![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() |
Table Of Contents
Configuring System Management Functions
Configuring Terminal Lines and Modem Support (Catalyst 8540 MSR)
Configuring Terminal Lines and Modem Support (Catalyst 8510 MSR and LightStream 1010)
Configuring Cisco Discovery Protocol
Configuring Load Statistics Interval
Configuring Login Authentication
Configuring Scheduler Attributes
Configuring the Privilege Level
Configuring Privilege Level (Global)
Configuring Privilege Level (Line)
Configuring the Network Time Protocol
Displaying the NTP Configuration
Configuring the Clock and Calendar
Enabling TACACS and Extended TACACS
Configuring AAA Access Control with TACACS+
Configuring PPP Authentication
Testing the System Management Functions
Checking Basic Connectivity (Catalyst 8540 MSR)
Checking Basic Connectivity (Catalyst 8510 MSR and LightStream 1010)
Configuring System Management Functions
This chapter describes the basic tasks for configuring general system features, such as access control and basic switch management.
Note
This chapter provides advanced configuration instructions for the Catalyst 8540 MSR, Catalyst 8510 MSR, and LightStream 1010 ATM switch routers. For complete descriptions of the commands mentioned in this chapter, refer to the ATM Switch Router Command Reference publication.
The following sections describe basic tasks for configuring general system features, such as access control and basic switch management tasks:
•
Configuring the Privilege Level
•
Configuring the Network Time Protocol
•
Configuring the Clock and Calendar
•
Testing the System Management Functions
System Management Tasks
The role of the administration interface is to provide a simple command-line interface to all internal management and debugging facilities of the ATM switch router.
Configuring Terminal Lines and Modem Support (Catalyst 8540 MSR)
The Catalyst 8540 MSR has a console terminal line that might require configuration. For line configuration, you must first set up the line for the terminal or the asynchronous device attached to it. For a complete description of configuration tasks and commands used to set up your terminal line and settings, refer to the Dial Solutions Configuration Guide and Dial Solutions Command Reference publications.
You can connect a modem to the console port. The following settings on the modem are required:
•
Enable auto answer mode
•
Suppress result codes
You can configure your modem by setting the dual in-line package (DIP) switches on the modem or by connecting the modem to terminal equipment. Refer to the user manual provided with your modem for the correct configuration information.
Note
Because there are no hardware flow control signals available on the console port, the console port terminal characteristics should match the modem settings.
Configuring Terminal Lines and Modem Support (Catalyst 8510 MSR and LightStream 1010)
The Catalyst 8510 MSR and LightStream 1010 ATM switch routers have two types of terminal lines: a console line and an auxiliary line. For line configuration, you must first set up the lines for the terminals or other asynchronous devices attached to them. For a complete description of configuration tasks and commands used to set up your lines, modems, and terminal settings, refer to the Dial Solutions Configuration Guide and Dial Solutions Command Reference publications.
Configuring Alias
You can create aliases for commonly used or complex commands. Use word substitutions or abbreviations to tailor command syntax. For detailed instructions on performing these tasks, refer to the Configuration Fundamentals Configuration Guide publication.
Configuring Buffers
To make adjustments to initial buffer pool settings and to the limits at which temporary buffers are created and destroyed, use the following global configuration command:
To display the buffer pool statistics, use the following privileged EXEC command:
Configuring Cisco Discovery Protocol
To specify how often your ATM switch router sends Cisco Discovery Protocol (CDP) updates, perform the following tasks in global configuration mode:
To reset CDP traffic counters to zero (0) on your ATM switch router, perform the following tasks in privileged EXEC mode:
Command PurposeStep 1
Switch# clear cdp counters
Clears CDP counters.
Step 2
Switch# clear cdp table
Clears CDP tables.
To show the CDP configuration, use the following privileged EXEC commands:
Configuring Enable Passwords
To log on to the ATM switch router at a specified level, use the following EXEC command:
To configure the enable password for a given level, use the following global configuration command:
Command Purposeenable password [level number] [encryption-type] password
Configures the enable password.
Configuring Load Statistics Interval
To change the length of time for which data is used to compute load statistics, perform the following tasks, beginning in global configuration mode:
Configuring Logging
To log messages to a syslog server host, use the following global configuration commands:
Configuring Login Authentication
To enable TACACS+ authentication for logins, perform the following steps, beginning in global configuration mode:
Command Purposeline [aux | console | vty] line-number [ending-line-number]
Selects the line to configure.
login [local | tacacs]
Configures login authentication.
Configuring Scheduler Attributes
To control the maximum amount of time that can elapse without running the lowest-priority system processes, use the following global configuration commands:
Configuring Services
To configure miscellaneous system services, use the following global configuration commands:
Configuring SNMP
To create or update an access policy, use the following global configuration commands:
To display the SNMP status, use the following EXEC command:
Command Purposeshow snmp
Checks the status of communications between the SNMP agent and SNMP manager.
