This command configures Overload Protection Policy for accounting requests.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

aaa accounting-overload-protection prioritize-gtpp
{ default | no } aaa accounting-overload-protection

default

Configures the default setting.

Default: no priority assigned

no

Disables the Overload Protection configuration.

prioritize-gtpp

Gives higher priority to GTPP requests among the other outstanding requests. So while purging the lower priority requests will be selected first.

Usage Guidelines

Use this command to configure Overload Protection Policy for accounting requests.

Configure global accounting and authentication default domain for subscriber and context-level administrative user sessions.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

aaa default-domain { administrator | subscriber } domain_name
no aaa default-domain { administrator | subscriber }

no

Removes all or only the specified configured domain.

administrator | subscriber

administrator: Configures the default domain for context-level administrative users.

subscriber: Configures the default domain for subscribers.

domain_name

Sets the default context.

domain_name must be an alphanumeric string of 1 through 79 characters.

Usage Guidelines

This command configures the default domain which is used when accounting and authentication services are required for context-level administrative user and subscriber sessions whose user name does not include a domain.

This command disables case sensitivity when performing domain matching. When this command is enabled, the system disregard case when matching domains.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] aaa domain-matching ignore-case
default aaa domain-matching

default

Configures ignore-case as the domain matching method.

no

Specifies that the system consider case when domain matching.

Usage Guidelines

Use this command to configure the system to ignore case when matching domains.

Enables domain lookup for session based on the International Mobile Subscriber Identity (IMSI) prefix length. Default: Disabled

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

aaa domain-matching imsi-prefix prefix-length prefix_length
no aaa domain-matching imsi-prefix
default aaa domain-matching

no

Specifies the system must not consider imsi-prefix domain matching method.

prefix-length

Specifies the IMSI length to be matched with the domain.

prefix_length must be an integer from 1 through 15.

Usage Guidelines

Use this command to configure the IMSI-prefix method of domain matching. This command enables domain lookup for the session based on the IMSI prefix length. If there is a domain configured with the matching IMSI prefix, the associated configuration is used.

This feature does not support partial matches.

This command enables or disables the system to accept a large number of RADIUS configurations to be defined and stored.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] aaa large-configuration

no

Disables AAA large configuration support.

Usage Guidelines

When aaa large-configuration is enabled, the system provides the ability to configure multiple NAS IP addresses in a single context to used with different radius groups. As well, the command allows support for up to 1,600 RADIUS server configurations and for a PDSN a maximum of 400 or for a GGSN a maximum of 800 RADIUS server group configurations system-wide.

Configure global accounting and authentication last resort domain for subscriber and context-level administrative user sessions.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

aaa last-resort context { administrator | subscriber context_name }
no aaa last-resort context { administrator | subscriber }

no

Removes all or only the specified previously configured authentication last resort domain name.

administrator | subscriber

administrator: Configures the last resort domain for context-level administrative.

subscriber: Configures the last resort domain for the subscribers.

context_name

Specifies the context which is to be set as the last resort. context_name must be an alphanumeric string of 1 to 79 characters.

Usage Guidelines

Set the last resort context which is used when there is no applicable default domain (context) and there is no domain provided with the subscriber's or context-level administrative user's name for use in the AAA functions.

Enables or disables system-wide TACACS+ AAA (authentication, authorization and accounting) services for administrative users. This command is valid only if TACACS+ servers and related services have been configured in TACACS Configuration Mode.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] aaa tacacs+ [ noconsole ]

no

Disables TACACS+ AAA authentication.

noconsole

Disables TACACS+ authentication on the Console line only. By default this option is disabled; TACACS+ server authentication is performed for login via SSH or telnet (vty line) and a connection to the Console port.

With noconsole enabled, TACACS+ authentication is bypassed; the authentication request goes directly to the local database. Effectively TACACS+ authentication on the Console port is disabled. However, TACACS+ authentication remains enabled via vty lines.

Usage Guidelines

Enables or disables the use of TACACS+ AAA services for administrative users.

Configure global accounting and authentication user name formats for AAA (authentication, authorization and accounting) functions. Up to six formats may be configured.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] aaa username-format { domain | username } separator
default aaa username-format 

no

Removes the specified user name format from the configuration.

domain | username

Default: username @

domain: indicates the left side of the string from the separator character is a domain name and the right side is the user name.

username: indicates the left side of the string from the separator character is a user name and the right side is the domain name.

separator

Specifies the character to use to delimit the domain from the user name for global AAA functions.Permitted characters include: @, %, -, \, #, or /. To specify a back slash ('\') as the separator, you must enter a double back slash ('\\') on the command line.

Usage Guidelines

Define the formats for user name delimiting if certain domains or groups of users are to be authenticated based upon their user name versus domain name.

This command allows you to create/configure/delete the Active Charging Service (ACS)/Enhanced Charging Service (ECS).

Product

ACS

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

active-charging service acs_service_name [ -noconfirm ]
no active-charging service acs_service_name

no

Deletes the specified Active Charging Service.

acs_service_name

Specifies name of the Active Charging Service.

acs_service_name must be the name of an Active Charging Service, and must be an alphanumeric string of 1 through 15 characters.

If the named Active Charging Service does not exist, it is created, and the CLI mode changes to the ACS Configuration Mode wherein the service can be configured. If the named Active Charging Service already exists, the CLI mode changes to the ACS Configuration Mode.

-noconfirm

Specifies that the command must execute without any additional prompt and confirmation from the user.

Usage Guidelines

Use this command to create/configure/delete an Active Charging Service in the system. Note that, in this release, only one Active Charging Service can be created in the system.

Use this command after enabling ACS using the require active-charging command. This command allows administrative users to configure the ACS functionality.

On entering this command, the CLI prompt changes to:

[context_name]hostname(config-acs)#

Enables or disables alarming options for the SPIO card or the SSC internal alarms and the central-office external alarms. To verify the state of the alarms, refer to the show alarm command.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] alarm  { audible | central-office }

no

Disables the option specified.

audible

Enables the internal audible alarm on ASR 5000 SPIO cards or ASR 5500 SSCs.

central-office

Enables the central office (external relay) alarms.

Usage Guidelines

Use this command to enable or disable audiable and external realy alarms on ASR 5000 SPIO cards or ASR 5500 SSCs.

Creates an instance of an Access Point Name (APN) profile.

Product

MME

SGSN

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] apn-profile apn_profile_name

no

Deletes the APN profile instance from the configuration.

apn_profile_name

Specifies the name of the APN profile. Enter an alphanumeric string of 1 through 64 characters.

Usage Guidelines

Use this command to create an instance of an APN profile and to enter the APN profile configuration mode. An APN profile is a template which groups a set of APN-specific commands that may be applicable to one or more APNs. See the APN Profile Configuration Mode Commands chapter for information regarding the definition of the rules contained within the profile and the use of the profile.

To see what APN profiles have already been created, return to the Exec mode and enter the show apn-profile all command.

Creates an instance of an Access Point Name (APN) remap table.

Product

MME

SGSN

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] apn-remap-table apn_remap_table_name

no

Deletes the APN remap table instance from the configuration.

apn_remap_table_name

Specifies the name of the APN remap table. Enter an alphanumeric string of 1 through 65 characters.

Usage Guidelines

Use this command to create an instance of an APN remap table and to enter the APN remap table configuration mode. An APN remap table includes entries that define how an incoming APN, or the lack on one, will be handled. See the APN Remap Table Configuration Mode Commands chapter for information regarding the definition of the entries contained within the table and the use of the table.

To see what APN remap tables have already been created, return to the Exec mode and enter the show apn-remap-table all command.

Configures a system-wide time interval for performing Address Resolution Protocol (ARP) refresh.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

arp base-reachable-time time
default arp base-reachable-time

default

Restores the parameter to its default setting.

time

Default: 30

Specifies the ARP refresh interval (in seconds) as an integer from 30 through 86400.

Usage Guidelines

Use this command to configure a system-wide ARP refresh interval. Once a neighbor is found, the entry is considered valid for at least a random value between the time/2 and the time*1.5.

This command disables or enables confirmation for certain commands. This command affects all future CLI sessions and users.

