cc/td/doc/product/atm/ls1010s/wa5/12
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Configuring System Management  Functions

Configuring System Management  Functions

This chapter describes the basic tasks for configuring general system features, such as access control and basic switch management. The following sections describe these tasks:

Note For a complete description of the commands mentioned in this chapter, refer to the LightStream  1010 ATM Switch and Catalyst  8510 MSR Command Reference publication.

System Management Tasks

The role of the administration interface is to provide a simple command-line interface to all internal management and debugging facilities of the ATM switch.

Configure Terminal Lines and Modem Support

The ATM switch has two types of terminal lines: a console line and an auxiliary line. For line configuration, you must first set up the lines for the terminals or other asynchronous devices attached to them. For a complete description of configuration tasks and commands used to set up your lines, modems, and terminal settings, refer to the Dial Solutions Command Reference and Configuration Fundamentals Command Reference publications.

Configure Alias

You can create aliases for commonly used or complex commands. Use word substitutions or abbreviations to tailor command syntax. For detailed instructions on performing these tasks, refer to the Cisco Configuration Fundamentals Configuration Guide publication.

Configure Buffers

To make adjustments to initial buffer pool settings and to the limits at which temporary buffers are created and destroyed, use the following global configuration command:
Command Task

buffers {small | middle | big | verybig | large |huge | type number}

Configure buffers; the default huge buffer size is 18024 bytes.

show buffers [all | assigned [dump]]

Display statistics for the buffer pools on the network server.

To display the buffer pool statistics, use the following privileged EXEC command:
Command Task

show buffers [address hex-addr | all | assigned | free | input-interface interface-type card/subcard/port | old | pool pool-name [dump | header | packet]] [failures]

Display statistics for the buffer pools on the network server.

Configure Cisco Discovery Protocol

To specify how often your ATM switch sends Cisco Discover Protocol (CDP) updates, perform the following tasks in global configuration mode:
Step Command Task
1

cdp holdtime seconds

Specify the hold time in seconds, to be sent in packets.

2

cdp timer seconds

Specify how often your ATM switch will send CDP updates.

3

cdp run

Enable CDP.

To reset CDP traffic counters to zero (0) on your ATM switch, perform the following tasks in privileged EXEC mode:
Step Command Task
1

clear cdp counters

Clear CDP counters.

2

clear cdp table

Clear CDP tables.

To show the CDP configuration, use the following privileged EXEC commands:
Command Task

show cdp

Display global CDP information.

show cdp entry-name [protocol | version]

Display information about a neighbor device listed in the CDP table.

show cdp interface [interface-type interface-number]

Display interfaces on with CDP enabled.

show cdp neighbors [interface-type interface-number] [detail]

Display CDP neighbor information.

show cdp traffic

Display CDP traffic information.

Configure Enable

To log on to the ATM switch at a specified level, use the following EXEC command:
Command Task

enable level

Enable login.

To configure the enable password for a given level, use the following global configuration command:
Command Task

enable password [level level] [encryption-type] password

Configure the enable password.

Configure Load-Interval

To change the length of time for which data is used to compute load statistics, perform the following tasks, beginning in global configuration mode:
Step Command Task
1

interface type card/subcard/port

Select the physical interface to be configured.

2

load-interval seconds

Configure the load interval.

Configure Logging

To log messages to a syslog server host, use the following global configuration commands:
Command Task

logging host

Configure the logging name or IP address of the host to be used as a syslog server.

logging buffered [level | size]

To log messages to an internal buffer, use the logging buffered global configuration command. The no logging buffered command cancels the use of the buffer and writes messages to the console terminal, which is the default.

logging console level

To limit messages logged to the console based on severity, use the logging console global configuration command.

logging facility facility-type

To configure the syslog facility in which error messages are sent, use the logging facility global configuration command. To revert to the default of local, use the no logging facility global configuration command.

logging monitor level

To limit messages logged to the terminal lines (monitors) based on severity, use the logging monitor global configuration command. This command limits the logging messages displayed on terminal lines other than the console line to messages with a level at or above level. The no logging monitor command disables logging to terminal lines other than the console line.

logging on

To control logging of error messages, use the logging on global configuration command. This command enables or disables message logging to all destinations except the console terminal. The no logging on command enables logging to the console terminal only.

logging trap level

To limit messages logged to the syslog servers based on severity, use the logging trap global configuration command. The command limits the logging of error messages sent to syslog servers to only those messages at the specified level. The no logging trap command disables logging to syslog servers.

logging source-interface interface-number

To specify the interface for source address in logging transactions.

