Cisco SCE8000 GBE User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco SCE8000 Software Configuration
Guide
Release 3.1.6S
February 15, 2011
Text Part Number: OL-16479-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco SCE8000 Software Configuration Guide
© 2011 Cisco Systems, Inc. All rights reserved.

iii
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
CONTENTS
Preface xvii
Document Revision History xvii
Organization xvii
Related Publications xviii
Conventions xix
Obtaining Documentation and Submitting a Service Request xx
CHAPTER 1Cisco Service Control Overview 1-1
Cisco Service Control Solution 1-1
Service Control for Broadband Service Providers 1-2
Cisco Service Control Capabilities 1-2
SCE Platform Description 1-3
Management and Collection 1-4
Network Management 1-5
Subscriber Management 1-5
Service Configuration Management 1-6
Data Collection 1-6
CHAPTER 2Command Line Interface 2-1
Getting Help 2-1
Authorization and Command Levels (Hierarchy) 2-2
CLI Command Hierarchy 2-3
Prompt Indications 2-5
CLI Help Features 2-6
Partial Help 2-6
Argument Help 2-6
The [no] Prefix 2-7
Navigational and Shortcut Features 2-7
Command History 2-7
Keyboard Shortcuts 2-8
Tab Completion 2-9
FTP User Name and Password 2-9
Managing Command Output 2-9

Contents
iv
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Scrolling the Screen Display 2-10
Filtering Command Output 2-10
Redirecting Command Output to a File 2-10
CLI Authorization Levels 2-11
How to change from User to Viewer level authorization 2-12
How to log in with Root level authorization 2-12
Exiting Modes 2-12
How to exit from the Privileged Exec mode and revert to the Viewer mode 2-13
How to exit from the Global Configuration Mode 2-13
Navigating Between Configuration Modes 2-13
Entering and Exiting Global Configuration Mode 2-13
How to enter the Global Configuration Mode 2-13
How to exit the Global Configuration Mode 2-14
Interface Configuration Modes 2-14
Configuring the Ports 2-14
Entering Management Interface Configuration Mode 2-15
How to Enter Linecard Interface Configuration mode 2-15
Entering Line Interface Configuration Mode 2-16
How to navigate from one Interface Configuration Mode to another 2-16
The "do" Command: Executing Commands Without Exiting 2-16
Creating a CLI Script 2-17
CHAPTER 3Basic Cisco SCE8000 Platform Operations 3-1
Starting the Cisco SCE8000 Platform 3-1
Checking Conditions Prior to System Startup 3-1
Starting the System and Observing Initial Conditions 3-2
Final Tests 3-2
How to Verify Operational Status 3-3
How to View the User Log Counters 3-3
Managing Configurations 3-3
Viewing Configurations 3-4
How to Save or Change the Configuration Settings 3-5
Example for Saving or Changing the Configuration Settings 3-6
Restoring a Previous Configuration 3-7
Example for Restoring a Previous Configuration 3-7
How to Display the SCE Platform Version Information 3-8
Example for Displaying the SCE Platform Version Information 3-8
How to Display the SCE Platform Inventory 3-10
Examples for Displaying the SCE Platform Inventory 3-11

Contents
v
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Displaying the SCE Platform Inventory: FRUs Only 3-11
Displaying the Complete SCE Platform Inventory 3-12
How to Display the System Uptime 3-14
Example for Displaying the System Uptime 3-14
Rebooting and Shutting Down the SCE Platform 3-14
Rebooting the SCE Platform 3-14
Examples for Rebooting the SCE Platform 3-15
How to Shut Down the SCE Platform 3-15
Examples for Shutting Down the SCE Platform 3-15
CHAPTER 4Utilities 4-1
Working with SCE Platform Files 4-1
Working with Directories 4-1
How to Create a Directory 4-1
How to Delete a Directory 4-2
How to Change Directories 4-2
How to Display your Working Directory 4-2
How to List the Files in a Directory 4-2
Working with Files 4-3
How to Rename a File 4-3
How to Delete a File 4-3
Copying Files 4-4
How to Display File Contents 4-5
How to Unzip a File 4-5
The User Log 4-5
The Logging System 4-5
Copying the User Log 4-6
Enabling and Disabling the User Log 4-6
Viewing the User Log Counters 4-6
Viewing the User Log 4-7
Clearing the User Log 4-7
Generating a File for Technical Support 4-7
Generating a File for Technical Support: Example 4-7
CHAPTER 5Configuring the Management Interface and Security 5-1
About Management Interface and Security 5-1
Configuring the Management Port 5-2
How to Enter Management Interface Configuration Mode 5-2
Configuring the Management Port Physical Parameters 5-2