Product

All

Privilege

Security Administrator, Administrator, Operator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] autoconfirm

no

Disables the autoconfirm feature.

Usage Guidelines

When autoconfirm is enabled, certain commands ask you to answer yes or no to confirm that you want to execute the command. When autoconfirm is disabled the confirmation prompts never appear. Disabling autoconfirm disables command confirmation for all future CLI sessions.

By default autoconfirm is enabled.

This command is obsolete. It is included in the CLI for backward compatibility with older configuration files. When executed, this command issues a warning and performs no function.

Configures the CLI banner which is displayed upon the start of a CLI session.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

banner { charging-service | lawful-intercept | motd | pre-login } string
no banner { charging-service | lawful-intercept | motd | pre-login }

no

Removes the banner message by setting it to be a string of zero length.

charging-service

Specifies the Active Charging Service banner message. The banner is displayed upon initialization of an SSH CLI session with ACS-admin privileges (whenever anyone with the CLI privilege bit for ACS logs on).

lawful-intercept

Refer to the Lawful Intercept Configuration Guide for a description of this parameter.

motd

Configures the CLI banner message of the day which is displayed upon the initialization of any CLI session.

pre-login

Configures the CLI banner displayed before a CLI user logs in.

string

Specifies the banner or message to be displayed at session initialization. string may be an alphanumeric string of 0 through 2048 characters. The string must be enclosed in double quotation marks if the banner or message is to include spaces.

Usage Guidelines

Set the message of the day banner when an important system wide message is needed. For example, in preparation for removing a chassis from service, set the banner 1 or more days in advance to notify administrative users of the pending maintenance.

This command creates an instance of a Bearer Control profile, a key element of the MME QoS Profile feature.

Product

MME

Privilege

Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] bearer-control-profile bcprofile_name 

no

Including this command prefix causes the MME to delete the named instance of the bearer control profile from the MME's configuration.

bcprofile_name

Enter an alphanumeric string of 1 through 64 characters to identify a specific bearer control profile.

Usage Guidelines

Entering this command provides access to the configuration commands of the Bearer Control Profile Configuration Mode to configure QoS parameters for dedicated-bearers and for default-bearers. Bearer level parameters such as ARP-PL, ARP-PVI, ARP-PCI, MBR, GBR, remap QCI value can be configured here independently for default/dedicated bearer along with the action to be taken, such as prefer-as-cap or pgw-upgrade. Bearer Control profile can be applied for specific QCIs or range of QCIs.

Configures the delay period, in seconds, before attempting to boot the system from a software image file residing on an external network server.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

boot delay time
no boot delay

no

Deletes the setting for the boot delay. The boot process executes immediately.

time

Specifies the amount of time (in seconds) to delay prior to requesting the software image from the external network server as an integer from 1 through 300.

Usage Guidelines

Useful when booting from the network when connection delays may cause timeouts. Such as when the Spanning Tree Protocol is used on network equipment.

Configures Ethernet network interfaces for obtaining a system software image during the system boot process.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

boot interface { spio-eth1 | spio-eth2 } [ medium { auto | speed medium_speed duplex medium_duplex } [ media medium_media ] ]
no boot interface

boot interface { local-eth1 | local-eth2 } [ medium { auto | speed medium_speed duplex medium_duplex } [ media medium_media ] ]
no boot interface

no

Removes the boot interface configuration from the boot.sys file. Only files from the local file system can be loaded.

spio-eth1 | spio-eth2

Specifies the network interface to be configured where spio-eth1 is the primary interface on the SPIO (slot 24 interface 1 or slot 25 interface 1) and spio-eth2 is the secondary interface on the SPIO (slot 24 interface 2 or slot 25 interface 2). The interfaces are either RJ-45 ifor speeds of 10, 100, or 1000 megabits per second (Mbps), or SFP for the optical Gigabit (1000 Mbps).

local-eth1 | local-eth2

Specifies the network interface to be configured where local-eth1 is the primary ethernet interface and local-eth2 is the secondary ethernet interface.

For the ASR 5000, the primary is interface 1 on the SPIO and the secondary is interface 2 on the SPIO. The interfaces are either RJ-45 ifor speeds of 10, 100, or 1000 megabits per second (Mbps), or SFP for optical Gigabit (1000 Mbps).

For the ASR 5500, the primary is port 1 (1000Base-T) on the MIO and the secondary interface is port 2 (1000Base-T) on the MIO.

medium { auto | speed medium_speed duplex medium_duplex }

Default: auto

auto: configures the interface to auto-negotiate the interface speed. and duplex.

media medium_media

Default: rj45

Optionally sets the physical interface where medium_media must be either rj45 or sfp.

Usage Guidelines

Modify the boot interface settings to ensure the system is able to obtain a software image from an external network server.

Configures the IP address of the DNS (Domain Name Service) server to use when looking up hostnames in URLs for network booting.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

boot nameserver ip_address
no boot nameserver

no

Removes the network boot nameserver information from the boot.sys file.

ip_address

IPv4 dotted-decimal address of the DNS server the system uses to lookup hostnames in URLs for a software image from the network during the system boot process.

Usage Guidelines

Use this command to identify the DNS server to use to lookup hostnames in a software image URL.

Configures the networking parameters for the Switch Processor I/O card network interfaces to use when obtaining a software image from an external network server during the system boot process.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

boot networkconfig { dhcp | { { dhcp-static-fallback | static } ip address spio24 ip_address [ spio25 ip_address ] netmask ip_mask [ gateway gw_address ] } }
no boot networkconfig

no

Removes the network configuration information from the boot.sys file.

dhcp

Indicates that a Dynamic Host Control Protocol (DHCP) server is used for communicating with the external network server.

dhcp-static-fallback | static

dhcp-static-fallback: provides static IP address fallback network option when a DHCP server is unavailable.

static: specifies a fixed network IP address for the external network server that hosts the software image.

spio24 ip_address [ spio25 ip_address ] netmask ip_mask [ gateway gw_address ]

spio24 ip_address [ spio25 ip_address ]: the IP address to use for the SPIO in slot 24 and optionally the SPIO in slot 25 for network booting. ip_address must be specified using IPv4 dotted-decimal notation.

netmask ip_mask: the network mask to use in conjunction with the IP address(es) specified for network booting. ip_mask must be specified using IPv4 dotted-decimal notation.

gateway gw_address: the IP address of a network gateway to use in conjunction with the IP address(es) specified for network booting. gw_address must be entered using IPv4 dotted-decimal notation.

Usage Guidelines

Configure the network parameters for the ports on the SPIO cards to use to communicate with an external network server that hosts software images.

Specifies the priority of a boot stack entry to use when the system first initializes or restarts. Up to 10 boot system priorities (entries in the boot.sys file located in the /flash device in the SPC, SMC or MIO) can be configured.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

boot system priority number image image_url config config_path
no boot system priority number

no

Remove a boot stack entry at the priority specified from the boot stack when it is no longer used.

priority number

Specifies the priority for the file group (consisting of an image (.bin) and its corresponding configuration (.cfg) file) specified in the boot stack. The value must be in the range from 1 through 100 where a priority of 1 is the highest. Up to 10 boot system priorities (boot stack entries) can be configured.

image image_url

Specifies the location of a image file to use for system startup. The URL may refer to a local or a remote file. The URL must be formatted according to the following format:

directory is the directory name.

filename is the actual file of interest.

host is the IP address or host name of the server.

port# is the logical port number that the communication protocol is to use.

config config_path

Specifies the location of a configuration file to use for system startup. This must be formatted according to the following format:

Where path is the directory structure to the file of interest, and filename is the name of the configuration file. This file typically has a .cfg extension.

Usage Guidelines

This command is useful in prioritizing boot stack entries in the boot.sys file, typically located on the /flash device of the Active SPC, SMC, or MIO, for automatic recovery in case of a failure of a primary boot file group.

Enables the collection of bulk statistics and/or enters the bulk statistics configuration mode.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

bulkstats { collection | historical collection | mode }
no bulkstats { collection | historical }

no

Disables the collection of bulk statistics.

collection

Enables the statistics collection process. Collects a periodic snapshot of activity and performance data as configured via the Bulk Statistics Configuration mode.

historical collection

Enables the collection of historical bulk statistics.

