Cisco NCS 1004 Installation manual

Command Reference for Cisco NCS 1004
First Published: 2019-08-30
Last Modified: 2020-04-14
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
©2020 Cisco Systems, Inc. All rights reserved.

CONTENTS
Commands 1
CHAPTER 1
Reference 3
aaa authentication login 4
aaa authorization 5
active 6
address 7
cipher-suite 8
controller coherentDSP 9
controller HundredGigECtrlr 11
controller ODU4 13
controller optics 15
destination address 19
destination ipv4 unicast 20
destination transport-method 21
dh 22
dwdm-carrier 23
encryption 24
fault-profile 25
fault-profile apply 27
gmpls optical-uni 28
http-proxy 29
hw-module 30
ikev2 policy 33
ikev2 profile 34
ikev2 proposal 35
integrity 36
Command Reference for Cisco NCS 1004
iii

interface gcc0 37
interface gcc2 38
ipcc routed 39
ipv4 access-group 40
ipv6 access-group 41
keyring 42
license smart register 43
license smart renew 44
license smart deregister 45
lifetime 46
link-id ipv4 unicast 47
lmp 48
match address local 49
match identity remote address 50
neighbor interface-id unnumbered 51
neighbor link-id ipv4 unicast 52
neighbor 53
otnsec policy 54
path-option 55
peer 56
pm 57
pre-shared-key 62
prf 63
router-id ipv4 unicast 64
sak-rekey-interval 65
security-policy 66
session-id 67
show alarms 68
show controllers 70
show access-lists ipv4 80
show access-lists ipv6 82
show environment 84
show hw-module 87
show inventory 90
Command Reference for Cisco NCS 1004
iv
Contents

show led 97
show platform 98
signalling refresh out-of-band interval 101
signalling refresh out-of-band missed 102
tunnel-id 103
tunnel-properties 104
Command Reference for Cisco NCS 1004
v
Contents

Command Reference for Cisco NCS 1004
vi
Contents

Commands
•Reference, on page 3
•aaa authentication login, on page 4
•aaa authorization, on page 5
•active, on page 6
•address, on page 7
•cipher-suite, on page 8
•controller coherentDSP, on page 9
•controller HundredGigECtrlr, on page 11
•controller ODU4, on page 13
•controller optics, on page 15
•destination address, on page 19
•destination ipv4 unicast, on page 20
•destination transport-method, on page 21
•dh, on page 22
•dwdm-carrier, on page 23
•encryption, on page 24
•fault-profile, on page 25
•fault-profile apply, on page 27
•gmpls optical-uni, on page 28
•http-proxy, on page 29
•hw-module, on page 30
•ikev2 policy, on page 33
•ikev2 profile, on page 34
•ikev2 proposal, on page 35
•integrity, on page 36
•interface gcc0, on page 37
•interface gcc2, on page 38
•ipcc routed, on page 39
•ipv4 access-group, on page 40
•ipv6 access-group, on page 41
•keyring, on page 42
•license smart register, on page 43
•license smart renew , on page 44
Command Reference for Cisco NCS 1004
1

•license smart deregister, on page 45
•lifetime, on page 46
•link-id ipv4 unicast, on page 47
•lmp, on page 48
•match address local, on page 49
•match identity remote address, on page 50
•neighbor interface-id unnumbered, on page 51
•neighbor link-id ipv4 unicast, on page 52
•neighbor, on page 53
•otnsec policy, on page 54
•path-option, on page 55
•peer, on page 56
•pm, on page 57
•pre-shared-key, on page 62
•prf, on page 63
•router-id ipv4 unicast, on page 64
•sak-rekey-interval, on page 65
•security-policy, on page 66
•session-id, on page 67
•show alarms, on page 68
•show controllers, on page 70
•show access-lists ipv4, on page 80
•show access-lists ipv6, on page 82
•show environment, on page 84
•show hw-module, on page 87
•show inventory, on page 90
•show led, on page 97
•show platform, on page 98
•signalling refresh out-of-band interval, on page 101
•signalling refresh out-of-band missed, on page 102
•tunnel-id, on page 103
•tunnel-properties, on page 104
Command Reference for Cisco NCS 1004
2
Commands

