Stinger Configuration Guide

Transcription

1 Stinger Configuration Guide Part Number: For software version August 1999

2 Copyright 1999 Lucent Technologies. All Rights Reserved. This material is protected by the copyright laws of the United States and other countries. It may not be reproduced, distributed, or altered in any fashion by any entity (either internal or external to Lucent Technologies), except in accordance with applicable agreements, contracts or licensing, without the express written consent of Lucent Technologies, Inc. Notice Every effort was made to ensure that the information in this document was complete and accurate at the time of printing. However, information is subject to change. Security Statement In rare instances, unauthorized individuals make connections to the telecommunications network through the use of access features. Trademarks DSLPipe, DSLMAX, DSL Terminator, MAX, MAX TNT, MultiDSL, Pipeline, and Stinger are trademarks of Lucent Technologies. Other trademarks and trade names mentioned in this publication belong to their respective owners. Ordering Information To order copies of this document, contact your Lucent Technologies representative or reseller. Support Telephone Numbers For a menu of support and other services, call (800) Or call (510) for an operator. Lucent Technologies

3 Customer Service Customer Service provides a variety of options for obtaining technical assistance, information about Lucent products and services, and software upgrades. Obtaining technical assistance You can obtain technical assistance by telephone, , fax, or modem, or over the Internet. If you need help with a problem, make sure that you have the following information when you call or that you include it in your correspondence: Product name and model. Software and hardware options. Software version. Type of computer you are using. Description of the problem. Calling from within the United States In the U.S., you can take advantage of Priority Technical Assistance or an Advantage Pak service contract, or you can call to request assistance. Priority Technical Assistance If you need to talk to an engineer right away, call to reach the Lucent InterNetworking Systems Priority Call queue. The charge of $2.95 per minute does not begin to accrue until you are connected to an engineer. Average wait times are less than three minutes. Advantage Pak Advantage Pak is a one-year service contract that includes overnight advance replacement of failed products, technical support, software maintenance releases, and software update releases. For more information, call Other telephone numbers For a menu of Lucent InterNetworking Systems services, call Or call for an operator. Calling from outside the United States Outside the United States, use one of the following numbers: Telephone outside the United States Asia Pacific (except Japan) Austria/Germany/Switzerland Benelux Stinger Configuration Guide iii

4 France Italy Japan Middle East/Africa Scandinavia Spain/Portugal UK For a list of support options in the Asia Pacific Region, refer to Obtaining assistance through correspondence Use one of two addresses for technical support questions: one is for customers in the United States, and the other is for customers in Europe, the Middle East, and Asia. If you prefer to correspond by fax, BBS, or regular mail, please direct your inquiry to U.S. offices. Following are the ways in which you can reach Customer Service: from within the U.S. support@ascend.com from Europe or the Middle East EMEAsupport@ascend.com from Asia Pacific apac.support@ascend.com Fax Customer Support BBS (by modem) Write to Lucent InterNetworking Systems at the following address: Attn: Customer Service 1701 Harbor Bay Parkway Alameda, CA Finding information and software on the Internet Visit for technical information, product information, and descriptions of available services. Visit ftp.ascend.com for software upgrades, release notes, and addenda. iv Stinger Configuration Guide

5 Contents Customer Service... iii About This Guide... xiii Documentation conventions... xiii Documentation set... xiv Related publications... xiv Related RFCs... xiv ITU-T recommendations... xv ANSI standards... xv ATM specifications... xv Chapter 1 Getting Started Using a Stinger unit as a DSL Access Multiplexer Stinger switching operations Virtual circuit (VC) switching Virtual path (VP) switching Overview of Stinger configuration Configuring the primary Control Module (CM) Configuring the Line Interface Modules (LIMs) Configuring the Trunk Modules (TM) Configuring system clocking modes Defining ATM traffic contracts Configuring ATM circuits and terminating connections Stinger management features Using the command-line interface Tracking system activity Onboard flash memory and software updates SNMP support RADIUS support Where to go next Chapter 2 Configuring the Control Modules Logging into the primary CM Restricting administrative access Changing defaults for serial-port logins Changing the default admin password Setting a Telnet password Providing a basic system IP configuration IP address syntax Assigning the Ethernet IP addresses Defining the soft interface for fault tolerance Stinger Configuration Guide v