Contents
vi
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Setting the IP Address and Subnet Mask of the Management Interface 5-3
Options 5-3
Setting the IP Address and Subnet Mask of the Management Interface: Example 5-3
Configuring the Management Interface Speed and Duplex Parameters 5-3
Interface State Relationship to Speed and Duplex 5-4
How to Configure the Speed of the Management Interface 5-4
How to Configure the Duplex Operation of the Management Interface 5-5
How to Monitor the Management Interface 5-5
Configuring the Available Interfaces 5-6
TACACS+ Authentication, Authorization, and Accounting 5-6
Information About TACACS+ Authentication, Authorization, and Accounting 5-6
How to Configure the SCE Platform TACACS+ Client 5-9
How to Manage the User Database 5-12
Configuring AAA Login Authentication 5-16
Configuring AAA Privilege Level Authorization Methods 5-17
Configuring AAA Accounting 5-18
Monitoring TACACS+ Servers 5-19
Monitoring TACACS+ Users 5-19
Configuring Access Control Lists (ACLs) 5-19
About Access Control Lists 5-20
Options 5-20
How to Add Entries to an ACL 5-21
How to Remove an ACL 5-21
How to Enable an ACL 5-21
Managing the Telnet Interface 5-21
About the Telnet Interface 5-22
How to Prevent Telnet Access 5-22
How to Configure the Telnet Timeout 5-22
Configuring the SSH Server 5-22
The SSH Server 5-23
Key Management 5-23
Managing the SSH Server 5-23
How to Monitor the Status of the SSH Server 5-24
Enabling the SNMP Interface 5-25
How to Enable the SNMP Interface 5-25
How to Disable the SNMP Interface 5-25
Configuring and Managing the SNMP Interface 5-25
About the SNMP Interface 5-25
SNMP Protocol 5-26
Security Considerations 5-26

Contents
vii
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
About CLI 5-27
About MIBs 5-27
Configuration via SNMP 5-28
Configuring SNMP Community Strings 5-28
How to Define a Community String 5-28
How to Remove a Community String 5-29
How to Display the Configured Community Strings 5-29
How to Configure SNMP Notifications 5-29
About SNMP Notifications 5-29
How to Define SNMP Hosts 5-30
IP Configuration 5-33
Configuring the IP Routing Table 5-33
About the IP Routing Table 5-33
How to Configure the Default Gateway 5-34
How to Add an Entry to the IP Routing Table 5-34
How to Display the IP Routing Table 5-34
IP Advertising 5-35
Configuring IP Advertising 5-36
How to Display the Current IP Advertising Configuration 5-37
How to Configure the IP Address of the Management Interface 5-37
Options 5-37
Configuring the IP Address of the Management Interface: Example 5-37
Configuring Time Clocks and Time Zone 5-38
Displaying the System Time 5-38
Displaying the System Time: Example 5-38
Displaying the Calendar Time 5-39
Displaying the Calendar Time: Example 5-39
Setting the System Clock 5-39
Options 5-39
Setting the System Clock: Example 5-39
Setting the Calendar 5-39
Options 5-39
Setting the Calendar: Example 5-40
Setting the Time Zone 5-40
Options 5-40
Setting the Time Zone: Example 5-40
Removing the Current Time Zone Setting 5-41
Configuring Daylight Saving Time 5-41
Options 5-41
Guidelines 5-42