Configure Login Authentication

To enable TACACS+ authentication for logins, perform the following steps, beginning in global configuration mode:
Command Task

line [aux | console | vty] line-number [ending-line-number]

Select the line to configure.

login [local | tacacs]

Configure login authentication.

Configure Scheduler

To control the maximum amount of time that can elapse without running the lowest-priority system processes, use the following global configuration commands:

Command Task

scheduler {allocate interrupt-time | interval process-time}

Configure the scheduler allocate integer that specifies the interval, in milliseconds. The minimum interval that you can specify is 500  milliseconds; there is no maximum value.

scheduler process-watchdog {hang | normal | reload | terminate}

Configure scheduler process-watchdog.

scheduler interval process-time

Specify maximum time in milliseconds before lowest priority process.

Configure Services

To configure miscellaneous system services, use the following global configuration commands:
Command Task

service alignment

Configure alignment correction and logging.

service compress-config

Compress the configuration file.

service config

Load config TFTP files.

service disable-ip-fast-frag

Disable IP particle-based fast fragmentation.

service exec-callback

Enable EXEC callback.

service exec-wait

Configure a delay of the start-up of the EXEC on noisy lines.

service finger

Allow Finger protocol requests (defined in RFC 742) from the network server.

service hide-telnet-addresses

Hide destination addresses in Telnet command.

service linenumber

Enable a line number banner for each EXEC.

service nagle

Enable the Nagle congestion control algorithm.

service old-slip-prompts

Allow old scripts to operate with SLIP/PPP.

service pad

Enable Packet Assembler Dissembler commands.

service password-encryption

Enable encrypt passwords.

service prompt

Enable a mode-specific prompt.

service slave-log

Enable log capability on slave IPs.

service tcp-keepalives {in | out}

Configure keepalive packets on idle network connections.

service tcp-small-servers

Enable small TCP servers (for example, ECHO).

service telnet-zero-idle

Set the TCP window to zero (0) when the Telnet connection is idle.

service timestamps

Display timestamp debug/log messages.

service udp-small-servers

Enable small UDP servers (for example, ECHO).

Configure SNMP

To create or update an access policy, use the following global configuration commands:
Command Task

snmp-server access-policy destination-party source-party context privileges

Configure global access policy.

snmp-server chassis-id text

Provide a message line identifying the SNMP server serial number.

snmp-server community string [RO | RW] [number]

Configure the SNMP community access string.

snmp-server contact text

Configure the system contact (syscontact) string.

snmp-server context context-name context-oid view-name

Configure a context record.

snmp-server enable

Enable SNMP traps or informs.

snmp-server host host community-string [envmon] [frame-relay] [sdlc] [snmp] [tty] [x25]

Configure the recipient of an SNMP trap operation.

snmp-server location text

Configure a system location string.

snmp-server packetsize byte-count

Configure the largest SNMP packet size permitted when the SNMP server is receiving a request or generating a reply.

snmp-server party party-name party-oid [protocol-address] [packetsize size] [local | remote] [authentication {md5 key [clock clock]
[lifetime lifetime] | snmpv1 string}]

Configure a party record.

snmp-server queue-length length

Configure the message queue length for each trap host.

snmp-server system-shutdown

Configure SNMP message reload.

snmp-server trap-authentication
[snmpv1 | snmpv2]

Configure trap message authentication.

snmp-server trap-timeout seconds

Configure how often to resend trap messages on the retransmission queue.

snmp-server view view-name mib-tree
{included | excluded}

Configure view entry.