6 Contents Configuring a default route Verifying a LAN connection for administrators Enabling a Stinger unit to use RADIUS Overview of external authentication settings Example of configuring a Stinger unit to use RADIUS Configuring controller redundancy Overview of redundancy operations Overview of the Redundancy profile settings Example of specifying a primary CM preference Chapter 3 Configuring the Line Interface Modules Manual LIM sparing Allocating LIM bandwidth Overview of bandwidth settings Guaranteed vs. maximum upstream bandwidth Example of bandwidth allocation configuration Configuring VPI/VCI ranges for LIM slots Configuring ATM SDSL interfaces Overview of SDSL settings Displaying SDSL port status and nailed groups Maximum data rates and session data rates VPI used for VP switching on SDSL port Example of SDSL interface configuration Configuring ATM ADSL-DMT interfaces Overview of AL-DMT settings Line activation and DMT parameters Rate-adaptive mode parameters Power Spectral Density (PSD) and power-level parameters Fast and interleaved bit-rate parameters Interleaving delay parameters Noise margin parameters Dynamic rate-adaptive noise margin parameters Examples of AL-DMT interface configuration Checking LIM status Checking the status of an SDSL interface Checking the status of the physical interface Obtaining statistics about operations Checking the status of an AL-DMT interface Checking the status of the physical interface Obtaining statistics about operations Checking the status of manual LIM sparing Checking bandwidth status Chapter 4 Configuring the Trunk Modules Trunk port sparing Trunk port sparing settings Example of automatic sparing configuration Example of manual sparing configuration Using trunk ports as clock source Informing the system of its clock source Configuring trunk ports as eligible clock sources vi Stinger Configuration Guide

7 Contents VPI/VCI allocation for trunk ports Configuring DS3-ATM interfaces Overview of DS3-ATM settings Displaying DS3 port status and nailed groups Setting DS3 framing formats Example of DS3-ATM configuration Configuring OC3-ATM interfaces Overview of OC3-ATM settings Displaying OC3 status and nailed groups Changing physical-layer interface settings Examples of OC3-ATM configuration Checking ATM trunk interface status DS3 ATM status information Checking OC3-ATM interface status Checking line and ATM framer status Monitoring errors and performance of the SONET payload Chapter 5 Specifying Traffic Contracts Overview of ATM Quality of Service parameters ATM service categories Traffic policing and shaping Flow control Examples of defining a traffic contract Example of a Constant Bit Rate contract Example of a Variable Bit Rate contract Example of an Available Bit Rate (ABR) contract Chapter 6 Configuring ATM Circuits Overview of ATM circuit settings RADIUS profile settings How circuits are established Identifying a circuit s physical interfaces Assigning valid VPI/VCI pairs VPIs and VCIs on LIM slots VPIs and VCIs on trunk ports Applying traffic contracts Examples of ATM circuits using VC switching Configuring a LIM-to-trunk circuit (DSLAM operations) Configuring a trunk-to-trunk circuit Configuring a LIM-to-LIM circuit Example of VP switching configuration Example of Stinger-A configuration (VP switching) Sample LIM port configuration Sample trunk port configuration Sample CPE Connection profile Sample trunk-to-trunk circuit for traffic from Stinger-B Example of Stinger-B CPE configurations (VC switching) Checking the status of an ATM circuit Stinger Configuration Guide vii

8 Contents Chapter 7 Configuring Terminating ATM Connections Overview of ATM connection settings Local Connection profile settings RADIUS profile settings IP information AAL5 multiplexing Example of a terminating connection Sample Stinger configuration Sample far-end DSLTNT configuration Checking the status of an ATM connection Index... Index-1 viii Stinger Configuration Guide

9 Figures Figure 1-1 Example of DSLAM operations Figure 1-2 VC switching Figure 1-3 VP switching Figure 2-1 Default subnet mask for class C IP address Figure 2-2 Local backbone router to be used as default route Figure 2-3 RADIUS servers on local network Figure 2-4 Redundant paths to each CM Figure 3-1 Maximum upstream real-time traffic in Mbits per second Figure 3-2 Default VPI/VCI range Figure 3-3 SDSL ATM LIM configuration Figure 3-4 How noise margin parameters relate to power adjustments Figure 3-5 Future support: How noise margins related to dynamic rate adaptation Figure 3-6 ADSL ATM LIM configuration Figure 4-1 DS3 interfaces to the ATM network Figure 4-2 OC3 interfaces to the ATM network Figure 4-3 SONET layers Figure 5-1 When traffic policing and shaping can occur during DSLAM operations Figure 5-2 Congestion management with Explicit Forward Congestion Indicator Figure 5-3 Flow control for ABR traffic with Explicit Rate Marking Figure 6-1 ATM circuits on LIM and trunk interfaces Figure 6-2 LIM to trunk circuit (DSLAM operations) Figure 6-3 Trunk-to-trunk circuit Figure 6-4 LIM-to-LIM circuit Figure 6-5 Example of VP switching and VC switching Figure 7-1 Terminating ATM connection Figure 7-2 Terminating connection from DSLTNT Stinger Configuration Guide ix

10

11 Tables Table 1-1 Where to go next Table 2-1 IP address classes and number of network bits Table 2-2 Decimal subnet masks and prefix lengths Table 3-1 VPI/VCI bit sizes Table 4-1 Combined settings and resulting number of VCCs on the port Stinger Configuration Guide xi