Contents
viii
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to Define Recurring Daylight Saving Time Transitions 5-42
How to Define Non-Recurring Daylight Saving Time Transitions 5-43
How to Cancel the Daylight Saving Time Configuration 5-43
How to Display the Current Daylight Saving Time Configuration 5-43
Domain Name Server (DNS) Settings 5-44
Configuring DNS Lookup 5-44
How to Enable DNS Lookup 5-44
How to Disable DNS Lookup 5-44
Configuring Name Servers 5-45
Options 5-45
How to Define Domain Name Servers 5-45
How to Remove a Domain Name Server 5-45
How to Remove All Domain Name Servers 5-46
How to Add a Host to the Host Table 5-46
Options 5-46
Adding Hosts to Removing them from the Host Table: Examples 5-46
How to Display Current DNS Settings 5-46
Displaying Current DNS Settings: Example 5-46
CHAPTER 6Configuring the Line Interface 6-1
Line Interfaces 6-1
Flow Control and Bandwidth Considerations 6-1
Maximum Packet Size 6-1
How to Configure the Ten Gigabit Ethernet Line Interfaces 6-2
Tunneling Protocols 6-2
Selecting the Tunneling Mode 6-3
How to Configure IP Tunnels 6-4
IPinIP Tunneling 6-4
How to Configure the VLAN Environment 6-6
How to Configure the L2TP Environment 6-6
Asymmetric L2 Support 6-7
How to Display the Tunneling Configuration 6-8
Configuring Traffic Rules and Counters 6-8
Traffic Rules and Counters 6-8
What are Traffic Rules and Counters? 6-8
Traffic Rules 6-9
Traffic Counters 6-10
Configuring Traffic Counters 6-10
How to Create a Traffic Counter 6-10

Contents
ix
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to Delete a Traffic Counter 6-10
How to Delete all Existing Traffic Counters 6-11
Configuring Traffic Rules 6-11
How to Create a Traffic Rule 6-11
How to Delete a Traffic Rule 6-14
How to Delete all Traffic Rules 6-14
Managing Traffic Rules and Counters 6-14
How to View a Specified Traffic Rule 6-14
How to View all Traffic Rules 6-14
How to View a Specified Traffic Counter 6-15
How to View all Traffic Counters 6-15
How to Reset a Specified Traffic Counter 6-15
How to Reset all Traffic Counters 6-15
DSCP Marking 6-16
How to Display the DSCP Marking Configuration 6-16
Counting Dropped Packets 6-16
About Counting Dropped Packets 6-16
Disabling the Hardware Packet Drop 6-17
CHAPTER 7Configuring the Connection 7-1
Configuring the Connection Mode 7-1
Options 7-1
Configuring the Connection Mode Example 7-2
Monitoring the Connection Mode 7-2
Monitoring the Connection Mode: Example 7-3
Configuring the Link Mode 7-3
About the Link Mode 7-3
Options 7-3
External Optical Bypass 7-4
How to Activate the External Bypass 7-5
How to Deactivate the External Bypass 7-5
How to Set the External Bypass to the Default State 7-5
How to Display the State of the External Bypass 7-6
Link Failure Reflection 7-6
How to Enable Link Failure Reflection 7-6
How to Disable Link Failure Reflection 7-6
Enabling and Disabling Link Failure Reflection on All Ports 7-7
Options 7-7
How to Enable Link Failure Reflection on All Ports 7-7

