Configuring the Cisco ONS 15304 SDCC and DCN Management Paths

From an application-layer perspective, the Cisco ONS 15304 is managed using Telnet, Simple Network Management Protocol (SNMP), TFTP, Domain Name System (DNS), and other Internet-based protocols. This IP-oriented management methodology contrasts with traditional SDH/GR-253 based network elements that support only OSI protocols, and which specify the use of CLNS, IS-IS, or ES-IS at the network layer.

In order to be compatible, and to allow management traffic to traverse between the Cisco ONS 15304 and foreign network elements manufactured by other vendors, the Cisco ONS 15304 needs to be configured to enable CLNS, so that existing ring management capabilities and traffic are not disrupted. This implies that the SDCC interfaces on the Cisco ONS 15304 need to be configured to run CLNS, as a minimum, under normal circumstances. CLNS can be activated on other interfaces, if desired, but this might not be necessary. The information given in this chapter focuses primarily on setting up CLNS only on the SDCC interfaces.

This chapter describes the process for setting up the management plane network. This network is comprised of three types of interfaces within the Cisco ONS 15304:

• Regenerator SDCC on SAM A and SAM B

• Management Ethernet interface (Ethernet 0)

• Serial (E1) interface(s)

The SDCC channels provide an in-band management path within STM-1 fiber rings, of which there are two interfaces, one for each side of the fiber. The management Ethernet interface is used primarily as a high-speed local access port for craft user access, but could be used to connect to another router to connect to the DCN network. The serial E1 interfaces, which are normally used for user services, can be redirected and used to carry management traffic instead.

Provisioning the Cisco ONS 15304 to permit remote manageability involves the configuration processes described below. The remaining sections in this chapter are organized according to this series of processes, in the following order:

1. Enabling CLNS---CLNS packet forwarding and IS-IS and ES-IS routing processes should be started as a first step. A CLNS Network Entity Title (NET) needs to be assigned as part of this process. Without proper CLNS configuration, traffic to other network elements might be disrupted.

2. Configuring SDCC Interfaces---Two SDCC interfaces are present for the Cisco ONS 15304. Both SDCC interfaces must be configured with Q.921 and CLNS to achieve interoperability with other SDH standards-based network elements. This is usually the first, and most important, step. The Q.921 protocol support and CLNS feature set permit interoperability with other vendors' network elements.

3. Setting Up IP-over-Connectionless Network Protocol (CLNP) Tunnels---One or more IP-over-CLNP tunnels need to be created to allow IP traffic to be carried within CLNS packets. IP-over-CLNS tunnels can be used wherever CLNS traffic is carried. From the perspective of CLNS, each Cisco ONS 15304 can be seen as a separate IP "island" in a sea of CLNS. The tunnels are links that provide connectivity between the IP islands.

The IP-over-CLNP tunnels can be built between Cisco ONS 15304s on the same ring, or between the Cisco ONS 15304 and EMS separated across a DCN. The Cisco Transport Manager/ConnectWay tunneling software, available as part of the Element Management Software, can be used to terminate the tunnel at EMS sites. In other instances, it might be useful to build tunnels between a designated Cisco ONS 15304, serving as a hub for management traffic, and other Cisco ONS 15304s. The nominated Cisco ONS 15304 becomes a point where IP traffic is directed before being forwarded to other Cisco ONS 15304 network elements on the ring. Therefore, the Cisco ONS 15304 is designated as the management hub for the ring.

4. Enabling the Ethernet Management Interface---The Ethernet management port is intended for use as either a craft access port or an attachment to a central office LAN. If using a central office LAN, CLNS or IP must be configured on this port.

5. Using a Serial E1 Channel as a Management Interface---As an alternate connectivity solution, the serial channels in the Cisco ONS 15304 can be used as a management interface. That is, a serial channel that would otherwise be used for user traffic can be used to carry management traffic. Typically, a single E1 channel terminates on a designated Cisco ONS 15304 serving as a management hub, with IP-over-CLNP tunnels to other Cisco ONS 15304 devices on the ring. The serial E1 channel is treated like any other interface, and can run both IP and CLNS.

The serial E1 channel can also be used to overcome congestion within the gateway network element (GNE) by using one of the user E1 channels as a management data link. This configuration helps off-load some packet processing activities from the GNE.

6. Specifying an Access List---As a final step, IP access lists can be established to prevent user traffic from entering the management network, and vice versa. Because access lists vary from one network deployment to another, it is hard to specify the necessary configurations in a way that is sufficiently general for multiple applications. For this reason, this step is described without much detail.

