Cisco SCE 8000 10GBE User manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide. 
Addresses, phone numbers, and fax numbers 
are listed on the Cisco website at 
www.cisco.com/go/offices.
Cisco SCE 8000 10GBE Software
Configuration Guide
Release 4.1.x
February 07, 2014
Text Part Number: OL-30621-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco SCE 8000 10GBE Software Configuration Guide
© 2013 - 2014 Cisco Systems, Inc. All rights reserved.

iii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
CONTENTS
About this Guide 1
Introduction 1
Document Revision History 2
Organization 3
Related Publications 5
Conventions 6
Obtaining Documentation and Submitting a Service Request 7
CHAPTER 1Cisco Service Control Overview 1-1
Introduction 1-1
Cisco Service Control Solution 1-2
Service Control for Broadband Service Providers 1-2
Cisco Service Control Capabilities 1-3
Cisco SCE Platform Description 1-4
Bandwidth Management of P2P Traffic 1-5
Management and Collection 1-6
Network Management 1-6
Subscriber Management 1-7
Service Configuration Management 1-7
Data Collection 1-7
IPv6 Support 1-8
CHAPTER 2Command-Line Interface 2-1
Introduction 2-1
Authorization and Command Mode Levels (Hierarchy) 2-2
CLI Authorization Levels 2-2
CLI Command Mode Hierarchy 2-3
Prompt Indications 2-6
Navigating Between Authorization Levels and Command Modes 2-6
The do Command: Executing Commands Without Exiting 2-7
CLI Help Features 2-9
Partial Help 2-9
Argument Help 2-9

Contents
iv
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Navigational and Shortcut Features 2-11
Command History 2-11
Keyboard Shortcuts 2-11
Auto-Completion 2-12
FTP User Name and Password 2-13
Managing Command Output 2-14
Scrolling the Screen Display 2-14
Filtering Command Output 2-14
Redirecting Command Output to a File 2-15
Creating a CLI Script 2-16
CHAPTER 3Basic Cisco SCE 8000 Platform Operations 3-1
Introduction 3-1
Starting the Cisco SCE 8000 Platform 3-2
Checking Conditions Prior to System Startup 3-2
Starting the System and Observing Initial Conditions 3-2
Final Tests 3-3
How to Verify Operational Status 3-3
How to View the User Log Counters 3-3
Managing Configurations 3-5
Viewing Configurations 3-5
How to Save or Change the Configuration Settings 3-6
Example for Saving or Changing the Configuration Settings 3-7
Restoring a Previous Configuration 3-8
Example for Restoring a Previous Configuration 3-8
How to Display the Cisco SCE Platform Version Information 3-10
Example for Displaying the Cisco SCE Platform Version Information 3-10
How to Display the Cisco SCE Platform Inventory 3-13
Examples for Displaying the Cisco SCE Platform Inventory 3-13
Displaying the Cisco SCE Platform Inventory: FRUs Only 3-13
Displaying the Complete Cisco SCE Platform Inventory 3-14
How to Display the System Uptime 3-17
Example for Displaying the System Uptime 3-17
Configuring the System Mode 3-17
Configuring the IPv6 Prefix Length 3-18
Monitoring Control Processor CPU Utilization 3-20
CLI Commands for Monitoring Control Processor CPU Utilization 3-20
Example for Monitoring Control Processor CPU Utilization 3-21