If enabled, StarOS tracks activities that require the storing of more data, such as "the highest value that's been seen over the last 24 hours".

mode

[<context-name>]asr5000(config-bulkstats)#

Usage Guidelines

The Bulk Statistics Configuration mode consists of commands for configuring bulk statistic properties, such as the periodicity of collection. Detailed command descriptions appear in the Bulk Statistics Configuration Mode Commands chapter.

The collected bulk statistics are sent to a collection server (called a receiver). Bulk statistics are statistics that are collected in a group or schema, for example, system statistics, port statistics, RADIUS statistics.

Once the receiver, schema, and collection properties are configured, the bulkstats collection command enables or disables the collection of the data.

To collect a sample that will provide an average, for example, an average of CPU counters, the "historical" features must be enabled with the bulkstats historical collection command.

Since bulk statistics are collected at regular, user-defined intervals, the Exec mode bulkstats force command can be used to manually initiate the immediate collection of statistics.

Configures and selects an X.509 CA certificate to enable a security gateway to perform certificate-based peer (client) authentication. StarOS supports a maximum of 16 certificates and 16 CA (Certificate Authrority) root certificates. A maximum of four CA root certificates can be bound to a crypto or SSL (Secure Sockets Layer) template.

Product

All IPSec-related products

Privilege

Administrator, Security Administrator, Operator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

ca-certificate name name { der url url_format | pem { data pemdata | url url_format [ cert-enc ] [ cert-hash-url  url url_format ] } }
no ca-certificate name name

no

Disables ca-certificate.

Note	If the CA-CERT is mandatory for the service to be up and running, then the removal of that CA-CERT is not allowed.

name name

Specifies the name the CA certificate as an alphanumeric string of 1 through 128 characters.

der url

Specifies the use of the Distinguished Encoding Rules (DER) binary format.

url is the Universal Reosurce Locator of the file containing certificate in der format.

pem

Specifies that the Privacy-enhanced Electronic Mail (PEM) format is to be used.

data pemdata

ndicates that the CA certificate data will be in PEM format. pemdata must be an alphanumeric string of 1 through 4095 characters.

cert-enc

Specifiesa certificate encoding type other than default encoding type.

cert-hash-url

Specifies a hash of X.509 Certificate.

url

Specifes the Universal Resource Locator of the file containing the CA certificate.

url_format

When read via a file, note that show configuration will not contain the URL reference, but will instead output the data via data pemdata, such that the configuration file is self-contained.

Usage Guidelines

Use this command to configure and select an X.509 CA certificate to enable a security gateway or SCM to perform certificate-based peer (client) authentication.

Configures the name and URL path of a Certificate Authority-Certificate Revocation List (CA-CRL).

Product

All IPSec-related products

Privilege

Operator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

ca-crl name name { der | pem } { url url }
no ca-crl name name

no

Removes the named CA-CRL.

name

Provides a name of the CA-CRL. name must be an alphanumeric string of 1 through 128 characters.

der

Specifies that Distinguished Encoding Rules (DER) format is to be used for the source format.

pem

Specifies that Privacy-enhanced Electronic Mail (PEM) format is to be used for the source format.

url url

Usage Guidelines

Use this command to name and fetch a CA-CRL from a specified location.

Without additional information from the CA, an issued certificate remains valid to any verifier until it expires. To revoke certificates, the CA publishes a CRL periodically to provide an updated list of certificates revoked, but not yet expired. Like a certificate, a CRL is a digital document signed by the CA. In addition to a list of serial numbers of revoked certificates, the CRL includes attributes such as issuer name (same as the issuer name in the certificate), signature (signed by the issuer using the same key that signs certificates), last update (the time this CRL was issued), and next update (the time next CRL will be available).

Creates an instance of a call-control profile.

Product

MME

SGSN

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] call-control-profile cc_profile_name

no

Deletes the Call-Control Profile instance from the configuration.

cc_profile_name

Specifies the name of the call-control profile. Enter an alphanumeric string of 1 through 64 characters.

Usage Guidelines

Use this command to create an instance of a call-control profile and to enter the call-control profile configuration mode. A call-control profile is a template which groups a set of call-handling instructions that may be applicable to one or more incoming calls. See the Call-Control Profile Configuration Mode Commands chapter for information regarding the definition of the rules contained within the profile and the use of the profile.

To see what call-control profiles have already been created, return to the Exec mode and enter the show call-control-profile all command.

Enters the Card Configuration mode for the specified card. (ASR 5x00 only)

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

card slot_number

slot_number

Specifies the slot number of the card for which the card configuration mode is to be entered. slot_number must be an integer from 1 through 48 (on the ASR 5000) or 1 through 20 (on the ASR 5500).

Usage Guidelines

Enter the configuration mode for a specific card when changes a required.

Configures the redundancy priorities for packet processing cards by specifying the slot number search order for a standby card when needed.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

card-standby-priority slot_num+

slot_num

Specifies the slot of the card for the order of the standby cards. slot_num must be in the range from 1 through 16 excluding slots 8 and 9 (on the ASR 5000) or 1 through 10 excluding slots 5 and 6 (on the ASR 5500). + indicates that you may enter as many slot numbers (separated by a space) as necessary to indicate the complete search order.

Usage Guidelines

Set the standby order of the redundant cards when multiple standby cards are available.

Questionable hardware should be placed lower in the priority list.

This command enables multiple instances of CDRMOD, one per packet processing card.

Product

ACS

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ default ] cdr-multi-mode

default

Configures this command with its default setting.

Default: Single-CDRMOD mode

Usage Guidelines

Use this command to enable the multi-CDRMOD mode, wherein there will be one instance of CDRMOD per packet processing card. All the SessMgr instances that are running on a packet processing card will send the records to the CDRMOD instance running on that card.

By default, CDRMOD runs in single mode, wherein there will be only one instance of CDRMOD running for the entire chassis. All the SessMgr instances that are running on a packet processing card will send the records to the CDRMOD instance.

Configures and selects an X.509 Trusted Author certificate.

Product

All IPSec-related products

Privilege

Administrator, Security Administrator, Operator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

certificate name name { der url url  | pem { data pemdata | url url } private-key pem { [ encrypted ] data pemdata | url url [cert-enc] [cert-hash-url url  url ] } }
no certificate name name

no

Disables certificate.

name name

Names the certificate. name must be from 1 to 128 alphanumeric characters.

der url

Specifies that the Distinguished Encoding Rules (DER) binary format is to be used.

pem

Specifies that the Privacy-enhanced Electronic Mail (PEM) format is to be used.

data pemdata

Certificate/private key data in PEM format. pemdata must be an alphanumeric string of 1 through 4095 (if private key is not implmented) or 1 through 8191 (if private key is implemented) characters.

cert-enc

Specifies a certificate encoding type other than default encoding type.

cert-hash-url

Specifes a hash and URL of the X.509 Certificate.

url url

Specifies the Universal Resource Locator (URL) of the file containing certificate/private key.

url_format

When read via a file, show configuration will not contain the URL reference, but instead outputs the data via data pemdata, such that the configuration file is self-contained.

private-key pem

Specifies use of private key PEM data.

encrypted

Specifs the use of encrypted private key data.

Usage Guidelines

Use this command to Configures and selects an X.509 Trusted Author certificate.

Configures global Command Line Interface (CLI) parameters.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

cli { access { monitor-protocol | monitor-subscriber | show-configuration } { administrator | operator } } | configuration-monitor | hidden | login-failure-delay number | max-sessions number | operator clear-subscriber-one-only | test-commands [encrypted] password password | trap config-mode }
no cli { configuration-monitor | hidden | login-failure-delay number | max-sessions | operator clear-subscriber-one-only | trap config-mode }
default cli { access { monitor-protocol | monitor-subscriber | show-configuration } | configuration-monitor | login-failure-delay | max-sessions | operator clear-subscriber-one-only | trap config-mode }

no

Removes the specified option.

default

Resets the keywords to their default values.

access { monitor-protocol | monitor-subscriber | show-configuration } { operator | administrator }

Sets access privileges on the monitor protocol and monitor subscriber commands:

monitor-protocol: Selects privileges for the monitor protocol command.

monitor-subscriber: Selects privileges for the monitor subscriber command.

show-configuration: Selects privileges for the show-configurationcommand. However the default access level for this command is the user with operator privileges.

operator: Sets the privileges for the selected command to allow use by users with operator privileges.

administrator: Restricts use of the selected command to administrators only.

configuration-monitor

When this keyword is enabled, the system executes a show configuration checksum command every 15-minutes. The resulting checksum is compared with the previous checksum.