12

13 About This Guide This guide describes how to configure a Stinger unit and define ATM connections for different types of traffic. In the current software version, ATM connections are Permanent Virtual Circuits (PVCs). This guide assumes that you have already installed the Stinger unit and connected a workstation to the primary controller s serial port. If you have not already finished those tasks, please see the Stinger Hardware Installation Guide.! Warning: Please read the safety instructions in the Stinger Hardware Installation Guide before installing or operating the product. Documentation conventions Following are all the special characters and typographical conventions used in this manual: Convention Monospace text Boldface monospace text Meaning Represents text that appears on your computer s screen, or that could appear on your computer s screen. Represents characters that you enter exactly as shown (unless the characters are also in italics see Italics, below). If you could enter the characters but are not specifically instructed to, they do not appear in boldface. Italics Represent variable information. Do not enter the words themselves in the command. Enter the information they represent. In ordinary text, italics are used for titles of publications, for some terms that would otherwise be in quotation marks, and to show emphasis. [ ] Square brackets indicate an optional argument you might add to a command. To include such an argument, type only the information inside the brackets. Do not type the brackets unless they appear in bold type. Separates command choices that are mutually exclusive. Key1-Key2 Represents a combination keystroke. To enter a combination keystroke, press the first key and hold it down while you press one or more other keys. Release all the keys at the same time. (For example, Ctrl-H means hold down the Control key and press the H key.) Press Enter Means press the Enter, or Return, key or its equivalent on your computer. Stinger Configuration Guide xiii

14 About This Guide Documentation set Convention Note:! Caution:! Warning: Meaning Introduces important additional information. Warns that a failure to follow the recommended procedure could result in loss of data or damage to equipment. Warns that a failure to take appropriate safety precautions could result in physical injury. Documentation set The Stinger documentation set includes the following manuals: TAOS Command-Line Interface Guide. Introduces the Stinger command-line environment and shows you how to use the command line interface effectively. Describes keyboard shortcuts. Introduces commands, security levels, profile structure, and parameter types. Stinger Hardware Installation Guide. Shows how to install the Stinger hardware. Includes the Stinger technical specifications and an architectural overview. Stinger Configuration Guide (this manual). Describes how to use the command-line interface to configure the Stinger modules. Provides instructions for configuring ATM PVCs using the command-line interface or an external RADIUS server. Stinger Reference Guide. An alphabetic reference to all Stinger profiles, parameters, and commands. Stinger Administration Guide. Describes how to administer the Stinger, including how to monitor the system and its modules, troubleshoot the unit, and enable SNMP. Related publications Related RFCs This guide and documentation set do not provide a detailed explanation of products, architectures, or standards developed by other companies or organizations. Following are some publications that you might find useful: RFCs are available on the Web. The Stinger unit supports the standards and MIBs described in the following RFCs: RFC 1407: Definitions of Managed Objects for the DS3/E3 Interface Type RFC 1483: Multiprotocol Encapsulation over ATM Adaptation Layer 5 RFC 1595: Definitions of Managed Objects for the SONET/SDH Interface Type RFC 2138: Remote Authentication Dial In User Service (RADIUS) RFC 2515: Definitions of Managed Objects for ATM Management xiv Stinger Configuration Guide

15 About This Guide Related publications ITU-T recommendations ANSI standards ATM specifications ITU-T (formerly CCITT) recommendations are available commercially. You can order them at The Stinger unit supports the ANSI T1.413 (Issue 2) specification: Telecommunications - Network and Customer Installation Interfaces - Asymmetric Digital Subscriber Line (ADSL) Metallic Interface The Stinger unit is compliant with the following ATM specifications: ATM Forum Traffic Management Specification Version 4.0. ATM User-Network-Interface (UNI) Signaling Specification Version 3.1. Stinger Configuration Guide xv

16

17 Getting Started 1 : Using a Stinger unit as a DSL Access Multiplexer Stinger switching operations Overview of Stinger configuration Stinger management features Where to go next Using a Stinger unit as a DSL Access Multiplexer A Stinger unit operates as an ATM switch-through Digital Subscriber Line Access Multiplexer (DSLAM). It switches data from multiple xdsl subscribers onto a high-speed ATM backbone. Figure 1-1. Example of DSLAM operations DSL CPE U P S T R E A M ATM DSL Terminator D O W N S T R E A M For DSLAM operations, data transmitted from the CPE to the Stinger unit is upstream traffic. Data transmitted from the Stinger unit to the CPE is downstream traffic. In the current software version, Stinger units switch traffic at OSI Layer 2. They do not currently route user data. However, they do support IP routing for terminating connections, such as administrative Telnet or SNMP sessions to the unit itself. Stinger Configuration Guide 1-1

18 Getting Started Stinger switching operations Stinger switching operations A Stinger unit receives cells across a link on a known VPI/VCI pair, and retransmits the cells on another interface using another VPI/VCI pair. For PVCs, the administrator configures both VPI/VCI pairs manually by specifying an ATM circuit in a Connection or RADIUS profile, as described in Chapter 6, Configuring ATM Circuits. An ATM circuit can specify a virtual circuit or a virtual path. Virtual circuit (VC) switching A virtual circuit is a point-to-point connection between an end system (such as a user) and an end point in the ATM network (the point at which the cell stream leaves the ATM layer). VCCs are switched on the basis of a unique VPI/VCI pair, an operation called VC switching. Figure 1-2. VC switching VCI 22 VCI 35 VCI 37 VPI 1 VPI 2 VCI 137 VPI 3 When the Stinger unit is performing VC switching, it switches cells on the basis of the VCI number and a VPI number which is typically (but not necessarily) zero. Both the VPI and VCI numbers may change as they are switched onto the outbound leg of the circuit. Virtual path (VP) switching A virtual path is a bundle of virtual channels that are grouped together and switched on the basis of a common VPI. The VCI numbers associated with the individual connections are not used for switching purposes. This operation is called VP switching. Figure 1-3. VP switching VCI 35 VCI 37 VPI 1 VPI 3 For VP switching, the Stinger switches cells on the basis of the VPI number. The VCI numbers do not change as they are switched onto the next VPI. VP switching leaves the VCI numbers untouched. 1-2 Stinger Configuration Guide