Contents
x
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to Disable Link Failure Reflection on All Ports 7-7
Configuring Link Failure Reflection in Linecard-Aware Mode 7-8
How to Enable Linecard-Aware Mode 7-8
How to Disable Linecard-Aware Mode 7-8
Asymmetric Routing Topology 7-9
Asymmetric Routing and Other Service Control Capabilities 7-9
Enabling Asymmetric Routing 7-10
Monitoring Asymmetric Routing 7-10
Monitoring Asymmetric Routing: Example 7-10
Configuring a Forced Failure 7-11
How to Force a Virtual Failure 7-11
How to Exit from a Virtual Failure 7-11
Configuring the Failure Recovery Mode 7-11
Options 7-12
Configure the Failure Recovery Mode: Examples 7-12
Configuring the SCE Platform/SM Connection 7-12
Configuring the Behavior of the SCE Platform in Case of Failure of the SM 7-13
Options 7-13
Configuring the SM-SCE Platform Connection Timeout 7-13
Options 7-13
CHAPTER 8Raw Data Formatting: The RDR Formatter and NetFlow Exporting 8-1
RDR Formatter and NetFlow Exporting Support 8-1
The RDR Formatter 8-1
NetFlow 8-2
NetFlow Terminology 8-2
NetFlow Exporting Support 8-3
Data Destinations 8-3
Categories 8-4
Priority 8-5
Setting DSCP for NetFlow 8-5
Forwarding Modes 8-5
Protocol 8-6
Transport Type 8-6
Configuring Data Destinations and Categories 8-6
Configuringa Data Destination 8-6
Options 8-6
Configuring the Data Destinations: Examples 8-7
Configuring the Data Categories 8-7

Contents
xi
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Configuring a Destination and Assigning Categories 8-8
Configuring the Forwarding Mode 8-12
Options 8-12
Configuring the Forwarding Mode: Example 8-12
Configuring the RDR Formatter 8-12
Options 8-12
How to Enable the RDR Formatter 8-13
How to Disable the RDR Formatter 8-13
How to Configure the Size of the RDR Formatter History Buffer 8-13
Configuring NetFlow Exporting Support 8-13
Options 8-13
How to Configure a DSCP Value for NetFlow 8-14
Options 8-14
How to Configure the Template Refresh Interval 8-14
Options 8-14
Configuring Dynamic Mapping of RDRs to Categories 8-14
Configuring Mappings 8-15
Options 8-15
How to Add a Mapping to a Category 8-15
How to Remove a Mapping from a Category 8-15
How to Restore the Default Mapping for a Specified RDR Tag 8-15
Displaying Data Destination Configuration and Statistics 8-16
How to the Display the Current RDR Formatter Configuration 8-16
Displaying the RDR Formatter Configuration: Example 8-16
How to the Display the Current RDR Formatter Statistics 8-17
Displaying the Current RDR Formatter Statistics: Example 8-17
Disabling the Linecard from Sending RDRs 8-18
CHAPTER 9Managing Subscribers 9-1
Information About Subscribers 9-1
What is a Subscriber? 9-1
Subscriber Modes in Service Control Solutions 9-2
Subscriber Mapping Limits 9-3
Aging Subscribers 9-3
Anonymous Groups and Subscriber Templates 9-4
Subscriber Files 9-4
Subscriber default csv file format 9-4
Subscriber anonymous groups csv file format 9-5
Importing and Export ingSubscriber Information 9-5

Contents
xii
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Options 9-6
How to Import Subscriber Information 9-6
How to Export Subscriber Information 9-6
How to Import a Subscriber Template 9-6
How to Export a Subscriber Template 9-7
Removing Subscribers and Templates 9-7
How to Remove a Specific Subscriber 9-7
Options 9-7
How to Remove All Introduced Subscribers 9-8
How to Remove a Specific Anonymous Subscriber 9-8
Options 9-8
How to Remove All Anonymous Subscriber Groups 9-8
How to Remove All Anonymous Subscribers 9-8
How to Remove All Subscriber Templates 9-9
How to Remove Subscribers by Device 9-9
How to Remove Subscribers from the SM 9-9
How to Remove Subscribers from a Specified SCMP Peer Device 9-9
Importing and Exporting Anonymous Groups 9-9
How to Import Anonymous Groups 9-10
Options 9-10
How to Export Anonymous Groups 9-10
Options 9-10
Monitoring Subscribers 9-10
How to Monitor the Subscriber Database 9-11
How to Display the Subscriber Database Counters 9-11
Clearing the Subscriber Database Counters 9-12
Displaying Subscribers 9-12
Displaying Subscribers: All Current Subscriber Names 9-13
Displaying Subscribers: By Subscriber Property or Prefix 9-13
How to Display Subscribers: By Mapping (IP Address or VLAN ID) 9-15
How to Display Subscriber Information 9-17
How to display a listing of subscriber properties 9-17
How to display complete information for a specified subscriber 9-17
How to display values of subscriber properties for a specified subscriber 9-18
How to display mappings for a specified subscriber 9-18
How to display OS counters for a specified subscriber 9-18
Displaying Anonymous Subscriber Information 9-19
How to display currently configured anonymous groups 9-19
How to display currently configured templates for anonymous groups 9-19