When a configuration change is detected, a log message and SNMP notification are generated. The SNMP notification only indicates that a change has occurred without identifying what change had been made.

The 15-minute interval is fixed and cannot be configured. By default configuration monitoring is disabled.

hidden

Allows a Security Administrator to enable access to hidden cli test-commands command.

The no cli hidden command disables access to the cli test-commands command. This is the default mode. Refer to the description of the test-commands keyword below for additional information.

login-failure-delay number

Specifies the time to wait before a login failure is returned and another login may be attempted. Default is five seconds.

max-sessions number

Sets the number of allowed simultaneous CLI sessions on the system. If this value is set to a number below the current number of open CLI sessions, the open sessions will continue until closed. number must be an integer from 2 through 100.

Caution

Use caution when setting this command. Limiting simultaneous CLI sessions prevents authorized users from accessing the system if the maximum number allowed has been reached. The system already limits CLI sessions based on available resources. Additional limitation could have adverse effects.

operator clear-subscriber-one-only

Restricts Operator to clearing only one subscriber session at a time.

test-commands [encrypted] password password_string

Enables access to the CLI test-commands. The commands and keywords made available under this mode are for internal testing and debugging.

Caution

CLI test-commands are intended for diagnostic use only. Access to these commands is not required during normal system operation. These command are intended for use only by Cisco TAC personnel. Some of these commands can slow system performance, drop subscribers, and/or render the system inoperable

encrypted: Specifies that the system will save the password in an encrypted format in the configuration file. The system displays the encrypted keyword in the configuration file as a flag indicating that the variable following the password keyword is the encrypted version of the plain text password. Only the encrypted password is saved as part of the configuration file.

password password_string: Prompts for the password required to access CLI test-commands. This password must have been previously configured by a Security Administrator via the tech-suport test-commands password command. The password is an alphanumeric string of 1 through 64 characters (plain text password) or 1 through 524 characters (encrypted password).

If the password keyword is not entered, the user is prompted (no-echo) to enter the password. If tech-support test-commands password has not been enabled, you will be unable to execute cli test-commands.

Once this test mode is entered under Global Configuration mode, CLI test-commands become part of the current configuration. Therefore, any generated configuration file will contain the cli test-commands command as the first configuration command.

Caution

Use of CLI test-commands may cause significant service interruption. Contact Cisco TAC before executing any commands while in this mode.

The no cli test-commands command disables access to the CLI test-commands mode.

trap config-mode

Enables sending an SNMP trap (starCLIConfigMode) when a CLI user enters the configuration mode.

Usage Guidelines

This command sets access parameters and enables several operational parameters for the system's command line interface.

Specifies the type of encryption algorithm to be used for passwords and secrets.

Product

All

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

cli-encrypt-algorithm { A | B | C }
default cli-encrypt-algorithm

default

Resets the encryption algorithm to "A" (prior to release 21.0) or "B" (release 21.0 and higher).

A

Specifies MD5-based cipher encryption algorithm. This is the default for StarOS releases prior to 21.0. Passwords encrypted with this key will have "+A" prefixes in the configuration file.

B

Specifies the AES-CBC-128 cipher algorithm for encryption and the HMAC-SHA1 cipher algorithm for authentication. Passwords encrypted with this key will have "+B" prefixes in the configuration file. Algorithm B is the default for release 21.0 and higher.

C

Specifies HMAC-SHA512 cipher algorithm for encryption and authentication. Passwords encrypted with this key will have "+C" prefixes in the configuration file.

Usage Guidelines

Use this command to specify the types of cipher algorithm(s) to be used as encryption and authentication keys for passwords.

The encryption key protects the confidentiality of passwords, while the authentication key protects their integrity.

Configures system clock timezone and what local time zone to use.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

clock timezone tz [ local ]
no clock timezone

no

Resets the system timezone to the system default UTC.

tz

local

Indicates the timezone specified by tz is to be considered the local time zone for local time display and conversion.

Usage Guidelines

Clock and timezone management is necessary for proper accounting records. The chassis may be set to display a different local time than that of the system clock which allows accounting records to use the system time but to display the proper local time for users.

Use this command to add a fetch configuration for each certificate for which automatic update is required. This is a Certificate Management Protocol v2 command.

Product

All products supporting IPSec CMPv2 features

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

cmp auto-fetch current-name cert_name ca-root ca_name time days
no auto-fetch current-name cert_name

no

Removes auto-fetch configuration for a certificate.

current-name cert-name

Specifies a valid security gateway certificate as an alphanumeric string of 1 through 129 characters.

ca-root ca_name

Specifies the filename of the root certificate of the CA server. ca_name is an alphanumeric string of 1 through 129 characters.

time days

Specifies the number of days before the certificate expires as the time when the auto fetch should be triggered. days is specified as an integer from 1 through 256.

Usage Guidelines

Use this command to specify when a current certificate should be automatically fetched.

Use this command to add a file location on /flash disk where the certificates and private keys will be stored. This is a Certificate Management Protocol v2 command.

Product

All products supporting IPSec CMPv2 features

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

cmp cert-store location pathname [ key reuse ]
no cmp cert-store

no

Removes the certificate storage location configuration.

pathname

Usage Guidelines

Use this command to specify where certificates and key files should be stored.

Defines when an SNMP MIB certificate expiry trap should be sent as the number of hours before expiration.

Product

All products supporting IPSec CMPv2 features

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

cmp cert-trap time hours
no cmp cert-trap time

no

Removes the certificate expiry MIB trap notification.

time hours

Specifies the number of hours before certificate expiry when a MIB trap should be sent. hours is an integer from 1 through 1024.

Usage Guidelines

Use this command to set when an SNMP MIB certificate expiry trap should be sent.

Forces mandatory confirmation prompting for the autoconfirm (Exec mode and Global Configuration mode) and configure (Exec mode).

Product

All products

Privilege

Security Administrator, Administrator, Operator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] commandguard [ exec-command exec_mode_category ] 

no

Disables commandguard functionality if enabled.

exec-command exec_mode_category

Applies mandatory prompting for specified categories of Exec mode configuration commands, even when autoconfirm is enabled.

You can enter multiple commandguard exec-command exec_mode_category commands.

Usage Guidelines

Use this command to force mandatory confirmation prompting for the autoconfirm (Exec mode and Global Configuration mode) and configure (Exec mode). This command prevents users from accidentally entering Global Configuration mode, or to prevent file replay (most commonly caused by a cut and paste error in the configuration file). By default this command is disabled.

The status of commandguard is output in show configuration commands.

This command enables and disables the congestion control functionality on the system.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ default | no ] congestion-control

default

Sets the congestion control to its default value.

no

Disables the congestion control functionality. This is the default behavior.

Usage Guidelines

Congestion control on the system is used to monitor the system for conditions that could potentially degrade performance when the system is under heavy load. Typically, these conditions are temporary (i.e high CPU or memory utilization) and are quickly resolved. However, continuous or large numbers of these conditions within a specific time interval may impact the system's ability to service subscriber sessions. The purpose of congestion control is to aid in the identification of such conditions and invoke policies for addressing the situation.

Since the congestion control functionality on the system is disabled by default, this command should be executed once congestion-control thresholds and policies have been configured. (Refer to the other congestion-control related commands for more information.)

