• Adapter Type: Select an adapter type from those available and currently installed in Crosswork Hierarchical Controller.

• Adapter Name: Enter a unique name for this adapter type instance. Multiple instances of the same adapter type are allowed.

• Crosswork Network Controller adapter:

  Note

  API version for Crosswork Network Controller must be version 2.

  

  Note

  The Full Data Fetch Interval must be set to 300 seconds or higher in a production network.

  These parameters must be configured for Crosswork Network Controller notifications and collection.

  

  

• Cisco Optical Network Controller adapter

  The Polling cycle must be set to 300s or higher in a production network. Polling retrieves TAPI SIPs, topology, and connectivity services.

  The URL in this figure is for the Cisco Optical Network Controller 3.1.

  

  Cisco Optical Network Controller automatically discovers optical nodes. Assign a site to the nodes to display them in the Explorer UI.

  

• NSO adapter In Hierarchical Controller

  In Hierarchical Controller 11.0 there is an embedded NSO installed when Hierarchical Controller 11.0 is installed. The NSO adapter can use the internal NSO or an external NSO instance. To provision devices using the NSO adapter, add the NSO adapter to the devices.

  Use the NSO adapter when you use the Automation starter solution and full solution.

  Note

  • If using the internal NSO, the Routed Optical Networking 4.0 Core Function Pack must be installed on the NSO instance.

  • If using the internal NSO, devices must be added to that NSO, since adding them to Hierarchical Controller does not automatically onboard them into the internal NSO.

  

  Begin configuring your NSO and IOS-XR adapters.

  

1. Click Settings > Security > SAML Configuration.

   Enter the required information:

   • Login URL: Visit https://<CNC_IP_address>:<port>/crosswork/sso/idp/profile/SAML2/Redirect/SSO

   • Entity ID: Visit https://<CNC_IP_address>/idp

   • Signing Certificate: Copy the metadata from Crosswork Network Controller at https://<CNC_IP_address>:<port>crosswork/sso/idp/metadata

   • Groups Attribute Name: Type authenticationMethod.

   

2. Click Settings > Security > Permission Mapping.

   

3. Add a Match condition for SAML Group of QueryDatabaseAuthenticationHandler with a permission of permission/admin.

   

The metadata is at https://<HCO_IP_address>:<port>/sso/metadata. This file is a sample.

<EntityDescriptor entityID="https://172.29.11.83:8443" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:assertion="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://172.29.11.83:8443/sso/logout">
    </SingleLogoutService>
    <AssertionConsumerService index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://172.29.11.83:8443/sso/acs">
    </AssertionConsumerService>
    </SPSSODescriptor>
</EntityDescriptor>

1. Log in to Crosswork Network Controller and click Administration > AAA > SSO.

   

2. Click + and enter the required information:

   • Enter a name.

   • Enter a unique evaluation order number.

   • Upload the metadata file of HCO in XML format.

   

3. Click Save.

Troubleshooting Cisco Crosswork Hierarchical Controller SSO

• Use the sedo logs security audit in the Crosswork Hierarchical Controller to get the logs.

• Ensure that the time between Cisco Crosswork Hierarchical Controller and Cisco Crosswork Network Controller is synchronized

• If there is an error related to QueryDatabaseAuthenticationHandler, add the SAML group mapping in Crosswork Hierarchical Controller configuration and map to group Admin.

1. Click Links > IGP .

2. Hover over the source device or the destination device. Click the ellipsis and then click IGP device at Crosswork Network Controller.

   

   This operation displays router traffic engineering information in Crosswork Network Controller.

   

1. Click Connections > SR Policy.

2. Hover over a policy, and click the ellipsis to open cross launch.

   

   This operation displays detailed policy information in Crosswork Network Controller.

   

1. Click Devices > ONS.

2. Hover over a device, click the ellipsis, and then click Optical Node at COSM.

   

1. Click Ports > OTS.

2. Hover over a port, click the ellipsis, and then click Optical Port at COSM.

   

1. Click Link Assurance > Inspect links.

2. Hover over a node, click the ellipsis, and then click Optical Node at COSM.

   

   This operation displays the node functional view in Cisco Optical Site Manager for NCS 1000 series devices or in SVO for NCS 2000 series devices.

