Cisco ASR 5000 Series Mode d’emploi

ASR 5500 System Administration Guide, StarOS Release 21.4

First Published: 2017-11-22

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://

www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

CONTENTS

Preface

About this Guide xxix

Conventions Used xxix

Related Documentation xxx

MIOs and DPCs xxx

Contacting Customer Support xxxi

CHAPTER 1

System Operation and Configuration 1

System Management Overview 1

Terminology 3

Contexts 3

Ports 3

Logical Interfaces 4

Management Interface 4

Bindings 4

Services 4

AAA Servers 5

Subscribers 5

Trusted Builds 6

How the System Selects Contexts 7

Context Selection for Context-level Administrative User Sessions 7

Context Selection for Subscriber Sessions 10

Understanding the ASR 5500 Boot Process 10

Understanding Configuration Files 11

IP Address Notation 13

IPv4 Dotted-Decimal Notation 13

IPv6 Colon-Separated-Hexadecimal Notation 13

CIDR Notation 13

ASR 5500 System Administration Guide, StarOS Release 21.4

iii

Alphanumeric Strings 14

Character Set 14

Quoted Strings 16

CHAPTER 2

Getting Started 17

ASR 5500 Configuration 17

Using the ASR 5500 Quick Setup Wizard 17

The Quick Setup Wizard 18

Using the CLI for Initial Configuration 24

Configuring System Administrative Users 26

Limiting the Number of Concurrent CLI Sessions 26

Automatic Logout of CLI Sessions 26

Configuring the System for Remote Access 27

Configuring SSH Options 29

SSH Host Keys 30

Setting SSH Key Size 30

Configuring SSH Key Generation Wait Time 30

Specifying SSH Encryption Ciphers 31

Generating SSH Keys 32

Setting SSH Key Pair 32

Authorized SSH User Access 32

Authorizing SSH User Access 33

SSH User Login Restrictions 33

Creating an Allowed Users List 33

SSH User Login Authentication 34

Secure Session Logout 35

Changing Default sshd Secure Session Logout Parameters 35

SSH Client Login to External Servers 36

Setting SSH Client Ciphers 36

Setting Preferred Authentication Methods 37

Generating SSH Client Key Pair 38

Pushing an SSH Client Public Key to an External Server 38

Enabling NETCONF 39

Configuring the Management Interface with a Second IP Address 39

ASR 5500 System Administration Guide, StarOS Release 21.4

Contents

CHAPTER 3

System Settings 41

Configuring a Second Management Interface 42

Verifying and Saving Your Interface and Port Configuration 42

Configuring System Timing 43

Setting the System Clock and Time Zone 43

Verifying and Saving Your Clock and Time Zone Configuration 44

Configuring Network Time Protocol Support 44

Configuring NTP Servers with Local Sources 45

Using a Load Balancer 45

Verifying the NTP Configuration 46

Configuring SF Boot Configuration Pause 47

Enabling CLI Timestamping 47

Configuring CLI Confirmation Prompts 48

Enabling Automatic Confirmation 48

Requiring Confirmation for autoconfirm and configure Commands 48

Requiring Confirmation for Specific Exec Mode Commands 49

Configuring System Administrative Users 50

User Name Character Restrictions 50

Configuring Context-level Administrative Users 51

Configuring Context-level Security Administrators 51

Configuring Context-level Administrators 52

Configuring Context-level Operators 52

Configuring Context-level Inspectors 52

Configuring LI Administrators 53

Segregating System and LI Configurations 53

Verifying Context-level Administrative User Configuration 54

Configuring Local-User Administrative Users 55

Verifying Local-User Configuration 55

Updating Local-User Database 56

Updating and Downgrading the local-user Database 56

Provisioning Lawful Intercept 57

Restricting User Access to a Specified Root Directory 58

Configuring an SFTP root Directory 59

Associating an SFTP root Directory with a Local User 59

ASR 5500 System Administration Guide, StarOS Release 21.4

Contents