Contents
v
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Rebooting and Shutting Down the Cisco SCE Platform 3-23
Rebooting the Cisco SCE Platform 3-23
Examples for Rebooting the Cisco SCE Platform 3-23
How to Shut Down the Cisco SCE Platform 3-23
Example for Shutting Down the Cisco SCE Platform 3-24
CHAPTER 4Utilities 4-1
Introduction 4-1
Working with Cisco SCE Platform Files 4-2
Working with Directories 4-2
How to Create a Directory 4-2
How to Delete a Directory 4-2
How to Change Directories 4-3
How to Display your Working Directory 4-3
How to List the Files in a Directory 4-3
Working with Files 4-4
How to Rename a File 4-4
How to Delete a File 4-4
Copying Files 4-5
How to Display File Contents 4-6
How to Unzip a File 4-6
The User Log 4-7
The Logging System 4-7
Copying the User Log 4-7
Enabling and Disabling the User Log 4-8
Viewing the User Log Counters 4-8
Viewing the User Log 4-9
Clearing the User Log 4-9
Generating a File for Technical Support 4-9
Generating a File for Technical Support: Example 4-9
Managing Syslog 4-10
Enabling and Disabling Syslog 4-10
Configuring Remote Syslog Hosts 4-10
How to Add a Remote Syslog Host 4-11
How to Remove a Remote Syslog Host 4-11
Configuring the Minimum Severity Level to be Logged to Syslog 4-11
How to Configure the Minimum Severity Level for Syslog Messages 4-12
How to Restore the Default Minimum Severity Level for Syslog Messages 4-12
Configuring the Syslog Facility 4-12

Contents
vi
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Configure the Syslog Facility 4-13
How to Restore the Default Syslog Facility 4-13
Configuring the Syslog Logging Rate Limit 4-13
How to Configure the Syslog Rate Limit 4-14
How to Restore the Default Syslog Rate Limit 4-14
Configuring the Syslog Time Stamp Format 4-14
How to Configure the Syslog Time Stamp Format 4-15
How to Restore the Default Syslog Time Stamp Format 4-15
Enabling and Disabling the Syslog Message Counter 4-15
Monitoring Syslog 4-15
How to Display the Syslog Configuration 4-16
How to Display the Syslog Counters 4-16
Flow Capture 4-17
Limitations 4-17
The Flow Capture Process 4-18
Configuring a Flow Capture Traffic Rule 4-18
Configuring the Flow Capture Settings 4-18
Performing the Flow Capture 4-20
Monitoring the Flow Capture 4-20
CHAPTER 5Configuring the Management Interface and Security 5-1
Introduction 5-1
Management Interface and Security 5-2
Configuring the Management Ports 5-3
Entering the Management Interface Configuration Mode 5-3
Configuring the Management Port Physical Parameters 5-4
Setting the IP Address and Subnet Mask of the Management Interface 5-4
Configuring the Management Interface Speed and Duplex Parameters 5-5
Specifying the Active Management Port 5-7
Management Interface Redundancy 5-8
Configuring the Management Ports for Redundancy 5-8
Configuring the Fail-Over Mode 5-9
Monitoring the Management Interface 5-10
Configuring Management Interface VLANs 5-11
Monitoring Management VLANs 5-14
TACACS+ Authentication, Authorization, and Accounting 5-15
Information About TACACS+ Authentication, Authorization, and Accounting 5-15
Login Authentication 5-15
Accounting 5-16

Contents
vii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Privilege-Level Authorization 5-16
Command-Level Authorization 5-17
General AAA Fallback and Recovery Mechanism 5-17
About Configuring TACACS+ 5-18
Configuring the Cisco SCE Platform TACACS+ Client 5-19
Adding a New TACACS+ Server Host 5-19
Removing a TACACS+ Server Host 5-20
Configuring the Global Default Key 5-20
Configuring the Global Default Timeout 5-21
Managing the User Database 5-22
Adding a New User to the Local Database 5-22
Defining the User Privilege Level 5-24
Adding a New User with Privilege Level and Password 5-24
Deleting a User 5-26
Configuring AAA Login Authentication 5-26
Configuring Maximum Login Attempts 5-26
Configuring the AAA Login Authentication Methods 5-27
Configuring AAA Privilege-Level Authorization Methods 5-28
Configuring AAA Command-Level Authorization Methods 5-28
Configuring AAA Accounting 5-29
Monitoring TACACS+ 5-30
Displaying Statistics for TACACS+ Servers 5-30
Displaying Statistics, Keys, and Timeouts for TACACS+ Servers 5-30
Monitoring TACACS+ Users 5-31
Configuring Access Control Lists (ACLs) 5-32
Adding Entries to an ACL 5-33
Removing an ACL 5-33
Defining a Global ACL 5-34
Managing the Telnet Interface 5-35
Preventing Telnet Access 5-35
Assigning an ACL to the Telnet Interface 5-35
Removing ACL Assignment from the Telnet Interface 5-36
Configuring Telnet Timeout 5-36
Configuring the SSH Server 5-37
The SSH Server 5-37
Key Management 5-37
Managing the SSH Server 5-38
Generating a Set of SSH Keys 5-38
Enabling the SSH Server 5-38

