Ultra Gateway Platform System Administration Guide, Release 6.4
Total Page:16
File Type:pdf, Size:1020Kb
Ultra Gateway Platform System Administration Guide, Release 6.4 First Published: 2018-11-02 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) © 2018 Cisco Systems, Inc. All rights reserved. CONTENTS PREFACE About this Guide xxix Conventions Used xxix Related Documentation xxxi Contacting Customer Support xxxi CHAPTER 1 Ultra Services Platform (USP) Introduction 1 USP Introduction 1 USP Architecture 2 USP VNF Architecture 3 Ultra Element Manager (UEM) 3 Life Cycle Manager 6 Service Configuration Manager 7 Service Level Agreement Manager 8 Control Function 10 Service Function 11 Network Function 12 Application Function 13 USP VNF Types 14 Ultra Gateway Platform 15 Ultra Service Framework 15 Ultra Automation Services 16 AutoIT-NFVI 18 AutoIT-VNF 19 AutoIT 19 AutoDeploy 22 AutoVNF 24 Ultra Gateway Platform System Administration Guide, Release 6.4 iii Contents Ultra Web Services 27 USP VNF Component Redundancy and Availability 28 Platform Requirements 28 UEM Redundancy 28 CF Redundancy 29 SF Redundancy 29 NF Redundancy 30 AF Redundancy 30 Ultra Service Component (USC) Redundancy 30 ICSR Support 30 CHAPTER 2 Introduction to UGP 31 Product Description 31 Hypervisor Requirements 31 Underlying Infrastructure for the System 31 DI Network 33 Network Requirements 34 Jumbo Frames 35 Record Storage 36 Orchestration Network 36 Service Network 36 Packet Flows 36 Packets Received on SF Demux VM 36 Packets Received on SF Session VM 37 DPDK Internal Forwarder 38 Bandwidth Requirements 39 Feature Set 40 Interfaces and Addressing 40 Encryption 41 Security 41 Orchestration 41 Provisioning 42 Boot Sequence 42 CF Boot Sequence 42 Ultra Gateway Platform System Administration Guide, Release 6.4 iv Contents SF Boot Sequence 43 Capacity, CEPS and Throughput 43 Diagnostics and Monitoring 43 Cisco Prime Analytics 43 StarOS UGP Build Components 44 Software Installation and Network Deployment 44 CHAPTER 3 System Operation and Configuration 45 Terminology 45 Contexts 45 Logical Interfaces 45 Management Interface 46 Bindings 46 Services 46 AAA Servers 47 Subscribers 47 How the System Selects Contexts 48 Context Selection for Context-level Administrative User Sessions 48 Context Selection for Subscriber Sessions 51 Understanding Configuration Files 51 IP Address Notation 52 IPv4 Dotted-Decimal Notation 52 IPv6 Colon-Separated-Hexadecimal Notation 53 CIDR Notation 53 Alphanumeric Strings 54 Character Set 54 Quoted Strings 55 CHAPTER 4 Getting Started 57 Initial StarOS Configuration 57 Using the StarOS CLI for Initial Configuration 57 Configuring System Administrative Users 59 Limiting the Number of Concurrent CLI Sessions 59 Automatic Logout of CLI Sessions 60 Ultra Gateway Platform System Administration Guide, Release 6.4 v Contents Configuring the System for Remote Access 60 Configuring SSH Options 62 SSH Host Keys 63 Setting SSH Key Size 63 Configuring SSH Key Generation Wait Time 64 Specifying SSH Encryption Ciphers 64 Generating SSH Keys 65 Setting SSH Key Pair 65 Authorized SSH User Access 66 Authorizing SSH User Access 66 SSH User Login Restrictions 66 Creating an Allowed Users List 67 SSH User Login Authentication 67 Secure Session Logout 68 Changing Default sshd Secure Session Logout Parameters 69 SSH Client Login to External Servers 69 Setting SSH Client Ciphers 69 Setting Preferred Authentication Methods 70 Generating SSH Client Key Pair 71 Pushing an SSH Client Public Key to an External Server 71 Enabling NETCONF 72 Configuring