19 Getting Started Overview of Stinger configuration Overview of Stinger configuration Before you configure a Stinger unit, you should create a diagram that illustrates how the unit will interoperate with your current network configuration. Creating a comprehensive network diagram helps prevent problems during installation and configuration, and can help in troubleshooting any problems later. Stinger configuration tasks include the following: Configuring the primary control module Configuring the DSL line interface modules Configuring the trunk modules Defining ATM traffic contracts Configuring connections, either locally or through RADIUS Note: Stinger configuration settings are stored in onboard flash memory, and should be backed up to a TFTP host whenever changes are made. For details about backing up and restoring the Stinger configuration, see the Stinger Administration Guide. Configuring the primary Control Module (CM) Each of the Control Modules (CMs) has an RS-232 serial port (labeled Diag Port) and a 10Base-T Ethernet port. The serial port is for system management from a local workstation. It is also the standard error output for stack traces and messages in the event of a system crash. Until you have assigned IP addresses to the system s Ethernet interfaces, you must use a local workstation connected to the primary controller s serial port to configure the Stinger unit. There is no other way to log into the unit to perform the initial configuration. The system s Ethernet ports are intended for light data and management traffic. Once you have assigned the ports IP addresses, administrators can Telnet into the unit from a local host and download configuration files from a TFTP server to the Stinger system. A Stinger unit has a range of options for configuring IP and for protecting the unit from unauthorized administrative access. In addition, you should verify that the default CM redundancy configuration is appropriate for your site. Most sites operate the unit with redundant controllers, although it can operate with a single controller. If the unit has two CMs installed, check the status lights on the CM front panel to see which CM is the primary module. For details, see the Stinger Hardware Installation Guide. Note: All configuration must take place on the primary CM. The primary CM configuration repository overwrites that of the secondary CM immediately after every configuration change and at regular intervals. Configuring the Line Interface Modules (LIMs) A Stinger unit supports up to 14 Line Interface Modules (LIMs), which can be any combination of 48-port SDSL and 12-port ADSL-DMT ATM modules. LIMs reside in the front panel of the unit. Each port on a LIM has a variety of configuration options, including line rates and bandwidth. The way you configure each line depends on your connectivity needs. Stinger Configuration Guide 1-3

20 Getting Started Overview of Stinger configuration On LIM slots, administrators can configure VPI/VCI ranges to enable the slot to accept inbound connections from particular types of DSL modems. For example, Alcatel modems assume a VPI of 8 and a VCI of 35. All ports on a LIM slot use the same configured VPI/VCI range. Every enabled DSL port has a unique nailed-group number assigned as a factory default. Most sites enable only the DSL ports that are in use, which results in better system performance. (By default, DSL ports are disabled.) Configuring the Trunk Modules (TM) A Stinger unit can support up to two Trunk Modules (TMs), which can be OC3-ATM or DS3- ATM. TMs reside in the back panel of the unit. You can set up the unit to use the full trunk-side bandwidth actively, or you can designate one or two of the trunk ports as spares, to be used only when one or the other of the other trunks goes down. Each of the Stinger trunks connects to an ATM switch, and the line configuration includes settings that must match between the local and far-end switch interfaces. Trunk-side, the Stinger unit supports up to 32K connections using VC switching. By default, the system distributes the maximum of 32K VCCs equally across the four trunk ports. Administrators can configure VCI ranges to cause a port to handle more or less of the total number of VC-switched connections. Note: There is no restriction on the number of VCIs supported on virtual path connections (VPCs).The system does not examine the VCI value when it is performing VP switching. Configuring system clocking modes The unit requires a clock source for its timing subsystem. By default, it uses a built-in 8KHz clock on the primary CM as its timing source. Administrators can configure the system to take its clock source from a trunk port or from an external Building Interoffice Timing Source (BITS) clock connected to the Stinger Alarm board. For details about configuring a trunk port to source the ATM network clock and feed it to the primary CM, see Using trunk ports as clock source on page 4-3. For details about using the BITS source, see the Stinger Hardware Installation Guide. Defining ATM traffic contracts A Stinger unit supports ATM traffic management, which is configurable as a group of related capabilities (a contract). After you define a number of traffic contracts that specify a service category and related attributes, you can apply a contract to each upstream and each downstream data flow through the unit. Configuring ATM circuits and terminating connections An ATM circuit is a switch-through ATM connection received on one physical interface of the Stinger unit and transmitted on another. For example, if the unit is operating as a DSLAM, a connection received on a LIM port and switched out on a trunk port is one ATM circuit. 1-4 Stinger Configuration Guide