This command enables and disables the policy for disconnecting passive calls (chassis-wide) during an overload situation. It also configures and fine-tunes the overload-disconnect congestion control policy for an entire chassis.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control overload-disconnect [ iterations-per-stage integer | percent percentage_value | threshold { license-utilization percentage_value | max-sessions-per-service-utilization percentage_value | tolerance number } ]
default congestion-control overload-disconnect [ iterations-per-stage | percent | threshold { license-utilization | max-sessions-per-service-utilization | tolerance } ]
no congestion-control overload-disconnect

default

When "default" and one of the keywords is added to the command, the policy remains in its current state and the value for the specified keyword is reset to its default value.

When "default" and the command are entered without keywords, the overload-disconnect policy for congestion control is disabled.

no

Disables the overload-disconnect policy for congestion control.

iterations-per-stage integer

Specifies the number of calls to be disconnected during the defined number of seconds. integer is a value from 2 through 8. The default value is 8.

percent percentage_value

Specifies the percentage of calls to be disconnected, in stages, during an overload situation. percentage_value is an integer from 1 through 100. The default value is 5.

threshold

license-utilization: Specifies the license-utilization percentage threshold for overload situations. If candidates are available, passive calls are disconnected when this threshold is exceeded. percentage_value is an integer from 1 through 100. The default value is 80.

max-sessions-per-service-utilization: Specifies a percentage of the maximum sessions per service. If candidates are available, passive calls are disconnected when this threshold is exceeded. percentage_value is an integer from 1 through 100. The default value is 80.

tolerance:Specifies the percentage of calls the system disconnects below the values set for the other two thresholds. In either case, a Clear Traps message is sent after the number of calls goes below the corresponding threshold value. number is an integer from 1 through 25. The default value is 10.

Usage Guidelines

Use this command to set the policy for call disconnects when the chassis experiences call overload.

To verify the congestion-control configuration use show congestion-control configuration from the Exec mode.

To set overload-disconnect policies for individual subscribers., see overload-disconnect in Subscriber Configuration Mode Commands.

Configures congestion control policies.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control policy { asngw-service | asnpc-service | epdg-service fng-service | ggsn-service | ha-service | hnbgw-service | hsgw-service | ipsg-service | lma-service | lns-service | mipv6ha-service | pcc-af-service | pcc-policy-service | pdg-service | pdif-service | pdsn-service | pdsnclosedrp-service | pgw-service | phsgw-service | phspc-service | saegw-service  | samog-service | sgsn-service | sgw-service | wsg-service } action { drop | none | redirect | reject }
congestion-control policy mme-service action { drop | none | reject | report-overload { permit-emergency-sessions | reject-new-sessions | reject-non-emergency-sessions } enodeb-percentage percentage }
congestion-control policy { critical mme-service action-profile action_profile_name | major mme-service action-profile action_profile_name | minor mme-service action-profile action_profile_name }
    congestion-control policy { critical | major | minor } sgsn-service action-profile action_profile_name
    no congestion-control policy { critical | major | minor } sgsn-service
default congestion-control policy { asngw-service | asnpc-service | epdg-service | fng-service | ggsn-service | ha-service | hnbgw-service | hsgw-service | ipsg-service | lma-service | lns-service | mipv6ha-service | mme-service | pcc-af-service | pcc-policy-service | pdg-service | pdif-service | pdsn-service | pdsnclosedrp-service | pgw-service | phsgw-service | phspc-service | saegw-service samog-service | | sgsn-service | sgw-service | wsg-service }

default

Specifies the Congestion Control policy action for the selected service to its default value.

asngw-service

Specifies the Congestion Control policy action for the ASN-GW service.

asnpc-service

Specifies the Congestion Control policy action for the ASN PC-LR service.

critical

For MME (starting with Release 14.0), or ePDG (starting with Release 14.1), or for SGSN (starting with Release 17.0), this keyword associates the action-profile to be used for critical congestion thresholds for the MME or SGSN's service.

epdg-service action

Specifies the Congestion Control policy action for the ePDG service.

Supported policy actions are:

For ePDG type of session/calls, redirect action is not supported.

fng-service

Specifies the Congestion Control policy action for the FNG service.

ggsn-service

Specifies the Congestion Control policy action for the GGSN service.

ha-service

Specifies the Congestion Control policy action for the HA service.

hnbgw-service

Specifies the Congestion Control policy action for the HNB-GW service.

Supported policy actions are:

hsgw-service

Specifies the Congestion Control policy action for the HSGW service.

Supported policy actions are:

ipsg-service

Specifies the Congestion Control Policy action for the IPSG service. The policy specifies how the IPSG service will respond when the system detects that a congestion condition threshold has been crossed.

Supported policy actions are:

Default: none

lma-service

Specifies the Congestion Control policy action for the LMA service

lns-service

Specifies the Congestion Control policy action for the LNS service.

mipv6ha-service

Specifies the Congestion Control policy action for the MIPv6-HA service.

major

For MME (starting with Release 14.0), or ePDG (starting with Release 14.1), or for SGSN (starting with Release 17.0), this keyword associates the action-profile to be used for major congestion thresholds for the MME or SGSN's service.

minor

For MME (starting with Release 14.0), or ePDG (starting with Release 14.1), or for SGSN (starting with Release 17.0), this keyword associates the action-profile to be used for minor congestion thresholds for the MME or SGSN's service.

mme-service

Sets the congestion control policy for action to take when subscriber sessions exceeds the defined threshold limit.

For MME type of session/calls, redirect action is not supported.

pcc-af-service

Specifies the Congestion Control policy action for the PCC Application Function (AF) service.

pcc-policy-service

Specifies the Congestion Control policy action for the PCC Policy service.

pcc-quota-service

Specifies the Congestion Control policy action for the PCC Quota service.

pdg-service

Specifies the Congestion Control policy action for the PDG service.

pdif-service

Specifies the Congestion Control policy action for the PDIF service.

pdsn-service

Specifies the Congestion Control policy action for the PDSN service.

pdsnclosedrp-service

Specifies the Congestion Control policy action for the PDSN Closed R-P service.

pgw-service

Specifies the Congestion Control policy action for the P-GW service.

Supported policy actions are:

saegw-service

Specifies the Congestion Control policy action for the SAEGW service.

Supported policy actions are:

samog-service

Specifies the Congestion Control policy action for the SaMOG service.

sgsn-service

Specifies the Congestion Control policy - the congestion response actions for the SGSN service.

With Release 17.0 and higher, to define a policy you must first select one of the three congestion levels: critical, major or minor. Next select the service with the sgsn-service keyword and then associate a congestion-action-profile. Refer to the congestion-action-profile command in the SGSN-Global Configuration mode to create the congestion-action-profiles which define the congestion response actions to be taken when thresholds are exceeded for the SGSN.

sgw-service

Specifies the Congestion Control policy action for the S-GW service.

Supported policy actions are:

wsg-service

Specifies the Congestion Control policy action for the WSG service.

Supported policy actions are:

action { drop | none | redirect | reject }

Specifies the policy action:

report-overload { permit-emergency-sessions | reject-new-sessions | reject-non-emergency-sessions } enodeb-percentage percentage

Enables the MME to report overload conditions to eNodeBs and take additional action to alleviate congestion situations.

permit-emergency-sessions: Specifies that only emergency sessions are allowed to access the MME during the overload period.

reject-new-sessions: Specifies that all new sessions destined for the MME will be rejected during the overload period.

reject-non-emergency-sessions: Specifies that all non-emergency sessions will be rejected during the overload period.

enodeb-percentage percentage: Configures the percentage of known eNodeBs that will receive the overload report. percentage must be an integer from 1 to 100.

Usage Guidelines

Congestion policies can be configured for each service. When congestion control functionality is enabled, these policies dictate how services respond should the system detect that a congestion condition threshold has been crossed.