Associating an SFTP root Directory with an Administrator 59

Associating an SFTP root Directory with a Config Administrator 59

Configuring TACACS+ for System Administrative Users 60

Operation 60

User Account Requirements 61

TACACS+ User Account Requirements 61

StarOS User Account Requirements 61

Configuring TACACS+ AAA Services 62

Configuring TACACS+ for Non-local VPN Authentication 63

Verifying the TACACS+ Configuration 63

Separating Authentication Methods 64

Disable TACACS+ Authentication for Console 64

Disable AAA-based Authentication for Console 64

Disable TACACS+ Authentication at the Context Level 65

Limit local-user Login on Console/vty Lines 65

Limit Console Access for AAA-based Users 66

Verify Configuration Changes 66

Configuring a Chassis Key 66

Overview 66

Configuring a New Chassis Key Value 67

CLI Commands 67

Quick Setup Wizard 68

Configuring MIO/UMIO/MIO2 Port Redundancy 68

Configuring MIO/UMIO/MIO2 Port Redundancy Auto-Recovery 71

Verifying Port Redundancy Auto-Recovery 72

Configuring Data Processing Card Availability 72

Verifying Card Configurations 73

Enabling Automatic Reset of FSC Fabric 73

Configuring ASR 5500 Link Aggregation 73

LAG and Master Port 74

LAG and Port Redundancy 74

LAG and Multiple Switches 74

Multiple Switches with L2 Redundancy 75

Port States for Auto-Switch 75

Hold Time 75

ASR 5500 System Administration Guide, StarOS Release 21.4

Contents

Preferred Slot 76

Auto-Switch Criteria 76

Link Aggregation Control 76

Minimum Links 77

Redundancy Options 78

Horizontal Link Aggregation with Two Ethernet Switches 78

Non-Redundant (Active-Active) LAG 78

Faster Data Plane Convergence 79

Link Aggregation Status 80

Configuring a Demux Card 80

Overview 80

MIO Demux Restrictions 81

Configuration 82

CHAPTER 4

Config Mode Lock Mechanisms 83

Overview of Config Mode Locking 83

Requesting an Exclusive-Lock 84

Effect of Config Lock on URL Scripts 85

Saving a Configuration File 86

Reload and Shutdown Commands 86

show administrators Command 87

CHAPTER 5

Management Settings 89

ORBEM 89

Configuring ORBEM Client and Port Parameters 90

Configuring IIOP Transport Parameters 90

Verifying ORBEM Parameters 91

SNMP MIB Browser 91

SNMP Support 94

Configuring SNMP and Alarm Server Parameters 94

Verifying SNMP Parameters 95

Controlling SNMP Trap Generation 96

CHAPTER 6

Verifying and Saving Your Configuration 97

Verifying the Configuration 97

ASR 5500 System Administration Guide, StarOS Release 21.4

vii

Contents

Feature Configuration 97

Service Configuration 98

Context Configuration 98

System Configuration 98

Finding Configuration Errors 98

Synchronizing File Systems 99

Saving the Configuration 99

CHAPTER 7

System Interfaces and Ports 101

Contexts 101

Creating Contexts 101

Viewing and Verifying Contexts 102

Ethernet Interfaces and Ports 102

Creating an Interface 103

Configuring a Port and Binding It to an Interface 103

Configuring a Static Route for an Interface 103

Viewing and Verifying Port Configuration 104

VLANs 105

Hypervisors 105

VLANs and Management Ports 105

CHAPTER 8

System Security 107

Per-Chassis Key Identifier 107

MIO Synchronization 108

Protection of Passwords 108

Secure Password Encryption 109

Support for Non-Current Encryptions and Decryptions 109

Support for ICSR Configurations 110

Encrypted SNMP Community Strings 110

Lawful Intercept Restrictions 110

LI Server Addresses 110

Modifying Intercepts 111

Adding, Modifying and Removing Users 111

Notification of Users Being Added or Deleted 111

Notification of Changes in Privilege Levels 111

ASR 5500 System Administration Guide, StarOS Release 21.4

viii

Contents

User Access to Operating System Shell 112

Test-Commands 112

Enabling cli test-commands Mode 112

Enabling Password for Access to CLI-test commands 112

Exec Mode cli test-commands 113

Configuration Mode cli test-commands 113