Username Commands
To establish a username-based authentication system at login, use the following global configuration commands:
Configuring the Privilege Level
This section describes configuring and displaying the privilege level access to the ATM switch router. The access privileges can be configured at the global level or at the line level for a specific line.
Configuring Privilege Level (Global)
To set the privilege level for a command, use the following global configuration command:
To display your current level of privilege, use the following privileged EXEC command:
Configuring Privilege Level (Line)
To set the default privilege level for a line, perform the following steps, beginning in global configuration mode:
To display your current level of privilege, use the following privileged EXEC command:
Configuring the Network Time Protocol
This section describes configuring the Network Time Protocol (NTP) on the ATM switch router.
To control access to the system NTP services, use the following ntp global configuration commands. To remove access control to the system's NTP services, use the no ntp command. See the example configuration at the end of this section and the "Displaying the NTP Configuration" section to confirm the NTP configuration.
To see a list of the NTP commands enter a ? in EXEC configuration mode. The following example shows the list of commands available for NTP configuration:
Switch(config)# ntp ?
access-group Control NTP access
authenticate Authenticate time sources
authentication-key Authentication key for trusted time sources
broadcastdelay Estimated round-trip delay
clock-period Length of hardware clock tick
master Act as NTP master clock
max-associations Set maximum number of associations
peer Configure NTP peer
server Configure NTP server
source Configure interface for source address
trusted-key Key numbers for trusted time sources
update-calendar Periodically update calendar with NTP time
To control access to the system NTP services, use the following global configuration command:
Command Purposentp access-group {query-only | serve-only | serve | peer} access-list-number
Configures an NTP access group.
To enable NTP authentication, perform the following steps in global configuration mode:
Command PurposeStep 1
Switch(config)# ntp authenticate
Enables NTP authentication.
Step 2
Switch(config)# ntp authentication-key number md5 value
Defines an authentication key.
To specify that a specific interface should send NTP broadcast packets, perform the following steps, beginning to global configuration mode:
As NTP compensates for the error in the system clock, it keeps track of the correction factor for this error. The system automatically saves this value into the system configuration using the ntp clock-period global configuration command.
CautionDo not enter the ntp clock-period command; it is documented for informational purposes only. The system automatically generates this command as NTP determines the clock error and compensates.
To prevent an interface from receiving NTP packets, perform the following steps, beginning in global configuration mode:
To configure the ATM switch router as a NTP master clock to which peers synchronize themselves when an external NTP source is not available, use the following global configuration command:
To configure the ATM switch router as a NTP peer that receives its clock synchronization from an external NTP source, use the following global configuration command:
Command Purposentp peer ip-address [version number]
[key keyid] [source interface] [prefer]Configures the system clock to synchronize a peer or to be synchronized by a peer.
To allow the ATM switch router system clock to be synchronized by a time server, use the following global configuration command:
Command Purposentp server ip-address [version number]
[key keyid] [source interface] [prefer]Configures the system clock to allow it to be synchronized by a time server.
To use a particular source address in NTP packets, use the following global configuration command:
Command Purposentp source interface type card/subcard/port
Configures a particular source address in NTP packets.
To authenticate the identity of a system to which NTP will synchronize, use the following global configuration command:
To periodically update the ATM switch router calendar from NTP, use the following global configuration command:
Example
The following example configures the ATM switch router to synchronize its clock and calendar to an NTP server, using ethernet0, and other features:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ntp server 198.92.30.32
Switch(config)# ntp source ethernet0
Switch(config)# ntp authenticate
Switch(config)# ntp max-associations 2000
Switch(config)# ntp trusted-key 22507
Switch(config)# ntp update-calendar
Displaying the NTP Configuration
To show the status of NTP associations, use the following privileged EXEC commands:
Command Purposeshow ntp associations [detail]
Displays NTP associations.
show ntp status
Displays the NTP status.
Examples
The following example displays detail NTP configuration:
Switch# show ntp associations detail
198.92.30.32 configured, our_master, sane, valid, stratum 3
ref ID 171.69.2.81, time B6C04E67.6E779000 (18:18:15.431 UTC Thu Feb 27 1997)
our mode client, peer mode server, our poll intvl 128, peer poll intvl 128
root delay 109.51 msec, root disp 377.38, reach 377, sync dist 435.638
delay -3.88 msec, offset 7.7674 msec, dispersion 1.57
precision 2**17, version 3
org time B6C04F19.437D8000 (18:21:13.263 UTC Thu Feb 27 1997)
rcv time B6C04F19.41018C62 (18:21:13.253 UTC Thu Feb 27 1997)
xmt time B6C04F19.41E3EB4B (18:21:13.257 UTC Thu Feb 27 1997)
filtdelay = -3.88 -3.39 -3.49 -3.39 -3.36 -3.46 -3.37 -3.16
filtoffset = 7.77 6.62 6.60 5.38 4.13 4.43 6.28 12.37
filterror = 0.02 0.99 1.48 2.46 3.43 4.41 5.39 6.36
The following example displays the NTP status:
Switch# show ntp status
Clock is synchronized, stratum 4, reference is 198.92.30.32
nominal freq is 250.0000 Hz, actual freq is 249.9999 Hz, precision is 2**24
reference time is B6C04F19.41018C62 (18:21:13.253 UTC Thu Feb 27 1997)
clock offset is 7.7674 msec, root delay is 113.39 msec
root dispersion is 386.72 msec, peer dispersion is 1.57 msec
Configuring the Clock and Calendar
If no other source of time is available, you can manually configure the current time and date after the system is restarted. The time will remain accurate until the next system restart. Cisco recommends that you use manual configuration only as a last resort.