Configures the congestion control threshold values that are to be monitored.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold { license-utilization percent | max-sessions-per-service-utilization percent | message-queue-utilization percent | message-queue-wait-time time | port-rx-utilization percent | port-specific { slot/port | all } [ tx-utilization percent ] [ rx-utilization percent ] port-specific-rx-utilization critical | port-specific-tx-utilization critical | port-tx-utilization percent | service-control-cpu-utilization percent | system-cpu-utilization percent | system-memory-utilization percent | tolerance percent }
default congestion-control threshold { license-utilization | max-sessions-per-service-utilization | message-queue-utilization | message-queue-wait-time | port-rx-utilization | port-specific | tx-utilization | rx-utilization | port-tx-utilization | service-control-cpu-utilization | system-cpu-utilization | system-memory-utilization | tolerance }
no congestion-control threshold port-specific { slot/port | all }
no congestion-control threshold port-specific { slot/port | all } [ rx-utilization percent ] [ tx-utilization percent ]
no congestion-control threshold port-specific-rx-utilization critical
no congestion-control threshold port-specific-tx-utilization critical
no congestion-control threshold { message-queue-utilization | message-queue-wait-time | port-rx-utilization percent | port-tx-utilization percent | service-control-cpu-utilization | system-cpu-utilization | system-memory-utilization }

default congestion-control threshold keyword

Sets the threshold keyword to its default value.

no congestion-control threshold port-specific { slot/port | all }

This command disables port specific threshold monitoring on the specified port or on all ports.

slot/port: Specifies the port for which port specific threshold monitoring is being configured. The slot and port must refer to an installed card and port.

all: Set port specific threshold monitoring for all ports on all cards.

no congestion-control threshold port-specific-rx-utilization critical

This command disables specific receive port utilization.

no congestion-control threshold port-specific-tx-utilization critical

This command disables specific transmit port utilization.

license-utilization percent

Default: 100

The percent utilization of licensed session capacity as measured in 10 second intervals.

percent can be configured to any integer value from 0 to 100.

max-sessions-per-service-utilization percent

Default: 80

The percent utilization of the maximum sessions allowed per service as measured in real-time. This threshold is based on the maximum number of sessions or PDP contexts configured for the a particular service. (Refer to the bind command for the PDSN, GGSN, SGSN, or HA services.)

percent can be an integer from 0 through 100.

message-queue-utilization percent

Default: 80

The percent utilization of the Demux Manager software task's message queue as measured in 10 second intervals. The queue is capable of storing a maximum of 10000 messages.

percent can be an integer from 0 through 100.

message-queue-wait-time time

Default: 5

The maximum time (in seconds) messages can be held in queue as measured by packet time stamps.

time is measured in seconds and can be an integer from 1 through 30.

[ no ] port-rx-utilization percent

Default: 80

The average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be an integer from 0 through 100.

[ no ] port-specific { slot/port | all } [ rx-utilization percent ] [ tx-utilization percent]

Default: Disabled

Sets port-specific thresholds. If you set port-specific thresholds, when any individual port-specific threshold is reached, congestion control is applied system-wide.

slot/port: Specifies the port for which port-specific threshold monitoring is being configured. The slot and port must refer to an installed card and port.

all: Set port specific threshold monitoring for all ports on all cards.

rx-utilization percent: Default 80%. The average percent utilization of port resources for the specified port by received data as measured in 5-minute intervals. percent must an integer from 0 through 100.

tx-utilization percent: Default 80%. The average percent utilization of port resources for the specified port by transmitted data as measured in 5-minute intervals. percent must be an integer from 0 through 100.

[ no ] port-tx-utilization percent

Default: 80

The average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

percent can be an integer from 0 through 100.

service-control-cpu-utilization percent

Default: 80

The average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

percent can be an integer from 0 through 100.

system-cpu-utilization percent

Default: 80

The average percent utilization for all PAC/PSC/PSC2 CPUs available to the system as measured in 10-second intervals.

percent can be an integer from 0 through 100.

This threshold setting can be disabled with no congestion-control threshold system-cpu-utilization command. In case later you want to enable the same threshold setting congestion-control threshold system-cpu-utilization command will enable the CPU utilization threshold to preconfigured level.

system-memory-utilization percent

Default: 80

The average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

percent can be an integer from 0 through 100.

tolerance percent

Default: 10

The percentage under a configured threshold that dictates the point at which the condition is cleared.

percent can be an integer from 0 through 100.

Usage Guidelines

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). These thresholds function in a similar fashion to the operation thresholds that can be configured for the system (as described in later in this chapter). The primary difference is that when these thresholds are reached, not only is an SNMP trap generated (starCongestion), but a service congestion policy is invoked as well.

The tolerance parameter establishes the threshold at which the condition is cleared. An SNMP trap (starCongestionClear) is generated for the clear condition, as well.

Supports congestion based on the total number of utilized connected sessions.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

    congestion-control threshold connected-sessions-utilization{ critical percent | major percent | minor } 
   [ default | no ] congestion-control threshold connected-sessions-utilization { critical | major 
| minor } 

default congestion-control threshold connected-sessions-utilization

Sets all connected-sessions-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value of utilized connected sessions.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value of utilized connected sessions.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value of utilized connected sessions.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of utilized connected sessions.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures a demux manager facility type to be monitored for an average CPU utilization along with the threshold values.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

   congestion-control threshold demuxmgr-cpu utilization facility {  egtpegmgr { critical percent | major percent | minor percent } | egtpinmgr { critical percent | major percent | minor percent } |  gtpumgr { critical percent | major percent | minor percent }}
   [ default | no ] congestion-control threshold demuxmgr-cpu utilization { facility  egtpegmgr { critical | major | minor } | egtpinmgr { critical | major | minor } |  gtpumgr { critical | major | minor }}

default congestion-control threshold demuxmgr-cpu-utilization

Sets all demuxmgr-cpu-utilization thresholds to the default values.

facility

Specifies the specific facility.

egtpegmgr

Specifies the EGTP egress demux manager.

egtpinmgr

Specifies the EGTP ingress demux manager.

gtpumgr

Specifies the GTPUMGR demux manager.

critical percent

Default: 0

The critical threshold value for average percent CPU utilization to trigger the congestion control based on the configured congestion control policy.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent CPU utilization to trigger the congestion control based on the configured congestion control policy.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent CPU utilization to trigger the congestion control based on the configured congestion control policy.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent CPU utilization to trigger the congestion control based on the configured congestion control policy.

The demux manager facility average cpu utilization is the average of all the demux manager instances cpu utilization of same facility type that are currently running in the chassis. If the demux manager facility average cpu utilization exceeds the configuration threshold value, then congestion is notified to all services and the appropriate action begins based on the congestion policy configured.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion threshold levels for license utilization on the system.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold license-utilization { critical percent | major percent | minor percent }
default congestion-control threshold license-utilization

default congestion-control threshold license-utilization

Sets all license-utilization thresholds to the default values.

critical percent

Default: 100

The critical threshold value for percent utilization of licensed session capacity, measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for percent utilization of licensed session capacity, measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for percent utilization of licensed session capacity, measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of licensed session capacity as a percentage as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for the maximum sessions allowed per service.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold max-sessions-per-service-utilization { critical percent | major percent | minor percent }
default congestion-control threshold max-sessions-per-service-utilization

default congestion-control threshold max-sessions-per-service-utilization

Sets all max-sessions-per-service-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for percent utilization of the maximum sessions allowed per service.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for percent utilization of the maximum sessions allowed per service.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for percent utilization of the maximum sessions allowed per service.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of maximum sessions per service as a percentage measured in real-time. This threshold is based on the maximum number of sessions or PDP contexts configured for the a particular service. (Refer to the bind command for the PDSN, GGSN, SGSN, or HA services.)

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for the percent utilization of the Demux Manager software task's message queue.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold message-queue-utilization { critical percent | major percent | minor percent }
default congestion-control threshold message-queue-utilization

default congestion-control threshold message-queue-utilization

Sets all max-sessions-per-service-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for percent utilization of the Demux Manager software task's message queue as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for percent utilization of the Demux Manager software task's message queue as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for percent utilization of the Demux Manager software task's message queue as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of percent utilization of the Demux Manager software task's message queue as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for the maximum time (in seconds) messages can be held in queue as measured by packet time stamps.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold message-queue-wait-time { critical time | major time | minor time }
default congestion-control threshold message-queue-wait-time

default congestion-control threshold message-queue-wait-time

Sets all max-queue-wait-time thresholds to the default values.

critical time

Default: 5

The critical threshold value for the maximum time (in seconds) that messages can be held in queue as measured by packet time stamps.

time is measured in seconds and can be an integer from 1 through 30.

major time

Default: 0

The major threshold value for the maximum time (in seconds) that messages can be held in queue as measured by packet time stamps.

time is measured in seconds and can be an integer from 1 through 30.

minor time

Default: 0

The minor threshold value for the maximum time (in seconds) that messages can be held in queue as measured by packet time stamps.

time is measured in seconds and can be an integer from 1 through 30.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels for the maximum time (in seconds) messages can be held in queue.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed a congestion action-profile is invoked, if configured.

