SCE Software Configuration Guide

When you enter configuration commands, it immediately effects the SCE platform operation and configuration. This configuration, referred to as the running-config, is saved in the SCE platform volatile memory and is effective while the SCE platform is up. After reboot, the SCE platform loads the startup-config, which includes the non-default configuration as saved by the user, into the running-config.

The SCE platform provides commands for:

After configuring the SCE platform, you may query for the running configuration using the command show running-config. This command displays the non-default running configuration. To view all SCE platform running configuration, whether it is the default or not, you may use the option all-data in the show running-config command.

You can completely remove all current configuration by removing all configuration files. The following data is deleted by this command:

When you make changes to the current running configuration and you want those changes to continue to be valid when the system restarts, you must save the changes before leaving the management session, that is, you must save the running configuration to the startup configuration file.

The SCE platform provides multiple interfaces for the purpose of configuration and management. All interfaces supply an API to the same database of the SCE platform and any configuration made through one interface is reflected through all interfaces. Furthermore, when saving the running configuration to the startup configuration from any management interface, all configuration settings are saved regardless of the management interface used to set the configuration.

Example:

The following example shows the running configuration file.

For backup purposes, the old startup-config file is saved under the directory: tffs0:system/prevconf. Refer to Recovering a Previous Configuration for an explanation on how to recover previous configuration.

To remove a configuration command from the running-config, use the no form of the command.

Example:

The following example illustrates how to remove all DNS settings from the running configuration.

When you save a new configuration, the system automatically backs up the old configuration in the directory tffs0:system/prevconf/. Up to nine versions of the startup configuration file are saved, namely config.tx1-config.tx9, where config.tx1 is the most recently saved file.

You can view the old startup configuration files using the CLI command more.

Restoring a previous startup configuration means renaming the file so it overwrites the startup configuration (config.txt) file.

Example:

The following example displays a saved configuration file and then restores the file to overwrite the current configuration.

Although a backup of the configuration file is created automatically under certain circumstances, it is useful to be able to explicitly create a backup configuration file.

For example, it can be used in a cascaded solution to copy the configuration from one SCE platform to the other, as follows:

The following option is available:

Example:

The following example shows how to copy the configuration from one SCE platform to another.

On the first SCE platform, enter the following command:

On the second SCE platform, enter the following command:

Use the following commands to install, uninstall, and upgrade an application. You can use the show pqi file info command before installing or upgrading an application to display the options that are available when installing the pqi file. These options can then be specified in the install or upgrade command as needed.

The documentation of the application will tell the user whether the application is stand-alone (in which case install should be used), or an upgrade to an existing application that is assumed to be installed already (in this case upgrade should be used). Currently all Cisco Service Control applications are stand-alone.

You should always run the pqi uninstall command before installing a new pqi file. This prevents old files from accumulating on the disk.

The following commands are relevant for installing and uninstalling an application:

Rebooting the SCE platform is required after installing a new firmware, in order for that firmware to take effect. There might be other occasions where rebooting the SCE platform is necessary.

Example:

The following example shows the commands for system reboot.

Shutting down the SCE platform is required before turning the power off. This helps to ensure that non-volatile memory devices in the SCE platform are properly flushed in an orderly manner.

Example:

The following example shows the commands for system shutdown.

When explicitly invoked, the setup utility offers the option of multiple entries (lists) for certain parameters.

Several parameters, such as the Access Control Lists, are actually lists containing a number of entries. If these lists are empty (initial configuration) or contain only one entry, they act the same as any scalar parameter, except that you are giving the option of adding additional entries to the list.

If these lists already contain more than one entry, the entire list is displayed, and you are then presented with several options. Following is an excerpt from the SNMP trap manager menu, illustrating how to configure list entries.

The following file-system operations commands are relevant to directories:

cd
delete
dir
mkdir
pwd
rmdir
Creating a Directory
To create a directory, use the following command::
From the SCE# prompt, type mkdir directory-name and press Enter.
Deleting a Directory
There are two different commands for deleting a directory, depending on whether the directory is empty or not.
To delete a directory and all its files and sub-directories, use the following command::
From the SCE# prompt, type delete directory-name /recursive and press Enter.
To delete an empty directory, use the following command::
From the SCE# prompt, type rmdir directory-name and press Enter.
Changing Directories
To change the path of the current working directory, use the following command::
From the SCE# prompt, type cd new path and press Enter.
Displaying Working Directory
To display the current working directory, use the following command::
From the SCE# prompt, type pwd and press Enter.
Listing Files in Current Directory
You can display a listing of all files in the current working directory. This list may be filtered to include only application files. The listing may also be expanded to include all files in any sub-directories.
To list all the files in the current directory, use the following command::
From the SCE# prompt, type dir and press Enter.
To list all the applications in the current directory, use the following command::
From the SCE# prompt, type dir applications and press Enter.
To include files in all sub-directories in the listing of the current directory, use the following command::
From the SCE# prompt, type dir -r and press Enter.

The following file-system operations commands are relevant to files:

Events are logged to one of two log files. After a file reaches maximum capacity, the events logged in that file are then temporarily archived. New events are then automatically logged to the alternate log file. When the second log file reaches maximum capacity, the system then reverts to logging events to the first log file, thus overwriting the temporarily archived information stored in that file.

Basic operations include:

In order for technical support to be most effective, the user should provide them with the information contained in the system logs. Use the logger get support-file command to generate a support file for the use of Cisco technical support staff.

