User manual
Table Of Contents
- Cisco ONS 15310-CL and Cisco ONS 15310-MA Ethernet Card Software Feature and Configuration Guide
- Contents
- Preface
- Overview of the ML-Series Card
- CTC Operations on the ML-Series Card
- Initial Configuration of the ML-Series Card
- Configuring Interfaces on the ML-Series Card
- Configuring POS on the ML-Series Card
- Configuring STP and RSTP on the ML-Series Card
- STP Features
- STP Overview
- Supported STP Instances
- Bridge Protocol Data Units
- Election of the Root Switch
- Bridge ID, Switch Priority, and Extended System ID
- Spanning-Tree Timers
- Creating the Spanning-Tree Topology
- Spanning-Tree Interface States
- Spanning-Tree Address Management
- STP and IEEE 802.1Q Trunks
- Spanning Tree and Redundant Connectivity
- Accelerated Aging to Retain Connectivity
- RSTP Features
- Interoperability with IEEE 802.1D STP
- Configuring STP and RSTP Features
- Default STP and RSTP Configuration
- Disabling STP and RSTP
- Configuring the Root Switch
- Configuring the Port Priority
- Configuring the Path Cost
- Configuring the Switch Priority of a Bridge Group
- Configuring the Hello Time
- Configuring the Forwarding-Delay Time for a Bridge Group
- Configuring the Maximum-Aging Time for a Bridge Group
- Verifying and Monitoring STP and RSTP Status
- STP Features
- Configuring VLANs on the ML-Series Card
- Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling on the ML-Series Card
- Configuring Link Aggregation on the ML-Series Card
- Configuring IRB on the ML-Series Card
- Configuring Quality of Service on the ML-Series Card
- Understanding QoS
- ML-Series QoS
- QoS on RPR
- Configuring QoS
- Monitoring and Verifying QoS Configuration
- QoS Configuration Examples
- Understanding Multicast QoS and Multicast Priority Queuing
- Configuring Multicast Priority Queuing QoS
- QoS not Configured on Egress
- ML-Series Egress Bandwidth Example
- Understanding CoS-Based Packet Statistics
- Configuring CoS-Based Packet Statistics
- Understanding IP SLA
- Configuring the Switching Database Manager on the ML-Series Card
- Configuring Access Control Lists on the ML-Series Card
- Configuring Resilient Packet Ring on the ML-Series Card
- Understanding RPR
- Configuring RPR
- Connecting the ML-Series Cards with Point-to-Point STS Circuits
- Configuring CTC Circuits for RPR
- Configuring RPR Characteristics and the SPR Interface on the ML-Series Card
- Assigning the ML-Series Card POS Ports to the SPR Interface
- Creating the Bridge Group and Assigning the Ethernet and SPR Interfaces
- RPR Cisco IOS Configuration Example
- Verifying Ethernet Connectivity Between RPR Ethernet Access Ports
- CRC Threshold Configuration and Detection
- Monitoring and Verifying RPR
- Add an ML-Series Card into an RPR
- Delete an ML-Series Card from an RPR
- Cisco Proprietary RPR KeepAlive
- Cisco Proprietary RPR Shortest Path
- Redundant Interconnect
- Configuring Security for the ML-Series Card
- Understanding Security
- Disabling the Console Port on the ML-Series Card
- Secure Login on the ML-Series Card
- Secure Shell on the ML-Series Card
- RADIUS on the ML-Series Card
- RADIUS Relay Mode
- RADIUS Stand Alone Mode
- Understanding RADIUS
- Configuring RADIUS
- Default RADIUS Configuration
- Identifying the RADIUS Server Host
- Configuring AAA Login Authentication
- Defining AAA Server Groups
- Configuring RADIUS Authorization for User Privileged Access and Network Services
- Starting RADIUS Accounting
- Configuring a nas-ip-address in the RADIUS Packet
- Configuring Settings for All RADIUS Servers
- Configuring the ML-Series Card to Use Vendor-Specific RADIUS Attributes
- Configuring the ML-Series Card for Vendor-Proprietary RADIUS Server Communication
- Displaying the RADIUS Configuration
- Configuring Bridging on the ML-Series Card
- CE-100T-8 Ethernet Operation
- Command Reference for the ML-Series Card
- [no] bridge bridge-group-number protocol {drpri-rstp | ieee | rstp}
- clear counters
- [no] clock auto
- interface spr 1
- [no] pos mode gfp [fcs-disabled]
- [no] pos pdi holdoff time
- [no] pos report alarm
- [non] pos trigger defects condition
- [no] pos trigger delay time
- [no] pos vcat defect {immediate | delayed}
- show controller pos interface-number [details]
- show interface pos interface-number
- show ons alarm
- show ons alarm defect {[eqpt | port [port-number] | sts [sts-number] | vcg [vcg-number] | vt]}
- show ons alarm failure {[eqpt | port [port-number] | sts [sts-number] | vcg [vcg-number] | vt]}
- spr-intf-id shared-packet-ring-number
- [no] spr load-balance { auto | port-based }
- spr station-id station-id-number
- spr wrap { immediate | delayed }
- Unsupported CLI Commands for the ML-Series Card
- Using Technical Support
- Index
15-13
Cisco ONS 15310-CL and Cisco ONS 15310-MA Ethernet Card Software Feature and Configuration Guide R8.5
78-18133-01
Chapter 15 Configuring Security for the ML-Series Card
RADIUS Stand Alone Mode
To disable AAA, use the no aaa new-model global configuration command. To disable AAA
authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global
configuration command. To either disable RADIUS authentication for logins or to return to the default
value, use the no login authentication {default | list-name} line configuration command.
Defining AAA Server Groups
You can configure the ML-Series card to use AAA server groups to group existing server hosts for
authentication. You select a subset of the configured server hosts and use them for a particular service.
The server group is used with a global server-host list, which lists the IP addresses of the selected server
hosts.
Server groups also can include multiple host entries for the same server if each entry has a unique
identifier (the combination of the IP address and UDP port number), allowing different ports to be
individually defined as RADIUS hosts providing a specific AAA service. If you configure two different
host entries on the same RADIUS server for the same service (for example, accounting), the second
configured host entry acts as a fail-over backup to the first one.
You use the server group server configuration command to associate a particular server with a defined
group server. You can either identify the server by its IP address or identify multiple host instances or
entries by using the optional auth-port and acct-port keywords.
Beginning in privileged EXEC mode, follow these steps to define the AAA server group and associate a
particular RADIUS server with it:
Step 5
Router (config-line)# login
authentication {default | list-name}
Apply the authentication list to a line or set of lines.
• If you specify default, use the default list created with the aaa
authentication login command.
• For list-name, specify the list created with the aaa authentication
login command.
Step 6
Router (config)# end Return to privileged EXEC mode.
Step 7
Router# show running-config Verify your entries.
Step 8
Router# copy running-config
startup-config
(Optional) Save your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
Router# configure terminal Enter global configuration mode.
Step 2
Router (config)# aaa new-model Enable AAA.