Cisco ASR 5000 Series Instruction Manual

ASR 5500 System Administration Guide, StarOS Release 21.4
First Published: 2017-11-22
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface About this Guide xxix
Conventions Used xxix
Related Documentation xxx
MIOs and DPCs xxx
Contacting Customer Support xxxi
CHAPTER 1 System Operation and Configuration 1
System Management Overview 1
Terminology 3
Contexts 3
Ports 3
Logical Interfaces 4
Management Interface 4
Bindings 4
Services 4
AAA Servers 5
Subscribers 5
Trusted Builds 6
How the System Selects Contexts 7
Context Selection for Context-level Administrative User Sessions 7
Context Selection for Subscriber Sessions 10
Understanding the ASR 5500 Boot Process 10
Understanding Configuration Files 11
IP Address Notation 13
IPv4 Dotted-Decimal Notation 13
IPv6 Colon-Separated-Hexadecimal Notation 13
CIDR Notation 13
ASR 5500 System Administration Guide, StarOS Release 21.4
iii

Alphanumeric Strings 14
Character Set 14
Quoted Strings 16
CHAPTER 2 Getting Started 17
ASR 5500 Configuration 17
Using the ASR 5500 Quick Setup Wizard 17
The Quick Setup Wizard 18
Using the CLI for Initial Configuration 24
Configuring System Administrative Users 26
Limiting the Number of Concurrent CLI Sessions 26
Automatic Logout of CLI Sessions 26
Configuring the System for Remote Access 27
Configuring SSH Options 29
SSH Host Keys 30
Setting SSH Key Size 30
Configuring SSH Key Generation Wait Time 30
Specifying SSH Encryption Ciphers 31
Generating SSH Keys 32
Setting SSH Key Pair 32
Authorized SSH User Access 32
Authorizing SSH User Access 33
SSH User Login Restrictions 33
Creating an Allowed Users List 33
SSH User Login Authentication 34
Secure Session Logout 35
Changing Default sshd Secure Session Logout Parameters 35
SSH Client Login to External Servers 36
Setting SSH Client Ciphers 36
Setting Preferred Authentication Methods 37
Generating SSH Client Key Pair 38
Pushing an SSH Client Public Key to an External Server 38
Enabling NETCONF 39
Configuring the Management Interface with a Second IP Address 39
ASR 5500 System Administration Guide, StarOS Release 21.4
iv
Contents

CHAPTER 3 System Settings 41
Configuring a Second Management Interface 42
Verifying and Saving Your Interface and Port Configuration 42
Configuring System Timing 43
Setting the System Clock and Time Zone 43
Verifying and Saving Your Clock and Time Zone Configuration 44
Configuring Network Time Protocol Support 44
Configuring NTP Servers with Local Sources 45
Using a Load Balancer 45
Verifying the NTP Configuration 46
Configuring SF Boot Configuration Pause 47
Enabling CLI Timestamping 47
Configuring CLI Confirmation Prompts 48
Enabling Automatic Confirmation 48
Requiring Confirmation for autoconfirm and configure Commands 48
Requiring Confirmation for Specific Exec Mode Commands 49
Configuring System Administrative Users 50
User Name Character Restrictions 50
Configuring Context-level Administrative Users 51
Configuring Context-level Security Administrators 51
Configuring Context-level Administrators 52
Configuring Context-level Operators 52
Configuring Context-level Inspectors 52
Configuring LI Administrators 53
Segregating System and LI Configurations 53
Verifying Context-level Administrative User Configuration 54
Configuring Local-User Administrative Users 55
Verifying Local-User Configuration 55
Updating Local-User Database 56
Updating and Downgrading the local-user Database 56
Provisioning Lawful Intercept 57
Restricting User Access to a Specified Root Directory 58
Configuring an SFTP root Directory 59
Associating an SFTP root Directory with a Local User 59
ASR 5500 System Administration Guide, StarOS Release 21.4
v
Contents

Associating an SFTP root Directory with an Administrator 59
Associating an SFTP root Directory with a Config Administrator 59
Configuring TACACS+ for System Administrative Users 60
Operation 60
User Account Requirements 61
TACACS+ User Account Requirements 61
StarOS User Account Requirements 61
Configuring TACACS+ AAA Services 62
Configuring TACACS+ for Non-local VPN Authentication 63
Verifying the TACACS+ Configuration 63
Separating Authentication Methods 64
Disable TACACS+ Authentication for Console 64
Disable AAA-based Authentication for Console 64
Disable TACACS+ Authentication at the Context Level 65
Limit local-user Login on Console/vty Lines 65
Limit Console Access for AAA-based Users 66
Verify Configuration Changes 66
Configuring a Chassis Key 66
Overview 66
Configuring a New Chassis Key Value 67
CLI Commands 67
Quick Setup Wizard 68
Configuring MIO/UMIO/MIO2 Port Redundancy 68
Configuring MIO/UMIO/MIO2 Port Redundancy Auto-Recovery 71
Verifying Port Redundancy Auto-Recovery 72
Configuring Data Processing Card Availability 72
Verifying Card Configurations 73
Enabling Automatic Reset of FSC Fabric 73
Configuring ASR 5500 Link Aggregation 73
LAG and Master Port 74
LAG and Port Redundancy 74
LAG and Multiple Switches 74
Multiple Switches with L2 Redundancy 75
Port States for Auto-Switch 75
Hold Time 75
ASR 5500 System Administration Guide, StarOS Release 21.4
vi
Contents