The user must define the IP address of the management interface.

When both management ports are connected, providing a redundant management port, this IP address always acts as a virtual IP address for the currently active management port, regardless of which port is the active port.

The following options are available:

Example:

The following example shows how to set the IP address of the SCE platform to 10.1.1.1 and the subnet mask to 255.255.0.0.

This section presents sample procedures that describe how to configure the speed and the duplex of the Management Interface.

Both these parameters must be configured separately for each port.

SCE(config if)#speed 100

SCE(config if)#duplex half

This command explicitly specifies which management port is currently active. Its use varies slightly, depending on whether the management interface is configured as a redundant interface (auto fail-over enabled) or not (auto fail-over disabled)

The following options are available:

Example:

The following example shows how to use this command to configure Mng port 2 as the currently active management port.

Use the following command to enable automatic fail-over. The automatic mode must be enabled to support management interface redundancy. This mode automatically switches to the backup management link when a failure is detected in the currently active management link.

This parameter can be configured when in management interface configuration mode for either management port, and is applied to both ports with one command.

The following options are available:

When the automatic fail-over mode is disabled, by default Mng port 1 is the active port. If Mng port 2 will be the active port, it must be explicitly configured as such (see Specifying the Active Management Port.)

The procedure for configuring management port security is explained in the following sections:

Use this command to display the following information for management interface IP filtering.

TACACS+ is a security application that provides centralized authentication of users attempting to gain access to a network element. The implementation of TACACS+ protocol allows customers to configure one or more authentication servers for the SCE platform, providing a secure means of managing the SCE platform, as the authentication server will authenticate each user. This then centralizes the authentication database, making it easier for the customers to manage the SCE platform.

TACACS+ services are maintained in a database on a TACACS+ server running, typically, on a UNIX or Windows NT workstation. You must have access to and must configure a TACACS+ server before the configured TACACS+ features on your network element are available.

The TACACS+ protocol provides authentication between the network element and the TACACS+ ACS, and it can also ensure confidentiality, if a key is configured, by encrypting all protocol exchanges between a network element and a TACACS+ server.

The following is a summary of the procedure for configuring TACACS+. All steps are explained in detail in the remainder of this section.

The TACACS+ protocol provides the following three features:

The SCE platform can be configured with Access Control Lists (ACLs), which are used to permit or deny incoming connections on any of the management interfaces. An access list is an ordered list of entries, each consisting of an IP address and an optional wildcard “mask” defining an IP address range, and a permit/deny field.

The order of the entries in the list is important. The default action of the first entry that matches the connection is used. If no entry in the Access List matches the connection, or if the Access List is empty, the default action is deny.

Creating an access list is done entry by entry, from the first to the last.

When the system checks for an IP address on an access list, the system checks each line in the access list for the IP address, starting at the first entry and moving towards the last entry. The first match that is detected (that is, the IP address being checked is found within the IP address range defined by the entry) determines the result, according to the permit/deny flag in the matched entry. If no matching entry is found in the access list, access is denied.

You can create up to 99 access lists. Access lists can be associated with system access on the following levels:

It is possible to configure several management interfaces to the same access list, if this is the desired behavior of the SCE platform.

If no ACL is associated to a management interface or to the global IP level, access is permitted from all IP addresses.

The following commands are relevant to access lists:

access-list
access-class number in
ip access-class
no access-list
no ip access-class
show ip access-class
Adding Entries to an Access List
To add an address to an access list allowing access to a particular address, complete the following steps:
To enter the Global Configuration Mode, type configure and press Enter. 
The SCE(config)# prompt appears.
To configure one IP address type:
access-list number permit x.x.x.x and press Enter where x.x.x.x is the IP address. 
To configure more than one IP address type:
access-list number permit x.x.x.x y.y.y.y and press Enter.
This command configures a range of addresses in the format x.x.x.x y.y.y.y where x.x.x.x specifies the prefix bits common to all IP addresses in the range, and y.y.y.y is a wildcard-bits mask specifying the bits that are ignored. In this notation, ‘0’ means bits to ignore.
Example:
The following example adds an entry to the access list number 1, that permits access only to IP addresses in the range of 10.1.1.0–10.1.1.255. 
SCE(config)#access-list 1 permit 10.1.1.0 0.0.0.255

You can also add addresses from which you deny service, by using the deny rather than the permit switch. You can create up to 99 different address lists, which can be associated with access to the interfaces.

When you add a new entry to an ACL, it is always added to the end of the Access-List.

Each SSH server should define a set of keys (DSA2, RSA2 and RSA1) to be used when communicating with various clients. The key sets are pairs of public and private keys. The server publishes the public key while keeping the private key in non-volatile memory, never transmitting it to SSH clients. Note that the keys are kept on the tffs0 file system, which means that a person with knowledge of the ‘enable’ password can access both the private and public keys. The SSH server implementation provides protection against eavesdroppers who can monitor the management communication channels of the SCE platform, but it does not provide protection against a user with knowledge of the ‘enable’ password.

Key management is performed by the user via a special CLI command. A set of keys must be generated at least once before enabling the SSH server.

Size of the encryption key is always 2048 bits.

Use these commands to manage the SSH server. These commands do the following:

Remember that you must generate a set of SSH keys before you enable the SSH server.

Use this command to monitor the status of the SSH sever, including current SSH sessions.

This command is a Privileged Exec command. Make sure that you are in Privileged Exec command mode by exiting any other modes, and that the SCE# prompt appears in the command line.