21 Getting Started Stinger management features DSLAM operations make use of LIM-to-trunk circuits. The system also supports LIM-to-LIM and trunk-to-trunk circuits. The unit can also accept inbound ATM connections that terminate locally. These are IP-routed connections that specify a local destination address. You can configure connections locally or in RADIUS. With the current software version, all ATM connections are PVCs, which means they are nailed connections. Stinger management features To enable administrators to configure the system and monitor its activity, Stinger units support profiles, commands, and status windows in the command-line interface. Stinger units also support SNMP management, RADIUS profiles, and the ability to upload (back up) and download software and configuration files via TFTP or serial connection. A Stinger system provides several permission levels to control the management and configuration functions that are accessible in the command-line interface. For information about User profiles and other management features, see the Stinger Administration Guide. For an introduction to the command-line interface and its shortcuts, see the TAOS Command- Line Interface Guide. Using the command-line interface The Stinger command-line interface provides access to commands, profiles, and status windows. You must use the command-line interface to provide the initial system and IP configuration for the unit, although you can choose to perform subsequent configuration tasks remotely through SNMP, or by downloading configuration files via TFTP. Tracking system activity A Stinger unit supports many commands for monitoring system activity. To display the commands that are available with the permission settings in the current User profile, enter the help (or?) command. The following example shows the commands available for the admin login. The left column shows command names, and the right column shows the command class, which determines the permissions required to use the command. admin>?? ( user ) arptable ( system ) auth ( user ) callroute ( diagnostic ) clear ( user ) clock-source ( diagnostic ) clr-history ( system ) connection ( system ) date ( update ) debug ( diagnostic ) delete ( update ) device ( diagnostic ) dir ( system ) Stinger Configuration Guide 1-5

22 Getting Started Stinger management features dircode ( system ) ether-display ( diagnostic ) fatal-history ( system ) format ( code ) fsck ( code ) get ( system ) hdlc ( system ) [More? <ret>=next entry, <sp>=next page, <^C>=abort] For details about each command, see the Stinger Reference Guide. For more information about command help, see the TAOS Command-Line Interface Guide. The command-line interface supports several status windows that focus on different aspects of system activity (such as connection status and log messages). The windows provide a great deal of read-only information about what is currently happening in the unit. To display a status window, enter the Status command: admin> status The system prompt moves to just below the status window. To close the status window, enter the command again: admin> status If the system prompt is not visible below the status window, press Escape to display it. Onboard flash memory and software updates SNMP support RADIUS support Onboard flash RAM enables you to perform software upgrades in the field. You can upgrade the Stinger unit through its serial port by accessing it locally, or you can download software upgrades from a TFTP server. For details, see the Stinger Administration Guide. In addition to managing a Stinger unit by means of the command-line interface, administrators can manage the unit by using an SNMP management station such as NavisAccess. A Stinger unit can generate SNMP traps to indicate alarm conditions and it relies on SNMP community strings to implement SNMP security. For information about using SNMP with Stinger units, see the Stinger Administration Guide. Administrators can use RADIUS to store user profiles for ATM circuits and terminating connections. The RADIUS server must be compliant with the Vendor-Specific Attribute (VSA), as defined in RFC To use RADIUS, you must also configure the Stinger unit to communicate with the RADIUS server. 1-6 Stinger Configuration Guide

23 Getting Started Where to go next Where to go next When you have planned your network, you are ready to configure the Stinger unit. You can perform configuration tasks in any order you want. Table 1-1 shows where to look for the information you need. Table 1-1. Where to go next To do this: Determine which CM is primary Establish a serial connection See: Stinger Hardware Installation Guide Stinger Hardware Installation Guide Set up basic access security Restricting administrative access (page 2-2) Configure IP Providing a basic system IP configuration (page 2-5) Configure the unit to use RADIUS Enabling a Stinger unit to use RADIUS (page 2-9) Check the Redundancy settings Configuring controller redundancy (page 2-12) Configure the unit s LIMs Configuring the Line Interface Modules (page 3-1) Checking LIM port status Checking LIM status (page 3-20) Configure the unit s trunk lines Configuring the Trunk Modules (page 4-1) Checking trunk status Checking ATM trunk interface status (page 4-15) Define ATM traffic contracts Specifying Traffic Contracts (page 5-1) Configure ATM circuits Configuring ATM Circuits (page 6-1) Configure VP switching Example of VP switching configuration (page 6-11) Configure IP-routed connections Configuring Terminating ATM Connections (page 7-1) that terminate in the Stinger Check details about parameters and commands Use SNMP with the unit Configure login permissions Back up the system configuration Test lines and ports Stinger Reference Guide Stinger Administration Guide Stinger Administration Guide Stinger Administration Guide Stinger Administration Guide Stinger Configuration Guide 1-7