Reference
This guide describes the commands supported in Cisco NCS 1004. For information on Cisco IOS XR
commands, see here.
Command Reference for Cisco NCS 1004
3
Commands
Reference

aaa authentication login
To configure authentication, authorization, and accounting (AAA) authentication at login, use the aaa
authentication login command in global configuration mode.
aaa authentication login { default | list-name }method-list
Syntax Description Sets authentication for login.login
Uses the listed authentication methods that follow this keyword as the default list of methods
for authentication.
default
Character string used to name the authentication method list.list-name
Method used to enable AAA system accounting. Method list types are entered in the preferred
sequence. The value is one of the following options:
•group tacacs+ — Specifies a method list that uses the list of all configured TACACS+
servers for authentication.
•group radius — Specifies a method list that uses the list of all configured RADIUS
servers for authentication.
•group named-group — Specifies a named subset of TACACS+ or RADIUS servers for
authentication.
•local — Specifies a local username or password database for authentication.
•line — Specifies a line password or user group for authentication.
method-list
Command Default No authentication is performed.
Command Modes Global configuration
Command History ModificationRelease
This command was introduced.R7.0.1
Example
The following example shows how to specify the default method list for authentication, and also
enable authentication.
configure
aaa authentication login default group tacacs+
exit
commit
Command Reference for Cisco NCS 1004
4
Commands
aaa authentication login

aaa authorization
To create a method list for authorization, use the aaa authorization command in global configuration mode.
aaa authorization {exec | nacm} { default | list-name } {none | local | group tacacs+ | group radius |
group group-name }
Syntax Description Configures authorization for an interactive (EXEC) session.exec
Enables the NACM (NETCONF Access Control Model) functionality.nacm
Uses the listed authorization methods that follow this keyword as the default list of
methods for authorization.
default
Character string used to name the list of authorization methods.list-name
Uses no authorization. If you specify none, no subsequent authorization method is
attempted.
none
Uses local authorization. This method of authorization is not available for command
authorization.
local
Uses the list of all configured TACACS+ servers for authorization.group tacacs+
Uses the list of all configured RADIUS servers for authorization. This method of
authorization is not available for command authorization.
group radius
Specifies a named subset of TACACS+ or RADIUS servers for authorization.group group-name
Command Default Authorization is disabled for all actions (equivalent to the method none keyword).
Command Modes Global configuration
Command History ModificationRelease
This command was introduced.R7.0.1
Example
The following example shows how to define the network authorization method list named listname1,
which specifies that TACACS+ authorization is used.
configure
aaa authorization exec listname1 group tacacs+
exit
commit
Command Reference for Cisco NCS 1004
5
Commands
aaa authorization

active
To enable a Call Home profile, use the active command in the call home profile configuration mode.
active
Syntax Description This command has no keywords or arguments.
Command Default None
Command Modes Call home profile configuration mode
Command History ModificationRelease
This command was introduced.Release
7.0.1
Usage Guidelines You must enable a profile using the active command so that call home messages can be triggered.
The following example shows how to activate a profile.
domain name-server 64.102.6.247
call-home
service active
contact smart-licensing
profile CiscoTAC-1
active
Command Reference for Cisco NCS 1004
6
Commands
active

