field changes to UP​ state.

    

    The Summary tab displays the new service link.

17. Verify the end-to-end link across both IP and optical layers in the Explorer view.

    

Here, you can view the port, the specific optical channel, and the CoherentDSP entities.

These figures display EPNM monitoring data relevant to ZR or ZR+ optics, including current and historical performance.

A KPI profile can have many different KPIs assigned. In this procedure, add only specific optics KPIs to the optics_profile KPI profile.

See Create a New KPI Profile.

You can select multiple nodes. The image shows the KPI profile being applied to a single node.

See Enable KPI Profiles on Devices.

See View Alerts for Network Devices

This image shows the RX and TX power of the QDD-400G-ZR-S transceiver.