Contents
viii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Disabling the SSH Server 5-38
Running Only SSHv2 5-39
Assigning an ACL to the SSH Server 5-39
Removing the ACL Assignment from the SSH Server 5-39
Deleting the Existing SSH Keys 5-39
Monitoring the Status of the SSH Server 5-40
Configuring and Managing the SNMP Interface 5-41
About the SNMP Interface 5-41
SNMP Protocol 5-41
Security Considerations 5-42
About CLI 5-43
About MIBs 5-44
Configuration via SNMP 5-44
Enabling the SNMP Interface 5-45
How to Enable the SNMP Interface 5-45
How to Disable the SNMP Interface 5-45
Configuring SNMP Community Strings 5-45
Defining a Community String 5-46
Removing a Community String 5-46
Displaying the Configured Community Strings 5-47
Configuring SNMP Notifications 5-47
Configuring SNMP Server Group 5-48
Configuring SNMP Server View 5-48
Configuring SNMP Server User 5-49
Defining SNMP Hosts 5-50
Configuring SNMP Traps 5-51
SNMP Walk Acceleration for linkServiceUsage Queries 5-53
How to Enable SNMP Query Acceleration 5-53
SNMPv3 Configuration Example 5-53
CHAPTER 6Global Configuration 6-1
Introduction 6-1
IP Routing Configuration 6-2
Configuring the IP Routing Table 6-2
How to Configure the Default Gateway 6-2
How to Add an Entry to the IP Routing Table 6-3
How to Display the IP Routing Table 6-3
IP Advertising 6-4
Configuring IP Advertising 6-4

Contents
ix
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Display the Current IP Advertising Configuration 6-5
Configuring Time Clocks and Time Zone 6-6
Displaying the System Time 6-6
Displaying the System Time: Example 6-6
Displaying the Calendar Time 6-7
Displaying the Calendar Time: Example 6-7
Setting the System Clock 6-7
Options 6-7
Setting the System Clock: Example 6-7
Setting the Calendar 6-7
Options 6-8
Setting the Calendar: Example 6-8
Setting the Time Zone 6-8
Options 6-8
Setting the Time Zone: Example 6-9
Removing the Current Time Zone Setting 6-9
Configuring Daylight Saving Time 6-9
Options 6-9
Guidelines 6-10
How to Define Recurring Daylight Saving Time Transitions 6-11
How to Define Non-Recurring Daylight Saving Time Transitions 6-11
How to Cancel the Daylight Saving Time Configuration 6-11
How to Display the Current Daylight Saving Time Configuration 6-12
Configuring SNTP 6-13
How to Enable the SNTP Multicast Client 6-13
How to Disable the SNTP Multicast Client 6-14
How to Enable the SNTP Unicast Client 6-14
Options 6-14
Enabling SNTP Unicast Client: Example 6-14
Disabling the SNTP Unicast Client 6-14
How to Disable the SNTP Unicast Client and Remove All Servers 6-14
How to Remove One SNTP Server 6-15
How to Define the SNTP Unicast Update Interval 6-15
Options 6-15
How to Display SNTP Information 6-15
Domain Name Server (DNS) Settings 6-17
Configuring DNS Lookup 6-17
How to Enable DNS Lookup 6-17
How to Disable DNS Lookup 6-17