address
To configure the IP address of the peer node during keyring configuration, use the address command in
keyring configuration mode.
address {ipv4-address [subnet-mask]}
Syntax Description IP address of the peer
node.
ipv4-address
Subnet mask address.subnet-mask
Command Default None
Command Modes Keyring configuration
Command History ModificationRelease
This command was
introduced.
Release
7.0.1
Example
The following is a sample in which an OTNSec policy is configured.
RP/0/RP0/CPU0:ios#conf
Thu Mar 7 19:33:14.594 UTC
RP/0/RP0/CPU0:ios(config)#keyring kyr1
RP/0/RP0/CPU0:ios(config-keyring-kyr1)#peer peer1
RP/0/RP0/CPU0:ios(config-keyring-kyr1-peer-peer1)#address 10.0.0.1 255.255.255.0
RP/0/RP0/CPU0:ios(config-keyring-kyr1-peer-peer1)#pre-shared-key key1|clear
RP/0/RP0/CPU0:ios(config-keyring-kyr1-peer-peer1)#commit
Thu Mar 7 19:54:33.314 UTC
RP/0/RP0/CPU0:ios(config-keyring-kyr1-peer-peer1)#exit
RP/0/RP0/CPU0:ios(config-keyring-kyr1)#exit
RP/0/RP0/CPU0:ios(config)#exit
RP/0/RP0/CPU0:ios#show keyring kyr1
Thu Mar 7 19:58:07.135 UTC
Keyring Name : kyr1
===============================================================================
Total Peers : 1
-------------------------------------------------------------------------------
Peer Name : peer1
IP Address : 10.0.0.1
Subnet Mask : 255.255.255.0
Local PSK : Configured
Remote PSK : Configured
Command Reference for Cisco NCS 1004
7
Commands
address

cipher-suite
To specify the encryption algorithm for an OTNSec policy, use the cipher-suite command in the OTNSec
policy configuration mode.
cipher-suite encryption-algorithm-type
Syntax Description Encryption algorithm type. AES-GCM-256 is used.encryption-algorithm-type
Command Default None
Command Modes OTNSec policy configuration
Command History ModificationRelease
This command was
introduced.
Release
7.0.1
Example
The following is a sample in which an OTNSec policy is configured.
RP/0/RP0/CPU0:ios#configure
Mon Mar 11 15:16:58.417 UTC
RP/0/RP0/CPU0:ios(config)#otnsec policy otnsec-policy1
RP/0/RP0/CPU0:ios(config-otnsec-policy)#cipher-suite AES-GCM-256
RP/0/RP0/CPU0:ios(config-otnsec-policy)#security-policy must-secure
RP/0/RP0/CPU0:ios(config-otnsec-policy)#sak-rekey-interval 120
RP/0/RP0/CPU0:ios(config-otnsec-policy)#commit
The following is a sample of an OTNSec policy.
RP/0/RP0/CPU0:ios#show run otnsec policy otnsec-policy1
Tue Mar 12 11:14:03.591 UTC
otnsec policy otnsec-policy1
cipher-suite AES-GCM-256
security-policy must-secure
sak-rekey-interval 120
!
Command Reference for Cisco NCS 1004
8
Commands
cipher-suite

controller coherentDSP
To configure the coherent DSP controller, use the controller coherentDSP command in the Coherent DSP
controller configuration mode.
controller coherentDSP R/S/I/P [description ] | [ fec fec-value ] | [ pm {30-sec
|15-min | 24-hour } { fec | otn } { report | threshold }value ] | [ perf-mon {enable |disable
} ] | [ loopback internal ] | [ secondary-admin-state {maintenance | normal }] | [
shutdown ] | [ tti {sent | expected } { ascii | hex }tti-string ][ gcc0
Syntax Description Rack/Slot/Instance/Port of the coherent DSP controller.R/S/I/P
Description of the coherent DSP controller.description description
Configures the FEC on the controller. The supported options on the 1.2T
line card are StandardSD15 and StandardSD27.
fec fec-value
Configures performance monitoring parameters for 30 second,15 minute,
or 24 hour intervals.
The fec keyword configures FEC PM data in 30 second, 15 minute, or 24
hour intervals.
The otn keyword configures OTN PM data in 30 second, 15 minute, or
24 hour intervals.
The report keyword configures TCA reporting status.
The threshold keyword configures threshold values on PM parameters.
pm {30-sec|15-min|24-hour}
{fec | otn} {report |
threshold}value
Enables or disables performance monitoring.perf-mon {enable |disable
}
Configures the internal loopback mode on the controller.
For the 1.2T line card, internal and line loopbacks are supported on the
Ethernet controllers whereas only internal loopback is supported on the
CoherentDSP controllers.
loopback internal
Configures the administrative state of the controller. The values are
maintenance or normal.
secondary-admin-state
Disables the configuration of the controller.shutdown
Configures the Trail Trace Identifier (TTI) ASCII or hex string to be sent.
SAPI, DAPI, and operator inputs are not supported.
tti sent {ascii | hex} tti-string
Configures the expected TTI ASCII or hex string. The OTUK-TIM alarm
is raised if the received TTI string does not match the expected TTI string.
SAPI, DAPI, and operator inputs are not supported.
tti expected {ascii | hex}
tti-string
Enables the GCC0 interface.gcc0
Command Reference for Cisco NCS 1004
9
Commands
controller coherentDSP