Contents
xiii
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to display current configuration for a specified anonymous group 9-20
How to display subscribers in a specified anonymous group 9-20
How to display all subscribers currently in anonymous groups 9-20
How to display the number of subscribers in a specified anonymous group 9-20
How to display the total number of subscribers in all anonymous groups 9-20
Configuring Subscriber Aging 9-21
How to Enable Aging for Anonymous Group Subscribers 9-21
How to Enable Aging for Introduced Subscribers 9-21
How to Disable Aging for Anonymous Group Subscribers 9-21
How to Disable Aging for Introduced Subscribers 9-22
How to Set the Aging Timeout Period for Anonymous Group Subscribers 9-22
Options 9-22
How to Set the Aging Timeout Period for Introduced Subscribers 9-22
Options 9-22
How to Display Aging for Anonymous Group Subscribers 9-22
How to Display Aging for Introduced Subscribers 9-22
Configuring the SCE Platform/SM Connection 9-23
Options 9-23
How to Configure the Behavior of the SCE Platform in Case of Failure of the SM 9-23
How to Configure the SM-SCE Platform Connection Timeout 9-23
CHAPTER 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks 10-1
Attack Filtering and Attack Detection 10-1
Attack Filtering 10-1
Specific Attack Filtering 10-2
Attack Detection 10-3
Attack Detection Thresholds 10-4
Attack Handling 10-4
Subscriber Notification 10-5
Hardware Filtering 10-5
Configuring Attack Detectors 10-6
Enabling Specific-IP Detection 10-8
Options 10-9
How to Enable Specific-IP Detection 10-9
How to Enable Specific-IP Detection for the TCP Protocol Only for all Attack Directions 10-9
How to Enable Specific-IP Detection for the TCP Protocol for Port-based Detections Only for
Dual-sided Attacks 10-9
How to Disable Specific-IP Detection for Protocols Other than TCP, UDP, and ICMP for all Attack
Directions 10-10

Contents
xiv
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to Disable Specific-IP Detection for ICMP for Single-sided Attacks Defined by the Source
IP 10-10
Configuring the Default Attack Detector 10-10
Options 10-10
How to Define the Default Action and Optionally the Default Thresholds 10-11
How to Reinstate the System Defaults for a Selected Set of Attack Types 10-12
How to Reinstate the System Defaults for All Attack Types 10-12
Specific Attack Detectors 10-12
Options 10-13
How to Enable a Specific Attack Detector and Assign it an AC 10-14
How to Define the Action and Optionally the Thresholds for a Specific Attack Detector 10-14
How to Define the Subscriber Notification Setting for a Specific Attack Detector 10-14
How to Define the SNMP Trap Setting for a Specific Attack Detector 10-14
How to Define the List of Destination Ports for TCP or UDP Protocols for a Specific Attack
Detector 10-15
How to Delete User-Defined Values 10-15
How to Disable a Specific Attack Detector 10-15
How to Disable All Non-default Attack Detectors 10-15
How to Disable All Attack Detectors 10-16
Sample Attack Detector Configuration 10-16
Subscriber Notifications 10-17
Configuring the Subscriber Notification Port 10-17
Options 10-17
How to Remove the Subscriber Notification Port 10-17
Preventing and Forcing Attack Detection 10-18
Options 10-18
Preventing Attack Filtering 10-19
How to Configure a dont-filter Setting for a Specified Situation 10-19
How to Remove a dont-filter Setting from a Specified Situation 10-19
How to Remove All dont-filter Settings 10-19
Forcing Attack Filtering 10-19
How to Configure a force-filter Setting for a Specified Situation 10-20
How to Remove a force-filter Setting from a Specified Situation 10-20
How to Remove All force-filter Settings 10-20
Monitoring Attack Filtering 10-20
Monitoring Attack Filtering Using SNMP Traps 10-20
Monitoring Attack Filtering Using CLI Commands 10-22
How to display a specified attack detector configuration 10-23
How to display the default attack detector configuration 10-24
How to display all attack detector configurations 10-25