Contents
x
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Configuring Name Servers 6-18
Options 6-18
How to Define Domain Name Servers 6-18
How to Remove a Domain Name Server 6-18
How to Remove All Domain Name Servers 6-19
How to Add a Host to the Host Table 6-19
Options 6-19
Adding Hosts to Removing them from the Host Table: Example 6-19
How to Display Current DNS Settings 6-19
Displaying Current DNS Settings: Example 6-19
Configuring Cisco Discovery Protocol 6-20
Cisco Discovery Protocol 6-20
Cisco Discovery Protocol on the Cisco SCE 8000 Platform 6-21
CDP Operational Modes on the Cisco SCE 8000 6-21
CDP Limitations on the Cisco SCE 8000 6-22
Configuring CDP on the Cisco SCE 8000 Platform 6-22
Enabling CDP Globally 6-22
Setting CDP Mode 6-23
Enabling CDP on a Specific Traffic Interface 6-23
Setting the Hold Time 6-24
Setting the Timer 6-24
Monitoring and Maintaining CDP 6-25
CDP Configuration Examples 6-27
Example: Setting the CDP Mode 6-27
Example: Monitoring and Maintaining CDP 6-27
Enabling the CLI Interface Warning Banner 6-29
OS Fingerprinting and NAT Detection 6-30
Restrictions and Limitations 6-30
Configuring OS Fingerprinting 6-31
Monitoring OS Fingerprinting 6-33
CHAPTER 7Configuring Line Interfaces 7-1
Introduction 7-1
Line Interfaces 7-2
Information About Line Interfaces 7-2
Flow Control and Bandwidth Considerations 7-2
Maximum Packet Size 7-2
How to Configure the Ten Gigabit Ethernet Line Interfaces 7-2
Changing the Traffic Direction on the Ten Gigabit Ethernet Line Interfaces 7-3

Contents
xi
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Specify the Traffic Direction on Link 1 7-3
Tunneling Protocols 7-4
Tunneling IPv6 Traffic 7-6
Selecting the Tunneling Mode 7-7
Configuring the 6to4 Tunnels 7-8
Configuring DS-Lite Tunnels 7-9
Configuring L2TP Tunnels 7-10
Configuring GRE Tunneling 7-11
Configuring IPinIP Tunneling 7-13
Configuring DSCP Marking 7-14
Configuring the 6to4 Environment 7-15
Configuring the VLAN Environment 7-16
Configuring the MPLS Environment 7-17
Configuring the L2TP Environment 7-18
Asymmetric L2 Support 7-18
Displaying the Tunneling Configuration 7-19
How to Display the 6to4 Configuration 7-19
How to Display the DS-Lite Configuration 7-19
How to Display the IPinIP Configuration 7-20
How to Display the Logged-In VPNs 7-20
Options 7-20
How to Display the Asymmetric L2 Support Mode 7-21
Managed VPNs 7-22
Monitoring VPN Support 7-23
Displaying VPN-related Mappings 7-23
Configuring Traffic Rules and Counters 7-26
Traffic Rules and Counters 7-26
What are Traffic Rules and Counters? 7-26
Traffic Rules 7-27
Traffic Counters 7-27
Configuring Traffic Counters 7-28
How to Create a Traffic Counter 7-28
How to Delete a Traffic Counter 7-28
How to Delete all Existing Traffic Counters 7-28
Configuring Traffic Rules 7-29
How to Create a Traffic Rule for IPv4 Addresses 7-29
How to Create a Traffic Rule for IPv6 Addresses 7-32
How to Delete a Traffic Rule 7-33
How to Delete All Traffic Rules 7-33