24

25 Configuring the Control Modules 2 Logging into the primary CM Restricting administrative access Providing a basic system IP configuration Enabling a Stinger unit to use RADIUS Configuring controller redundancy The primary Control Module (CM) performs all controller operations for the Stinger unit. It manages and boots the LIMs, maintains a central repository of the unit s configuration, performs call control and processing operations, and manages all centralized functions, such as SNMP access or communication with a RADIUS server. The secondary CM does not perform controller operations unless the primary CM resets or the administrator manually changes the primary/secondary status of the CMs. However, administrators can Telnet into the secondary CM and run commands. The secondary CM has up-to-date configuration and system activity information. Control module configuration includes the following tasks: Logging into the unit from a workstation connected to the primary CM serial port Changing default security settings to protect the unit Configuring IP to make the system accessible by Telnet, SNMP, and Ping Configuring RADIUS access (if appropriate) Checking the Redundancy profile settings, and modifying them if appropriate Logging into the primary CM To configure the unit initially, or after clearing its NVRAM, you must connect a workstation to the primary CM serial port (labeled Diag Port). For information about checking the status lights to determine which CM has been elected primary, and about establishing a serial connection between a workstation and the primary CM serial port, see the Stinger Hardware Installation Guide. After connecting the management workstation, launch a communications program that supports terminal emulation. The terminal emulation settings should specify 9600 bps, 8 data bits, 1 stop bit, and no parity or flow control. When you launch the program, the Stinger unit uses settings in the Serial profile to authenticate the serial-port login. With the default settings in that profile, it prompts for the password of the User profile named admin. For example: Password: Stinger Configuration Guide 2-1

26 Configuring the Control Modules Restricting administrative access Enter the password Ascend to authenticate the admin User profile. For example: Password: Ascend Typically, the name specified in the User profile appears as your system prompt. For example, if you log in as admin, the following prompt appears: admin> After you have supplied basic IP information, as described in Providing a basic system IP configuration on page 2-5, you can access the Stinger command-line interface through the serial port, or by using Telnet from an IP host. Or, you can log in by using an SNMP management station, such as NavisAccess, from an IP host. In any case, no matter how you access the unit, you must authenticate a User profile and supply a password to acquire administrative permissions. For details about User profiles, see the Stinger Administration Guide. Restricting administrative access Each Stinger unit is shipped from the factory with its security features set to defaults that enable you to configure and set up the unit without any restrictions. Before you bring the unit online, you should change the default security settings to protect the configured unit from unauthorized access. Changing defaults for serial-port logins To help protect the system from unauthorized access on one of its CM serial interfaces, change the following (factory default) settings: [in SERIAL/{ shelf-1 control-module 2 }] user-profile = admin auto-logout = no Parameter User-Profile Auto-Logout Specifies Name of the User profile to be used for logins on the CM serial port. User profiles set permissions and other parameters for logins to the Stinger command-line interface. If no name is specified, the system prompts for both the name and password of a User profile, as it does for Telnet logins. Enable/disable termination of the serial-port login if the DTR signal is lost on the interface. A yes setting causes the system to log out the administrative login even if the administrator forgets to enter the Quit command in the terminal-emulation program. A Stinger unit automatically creates a Serial profile for each installed CM. To list the Serial profiles, use the Dir command as follows: admin> dir serial 5 06/20/ :57:48 { shelf-1 control-module-2 2 } 12 06/20/ :01:46 { shelf-1 control-module 2 } 2-2 Stinger Configuration Guide

27 Configuring the Control Modules Restricting administrative access The designations control-module and control-module-2 refer to the slot position, not the primary/secondary status of each CM. To make serial logins more secure, modify both Serial profiles to specify a null User profile name and enable the Auto-Logout parameter. For example: admin> read serial {1 control-module 2} SERIAL/{ shelf-1 control-module 2 } read admin> set user-profile = admin> set auto-logout = yes admin> write SERIAL/{ shelf-1 control-module 2 } written admin> read serial {1 control-module-2 2} SERIAL/{ shelf-1 control-module-2 2 } read admin> set user-profile = admin> set auto-logout = yes admin> write SERIAL/{ shelf-1 control-module-2 2 } written Changing the default admin password The admin User profile sets permissions that enable most levels of activity, so access to that login should be carefully restricted. To protect the admin login, you should change its wellknown password the first time you log into the unit. Following is the relevant parameter, shown with the factory default setting: [in USER/admin] password = "Ascend" Parameter Password Specifies Text string of up to 20 characters, which must be entered by a user to log in with permissions authorized by the admin profile. The value is case sensitive. You can specify any password, up to 20 characters. All future logins governed by the admin User profile must provide the new password. For example, the following commands change the password to x1!35dpg: admin> read user admin USER/admin read admin> set password = x1!35dpg admin> write USER/admin written Note: If the password is displayed as a string of asterisks rather than readable text, you do not have sufficient permissions to read or change the password. For information about how to enable the permission or log in with a different User profile, see the Stinger Administration Guide or the Allow-Password entry in the Stinger Reference Guide. Stinger Configuration Guide 2-3