   

1. Click Link Assurance > Inspect links.

2. Hover over a port, click the ellipsis, and click Optical Port at COSM.

   

1. In the Device manager, click the + to add a new device. Specify a name for the new device and click Confirm.

   

2. After creating the new device, click its name. Then, enter both required and optional parameters. In this screen, you must provide the authgroup and the IP address of the device.

   

3. Scroll down in the device configuration screen. Click 'device-type' to open the device type selection screen. The supported device type for Routed Optical Networking ML FP is IOS-XR CLI NED.

   

4. Click NETCONF to select the appropriate NED. The Routed Optical Networking ML FP requires the use of the cisco-iosxr-nc-7.3 NED.

   

5. Click the Commit manager to view the NSO CLI configuration being applied. Click Commit to save the device configuration to NSO.

   

Note

Next we add the multilayer end-to-end service to configure and provision both the optical line system and routers. We recommend you to click check-sync in the Device manager to ensure that the device configuration is properly in sync with NSO before provisioning. Initial provisioning fails if the device is out of sync.

1. In the Service manager, select the inter-layer-link service point from the drop-down list.

   

2. Specify the end-point-device and the line port. These are required values. The endpoint device is the 8201 router. Specify the router optics port that is connected to the optical line system add-drop port in the line port field. Click Confirm.

   

3. In the Configuration editor, edit the inter-layer-link service by clicking the newly created draft service to complete the information required. In this example, we add the site name, optical add-drop network element, and the optical add-drop port. The optical controller field specifies which Optical Network Controller instance is used for provisioning. This parameter is optional if a global instance is defined. A global Cisco Optical Network Controller instance can be set in NSO and will be used if the field is not populated. The add-drop port uses the inventory ID of the physical port on the NCS1K-MD-64-C multiplexer for frequency XXXX.YY. The add-drop reference includes both RX and TX directions. In addition to specifying the network-element and add-drop in R/S/I/P form, a TAPI SIP can also be used to identify the add-drop port.

   

   These elements are the only required elements in the inter-layer-link service type.

4. Perform Ols-domain optical-service-interface configuration.

   • Optical-controller specifies the Cisco Optical Network Controller instance managing the OLS.

   • Network-element specifies the optical element name as shown in TAPI topology.

   • Optical-add-drop specifies the port to be used on the optical network element.

     

   • The optical-service-interface can also be added as a TAPI SIP UUID.

     

5. Click the config tab in the Commit manager to see the NSO CLI configuration that will be committed to NSO.

   

6. Click Commit in the upper right corner to commit the service. An end-to-end service requires two inter-layer-links, one for each router connected to its optical line system add-drop port.

   

Note

Next we add the multilayer end-to-end service to configure and provision both the optical line system and routers. We recommend you to click check-sync in the Device manager to ensure that the device configuration is properly in sync with NSO before provisioning. If the device is out of sync, initial provisioning fails.

1. In the Service manager, select the Routed Optical Networking ML service point from the drop-down list. When we create the new Routed Optical Networking ML service, the required components are the service name, mode of the service (transponder or muxponder), and the bandwidth. The bandwidth corresponds to the line rate of the ZR or ZR+ optics. Click Confirm.

   

2. In the Configuration editor, click the newly created service name for editing the additional parameters that are required for the service. In this example, set the circuit-id name in the global parameters. The frequency is set by the optical controller based on the specified optical add-drop port. The dac-rate is set to the default value.

   Note

   • User configuration global options are frequency and dac-rate.

   • Dac-rate controls the TX shaping parameters: 1x1.25 = enabled, 1x1 = disabled. If you leave this field blank, the system uses the default setting of enabled.

   • Modulation of 16 QAM is available for 2x100G muxponder mode.

3. After the ols-domain is added, you must add end-points to the circuit. Two end-points are always required. The end-points are the routers with ZR/ZR+ optics.

   

4. Add the end-point-device to the service. Click Confirm.

   

   After the end-point is created, click the end-point to edit the end-point parameters. The line port is a required parameter and refers to the optics port on the router. In this example, the line port for the end-point matches the value specified in the inter-layer-link service.