Contents
xii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Delete All Flow Control Traffic Rules 7-34
Managing Traffic Rules and Counters 7-34
How to View a Specified Traffic Rule 7-34
How to View All Traffic Rules 7-34
How to View a Specified Traffic Counter 7-34
How to View All Traffic Counters 7-35
How to Reset a Specified Traffic Counter 7-35
How to Reset All Traffic Counters 7-35
DSCP Marking 7-36
How to Display the DSCP Marking Configuration 7-36
Counting Dropped Packets 7-37
About Counting Dropped Packets 7-37
Disabling the Hardware Packet Drop 7-37
CHAPTER 8Configuring the Connection 8-1
Introduction 8-1
Configuring the Connection Mode 8-2
Options 8-2
Configuring the Connection Mode Examples 8-3
Monitoring the Connection Mode and Related Parameters 8-4
Connection Mode Examples 8-4
Configuring the Link Mode 8-6
About the Link Mode 8-6
Options 8-6
External Optical Bypass 8-7
How to Activate the External Bypass 8-7
How to Deactivate the External Bypass 8-8
How to Set the External Bypass to the Default State 8-8
How to Display the State of the External Bypass 8-8
Hardware Bypass 8-9
How to Enable the Hardware Bypass Mode 8-9
How to Disable the Hardware Bypass Mode 8-10
How to Display the Status of the Hardware Bypass Mode 8-10
How to Set the Hardware Bypass Status for a Static Party 8-10
How to Reset the Hardware Bypass Staus of a static party 8-10
How to Display the Hardware Bypass Status of a Static Party 8-11
How to Display the Startup Configuration Party Database 8-11
How to Display the Currently Running Party Database Configuration 8-12

Contents
xiii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Copy the Running Configuration Party Database to the Startup Configuration Party
Database 8-12
How to Copy the Startup Configuration Party Database and Create a Backup File 8-12
Configuring the Static Subscribers 8-13
How to the Set the IP Address for a Static Subscriber 8-13
How to Set the IP Range for a Static Subscriber 8-13
How to Display All Mappings to Dual Stack Static Subscriber 8-13
How to Display IPv6 Mappings to Dual Stack Static Subscriber 8-14
How to Display Dual Stack Static Subscriber 8-14
Link Failure Reflection 8-15
How to Enable Link Failure Reflection 8-15
How to Disable Link Failure Reflection 8-15
Enabling and Disabling Link Failure Reflection on All Ports 8-15
Options 8-16
How to Enable Link Failure Reflection on All Ports 8-16
How to Disable Link Failure Reflection on All Ports 8-16
Configuring Link Failure Reflection in Linecard-Aware Mode 8-16
How to Enable Linecard-Aware Mode 8-17
How to Disable Linecard-Aware Mode 8-17
Asymmetric Routing Topology 8-18
Asymmetric Routing and Other Service Control Capabilities 8-18
Enabling Asymmetric Routing 8-18
Monitoring Asymmetric Routing 8-19
Monitoring Asymmetric Routing: Example 8-19
Configuring a Forced Failure 8-20
Configuring the Failure Recovery Mode 8-21
Options 8-21
Configure the Failure Recovery Mode: Examples 8-21
Configuring the Cisco SCE Platform/SM Connection 8-22
Configuring the Behavior of the Cisco SCE Platform in Case of Failure of the SM 8-22
Options 8-22
Configuring the SM-SCE Platform Connection Timeout 8-22
Options 8-23
CHAPTER 9Raw Data Formatting: The RDR Formatter and NetFlow Exporting 9-1
Introduction 9-1
RDR Formatter and NetFlow Exporting Support 9-2
The RDR Formatter 9-2
NetFlow 9-2

Contents
xiv
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
NetFlow Terminology 9-2
NetFlow Exporting Support 9-3
Data Destinations 9-4
Categories 9-5
Priority 9-5
Setting DSCP for NetFlow 9-6
Forwarding Modes 9-6
Protocol 9-6
Transport Type 9-6
Configuring Data Destinations and Categories 9-7
Configuring a Data Destination 9-7
Options 9-7
Configuring the Data Destinations: Examples 9-7
Configuring the Data Categories 9-8
Configuring the Buffer Size 9-9
Configuring a Destination and Assigning Categories 9-9
Configuring the Forwarding Mode 9-13
Options 9-13
Configuring the Forwarding Mode: Example 9-13
Configuring the RDR Formatter 9-14
Options 9-14
How to Configure the Size of the RDR Formatter History Buffer 9-14
Configuring NetFlow Exporting Support 9-15
Options 9-15
How to Configure a DSCP Value for NetFlow 9-15
Options 9-15
How to Configure the Template Refresh Interval 9-15
Options 9-15
Configuring Dynamic Mapping of RDRs to Categories 9-17
Configuring Mappings 9-17
Options 9-17
How to Restore the Default Mapping for a Specified RDR Tag 9-17
Displaying Data Destination Configuration and Statistics 9-18
How to the Display the Current RDR Formatter Configuration 9-18
Displaying the RDR Formatter Configuration: Example 9-19
How to the Display the Current RDR Formatter Statistics 9-19
Displaying the Current RDR Formatter Statistics: Example 9-19
Disabling the Linecard from Sending RDRs 9-21
Disabling RDR Aggregation 9-22