Command Default None
Command Modes Coherent DSP controller configuration
Command History ModificationRelease
This command was introduced.Release
7.0.1
gcc0 keyword was added.Release
7.1.1
Example
The following is a sample in which performance monitoring parameters of Coherent DSP controller
is configured in 30 second intervals.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller coherentDSP 0/0/1/1 pm 30-sec fec threshold post-fec-ber
max OE-15
RP/0/RP0/CPU0:ios(config)#commit
The following example shows how to configure TTI on a coherentDSP controller with the sent and
expected strings set to the same ASCII string. The state of the controller is up.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller coherentDSP 0/1/0/1 tti sent ascii 1234
RP/0/RP0/CPU0:ios(config)#controller coherentDSP 0/1/0/1 tti expected ascii 1234
RP/0/RP0/CPU0:ios(config)#commit
The following example shows how to configure TTI on a coherentDSP controller with the sent and
expected strings set to different ASCII strings. The state of the controller goes down and the
OTUK-TIM alarm is raised.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller coherentDSP 0/1/0/1 tti sent ascii 1234
RP/0/RP0/CPU0:ios(config)#controller coherentDSP 0/1/0/1 tti expected ascii 5678
RP/0/RP0/CPU0:ios(config)#commit
The following is a sample to enable the GCC0 interface.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller CoherentDSP0/0/0/0
RP/0/RP0/CPU0:ios(config-CoDSP)#gcc0
RP/0/RP0/CPU0:ios(config-CoDSP)#commit
RP/0/RP0/CPU0:ios(config-CoDSP)#exit
Command Reference for Cisco NCS 1004
10
Commands
controller coherentDSP

controller HundredGigECtrlr
To configure the Ethernet controller, use the controller HundredGigECtrlr command in the Ethernet
controller configuration mode.
controllerHundredGigECtrlr R/S/I/P [pm {30-sec|15-min| 24-hour} {ether} {report|threshold}
value ]|[perf-mon disable ] | [loopback {internal |line} ] | [sec-admin-state
maintenance] | [shutdown ] | [laser-squelch]|[fec {none |standard } ] |
[holdoff-time trunk-fault timevalue]
Syntax Description Rack/Slot/Instance/Port of the Ethernet controller.R/S/I/P
Configures performance monitoring parameters for 30 second, 15 minutes,
or 24 hour intervals.
pm {30-sec | 15-min | 24-hour
}
Configures Ethernet PM data in 30 second, 15 minute or 24 hour intervals.ether
Configures TCA reporting status.report
Configures threshold on Ethernet controller parameters.threshold
Disables performance monitoring.perf-mon disable
Configures the internal or line loopback mode on the Ethernet controller.
For the 1.2T line card, internal and line loopbacks are supported on the
ethernet controllers whereas only internal loopbacks are supported on
the CoherentDSP controllers.
loopback [ internal | line ]
Configures the administrative state of the controller indicating that the
controller is under maintenance.
sec-admin-state maintenance
Disables the configuration of the controller.shutdown
Enables laser squelching so that laser is brought down in the event of
trunk faults (LOF, LOS) and a SQUELCHED alarm is raised.
laser-squelch
Disables FEC or enables standard (Reed-Solomon) FEC.fec {none |standard }
When a fault occurs on the trunk port, the user can hold the propagation
of Local Fault using this parameter. The range of timevalue is 0 to 3000
ms.
holdoff-time trunk-fault
timevalue
Command Default None
Command Modes Ethernet controller configuration
Command History ModificationRelease
This command was introduced.Release
7.0.1
Command Reference for Cisco NCS 1004
11
Commands
controller HundredGigECtrlr