the Management Interface with a Second IP Address 72 VM Hardware Verification 73 CHAPTER 5 System Settings 75 Verifying and Saving Your Interface and Port Configuration 75 Configuring System Timing 76 Setting the System Clock and Time Zone 76 Verifying and Saving Your Clock and Time Zone Configuration 76 Configuring Network Time Protocol Support 77 Configuring NTP Servers with Local Sources 78 Using a Load Balancer 78 Verifying the NTP Configuration 78 Configuring Software RSS 80 Ultra Gateway Platform System Administration Guide, Release 6.4 vi Contents DI-Network RSS Encryption 80 Feature Summary and Revision History 80 Feature Changes 81 Command Changes 81 Configuring SF Boot Configuration Pause 81 Enabling CLI Timestamping 82 Configuring CLI Confirmation Prompts 82 Enabling Automatic Confirmation 82 Requiring Confirmation for autoconfirm and configure Commands 83 Requiring Confirmation for Specific Exec Mode Commands 83 Configuring System Administrative Users 84 User Name Character Restrictions 85 Configuring Context-level Administrative Users 85 Configuring Context-level Security Administrators 85 Configuring Context-level Administrators 86 Configuring Context-level Operators 86 Configuring Context-level Inspectors 87 Segregating System and LI Configurations 87 Verifying Context-level Administrative User Configuration 88 Configuring Local-User Administrative Users 89 Verifying Local-User Configuration 89 Updating Local-User Database 89 Updating and Downgrading the local-user Database 90 Restricting User Access to a Specified Root Directory 91 Configuring an SFTP root Directory 91 Associating an SFTP root Directory with a Local User 91 Associating an SFTP root Directory with an Administrator 91 Associating an SFTP root Directory with a Config Administrator 92 Configuring TACACS+ for System Administrative Users 92 Operation 92 User Account Requirements 93 TACACS+ User Account Requirements 93 StarOS User Account Requirements 94 Configuring TACACS+ AAA Services 94 Ultra Gateway Platform System Administration Guide, Release 6.4 vii Contents Configuring TACACS+ for Non-local VPN Authentication 95 Verifying the TACACS+ Configuration 95 Separating Authentication Methods 96 Disable TACACS+ Authentication for Console 96 Disable AAA-based Authentication for Console 97 Disable TACACS+ Authentication at the Context Level 97 Limit local-user Login on Console/vty Lines 97 Limit Console Access for AAA-based Users 98 Verify Configuration Changes 98 Configuring a Chassis Key 99 Overview 99 Configuring a New Chassis Key Value 99 CLI Commands 99 Quick Setup Wizard 100 Enabling Automatic Reset of FSC Fabric 100 CHAPTER 6 Config Mode Lock Mechanisms 103 Overview of Config Mode Locking 103 Requesting an Exclusive-Lock 104 Effect of Config Lock on URL Scripts 105 Saving a Configuration File 106 Reload and Shutdown Commands 106 show administrators Command 107 CHAPTER 7 Management Settings 109 SNMP MIB Browser 109 SNMP Support 111 Configuring SNMP and Alarm Server Parameters 112 Verifying SNMP Parameters 113 Controlling SNMP Trap Generation 114 CHAPTER 8 Verifying and Saving Your Configuration 115 Verifying the Configuration 115 Feature Configuration 115 Ultra Gateway Platform System Administration Guide, Release 6.4 viii Contents Service Configuration 116 Context Configuration 116 System Configuration 116 Finding Configuration Errors 116 Synchronizing File Systems 117 Saving the Configuration 117 CHAPTER 9 System Interfaces and Ports 119 Contexts 119 Creating Contexts 119 Viewing and Verifying Contexts 119 Ethernet Interfaces