Contents
xv
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
CHAPTER 10 Managing Subscribers 10-1
Introduction 10-1
Information About Subscribers 10-2
What is a Subscriber? 10-2
Subscriber Modes in Service Control Solutions 10-3
Subscriber Database: Capacity and Limits 10-4
Working with Large Numbers of Subscribers 10-5
Actual Maximum Number of Subscribers 10-5
Subscriber Mapping Limits 10-5
Rate of Creating Anonymous Subscribers 10-5
Aging Subscribers 10-5
VPN-Based Subscribers 10-6
Automatic VLAN VPNs 10-6
Synchronizing Subscriber Information in a Cascade System 10-6
Anonymous Groups and Subscriber Templates 10-7
Subscriber Files 10-8
Subscriber Default csv File Format 10-8
IPv6 Subscriber csv File Format 10-9
Here is an example of a subscriber csv file in the default format: 10-9
Subscriber Anonymous Groups csv File Format 10-9
Importing and Exporting Subscriber Information 10-10
Editing the subaware.pro File 10-10
Options 10-11
How to Import Subscriber Information 10-11
How to Export Subscriber Information 10-11
How to Import a Subscriber Template 10-12
How to Export a Subscriber Template 10-12
Removing Subscribers and Templates 10-13
How to Remove a Specific Subscriber 10-13
Options 10-13
How to Remove All Introduced Subscribers 10-14
How to Remove a Specific Anonymous Subscriber Group 10-14
Options 10-14
How to Remove All Anonymous Subscriber Groups 10-14
How to Remove All the Anonymous Subscribers 10-14
How to Remove All Subscriber Templates 10-15
Removing VPN-based Subscribers 10-15
How to Remove Subscribers by Device 10-15
How to Remove Subscribers from the SM 10-15

Contents
xvi
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Remove Subscribers from a Specified SCMP Peer Device 10-17
Creating Anonymous Groups 10-18
Defining Anonymous Groups 10-18
How to Define an Anonymous Group 10-18
Importing and Exporting Anonymous Groups 10-19
How to Import Anonymous Groups 10-19
How to Export Anonymous Groups 10-19
Monitoring Subscribers 10-20
How to Monitor the Subscriber Database 10-20
How to Display the Subscriber Database Counters 10-21
Clearing the Subscriber Database Counters 10-22
Displaying Subscribers 10-22
Displaying Subscribers: All Current Subscriber Names 10-22
Displaying Subscribers: By Subscriber Property or Prefix 10-23
How to Display Subscribers: By Mapping (IP Address, VPN, or VLAN ID) 10-25
How to Display Subscriber Information 10-27
How to Display a Listing of Subscriber Properties 10-28
How to Display Complete Information for a Specified Subscriber 10-28
How to Display Values of Subscriber Properties for a Specified Subscriber 10-28
How to Display Mappings for a Specified Subscriber 10-28
How to Display OS Counters for a Specified Subscriber 10-29
Displaying Anonymous Subscriber Information 10-29
How to Display Currently Configured Anonymous Groups 10-29
How to Display Currently Configured Templates for Anonymous Groups 10-30
How to Display Current Configuration for a Specified Anonymous Group 10-30
How to Display Subscribers in a Specified Anonymous Group 10-30
How to Display All Subscribers Currently in Anonymous Groups 10-30
How to Display the Number of Subscribers in a Specified Anonymous Group 10-31
How to Display the Total Number of Subscribers in All Anonymous Groups 10-31
Configuring the Actual Maximum Number of Subscribers 10-32
How to Override the Configured Capacity Option 10-32
How to Override the Configured Capacity Option in a Cascade Setup 10-32
How to Restore the Configured Capacity Option 10-33
How to Monitor the Maximum Number of Subscribers 10-33
Configuring Subscriber Aging 10-34
How to Enable Aging for Anonymous Group Subscribers 10-34
How to Enable Aging for Introduced Subscribers 10-34
How to Disable Aging for Anonymous Group Subscribers 10-34
How to Disable Aging for Introduced Subscribers 10-35

