4. System Management
The 7705 SAR-Hm series of routers supports system management parameters as covered in the topics listed below:
4.1. System Security
For general information on system security support, refer to the topics listed below in the “Security” chapter of the 7450 ESS, 7750 SR, 7950 XRS, and VSR System Management Guide.
- Authentication
- Local Authentication
- Radius Authentication
- TACACS+ Authentication
- Authorization
- Local Authorization
- Radius Authorization
- TACACS+ Authorization
- Security Controls
- Vendor-Specific Attributes (VSAs)
- Other Security Features
- Secure Shell (SSH)
- SSH PKI Authentication
- HMAC strengthening (SHA-224/256/384/512)
- MAC Client and Server List
- Regenerate the ssh-key without disabling SSH
- TTL Security for BGP and LDP
- Exponential Login Backoff
- User Lockout
- CLI Login Scripts
- 802.1x Network Access Control
- TCP Enhanced Authentication Option
- Configuration Notes
- Configuring Security with CLI
For descriptions of security commands, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Classic CLI Command Reference Guide and to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Clear, Show, and Tools Command Reference Guide.
4.2. SNMP
For general information on SNMP support, refer to the “SNMP” chapter of the 7450 ESS, 7750 SR, 7950 XRS, and VSR System Management Guide.
4.3. Event Logs
For general information on event log support, refer to the “Event and Accounting Logs” chapter of the 7450 ESS, 7750 SR, 7950 XRS, and VSR System Management Guide.
4.4. In-band Management over LTE
The 7705 SAR-Hm series of routers supports the following modes of operation over a cellular network:
- static cellular system IPv4 mode
- static cellular interface IPv4 mode or IPv6 mode
- dynamic cellular interface IPv4 mode or IPv6 mode
The way in which the node is managed depends on which mode of operation is in use. See Services over the Cellular PDN Interface for more information about the modes of operation.
When a cellular port on the node is operating in static cellular system IP mode, the system IP address is identical to the cellular IP address assigned during the initial PDN attachment process. To manage the node in this mode, the NSP NFM-P or other network management platform reaches the node without using the system IP address directly over the cellular network. This is the only mode that does not require a pre-established in-band management service to manage the node.
When a cellular port on the node is operating in static cellular interface IP mode or dynamic cellular interface IP mode, the NSP NFM-P or other network management platform can only reach the node through an in-band management VPRN service. For these modes of operation, the system IP address used to manage the node is private and differs from the cellular port IP address assigned when connecting to the cellular network. The system IP address must be advertised from the 7705 SAR-Hm series node to the head-end node by the in-band management VPRN service. Routing in the private IP/MPLS network past the head-end node must allow management traffic to reach the head-end node which will then send the management traffic over the VPRN to the node being managed.
The NSP NFM-P automatically configures the required in-band management VPRN service during the ADP-Hm process; see ADP-Hm for more information.
On the 7705 SAR-Hm series nodes, there are two methods for enabling in-band management over a VPRN service:
- performing a Global Routing Table (GRT) lookup and VPRN-to-GRT route leaking
- using port cross-connect
4.4.1. GRT Lookup and VPRN-to-GRT Route Leaking
Figure 2 shows the GRT lookup and VPRN-to-GRT route leaking option for in-band management over a VPRN on the 7705 SAR-Hm.
Figure 2: GRP Lookup and VPRN-to-GRT Route Leaking
In-band management using the GRT lookup and VPRN -to-GRT route leaking option is enabled by configuring the following elements:
- A base router policy statement that includes a prefix list used to leak VPRN reachable addresses to the GRT. This prefix list includes the NSP NFM-P addresses and the management loopback interface that allows the CPM to respond to management queries or commands from the NSP NFM-P.
- A management loopback interface configured under the VPRN to allow the CPM to respond to management queries from the NSP NFM-P.
- A static route from the VPRN to the GRT for the system IP address of the node
- Enable a GRT lookup from the VPRN to the GRT so that management traffic received over the VPRN from the NSP NFM-P to the 7705 SAR-Hm series node can reach the CPM. This uses the grt-lookup, enable-grt, and allow-local-management CLI commands in the config>service>vprn context. For descriptions of these commands, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Classic CLI Command Reference Guide.
- A VPRN-to-GRT route leak that populates the GRT routing table with addresses that are reachable by the VPRN, using the export-grt command. For a description of this command, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Classic CLI Command Reference Guide. The reachable addresses include those for the NSP NFM-P and the local management loopback interface that allows responses from the CPM to return to the corresponding VPRN.
The CLI output below shows a configuration example of in-band management using GRT lookup and VPRN-to-GRT route leaking, based on Figure 2.
4.4.2. Port Cross-Connect (PXC)
For information about PXC, refer to the “Interfaces” chapter of the 7450 ESS, 7750 SR, 7950 XRS, and VSR Interface Configuration Guide.
Figure 3 shows an example of the operation of in-band management using a VPRN and PXC.
Figure 3: In-band Management using a VPRN Service and PXC
The CLI example below shows the configuration of the PXC based on the example shown in Figure 3.
To ensure management traffic from the CPM can reach the NSP NFM-P over the VPRN, an interface in the Global Routing Table (GRT) is configured on one of the PXC ports. In the example shown in Figure 3, the GRT PXC port is port pxc-1.b. This port is looped internally together with PXC port pxc-1.a, the SAP of the in-band management VPRN. A router interface is required on port pxc-1.b:1 (VLAN 1) and used to route management traffic from the CPM towards the in-band management VPRN. A static route is configured in the GRT for the NSP NFM-P address, 1.1.1.1, with a next hop of the VPRN SAP, or port pxc-1.a:1. The CLI output below shows configuration examples in the GRT.
A SAP interface on the other PXC port is required by the in-band management VPRN to route management traffic towards the CPM. A static route is configured in the VPRN for the CPM system IP address 10.10.10.1, with a next hop of the GRT interface port pxc-1.b:1. The CLI output below shows configuration examples for the VPRN.