Preferred Slot 76
Auto-Switch Criteria 76
Link Aggregation Control 76
Minimum Links 77
Redundancy Options 78
Horizontal Link Aggregation with Two Ethernet Switches 78
Non-Redundant (Active-Active) LAG 78
Faster Data Plane Convergence 79
Link Aggregation Status 80
Configuring a Demux Card 80
Overview 80
MIO Demux Restrictions 81
Configuration 82
CHAPTER 4 Config Mode Lock Mechanisms 83
Overview of Config Mode Locking 83
Requesting an Exclusive-Lock 84
Effect of Config Lock on URL Scripts 85
Saving a Configuration File 86
Reload and Shutdown Commands 86
show administrators Command 87
CHAPTER 5 Management Settings 89
ORBEM 89
Configuring ORBEM Client and Port Parameters 90
Configuring IIOP Transport Parameters 90
Verifying ORBEM Parameters 91
SNMP MIB Browser 91
SNMP Support 94
Configuring SNMP and Alarm Server Parameters 94
Verifying SNMP Parameters 95
Controlling SNMP Trap Generation 96
CHAPTER 6 Verifying and Saving Your Configuration 97
Verifying the Configuration 97
ASR 5500 System Administration Guide, StarOS Release 21.4
vii
Contents

Feature Configuration 97
Service Configuration 98
Context Configuration 98
System Configuration 98
Finding Configuration Errors 98
Synchronizing File Systems 99
Saving the Configuration 99
CHAPTER 7 System Interfaces and Ports 101
Contexts 101
Creating Contexts 101
Viewing and Verifying Contexts 102
Ethernet Interfaces and Ports 102
Creating an Interface 103
Configuring a Port and Binding It to an Interface 103
Configuring a Static Route for an Interface 103
Viewing and Verifying Port Configuration 104
VLANs 105
Hypervisors 105
VLANs and Management Ports 105
CHAPTER 8 System Security 107
Per-Chassis Key Identifier 107
MIO Synchronization 108
Protection of Passwords 108
Secure Password Encryption 109
Support for Non-Current Encryptions and Decryptions 109
Support for ICSR Configurations 110
Encrypted SNMP Community Strings 110
Lawful Intercept Restrictions 110
LI Server Addresses 110
Modifying Intercepts 111
Adding, Modifying and Removing Users 111
Notification of Users Being Added or Deleted 111
Notification of Changes in Privilege Levels 111
ASR 5500 System Administration Guide, StarOS Release 21.4
viii
Contents

User Access to Operating System Shell 112
Test-Commands 112
Enabling cli test-commands Mode 112
Enabling Password for Access to CLI-test commands 112
Exec Mode cli test-commands 113
Configuration Mode cli test-commands 113
CHAPTER 9 Secure System Configuration File 115
Feature Summary and Revision History 115
Feature Description 116
How System Configuration Files are Secured 116
Create a Digital Signature 116
Validate the Digital Signature 117
Configuring Signature Verification 117
Import RSA Public Key for Verification 117
Enable or Disable Signature Verification 118
CHAPTER 10 Software Management Operations 119
Understanding the Local File System 119
File Types Used by the Local File System 119
Understanding the boot.sys File 120
Maintaining the Local File System 120
File System Management Commands 120
Synchronizing the File System 121
Creating Directories 121
Renaming Files and Directories 121
Copying Files 122
Deleting Files 122
Removing Directories 122
Formatting Local Devices 122
Applying Pre-existing CLI Configuration Files 123
Viewing Files on the Local File System 123
Viewing the Contents of a Local Device 123
Viewing CLI Configuration and boot.sys Files 124
Validating an Operating System File 124
ASR 5500 System Administration Guide, StarOS Release 21.4
ix
Contents

Configuring the Boot Stack 125
System Boot Methods 125
Viewing the Current Boot Stack 125
Adding a New Boot Stack Entry 127
Deleting a Boot Stack Entry 127
Network Booting Configuration Requirements 127
Configuring the Boot Interface 127
Configuring the Boot Network 128
Configuring Boot Network Delay Time 129
Configuring a Boot Nameserver 129
Upgrading the Operating System Software 129
Identifying OS Release Version and Build Number 129
Verify Free Space on the /flash Device 130
Download the Software Image from the Support Site 130
Transfer StarOS Image to /flash 131
Saving a Copy of the Current Configuration File 131
Downgrading from Release 15.0 to 14.0 131
Downgrading from Release 20.0 132
Off-line Software Upgrade 132
Configure a Newcall Policy 132
Configure a Message of the Day Banner 133
Back up the Current CLI Configuration File 133
Create a New Boot Stack Entry 133
Synchronize File Systems 134
Save the Running Configuration 134
Reboot the System 134
Verify the Running Software Version 135
Restoring the Previous Software Image 135
Upgrading ICSR Chassis 135
Performing Dynamic Software Updates 135
Managing License Keys 135
New System License Keys 136
Session Use and Feature Use Licenses 136
Installing New License Keys 136
Cutting and Pasting the Key 136
ASR 5500 System Administration Guide, StarOS Release 21.4
x
Contents