Note
If you have an outside source to which the ATM switch router can synchronize, you do not need to manually set the system clock.
Configuring the Clock
To configure, read, and set the ATM switch router as a time source for a network based on its calendar, perform the following steps in global configuration mode:
To manually read and set the calendar into the ATM switch router system clock, perform the following steps in privileged EXEC mode:
To display the system clock information, use the following EXEC command:
Configuring the Calendar
To set the system calendar, use the following privileged EXEC command:
To display the system calendar information, use the following EXEC command:
Configuring TACACS
You can configure the ATM switch router to use one of three special TCP/IP protocols related to TACACS: regular TACACS, extended TACACS, or AAA/TACACS+. TACACS services are provided by and maintained in a database on a TACACS server running on a workstation. You must have access to and configure a TACACS server before configuring the TACACS features described in this publication on your Cisco device. Cisco's basic TACACS support is modeled after the original Defense Data Network (DDN) application.
A comparative description of the supported versions follows. Table 4-1 compares the versions by commands.
•
TACACS—Provides password checking, authentication, and notification of user actions for security and accounting purposes.
•
Extended TACACS—Provides information about protocol translator and ATM switch router use. This information is used in UNIX auditing trails and accounting files.
•
AAA/TACACS+—Provides more detailed accounting information as well as more administrative control of authentication and authorization processes.
You can establish TACACS-style password protection on both user and privileged levels of the system EXEC.
Enabling TACACS and Extended TACACS
This section describes the features available with TACACS and extended TACACS. The extended TACACS software is available using FTP (refer to the README file in the ftp.cisco.com directory).
Note
Many original TACACS and extended TACACS commands cannot be used after you have initialized AAA/TACACS+. To identify which commands can be used with the three versions, refer to Table 4-1.
Configuring AAA Access Control with TACACS+
To enable the AAA access control model that includes TACACS+, use the following global configuration command:
Configuring AAA Accounting
To enable the AAA accounting of requested services for billing or security purposes when using TACACS+, perform the following steps in global configuration mode:
Configuring TACACS Server
Refer to the Security Configuration Guide for details about the TACACS configuration tasks that include:
•
Setting the number of login attempts allowed to the TACACS server
•
Enabling extended TACACS mode
•
Configuring a TACACS host
Configuring PPP Authentication
Refer to the Dial Solutions Configuration Guide for details about the PPP Authentication configuration tasks that include:
•
Enabling Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP)
•
Enabling an AAA authentication method on an interface
Testing the System Management Functions
This section describes the commands used to monitor and display the system management functions.
Displaying Active Processes
To display information about the active processes, use the following privileged EXEC commands:
Command Purposeshow processes [cpu]
Displays active processes.
show processes memory
Displays memory utilization.
Displaying Protocols
To display the configured protocols, use the following privileged EXEC command:
Displaying Stacks
To monitor the stack utilization of processes and interrupt routines, use the following privileged EXEC command:
The show stacks display includes the reason for the last system reboot. If the system was reloaded because of a system failure, a saved system stack trace is displayed. This information is of use only to Cisco engineers analyzing crashes in the field. It is included here in case you need to read the displayed statistics to an engineer over the phone.
Displaying Routes
To discover the IP routes that the ATM switch router packets will actually take when traveling to their destination, use the following EXEC command:
Displaying Environment
To display temperature and voltage information on the ATM switch router console, use the following EXEC command:
Checking Basic Connectivity (Catalyst 8540 MSR)
To diagnose basic ATM network connectivity on the Catalyst 8540 MSR, use the following privileged EXEC command:
Command Purposeping atm interface atm card/subcard/port vpi [vci] {end-loopback [destination] | ip-address ip-address | seg-loopback [destination]}
Uses ping to check the ATM network connection.
Checking Basic Connectivity (Catalyst 8510 MSR and LightStream 1010)
To diagnose basic ATM network connectivity on the Catalyst 8510 MSR and LightStream 1010 ATM switch routers, use the following privileged EXEC command:
Posted: Mon Oct 11 09:18:51 PDT 2004
All contents are Copyright © 1992--2004 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.