Contents
xvii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Set the Aging Timeout Period for Anonymous Group Subscribers 10-35
Options 10-35
How to Set the Aging Timeout Period for Introduced Subscribers 10-35
Options 10-35
How to Display Aging for Anonymous Group Subscribers 10-35
How to Display Aging for Introduced Subscribers 10-36
Managing VPNs and VPN Subscriber Mappings 10-37
How to Display VPN-Related Mappings 10-37
How to Clear Automatic VPNs 10-37
Configuring the Cisco SCE Platform/SM Connection 10-39
Configuring the Behavior of the Cisco SCE Platform in Case of Failure of the SM 10-39
Options 10-39
Configuring the SM-SCE Platform Connection Timeout 10-40
Options 10-40
CHAPTER 11 Redundancy and Failover 11-1
Introduction 11-1
Redundancy and Failover 11-2
Terminology and Definitions 11-2
Redundant Topologies 11-2
External Bypass 11-3
Hardware Bypass 11-3
In-line Dual Link Redundant Topology 11-3
Failure Detection 11-3
Link Failure Reflection 11-5
Hot Standby and Failover 11-6
Hot Standby 11-6
Failover 11-6
Hardware Crash Mode 11-8
Failure in the Cascade Connection 11-9
Installing a Cascaded System 11-9
Recovery 11-11
Replacing the Cisco SCE Platform (Manual Recovery) 11-11
Manual Steps 11-11
Automatic Steps (in parallel with the manual steps, requires no user intervention): 11-12
Reboot Only (Fully Automatic Recovery) 11-12
CLI Commands for Cascaded Systems 11-13
Topology-Related Parameters for Redundant Topologies 11-13
Configuring the Connection Mode 11-13

Contents
xviii
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Examples 11-14
Monitoring the System 11-14
How to View the Current Connection Mode 11-14
How to View the Cisco SCE-ID 11-15
How to View the Current Redundancy Status of the Cisco SCE Platform 11-15
How to View Information about the Peer Cisco SCE Platform 11-15
How to View Information about the Cascade Connections 11-16
How to View the Current Link to Port Mappings 11-16
How to View the Current Link Mode 11-17
Configuring Forced Failure 11-18
System Upgrades 11-19
Firmware Upgrade (package installation) 11-19
Application Upgrade 11-19
Simultaneous Upgrade of Firmware and Application 11-20
CHAPTER 12 Identifying and Preventing Distributed Denial-of-Service Attacks 12-1
Introduction 12-1
Attack Filtering and Attack Detection 12-2
Attack Filtering 12-2
Specific Attack Filtering 12-2
Attack Detection 12-4
Attack Detection Thresholds 12-4
Attack Handling 12-5
Subscriber Notification 12-6
Hardware Filtering 12-6
Configuring Attack Detectors 12-8
Enabling Specific-IP Detection 12-10
Options 12-10
How to Enable Specific-IP Detection 12-10
How to Enable Specific-IP Detection for the TCP Protocol Only for all Attack Directions 12-11
How to Enable Specific-IP Detection for the TCP Protocol for Port-Based Detections Only for
Dual-Sided Attacks 12-11
How to Disable Specific-IP Detection for Protocols Other than TCP, UDP, and ICMP for all Attack
Directions 12-11
How to Disable Specific-IP Detection for ICMP for Single-Sided Attacks Defined by the Source
IP 12-11
Configuring the Default Attack Detector 12-11
Options 12-12
How to Define the Default Action and Optionally, the Default Thresholds 12-13
How to Reinstate the System Defaults for a Selected Set of Attack Types 12-13