28 Configuring the Control Modules Restricting administrative access When an administrator Telnets into the Stinger unit, the system prompts for the name and password of a User profile and authenticates the information before allowing the Telnet session. For example: % telnet Trying Connected to Escape character is ^]. User: admin Password: x1!35dpg Setting a Telnet password A Telnet password is a global, system-wide password to be required for Telnet logins to the unit. The Telnet password is requested before the system accepts the connection and prompts for the name of a User profile. Following are the parameters, shown with default settings, related to Telnet logins to a Stinger unit: [in IP-GLOBAL] telnet-password = "" user-profile = "" Parameter Telnet-Password User-Profile Specifies Text string of up to 20 characters, required from all users requesting a Telnet session. A user is allowed three attempts, with 60 seconds per attempt, to enter the correct password. A third unsuccessful attempt terminates the login process. The value is case-sensitive. Name of a default User profile for authenticating Telnet logins. If no name is specified, the system prompts the user to enter the name of a User profile. For example, the following commands set the Telnet password to dpg01!: admin> read ip-global IP-GLOBAL read admin> set telnet-password = dpg01! admin> write IP-GLOBAL written When a Telnet password has been specified, the system requires a two-tier password authentication for Telnet logins. For example: % telnet <stinger01> Enter Password: dpg01! Trying Connected to Escape character is ^]. User: admin Password: ********** 2-4 Stinger Configuration Guide

29 Configuring the Control Modules Providing a basic system IP configuration If the user enters an incorrect Telnet password, the system prompts again, allowing up to three attempts before timing out. If the user specifies the correct password, the connection is established and the user is prompted to enter the name and password of a valid User profile. Providing a basic system IP configuration IP address syntax To enable Telnet and SNMP access to the unit, and to allow connectivity between the unit and local IP hosts, you must assign IP addresses to the Stinger Ethernet ports and configure basic IP routing. Note: A Stinger unit does not require IP routing to operate as a DSLAM. The system does not provide IP routing for user data. A Stinger unit uses dotted decimal format (not hexadecimal) for IP addresses. If no subnet mask is specified, the unit assumes a default mask based on the address class. Table 2-1 shows address classes and the number of network bits in the default mask for each class. Table 2-1. IP address classes and number of network bits Class Address range Default network bits Class A Class B Class C For example, a class C address, such as , has 24 network bits, leaving 8 bits for the host portion of the address. If no subnet mask is specified for a class C address, the Stinger assumes the default mask of 24 bits: Figure 2-1. Default subnet mask for class C IP address Default 24 bits A subnet address includes a prefix length, which specifies the number of network bits in the address. For example, the following address specifies a 29-bit subnet: ip-address = /29 In this address, 29 bits of the address are used to specify the network. The three remaining bits are used to specify unique hosts on the subnet. With three bits used to specify hosts on a 29-bit subnet, eight different bit combinations are possible. Of those eight possible host addresses, two are reserved: 000 Reserved for the network (base address) Stinger Configuration Guide 2-5

30 Configuring the Control Modules Providing a basic system IP configuration Reserved for the broadcast address of the subnet Note: Be careful with zero subnets (subnets with the same base address as a class A, B, or C network). Early implementations of TCP/IP did not allow them. For example, the subnet /30 was illegal because it had the same base address as the class C network /24, while the subnet /30 was legal. Modern implementations of TCP/IP support zero subnets, and the Stinger implementation of RIP treats these subnets the same as any other network. However, it is important that you treat zero subnets consistently throughout your network. Otherwise, you will encounter routing problems. Table 2-2 shows subnet masks and prefix lengths for a class C network number. Table 2-2. Decimal subnet masks and prefix lengths Subnet mask Number of host addresses Prefix length hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / hosts + 1 broadcast, 1 network base / invalid mask (no hosts) / host a host route /32 The broadcast address of any subnet has the host portion of the IP address set to all ones. The network address (or base address) represents the network itself, because the host portion of the IP address is all zeros. For example, if the Stinger configuration assigns the following address to a remote router: /29 The Ethernet network attached to that router has the following address range: A host route is a special-case IP address with a prefix length of /32. For example: /32 Host routes are to a single host, rather than to a router or subnet. 2-6 Stinger Configuration Guide