Example
The following example shows how to configure the performance monitoring parameters of the
Ethernet controller in 15 minute intervals.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller HundredGigECtrlr 0/1/0/10 pm 15-min pcs report bip
enable
The following example shows how to configure the internal loopback.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller HundredGigECtrlr 0/1/0/10 secondary-admin-state
maintenance
RP/0/RP0/CPU0:ios(config)#controller HundredGigECtrlr 0/1/0/10 loopback internal
RP/0/RP0/CPU0:ios(config)#commit
The following example enables IDLE hold off timer in Ethernet controller.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller HundredGigECtrlr 0/1/0/10 holdoff-time trunk-fault
3000
RP/0/RP0/CPU0:ios(config)#commit
The following is a sample where laser quelching is enabled on the Ethernet controller.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller HundredGigECtrlr 0/1/0/10 laser-squelch
RP/0/RP0/CPU0:ios(config)#commit
Command Reference for Cisco NCS 1004
12
Commands
controller HundredGigECtrlr

controller ODU4
To configure the ODU4 controller, use the controller ODU4 command in the configuration mode.
controller ODU4 R/S/I/P gcc2
Syntax Description Rack/Slot/Instance/Port/Lane of the ODU4 controller.R/S/I/P/L
Enables the GCC2 interface.gcc2
Command Default None
Command Modes Configuration
Command History ModificationRelease
This command is
introduced.
Release
7.0.1
gcc2 keyword was added.Release
7.1.1
Example
The following is a sample in which OTNSec is configured on ODU4 controllers.
RP/0/RP0/CPU0:ios#configure
Mon Mar 12 12:10:21.374 UTC
RP/0/RP0/CPU0:ios(config)#controller ODU4 0/1/0/0/1
RP/0/RP0/CPU0:ios(config-odu4)#otnsec
RP/0/RP0/CPU0:ios(config-otnsec)#source ipv4 10.0.0.1
RP/0/RP0/CPU0:ios(config-otnsec)#destination ipv4 10.0.0.2
RP/0/RP0/CPU0:ios(config-otnsec)#session-id 9000
RP/0/RP0/CPU0:ios(config-otnsec)#policy otnsec-policy1
RP/0/RP0/CPU0:ios(config-otnsec)#ikev2 profile1
RP/0/RP0/CPU0:ios(config-otnsec)#commit
Mon Mar 12 12:14:17.609 UTC
RP/0/RP0/CPU0:ios(config-otnsec)#exit
RP/0/RP0/CPU0:ios(config)#exit
The following is a running configuration on an ODU4 controller.
RP/0/RP0/CPU0:ios#show run controller ODU4 0/1/0/0/1
Tue Mar 12 12:20:49.153 UTC
controller ODU40/1/0/0/1
gcc2
otnsec
policy otnsec-policy1
source ipv4 10.0.0.1
destination ipv4 10.0.0.2
session-id 9000
!
!
Command Reference for Cisco NCS 1004
13
Commands
controller ODU4

The following is a sample to enable the GCC2 interface.
RP/0/RP0/CPU0:ios#configure
RP/0/RP0/CPU0:ios(config)#controller odu4 0/1/0/0/1
RP/0/RP0/CPU0:ios(config-odu4)#gcc2
RP/0/RP0/CPU0:ios(config-odu4)#commit
RP/0/RP0/CPU0:ios(config-odu4)#exit
Command Reference for Cisco NCS 1004
14
Commands
controller ODU4