Contents
xv
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
How to display filter state (enabled or disabled) 10-25
How to display configured threshold values and actions 10-25
How to display the current counters 10-27
How to display all currently handled attacks 10-27
How to display all existing force-filter settings 10-27
How to display all existing don't-filter settings 10-27
How to display the list of ports selected for subscriber notification 10-27
How to find out whether hardware attack filtering has been activated 10-28
Viewing the Attack Log 10-28
The Attack Log 10-28
How to View the Attack Log 10-29
How to Copy the Attack Log to a File 10-29
CHAPTER 11 Managing the SCMP 11-1
About SCMP 11-1
SCMP Terminology 11-2
Deployment Scenarios 11-3
Single ISG Router with a Single SCE Platform (1xISG – 1xSCE) 11-3
Multiple ISG Routers with Multiple SCE Platforms via Load Balancing (NxISG – MxSCE) 11-4
SCMP Peer Devices 11-4
Connection Management 11-5
SCMP Subscriber Management 11-6
GUID and Subscriber ID 11-6
Configuring the SCMP 11-6
Configuring SCMP Parameters 11-6
How to Enable the SCMP 11-7
How to Disable the SCMP 11-7
How to Configure the SCMP Peer Device to Push Sessions 11-7
Configuring the SCMP Peer Device to Force Each Subscriber to Single SCE Platform 11-8
Defining the Keep-alive Interval Parameter 11-8
Defining the Reconnect Interval Parameter 11-9
Defining the Loss-of-Sync Timeout Parameter 11-9
Adding an SCMP Peer Device 11-9
How to Define an SCMP Peer Device 11-10
How to Assign the SCMP Peer Device to an Anonymous Group 11-10
Deleting Subscribers Managed by an SCMP Peer Device 11-11
Options 11-11
Deleting an SCMP Peer Device 11-11
Defining the Subscriber ID 11-11

Contents
xvi
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Options 11-12
Configuring the RADIUS Client 11-12
Options 11-13
Monitoring the SCMP Environment 11-13
How to Monitor the SCMP 11-13
Options 11-13
How to display the general SCMP configuration 11-14
How to display the configuration all currently defined SCMP peer devices 11-14
How to display the configuration for a specified SCMP peer device 11-14
How to display the statistics for all SCMP peer devices 11-14
How to display the statistics for a specified SCMP peer device 11-15
Monitoring the RADIUS Client 11-15
APPENDIX ACisco Service Control MIBs A-1
MIB Files A-1
Loading MIBs A-4
pcube to Cisco MIB Mapping A-4
Pcube Engage MIB (CISCO-SCA-BB-MIB) A-5
pcube to Cisco MIB Mapping: Detailed OID Mappings A-5
APPENDIX BMonitoring SCE Platform Utilization B-1
SCE Platform Utilization Indicators B-1
CPU Utilization B-2
Flows Capacity B-2
Subscribers Capacity B-2
Service Loss B-2
Monitoring Service Loss B-3

xvii
Cisco SCE8000 Software Configuration Guide, Release 3.1.6S
OL-16479-01
Preface
This preface describes who should read the Cisco SCE8000 Software Configuration Guide, how it is
organized, and its document conventions.
This guide is for experienced network administrators who are responsible for configuring and
maintaining the SCE platform.
Document Revision History
The Document Revision History below records changes to this document.
Organization
This guide contains the following sections:
Revision
Cisco Service Control
Release and Date Change Summary
OL-16479-01 3.1.6S
February 15, 2011
Updated Appendix A.
OL-16479-01 3.1.6S
May 6, 2010
Republished
OL-16479-01 3.1.6S
June, 2008
Created the Cisco SCE8000 Software
Configuration Guide.
Section Title Description
1Cisco Service Control Overview,
page 1-1
Overview of SCE platform management.
2Command Line Interface, page 2-1 Detailed explanation of how to use the Cisco SCE
Command-line Interface.
3Basic Cisco SCE8000 Platform
Operations, page 3-1
Explanation of how to manage configurations,
install applications and upgrade the system
software.
4Utilities, page 4-1 Explanation of the setup wizard and the user log,
as well as of file operations.