   

   The transmit-power is an optional parameter for end-to-end provisioning. If you omit this parameter, the Cisco Optical Network Controller provides the transmit power.Transmit power sets the transmit power, the value is calculated as 100 times the value in 0.1 dBm increments. For example, a value of –100 equals –10 dBm. If you do not specify a value, the system uses a default of –10 dBm for QDD-400G-ZR-S or QDD-400G-ZRP-S, and 0 dBm for DP04QSDD-HE0 (Bright ZR+). The transceiver-capability field specifies the optic type and is only required if no packet layer configuration is being performed. In this example, you are performing packet layer provisioning so specifying the transceiver capability is not required.

   Add the line port of 0/0/0/20 to the Routed Optical Networking ML service.

   

5. Click endpoint to return to the top-level endpoint configuration, click terminal-device-packet to configure Ethernet/IP parameters

   

   Note

   • Ethernet and IP configuration is optional.

   • Bundle configuration adds an interface to an existing bundle or creates a new bundle and adds the newly created IP interface to it.

     Interface configuration is used for configuring IP address parameters on newly created Ethernet interfaces.

     In this example, we add a new Bundle and assign an IP address to the Bundle.

6. Click the plus sign next to the bundle to create a bundle with the identifier 500. This action creates a bundle interface, Bundle-Ether 500, on the endpoint router.

   The interface index for a bundle use case is always 0. In a non-bundle configuration in muxponder mode, the index can be 0 to 3, representing the number of interfaces created as part of the muxponder configuration.

   

7. Click the bundle number and ip-address to configure an IP address on the bundle.

   

8. Return to the top-level endpoint configuration. Select index 0 that you created previously, and click membership to add the interface to the bundle.

   

   Note

   • Bundle-id selects the previously created bundle.

   • Mode sets the bundle LAG signaling mode. Active=LACP, passive=LACP listener only, on=No active signaling, inherit=Inherit signaling from Bundle interface configuration. Default is active.

9. Return to the top level of the service configuration. Then configure the second endpoint in the same manner.

   

10. Click SRLG to perform SRLG configuration

    

    Note

    • Configuration options are to specify a preconfigured group, a list of numeric SRLG values, or a list of SRLG names associated with preconfigured name:value pairs.

    • Each type can be populated in the same configuration.

    • In this example we specify a list of explicit numeric values. An index is used along with the numeric value.

You can verify the status by inspecting the plan associated with the service. You can find the plan under the main ron-ml configuration which you can access by clicking the top portion of the service configuration. An example is highlighted in this image.

1. Inspect the plan by clicking on the newly created service

   

   If all steps are green and complete, the service has been properly deployed to the network

   

2. Inspect router configuration.

   The show configuration commit changes last 1 command shows the CLI config applied to the device during the NSO provisioning.

   The show optics controller 0/0/0/20 command verifies the operational status.

   

Crosswork Hierarchical Controller 8.0 in Routed Optical Networking 3.0 also supports “router only” provisioning. This type of provisioning applies optical parameters to the router optics port and IP layer parameters, but does not provision the optical line system.

1. Select Link Manager application.

   

   You get this initial view that shows the list of cross links.

   

2. Click Add Cross Link.

   

3. Select the NMC cross link type. Cross Link Manager supports ETH and NMC cross links.

   

4. The Link Manager application allows you to select either the router DCO port or the optical add-drop first. In this example, the ports are filtered by the router device used for the NMC cross link.

   

5. The filtered list shows that our router, ron-poc-8201-1, has a single ZR+ optics port. Select this port, then click OK.

   

6. Select the second port, which is the optical add-drop port. To filter for the add-drop port, set the device to ron-poc-ols-1 and the name to 194.000.

   

7. Select the two ports (Ethernet and OCH) in your NMC Cross Link. Click Add Cross Link.

   (Optional) Add a description

   

8. Click the added cross link to see its attributes.

   

9. View the added crosslink in the explorer app by clicking on the link.

   

10. Similar to the earlier steps, create the second NMC cross link.

    

11. View the end-to-end network with both crosslinks in the Explorer app.

    

• Cross link connectivity verification is supported on all router platforms and on NCS 1010 with MD-32 and BRK-24 modules.