This command requires a valid product license.

Configures MMEMgr-specific thresholds to monitor the MMEMgrs' average CPU utilization.

Product

MME

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold mmemgr-average-cpu-utilization { critical percent | major percent | minor percent }
[ default | no ] congestion-control threshold mmemgr-average-cpu-utilization { critical | major |  minor }

default

Resets the configured thresholds to the system defaults.

no

Disables the configured thresholds and removes them from the MME's configuration.

critical percent

Default: 80

The critical threshold value for the average percent utilization of all the CPU memory available to the MMEMgr measured in 10-second intervals.

percent can be configured to any integer value from 1 to 100.

major percent

Default: 0

The major threshold value for the average percent utilization of all the CPU memory available to the MMEMgr measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for the average percent utilization of the all the CPU memory available to the MMEMgr measured in 10-second intervals.

percent can be configured to any integer value from 1 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of all CPU memory available to the MMEMgrs as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked.

The most commonly recommended threshold for the MMEMgr is the service CPU utilization. This is reflective of the MMEMgr's CPU usage since all MMEmgrs are located on demux cards.

Configures the congestion thresholds for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold port-rx-utilization { critical percent | major percent | minor percent }
default congestion-control threshold port-rx-utilization

default congestion-control threshold port-rx-utilization

Sets all port-rx-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for specific port utilization.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold port-specific { slot/port [ tx-utilization { critical percent | major percent | minor percent ] [ rx-utilization { critical percent | major percent | minor percent } | all { critical percent | major percent | minor percent } }
no congestion-control threshold port-specific { slot/port { critical | major | minor } | all { critical | major | minor } }

no congestion-control threshold port-specific { slot/port { critical | major | minor } | all { critical | major | minor } }

Sets all port-specific utilization thresholds to the default values.

slot/port

Default: Disabled

Specifies the port for which port specific threshold monitoring is being configured. The slot and port must refer to an installed card and port. If you set port-specific thresholds, when any individual port-specific threshold is reached, congestion control is applied system-wide.

all

Set threshold monitoring for all ports on all cards.

rx-utilization

Set threshold monitoring for received data only.

tx-utilization

Set threshold monitoring for transmitted data only.

critical percent

Default: 80

The critical threshold value for average percent utilization of the specified port resources as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent utilization of the specified port resources as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent utilization of the specified port resources as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of specified resources for all ports by transmitted data as measured in 5-minute intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold port-rx-utilization { critical percent | major percent | minor percent }
default congestion-control threshold port-rx-utilization

default congestion-control threshold port-rx-utilization

Sets all port-rx-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of port resources for all ports by received data as measured in 5-minute intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

Product

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold port-tx-utilization { critical percent | major percent | minor percent }
default congestion-control threshold port-tx-utilization

default congestion-control threshold port-tx-utilization

Sets all port-tx-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of port resources for all ports by transmitted data as measured in 5-minute intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold service-control-cpu-utilization { critical percent | major percent | minor percent }
default congestion-control threshold service-control-cpu-utilization

default congestion-control threshold service-control-cpu-utilization

Sets all service-control-cpu-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of CPUs on which a Demux Manager software task instance is running as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

When the service-control-cpu-utilization critical threshold setting is exceeded, ipsecmgrs running in the congested CPU are notified of the congestion. The ipsecmgrs raise traps for service-congestion exceeded and update the NPU so that no new calls are sent to those ipsecmgrs. The NPU does not send any new calls to the congested ipsecmgrs. However, if all ipsecmgrs are congested the action is always drop regardless of the setting for congestion policy action. The packet drops are silently done by the NPU.

When ipsecmgrs are congested and an NPU receives a packet whose Security Parameter Index, Initiator (SPIi) in IKE_SA_INIT matches that of a currently established session, the packet is classified as belonging to the existing session. Since congestion action is applied only on new sessions, such IKE_SA_INIT packets are allowed to create sessions. If the IKE_SA_INIT uses an SPIi which does not match any of the existing sessions, it is processed according to the congestion policy action.

This command requires a valid product license.

Configures the congestion thresholds for average percent CPU utilization of all packet processing cards available to the system as measured in 10-second intervals.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold system-cpu-utilization { critical percent | major percent | minor percent | exclude demux }
default congestion-control threshold system-cpu-utilization

default congestion-control threshold system-cpu-utilization

Sets all system-cpu-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for average percent CPU utilization of all packet processing cards available to the system.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for average percent CPU utilization of all packet processing cards available to the system.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for average percent CPU utilization of all packet processing cards available to the system.

percent can be configured to any integer value from 0 to 100.

exclude demux

Configures exclusion from the system CPU utilization calculation.

If exclude demux is not configured, then the demux CPU will be included while calculating the system CPU utilization. It is recommended to use this keyword to ensure accurate values of system CPU utilization.

demux Removes the demux DPC from the system CPU utilization calculation.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent CPU utilization of all packet processing cards available to the system as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the congestion thresholds for the average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold system-memory-utilization { critical percent | major percent | minor percent | exclude demux }
default congestion-control threshold system-memory-utilization

default congestion-control threshold system-memory-utilization

Sets all system-memory-utilization thresholds to the default values.

critical percent

Default: 80

The critical threshold value for the average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The major threshold value for the average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The minor threshold value for the average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

percent can be configured to any integer value from 0 to 100.

exclude demux

Configures exclusion from the system CPU utilization calculation.

If exclude demux is not configured, then the demux CPU will be included while calculating the system CPU utilization. It is recommend to use this keyword to ensure accurate values of system memory utilization.

demux Removes the demux DPC from the system CPU utilization calculation.

Usage Guidelines

Use this command to set the critical, major and minor threshold levels of average percent utilization of all CPU memory available to the system as measured in 10-second intervals.

Thresholds dictate the conditions for which congestion control is to be enabled and establish limits for defining the state of the system (congested or clear). When these thresholds are crossed, an SNMP trap is generated (starCongestion) and, if configured, a congestion action-profile is invoked as well.

This command requires a valid product license.

Configures the percentage under a configured threshold value that dictates the point at which the condition is cleared.

Product

MME

ePDG

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

congestion-control threshold tolerance { critical percent | major percent | minor percent }
default congestion-control threshold system-cpu-utilization

default congestion-control threshold tolerance

Sets all threshold tolerances to the default values.

critical percent

Default: 10

The tolerance percentage for critical thresholds. When a critical threshold drops below this level, the condition is cleared.

percent can be configured to any integer value from 0 to 100.

major percent

Default: 0

The tolerance percentage for major thresholds. When a major threshold drops below this level, the condition is cleared.

percent can be configured to any integer value from 0 to 100.

minor percent

Default: 0

The tolerance percentage for minor thresholds. When a minor threshold drops below this level, the condition is cleared.

percent can be configured to any integer value from 0 to 100.

Usage Guidelines

Use this command to set the tolerance limits for critical, major and minor thresholds.

The tolerance parameter establishes the threshold at which the condition is cleared. An SNMP trap (starCongestionClear) is generated for the clear condition.

This command requires a valid product license.

Enables the configuration of Connected Apps (CA) client communication with the IOS-XR CA server on an ASR 9000. This command sends you to the Connected Apps Configuration mode.

Product

SecGW (WSG)

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

connectedapps

Usage Guidelines

Use this command to go to the Connected Apps Configuration mode. In this mode you can set CA client session parameters and ASR 9000 VSM High Availability (HA) chassis and network modes.

This command configures the base directory to be used for storing all content-rating databases that are required for Category-based Content Filtering application.