xviii
Cisco SCE8000 Software Configuration Guide, Release 3.1.6S
OL-16479-01
Preface
Related Publications
Your SCE platform and the software running on it contain extensive features and functionality, which
are documented in the following resources:
• For further information regarding the Service Control CLI and a complete listing of all CLI
commands, refer to the Cisco SCE8000 CLI Command Reference
• For initial installation and startup information, refer to the relevant quick start guide:
– Cisco SCE8000 Quick Start Guide
5Configuring the Management
Interface and Security, page 5-1
Explanation of how to configure the various
management options: Telnet, SSH, and SNMP.
Also how to configure the system time, Domain
Name Settings, management IP address, and
passwords.
6Configuring the Line Interface,
page 6-1
Explanation of how to configure tunneling, TOS
marking, and traffic rules.
7Configuring the Connection, page 7-1 Explanation of how to configure the connection
mode, link mode, and failure behaviors
8Raw Data Formatting: The RDR
Formatter and NetFlow Exporting,
page 8-1
Explanation of how to configure the connection
mode, link mode, and failure behaviors.
9Managing Subscribers, page 9-1 Explanation of how to import and export
subscriber information and how to monitor
subscribers.
10 Identifying and Preventing
Distributed-Denial-Of-Service
Attacks, page 10-1
Explanation of how to configure attack filtering
11 Managing the SCMP, page 11-1 Explanation of Service Control Management
Protocol (SCMP), which is a protocol that
integrates the SCE platform and the ISG
(Intelligent Service Gateway) functionality of the
Cisco routers. It also explains how to configure
and manage SCMP, SCMP peer devices and the
RADIUS client.
ACisco Service Control MIBs,
page A-1
Explanation of how to map the proprietary pcube
MIB supported in previous releases to the new
MIB structure.
BMonitoring SCE Platform Utilization,
page B-1
Explanation of how to monitor SCE platforms that
are installed in real traffic.
Section Title Description

xix
Cisco SCE8000 Software Configuration Guide, Release 3.1.6S
OL-16479-01
Preface
• For international agency compliance, safety, and statutory information for wide-area network
(WAN) interfaces for the SCE 2000 platform, refer to the regulatory and safety information
document:
– Regulatory Compliance and Safety Information for Cisco SCE8000
• For installation and configuration of the other components of the Service Control Management Suite
refer to:
– Cisco SCMS Subscriber Management User Guide
– Cisco SCMS Collection Manager User Guide
– Cisco Service Control Application for Broadband User Guide
– Cisco Service Control Application Reporter User Guide
• To view Cisco documentation or obtain general information about the documentation, refer to the
following sources:
– Obtaining Documentation and Submitting a Service Request, page -xx
– The Cisco Information Packet that shipped with your SCE8000 platform.
Conventions
This document uses the following conventions:
Note Means reader take note.
Tip Means the following information will help you solve a problem.
Convention Indication
bold font Commands and keywords and user-entered text appear in bold font.
italic font Document titles, new or emphasized terms, and arguments for which you supply
values are in italic font.
[ ] Elements in square brackets are optional.
{x | y | z} Required alternative keywords are grouped in braces and separated by
vertical bars.
[ x | y | z] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.
courier font Terminal sessions and information the system displays appear in courier font.
< > Nonprinting characters such as passwords are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.

xx
Cisco SCE8000 Software Configuration Guide, Release 3.1.6S
OL-16479-01
Preface
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Timesaver Means the described action saves time. You can save time by performing the action described in
the paragraph.
Warning Means reader be warned. In this situation, you might perform an action that could result in
bodily injury.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional
information, see the monthly What's New in Cisco Product Documentation, which also lists all new and
revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS)
feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds
are a free service and Cisco currently supports RSS version 2.0.