• Connectivity verification uses NSO CLI NED to modify router port state and TX power, and is service-affecting.

• When validation starts, Croswork Hierarchical Controller continuously checks the RX power on the optical add-drop port. Connectivity verification is performed in the background.

1. Configure NMC validation settings to control validation. Set the Wait period to receive samples while on to 180 seconds. Set the Wait period to receive samples while off to 50 seconds.

   

2. Select a link and click Validate Link. Alternatively, you can click Validate All Manual Links to perform connectivity verification for all the links.

   

3. After validation completes, inspect the evidence of successful or unsuccessful verification. This image shows a successful verification. The status changes from Unknown to Validated By Shut No Shut. It typically takes 60 to 80 seconds for the ZR or ZR+ interface to start transmitting after the no shut command is issued.

   

   This image shows a failed verification. There is no change in the optical device port power levels after the no shut operation.

   

1. In the applications bar in the Crosswork Hierarchical Controller, click the Services Manager icon.

   

   The Service Manager application shows you a list of services.

   

2. Select the Point to Point tab and click IP Link from the Create New P2P drop-down list to create end-to-end service between router DCO ports.

   

   The IP Link Creation wizard appears.

3. Enter the Cisco Crosswork Hierarchical Controller service name, description of the router optical controller, and the Link Rate Mode in the General tab.

   • Here, we are creating a 1x400G link. In 2x100G, 3x100G, and 4x100G modes, you can choose to create separate IP links or create a Bundle with each channel link added as a member.

     

   (Optional) Check the Router Configuration Only check box to configure only the router optical controller and IP information and not the optical line system. This configuration is used when the OCHNC is created outside Crosswork Hierarchical Controller.

4. Select the two router ports in the service. This is done by selecting the site and port. ​The transmit power for each endpoint is an optional parameter. The default TX power is used if no value is provided.

   

5. Click the magnifying glass icon to select the first router port.

   The router interface selection displays interfaces on the router that satisfy these criteria:

   • is a ZR or ZR+ interface,

   • has no existing optics configuration, and

   • has a proper NMC cross-connect configured.

6. Similar to the previous step, choose the second router port.

7. The wizard prompts you to select the appsel value.

   

8. In this example, choose AppSel 8.

   

   AppSel code 8 represents a 1x400G configuration using 16QAM, OpenRoadm FEC, TX shaping enabled, and the enhanced modem mode.

9. (Optional) Enter the IP address information for interfaces. If IP addresses are not entered, ZR or ZR+ router optical configuration happens; however, IP addresses are not configured.

   

10. Click Next to move to Advanced configuration.

    

11. (Optional) Set the frequency. If optical provisioning is being performed, the OLS controller can return the frequency to be used, and it may be omitted. If router only provisioning is being performed, the frequency must be specified.

12. (Optional) Set links or nodes to include or exclude in the optical path. This setting is not available in router only provisioning.

13. (Optional) From the Add to existing LAG drop-down list, choose the bundle to add the new link or set of links to an existing Bundle LAG interface configured on the routers.

    

14. (Optional) If you are configuring a 200G 16-QAM link, set the DAC rate to 1 x 1.25.

    200G link rate mode enables the Modulation selection drop-down. Modulation selection is not available in any other mode. Select the16 QAM (30Ghz) modulation.

    

15. Click Next to review the final configuration. Verify the router endpoint and optical line system parameters. Click Finish to start provisioning, or click Save to save for later provisioning.

    

    This image shows a sample summary for a 200G 16-QAM link.

    

16. Go to the Services Manager to view the progress of provisioning.

    Click the Operations > Logs tab to view the provisioning API calls used and responses. The logs display API calls and responses for optical line system provisioning performed by Cisco Optical Network Controller, as well as router provisioning handled by Crosswork Network Controller.

    

    If the provisioning is successful, the Configuration State field changes to INSTALLED state and the Operational State field changes to UP​ state.

    

    The Summary tab displays the new service link.

17. Verify the end-to-end link across both IP and optical layers in the Explorer view.