31 Configuring the Control Modules Providing a basic system IP configuration Assigning the Ethernet IP addresses A Stinger unit creates an IP interface for the Ethernet port of each CM. To list the IP interfaces, use the Dir command as follows: admin> dir ip-interface 16 03/30/ :22:58 { { shelf-1 control-module-2 1 } 0 } 14 04/05/ :03:32 { { any-shelf any-slot 0 } 0 } 16 04/05/ :11:35 { { shelf-1 control-module 1 } 0 } The designations control-module and control-module-2 refer to the slot position, not the primary/secondary status of each CM. The IP-Interface profile with the zero index (the default any-shelf any-slot index) is reserved for the soft interface, which is described in Defining the soft interface for fault tolerance on page 2-7. In this example, the CM in the first control-module slot position is the primary CM. The following commands assign the primary CM the address /24: admin> read ip-interface { { shelf-1 control-module 1 } 0 } IP-INTERFACE/{ { shelf-1 control-module 1 } 0 } read admin> set ip-address = /24 admin> write IP-INTERFACE/{ { shelf-1 control-module 1 } 0 } written The following commands assign the address /24 to the secondary CM: admin> read ip-interface { { shelf-1 control-module-2 1 } 0 } IP-INTERFACE/{ { shelf-1 control-module-2 1 } 0 } read admin> set ip-address = /24 admin> write IP-INTERFACE/{ { shelf-1 control-module-2 1 } 0 } written After you assign IP addresses, you can verify that the Stinger unit is a valid IP host on its configured networks by Pinging other hosts on those networks, as shown in the following example: admin> ping PING : 56 Data bytes 64 bytes from : icmp_seq=0 ttl=255 time=0 ms 64 bytes from : icmp_seq=3 ttl=255 time=0 ms ^C : Ping statistics packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0/0/0 ms Defining the soft interface for fault tolerance A Stinger unit supports a soft IP interface, which is an internal interface that never goes down. Therefore, as long as one of the unit s IP interfaces is up, the soft interface address is reachable. The soft IP interface is associated only with the primary CM, regardless of which slot is operating as primary. The soft interface is hidden from the secondary CM. When the system powers on, it waits until a controller becomes the primary CM before setting up the soft Stinger Configuration Guide 2-7

32 Configuring the Control Modules Providing a basic system IP configuration interface. If a switchover occurs (the secondary CM becomes primary), the system reinitializes the soft interface at that time. The IP-Interface profile with the zero index is reserved for the soft interface. If RIP is enabled, the unit advertises the interface address as a host route (with a prefix length of /32) using the loopback interface. If RIP is not enabled, routers one hop away from the unit must have a static route to the soft interface address. (For more information, see Verifying a LAN connection for administrators on page 2-9.) The following commands set the soft interface IP address to /24: admin> read ip-interface { } IP-INTERFACE/{ { any-shelf any-slot 0 } 0 } read admin> set ip-addr = /24 admin> write IP-INTERFACE/{ { any-shelf any-slot 0 } 0 } written Configuring a default route A default route is a static route that specifies destination address of zero and the IP address of an external router. The Stinger unit routes all IP packets with unknown destinations to the specified external router. If no default route is defined, the unit drops IP packets for which it has no route. Figure 2-2 shows the Stinger Ethernet interfaces on a subnet, connected to the same Ethernet segment as a local backbone router. In this network, the Stinger can use the local router as its default route. Figure 2-2. Local backbone router to be used as default route Primary CM Ethernet Port /24 Local router /24 Hub / /24 Secondary CM Ethernet Port Making a local router the default route enables the Stinger unit to pass all unrecognized IP packets to that router, so its own routing tables can remain small. The external router maintains large routing tables, and assumes the responsibility and overhead of routing most packets. For example, the following commands define a default route to the LAN router in Figure 2-2: admin> new ip-route default IP-ROUTE/default read admin> set gateway-address = admin> set active-route = yes admin> write IP-ROUTE/default written 2-8 Stinger Configuration Guide

33 Configuring the Control Modules Enabling a Stinger unit to use RADIUS The system can support multiple default routes. The profile name does not have to be default. The only requirements are that the destination address must be zero, and Gateway- Address must specify a valid, reachable router. For information about other settings in the IP-Route profile, see the Stinger Reference Guide. Verifying a LAN connection for administrators To enable administrators to log into the Stinger unit s interface from local IP hosts, you must also make sure that the external LAN router can route to the unit. By default, RIP is disabled on Stinger interfaces. Because the unit is not primarily a Layer-3 device, many sites do not enable RIP on the local interfaces. If RIP is disabled on the Stinger interfaces, you must inform the local router about the Stinger addresses and which of the local router interfaces connect to the same subnet. The method you use to do so depends on the type of router. For example, if the hosts on the local network can already Ping each other and the local router, you would use commands such as the following to inform the local router about the Stinger addresses. These sample commands specify the Stinger LAN interfaces shown in Figure 2-2, as well as the Stinger unit s soft interface address: % route add % route add % route add After adding the routes, you should be able to Ping the unit from local hosts. For example, the following command executed on a local host tests connectivity to the soft interface: % ping PING ( ): 56 Data bytes 64 bytes from : icmp_seq=0 ttl=255 time=0 ms 64 bytes from : icmp_seq=7 ttl=255 time=0 ms ^C Ping statistics packets transmitted, 8 packets received, 0% packet loss round-trip min/avg/max = 0/0/0 ms Enabling a Stinger unit to use RADIUS Many sites choose to maintain a centralized external RADIUS database of user profiles. To use RADIUS with Stinger units, the RADIUS server must comply with the Vendor-Specific Attribute (VSA) specification, defined in RFC 2138, Remote Authentication Dial In User Service (RADIUS). All Ascend attributes of Type 91 or smaller are available only in VSA compatibility mode. The Ascend Vendor-Id is 529. In addition, you must add the ATM-related VSAs from the most recent Ascend RADIUS dictionary to the RADIUS server s dictionary. The relevant RADIUS attributes are documented in Chapter 6, Configuring ATM Circuits, and Chapter 7, Configuring Terminating ATM Connections. Stinger Configuration Guide 2-9