As an alternative strategy, out-of-band management through an asynchronous modem or terminal server is also possible. This management strategy is not discussed here, but might be an option for some applications. The console port can interface to most standard modems, which support the ability to disable the AT command set. In this scenario, the SDCC links and CLNS might still need to be configured to allow traffic to traverse the Cisco ONS 15304 for compatibility.

In situations where only Cisco ONS 15304 routers are present in the SDH ring, it is possible to set up the SDCC network to operate with only IP protocols. Currently, there are no standards governing usage of IP within the SDCC, but IP protocols are supported by the Cisco ONS 15304 using HDLC, PPP, or Q.921 link layers. The SDCC interfaces can be treated like any other IP-capable interface. An IP address can be assigned to an SDCC link. Because IP can be used in its native form, tunneling is not be required.

CLNS must be enabled if any of the other network elements on the SDH/GR-253 ring require CLNS. The process for setting up CLNS on the Cisco ONS 15304 is straightforward, but must be configured carefully. The following steps provide a summary of configurations that work in most applications.

router isis
 

Step 5 Specify the Network Entity Title (NET) that will be used by the IS-IS routing process:

net (40-byte-nsap-and-n-selector)
 

Step 6 Exit configuration mode:

exit
 

For more information about other configuration options for CLNS, refer to Part 3 of the Cisco Network Protocols Configuration Guide.

no shutdown
 

Step 8 Exit configuration mode:

exit
 

Several steps are necessary when configuring a CLNP-over-IP tunnel. The steps involve:

• Initiating a CTunnel virtual interface

• Assigning an IP address to the interface

• Specifying the destination NSAP address of the remote tunnel endpoint

The NSAP address specifies where the tunnel terminates, and where the IP packet is extracted.

After typing each of the following commands, press the Enter key:

Step 1 Log in to the Cisco ONS 15304 at the ONS> prompt and enter the username and password when prompted:

login
 

Step 2 Enter configuration mode:

configure terminal
 

Step 3 Create an IP-over-CLNP tunnel:

interface CTunnel tunnel-id
 

The first instance of the virtual interface is always 0. The interface number must be incremented for each unique tunnel. Interface numbering always begins with the number 0.

Step 4 Specify the destination NSAP address of the tunnel:

ctunnel destination remote-NSAP-address
 

This address specifies where the tunnel ends, and where IP packet is extracted.

Step 5 Assign an IP address to the tunnel and specify the NSAP address of the remote tunnel endpoint:

ip address interface-address subnet-mask
 

Step 6 Activate the interface:

no shutdown
 

This step is not required, as the virtual interfaces automatically come up in the active state when created.

Step 7 Exit configuration mode:

exit
 

Multiple tunnels can be created to provide broader and more robust connectivity. For each new tunnel, the interface number must be incremented to guarantee it is unique.

The serial E1 interface is treated as another routable interface within the system. In most cases, the serial channel is configured to run IP, but it could be configured to run CLNS as well. The following instructions explain how to drop-terminate a channel and configure it for IP operation. CLNS can be configured on the serial interface in the same manner as the SDCC interfaces, but this configuration mode is not described here.

After typing each of the following commands, press the Enter key:

Step 1 Log in to the Cisco ONS 15304 at the ONS> prompt and enter the username and password when prompted:

login
 

Step 2 Enter configuration mode:

configure terminal
 

Step 3 Activate the STM-1 optical interface and the associated VC-4:

ine enter stm1 ab admin is
ine enter vc4 vc4-id path-type drop admin is
 

If the STM-1 and VC-4 have already been created, these two steps are not necessary. The STM-1 and VC-4 must be in the in-service state.

Step 4 Terminate the VC-12 and cross-connect it to the serial E1 interface:

ine enter vc12 vc12-id path-type drop admin is
ine enter seriale1 ser-id admin is
ine enter crs seriale1 ser-id vc12 vc12-id
 

Step 5 Enter interface configuration mode for the serial interface:

interface seriale1 ser-id
 

Step 6 Assign an IP address and activate the selected interface:

ip address interface address subnet mask
no shutdown
 

Step 7 Exit configuration mode:

exit

If a serial channel is used as a management channel, Cisco highly recommends using access lists to restrict user traffic from entering the serial channel. If access to the serial channel is not restricted, congestion might occur, along with a possible breach of security between the user and management plane networks. You can use Cisco security features to protect all management plane interfaces.

access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [established] [log]
 

To apply an access list to an interface, use the following command in interface configuration mode:

ip access-group {access-list-number | name} {in | out}
 

For outbound access lists, after receiving and routing a packet to a controlled interface, the software checks the source address of the packet against the access list. If the access list permits the address, the software transmits the packet. If the access list rejects the address, the software discards the packet and returns an ICMP Host Unreachable message.