Product

CF

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

content-filtering category database directory path directory_path
default content-filtering category database directory path

default

Specifies the default base directory and directory path for Category-based Content Filtering application.

directory_path

Default: /pcmcia1/cf

Specifies the base directory and its path to store all of the full or incremental content rating databases for the Category-based Content Filtering application.

directory_path must be an alphanumeric string of 1 through 255 characters.

Usage Guidelines

Use this command to specify the directory and its path to download all full or incremental category-rating databases to be used for the Category-based Content Filtering application.

Merging of incremental database can be done as part of the database upgrade process preformed with upgrade content-filtering category database command in the Executive Mode.

This command configures the number of full content-rating databases to maintain/archive in the base directory for category-based content filtering application.

Product

CF

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

content-filtering category database max-versions num_archive
default content-filtering category database max-versions

default

Sets the default number of full databases for specified directory path/location.

num_archive

Default: 2

Specifies the maximum number of database to be archived or maintained in the specific location.

num_archive must be an integer from 1 through 3.

Usage Guidelines

Use this command to set the number of full content-rating database to be maintained in the specified directory path with the base file name specified using the content-filtering database override file command. The specified directory path is the location specified using the content-filtering category database directory path command.

This command specifies the name of a file to be used by the category-rating database load process for category-based content filtering application.

Product

CF

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

content-filtering category database override file file_name.extension
default content-filtering category database override file

default

Sets the default content rating database file name; for example, optcmd.bin.

file file_name.extension

Specifies the header of the file in the database directory path location to determine the newest full database.

file_name must be an alphanumeric string of up to 10 characters with an extension of 3 characters after a period (.) as extension.

Usage Guidelines

Use this command to configure the category-rating database file name to determine the newest version of full database. A process called "LOAD_DATABASE" invokes during the system startup or the database upgrade process by upgrade content-filtering category database command in Executive Mode. This process examines the header of each of the files in the database folder specified by content-filtering category directory path command in this mode.

Note that by default system examines the header of those files only which begins with the string "OPTCMDB" and having extension ".bin".

Creates or specifies an existing StarOS context and enters the Context Configuration mode.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

context context_name [ -noconfirm ]
no context context_name

no

Removes the specified context from the configuration.

name

Specifies the name of a context to enter, add, or remove. When creating a new context, the context name must be unique.

-noconfirm

Indicates that the command is to execute without any additional prompt and confirmation from the user.

Usage Guidelines

Use this command to create or remove a specified context and enter the COntext configuration mode.

Enables or disables the copying of crash data to a specified location.

Product

All

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

crash enable { async-core-transfer | critical-task-core | [ encrypted ] url crash_url} [ filename-pattern pattern ] [ restrict mbyte ]

no crash enable { async-core-transfer | critical-task-core url }

no

Disables the specified option.

async-core-transfer

Maintains the transfer of the core dump to the management card while asynchronously beginning proclet recovery which can reduce the total outage. This feature is enabled by default.

critical-task-core

Limits core collections from critical task on the active management card. This feature is enabled by default.

encrypted

Indicates that the URL is encrypted for security reasons.

filename-pattern pattern

If no pattern is specified, the result is the same as the pattern filename.

Use '/' characters in the filename pattern part to store crashes in per-system subdirectories.

url crash_url

Specifies the location to store crash files. crash_url may refer to a local or a remote file. crash_url must be entered using the following format:

directory is the directory name.

filename is the actual file of interest.

username is the user to be authenticated.

password is the password to use for authentication.

host is the IP address or host name of the server.

port# is the logical port number that the communication protocol is to use.

restrict mbyte

Specifies a maximum amount of memory (in megabytes) to use for storing crash files as an integer from 1 through 128. Default: 128

The restrict keyword is only applicable to local URLs.

Usage Guidelines

Enable crashes if there are systems that are not stable and the crash information will be useful for trouble shooting. The remote storage of the crash file reduces the memory utilized on the chassis.

Configures a blacklist (access denied) file to be used by a Wireless Security Gateway (WSG).

Product

All products supporting IPSec blacklisting

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

crypto blacklist file pathname
no crypto blackilist file 

no

Removes the blacklist file from the system.

pathname

Usage Guidelines

Use this command to configure the location of the blacklist file to be used by a WSG.

A blacklist is a list or register of entities that are being denied a particular privilege, service, mobility, access or recognition. With blacklisting, any peer is allowed to connect as long as it does not appear in the list.

Each entry in the blacklist file should contain the ID type so that the validation is performed for that ID type. In every entry, the ID type and ID value should be separated by a space. Only DOS and UNIX file formatting are supported. For additional information, refer to the System Administration Guide.

Enables an SecGW to initiate an IKEv2 session setup request when the peer does not initiate a setup request within a specified time interval. Executing this command moves you to the Peer List Configuration mode. This functionality is only applicable for site-to-site (S2S) based tunnels within a WSG service. For remote access tunnels the peer is always the initiator. (VPC-VSM only)

Product

SecGW (WSG)

Privilege

Security Administrator, Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] crypto peer-list { ipv4 | ipv6 } peer_list_name

no

Disables the specified crypto peer list.

peer_list_name

Specifies the name of the peer list as an alphanumeric string of one through 32 characters.

Usage Guidelines

Use this command to enable an SecGW to initiate an IKEv2 session setup request when the peer does not initiate a setup request within a specified time interval. Executing this command moves you to the Peer List Configuration mode. This functionality is only applicable for site-to-site (S2S) based tunnels within a WSG service. For remote access tunnels the peer is always the initiator. (VPC-VSM only)

When a peer list has been configured in the WSG service, the initiator and responder mode timer intervals each default to 10 seconds. The SecGW will wait for 10 seconds in the responder mode for a peer session initiation request before switching to the initiator mode and waiting 10 seconds for a peer response.

You can change the default settings for the initiator and/or responder mode intervals using the WSG Service Configuration mode initiator-mode-duration and responder-mode-duration commands.

For additional information, refer to the Peer List Configuration Mode Commands and WSG Service Configuration Mode Commands chapters of this guide. Also see the Security Gateway as Initiator chapter in the IPSec Reference.

Specifies the remote secret list for storing remote secrets based on the ID type. This command sends you to the Remote Secret List Configuration mode. Only one active remote-secret-list is supported per system.

Product

All products supporting IPSec remote secrets

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

[ no ] crypto remote-secret-list listname

no

Deletes the remote-secret-list file from the system.

listname

Specifies the name of the remote secret list as an alphanumeric string from 1 to 127 characters.

Usage Guidelines

Use this command to specify the remote secret list for storing remote secrets based on the ID type. Only one remote-secret-list can be configured per system. Executing this command places you in the Remote Secret List Configuration mode.

This list of remote pre-shared keys is based on the remote ID type. The remote secret list can contain up to 1000 entries.

For additional information, refer to the Remote Secret List Configuration Commands chapter and the System Administration Guide.

Configures a whitelist (access permitted) file to be used by a Wireless Security Gateway (WSG).

Product

All products supporting IPSec whitelisting

Privilege

Security Administrator

Mode

Exec > Global Configuration

configure

Entering the above command sequence results in the following prompt:

[local]host_name(config)#

Syntax

Syntax Description

crypto whitelist file pathname [ -noconfirm ]
no crypto whitelist file

no

Removes the blacklist file from the system.

pathname

Usage Guidelines

Use this command to configure the location of the white file to be used by a WSG.

A whitelist is a list or register of entities that are being provided a particular privilege, service, mobility, access or recognition. With whitelisting, no peer is allowed to connect unless it appears in the list.

Each entry in the whitelist file should contain the ID type so that the validation is performed for that ID type. In every entry, the ID type and ID value should be separated by a space. Only DOS and UNIX file formatting are supported. For additional information, refer to the System Administration Guide.

This command creates/removes an HNB-CS network configuration instance for Famed UMTS access over Iu-CS/Iu-Flex interface between Home NodeB Gateway (HNB-GW) service and CS networks elements; i.e. MSC/VLR. This command also configures an existing HNB-CS network instance and enters the HNB-CS Network Configuration mode on a system.

Product

HNBGW

Privilege

Administrator