Cisco ASR 5500 Instruction Manual

ASR 5500 System Administration Guide, StarOS Release 21.5
First Published: 2017-11-30
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface About this Guide xxv
Conventions Used xxv
Related Documentation xxvi
Contacting Customer Support xxvi
CHAPTER 1 System Operation and Configuration 1
Terminology 1
Contexts 1
Logical Interfaces 2
Management Interface 2
Bindings 2
Services 2
AAA Servers 3
Subscribers 3
Trusted Builds 4
How the System Selects Contexts 4
Context Selection for Context-level Administrative User Sessions 5
Context Selection for Subscriber Sessions 8
Understanding Configuration Files 8
IP Address Notation 9
IPv4 Dotted-Decimal Notation 9
IPv6 Colon-Separated-Hexadecimal Notation 9
CIDR Notation 10
Alphanumeric Strings 10
Character Set 11
Quoted Strings 12
ASR 5500 System Administration Guide, StarOS Release 21.5
iii

CHAPTER 2 Getting Started 13
Configuring System Administrative Users 13
Limiting the Number of Concurrent CLI Sessions 13
Automatic Logout of CLI Sessions 14
Configuring SSH Options 14
SSH Host Keys 15
Setting SSH Key Size 15
Configuring SSH Key Generation Wait Time 15
Specifying SSH Encryption Ciphers 16
Generating SSH Keys 17
Setting SSH Key Pair 17
Authorized SSH User Access 18
Authorizing SSH User Access 18
SSH User Login Restrictions 18
Creating an Allowed Users List 19
SSH User Login Authentication 19
Secure Session Logout 20
Changing Default sshd Secure Session Logout Parameters 21
SSH Client Login to External Servers 21
Setting SSH Client Ciphers 21
Setting Preferred Authentication Methods 22
Generating SSH Client Key Pair 23
Pushing an SSH Client Public Key to an External Server 24
Enabling NETCONF 24
CHAPTER 3 System Settings 25
Configuring System Timing 25
Setting the System Clock and Time Zone 26
Verifying and Saving Your Clock and Time Zone Configuration 26
Configuring Network Time Protocol Support 26
Configuring NTP Servers with Local Sources 27
Using a Load Balancer 27
Verifying the NTP Configuration 28
Configuring SF Boot Configuration Pause 29
ASR 5500 System Administration Guide, StarOS Release 21.5
iv
Contents

Enabling CLI Timestamping 30
Configuring CLI Confirmation Prompts 30
Enabling Automatic Confirmation 30
Requiring Confirmation for autoconfirm and configure Commands 31
Requiring Confirmation for Specific Exec Mode Commands 31
Configuring System Administrative Users 32
User Name Character Restrictions 33
Configuring Context-level Administrative Users 33
Configuring Context-level Security Administrators 33
Configuring Context-level Administrators 34
Configuring Context-level Operators 34
Configuring Context-level Inspectors 35
Segregating System and LI Configurations 35
Verifying Context-level Administrative User Configuration 36
Configuring Local-User Administrative Users 37
Verifying Local-User Configuration 37
Updating Local-User Database 37
Updating and Downgrading the local-user Database 38
Restricting User Access to a Specified Root Directory 39
Configuring an SFTP root Directory 39
Associating an SFTP root Directory with a Local User 39
Associating an SFTP root Directory with an Administrator 39
Associating an SFTP root Directory with a Config Administrator 40
Configuring TACACS+ for System Administrative Users 40
Operation 40
User Account Requirements 41
TACACS+ User Account Requirements 41
StarOS User Account Requirements 42
Configuring TACACS+ AAA Services 42
Configuring TACACS+ for Non-local VPN Authentication 43
Verifying the TACACS+ Configuration 43
Separating Authentication Methods 44
Disable TACACS+ Authentication for Console 44
Disable AAA-based Authentication for Console 45
Disable TACACS+ Authentication at the Context Level 45
ASR 5500 System Administration Guide, StarOS Release 21.5
v
Contents

Limit local-user Login on Console/vty Lines 45
Limit Console Access for AAA-based Users 46
Verify Configuration Changes 46
Configuring a Chassis Key 46
Overview 47
Configuring a New Chassis Key Value 47
CLI Commands 47
Quick Setup Wizard 48
Enabling Automatic Reset of FSC Fabric 48
CHAPTER 4 Config Mode Lock Mechanisms 51
Overview of Config Mode Locking 51
Requesting an Exclusive-Lock 52
Effect of Config Lock on URL Scripts 53
Saving a Configuration File 54
Reload and Shutdown Commands 54
show administrators Command 55
CHAPTER 5 Management Settings 57
ORBEM 57
Configuring ORBEM Client and Port Parameters 58
Configuring IIOP Transport Parameters 58
Verifying ORBEM Parameters 59
SNMP MIB Browser 59
SNMP Support 62
Configuring SNMP and Alarm Server Parameters 62
Verifying SNMP Parameters 63
Controlling SNMP Trap Generation 64
CHAPTER 6 Verifying and Saving Your Configuration 65
Verifying the Configuration 65
Feature Configuration 65
Service Configuration 66
Context Configuration 66
System Configuration 66
ASR 5500 System Administration Guide, StarOS Release 21.5
vi
Contents