CHAPTER 9

Secure System Configuration File 115

Feature Summary and Revision History 115

Feature Description 116

How System Configuration Files are Secured 116

Create a Digital Signature 116

Validate the Digital Signature 117

Configuring Signature Verification 117

Import RSA Public Key for Verification 117

Enable or Disable Signature Verification 118

CHAPTER 10

Software Management Operations 119

Understanding the Local File System 119

File Types Used by the Local File System 119

Understanding the boot.sys File 120

Maintaining the Local File System 120

File System Management Commands 120

Synchronizing the File System 121

Creating Directories 121

Renaming Files and Directories 121

Copying Files 122

Deleting Files 122

Removing Directories 122

Formatting Local Devices 122

Applying Pre-existing CLI Configuration Files 123

Viewing Files on the Local File System 123

Viewing the Contents of a Local Device 123

Viewing CLI Configuration and boot.sys Files 124

Validating an Operating System File 124

ASR 5500 System Administration Guide, StarOS Release 21.4

Contents

Configuring the Boot Stack 125

System Boot Methods 125

Viewing the Current Boot Stack 125

Adding a New Boot Stack Entry 127

Deleting a Boot Stack Entry 127

Network Booting Configuration Requirements 127

Configuring the Boot Interface 127

Configuring the Boot Network 128

Configuring Boot Network Delay Time 129

Configuring a Boot Nameserver 129

Upgrading the Operating System Software 129

Identifying OS Release Version and Build Number 129

Verify Free Space on the /flash Device 130

Download the Software Image from the Support Site 130

Transfer StarOS Image to /flash 131

Saving a Copy of the Current Configuration File 131

Downgrading from Release 15.0 to 14.0 131

Downgrading from Release 20.0 132

Off-line Software Upgrade 132

Configure a Newcall Policy 132

Configure a Message of the Day Banner 133

Back up the Current CLI Configuration File 133

Create a New Boot Stack Entry 133

Synchronize File Systems 134

Save the Running Configuration 134

Reboot the System 134

Verify the Running Software Version 135

Restoring the Previous Software Image 135

Upgrading ICSR Chassis 135

Performing Dynamic Software Updates 135

Managing License Keys 135

New System License Keys 136

Session Use and Feature Use Licenses 136

Installing New License Keys 136

Cutting and Pasting the Key 136

ASR 5500 System Administration Guide, StarOS Release 21.4

Contents

Autres manuels pour ASR 5000 Series

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Routeur réseau

Cisco

Cisco uBR7100 Series Manuel

Cisco

Cisco 675E Manuel

Cisco

Cisco ASR 1002 Manuel

Cisco

Cisco 1760V Manuel utilisateur

Cisco

Cisco 10000 Series Manuel utilisateur

Cisco

Cisco SCE 1000 2xGBE Manuel de l'opérateur

Cisco

Cisco WS-C5509 Manuel

Cisco

Cisco ASR 1013 Manuel utilisateur

Cisco

Cisco ASR 9001 Manuel

Cisco

Cisco CSS11501S-C-K9 Manuel utilisateur

Cisco

Cisco 7401ASR Manuel de l'opérateur

Cisco

Cisco ASR 903 Manuel

Cisco

Cisco RV042 - Small Business Dual WAN VPN Router Manuel utilisateur

Cisco

Cisco ASR 1004 Guide d'installation

Cisco

Cisco ASR 5000 Manuel utilisateur

Cisco

Cisco NCS 540 Series Manuel

Cisco

Cisco Cisco 2900 series Manuel utilisateur

Cisco

Cisco Linksys WRT54G3G Manuel utilisateur

Cisco

Cisco ASR1002 - ASR 1002 Router Manuel utilisateur

Cisco

Cisco 1603R Manuel utilisateur

Cisco

Cisco Linksys SRW208 Manuel utilisateur

Cisco

Cisco 2612 Manuel utilisateur

Cisco

Cisco C111 8P Series Manuel

Cisco

Cisco Internet Router Cisco 12404 Manuel de l'opérateur

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

EnGenius

EnGenius ESR-9710 Manuel utilisateur

LevelOne

LevelOne FBR-1416 Manuel utilisateur

Dynacord

Dynacord Promatrix 6000 Manuel utilisateur

Lorex

Lorex F5D8230-4 Manuel utilisateur