Contents
xix
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to Reinstate the System Defaults for All Attack Types 12-14
Specific Attack Detectors 12-14
Options 12-14
How to Enable a Specific Attack Detector and Assign it an ACL 12-15
How to Define the Action and Optionally the Thresholds for a Specific Attack Detector 12-16
How to Define the Subscriber Notification Setting for a Specific Attack Detector 12-16
How to Define the SNMP Trap Setting for a Specific Attack Detector 12-16
How to Define the List of Destination Ports for TCP or UDP Protocols for a Specific Attack
Detector 12-17
How to Delete User-Defined Values 12-17
How to Disable a Specific Attack Detector 12-17
How to Disable All Non-default Attack Detectors 12-18
How to Disable All Attack Detectors 12-18
Sample Attack Detector Configuration 12-18
Subscriber Notifications 12-20
Configuring the Subscriber Notification Port 12-20
Options 12-20
How to Remove the Subscriber Notification Port 12-20
Preventing and Forcing Attack Detection 12-21
Options 12-21
Preventing Attack Filtering 12-21
How to Remove All dont-filter Settings 12-22
Forcing Attack Filtering 12-22
How to Remove All force-filter Settings 12-23
Monitoring Attack Filtering 12-24
Monitoring Attack Filtering Using SNMP Traps 12-24
Monitoring Attack Filtering Using CLI Commands 12-26
How to Display a Specified Attack Detector Configuration 12-26
How to Display the Default Attack Detector Configuration 12-28
How to Display All Attack Detector Configurations 12-28
How to Display Filter State (Enabled or Disabled) 12-29
How to Display Configured Threshold Values and Actions 12-29
How to Display the Current Counters 12-30
How to Display all Currently Handled Attacks 12-31
How to Display all Existing Force-Filter Settings 12-31
How to Display all Existing Don't-Filter Settings 12-31
How to Display the List of Ports Selected for Subscriber Notification 12-31
How to Find out Whether Hardware Attack Filtering has been Activated 12-32
Viewing the Attack Log 12-32
The Attack Log 12-32

Contents
xx
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
How to View the Attack Log 12-33
How to Copy the Attack Log to a File 12-33
CHAPTER 13 Managing the SCMP 13-1
Introduction 13-1
About SCMP 13-2
SCMP Terminology 13-3
Deployment Scenarios 13-3
Single ISG Router with a Single Cisco SCE Platform (1xISG – 1xCisco SCE) 13-4
Single ISG Router with Two Cascaded Cisco SCE Platforms (1xISG – 2xCisco SCE) 13-4
Multiple ISG Routers with Two Cascaded Cisco SCE Platforms (NxISG – 2xCisco SCE) 13-5
Multiple ISG Routers with Multiple Cisco SCE Platforms via Load Balancing (NxISG – MxCisco
SCE) 13-6
SCMP Peer Devices 13-7
Connection Management 13-7
SCMP Subscriber Management 13-8
GUID and Subscriber ID 13-8
Configuring the SCMP 13-9
Configuring SCMP Parameters 13-9
How to Enable the SCMP 13-9
How to Disable the SCMP 13-10
How to Configure the SCMP Peer Device to Push Sessions 13-10
Configuring the SCMP Peer Device to Force Each Subscriber to Single Cisco SCE Platform 13-10
Defining the Keep-alive Interval Parameter 13-11
Defining the Reconnect Interval Parameter 13-11
Defining the Loss-of-Sync Timeout Parameter 13-12
Adding an SCMP Peer Device 13-12
How to Define an SCMP Peer Device 13-12
How to Assign the SCMP Peer Device to an Anonymous Group 13-13
Deleting Subscribers Managed by an SCMP Peer Device 13-14
Options 13-14
Deleting an SCMP Peer Device 13-14
Defining the Subscriber ID 13-14
Options 13-15
Configuring the RADIUS Client 13-15
Options 13-16
Monitoring the SCMP Environment 13-17
How to Monitor the SCMP 13-17
Options 13-17