Finding Configuration Errors 66
Synchronizing File Systems 67
Saving the Configuration 67
CHAPTER 7 System Interfaces and Ports 69
Contexts 69
Creating Contexts 69
Viewing and Verifying Contexts 70
Ethernet Interfaces and Ports 70
Creating an Interface 71
Configuring a Port and Binding It to an Interface 71
Configuring a Static Route for an Interface 71
Viewing and Verifying Port Configuration 72
VLANs 72
Hypervisors 73
VLANs and Management Ports 73
CHAPTER 8 System Security 75
Protection of Passwords 75
Secure Password Encryption 75
Support for Non-Current Encryptions and Decryptions 76
Support for ICSR Configurations 76
Encrypted SNMP Community Strings 77
Lawful Intercept Restrictions 77
LI Server Addresses 77
Modifying Intercepts 78
Adding, Modifying and Removing Users 78
Notification of Users Being Added or Deleted 78
Notification of Changes in Privilege Levels 78
User Access to Operating System Shell 78
Test-Commands 79
Enabling cli test-commands Mode 79
Enabling Password for Access to CLI-test commands 79
Exec Mode cli test-commands 80
Configuration Mode cli test-commands 80
ASR 5500 System Administration Guide, StarOS Release 21.5
vii
Contents

CHAPTER 9 Secure System Configuration File 81
Feature Summary and Revision History 81
Feature Description 82
How System Configuration Files are Secured 82
Create a Digital Signature 82
Validate the Digital Signature 83
Configuring Signature Verification 83
Import RSA Public Key for Verification 83
Enable or Disable Signature Verification 84
CHAPTER 10 Software Management Operations 85
Understanding the Local File System 85
File Types Used by the Local File System 85
Understanding the boot.sys File 86
Maintaining the Local File System 86
File System Management Commands 86
Creating Directories 86
Renaming Files and Directories 87
Copying Files 87
Deleting Files 87
Removing Directories 87
Formatting Local Devices 88
Applying Pre-existing CLI Configuration Files 88
Viewing Files on the Local File System 89
Viewing the Contents of a Local Device 89
Viewing CLI Configuration and boot.sys Files 89
Validating an Operating System File 89
Configuring the Boot Stack 90
System Boot Methods 90
Viewing the Current Boot Stack 90
Adding a New Boot Stack Entry 92
Deleting a Boot Stack Entry 92
Upgrading the Operating System Software 92
Identifying OS Release Version and Build Number 92
ASR 5500 System Administration Guide, StarOS Release 21.5
viii
Contents

Verify Free Space on the /flash Device 93
Download the Software Image from the Support Site 93
Transfer StarOS Image to /flash 94
Saving a Copy of the Current Configuration File 94
Downgrading from Release 15.0 to 14.0 94
Downgrading from Release 20.0 94
Off-line Software Upgrade 95
Configure a Newcall Policy 95
Configure a Message of the Day Banner 96
Back up the Current CLI Configuration File 96
Create a New Boot Stack Entry 96
Synchronize File Systems 97
Save the Running Configuration 97
Reboot the System 97
Verify the Running Software Version 97
Restoring the Previous Software Image 98
Managing License Keys 98
New System License Keys 98
Session Use and Feature Use Licenses 98
Installing New License Keys 99
Cutting and Pasting the Key 99
Adding License Keys to Configuration Files 99
License Expiration Behavior 100
Requesting License Keys 100
Viewing License Information 100
Deleting a License Key 101
Managing Local-User Administrative Accounts 101
Configuring Local-User Password Properties 101
Configuring Local-User Account Management Properties 101
Local-User Account Lockouts 101
Local-User Account Suspensions 102
Changing Local-User Passwords 102
CHAPTER 11 Smart Licensing 103
Feature Summary and Revision History 103
ASR 5500 System Administration Guide, StarOS Release 21.5
ix
Contents

Smart Software Licensing 104
Cisco Smart Software Manager 105
Smart Accounts/Virtual Accounts 105
Request a Cisco Smart Account 105
Software Tags and Entitlement Tags 106
Configuring Smart Licensing 107
Monitoring and Troubleshooting Smart Licensing 108
Smart Licensing Bulk Statistics 108
CHAPTER 12 Monitoring the System 111
SNMP Notifications 111
Monitoring System Status and Performance 111
Clearing Statistics and Counters 113
CHAPTER 13 Bulk Statistics 115
Feature Summary and Revision History 115
Configuring Communication with the Collection Server 116
Configuring Standard Settings 116
Configuring Optional Settings 117
Configuring Bulk Statistic Schemas 117
Configuring a Separate Bulkstats Config File 118
Using show bulkstats Commands 118
Verifying Your Configuration 119
Saving Your Configuration 120
Viewing Collected Bulk Statistics Data 120
Collecting Bulk Statistics Samples in SSD 120
Manually Gathering and Transferring Bulk Statistics 120
Clearing Bulk Statistics Counters and Information 121
Bulkstats Schema Nomenclature 121
Statistic Types 121
Data Types 122
Key Variables 122
Bulk Statistics Event Log Messages 124
CHAPTER 14 System Logs 125
ASR 5500 System Administration Guide, StarOS Release 21.5
x
Contents