To display the SNMP status, use the following EXEC command:
Command Task

show snmp

Check the status of communications between the SNMP agent and SNMP manager.

Username Commands

To establish a username-based authentication system at login, use the following global configuration commands:
Command Task

username name [dnis] [no password | password encryption-type password]

Configure username-based authentication system at login.

username name password secret

Configure username-based CHAP authentication system at login.

username name [autocommand command]

Configure username-based authentication system at login with an additional command to be added.

username name [noescape] [nohangup]

Configure username-based authentication system at login without escape but with another login prompt.

username name privilege level

Set user privilege level.

Configuring the Privilege Level

This section describes configuring and displaying the privilege level access to the ATM switch. The access privileges can be configured at the global level or at the line level for a specific line.

Configure Privilege Level (Global)

To set the privilege level for a command, use the following global configuration command:
Command Task

privilege mode level level command [type]

Set the privilege level.

To display your current level of privilege, use the following privileged EXEC command:
Command Task

show privilege

Display the privilege level.

Configure Privilege Level (Line)

To set the default privilege level for a line, perform the following tasks, beginning in global configuration mode:
Step Command Task
1

line [aux | console | vty] line-number [ending-line-number]

Select the line to configure.

2

privilege level level

Configure the default privilege level.

To display your current level of privilege, use the following privileged EXEC command:
Command Task

show privilege

Display the privilege level.

Configuring the Network Time Protocol

This section describes configuring the Network Time Protocol (NTP) on the ATM switch.

To control access to the system NTP services, use the following global NTP configuration commands. To remove access control to the system's NTP services, use the no ntp command. See the example configuration at the end of this section and the section "Display the NTP Configuration" to confirm the NTP configuration.

To see a list of the NTP commands enter a ? in EXEC configuration mode. The following example shows the list of commands available for NTP configuration:

Switch(config)# ntp ?

  access-group        Control NTP access
  authenticate        Authenticate time sources
  authentication-key  Authentication key for trusted time sources
  broadcastdelay      Estimated round-trip delay
  clock-period        Length of hardware clock tick
  master              Act as NTP master clock
  max-associations    Set maximum number of associations
  peer                Configure NTP peer
  server              Configure NTP server
  source              Configure interface for source address
  trusted-key         Key numbers for trusted time sources
  update-calendar     Periodically update calendar with NTP time

To control access to the system NTP services, use the following global configuration command:
Command Task

ntp access-group {query-only | serve-only | serve | peer} access-list-number

Configure an NTP access group.

To enable NTP authentication, perform the following steps in global configuration mode:
Step Command Task
1

ntp authenticate

Enable NTP authentication.

2

ntp authentication-key number md5 value

Define an authentication key.

To specify that a specific interface should send NTP broadcast packets, perform the following steps, beginning to global configuration mode:
Step Command Task
1

interface type card/subcard/port

Select the physical interface to be configured.

2

ntp broadcast [client | destination | key | version]

Configure the system to receive NTP broadcast packets.

As NTP compensates for the error in the system clock, it keeps track of the correction factor for this error. The system automatically saves this value into the system configuration using the ntp  clock-period global configuration command:

Caution Do not enter the ntp  clock-period command; it is documented for informational purposes only. The system automatically generates this command as NTP determines the clock error and compensates.

To prevent an interface from receiving NTP packets, perform the following steps, beginning in global configuration mode:
Step Command Task
1

interface type card/subcard/port

Select the physical interface to be configured.

2

ntp disable

Disable the NTP receive interface.

To configure the ATM switch as a NTP master clock to which peers synchronize themselves when an external NTP source is not available, use the following global configuration command
Command Task

ntp master [stratum]

Configure NTP master clock.

:

To configure the ATM switch as a NTP peer that receives its clock synchronization from an external NTP source, use the following global configuration command:
Command Task

ntp peer ip-address [version number] [key keyid] [source interface] [prefer]

Configure the system clock to synchronize a peer or to be synchronized by a peer.

To allow the ATM switch system clock to be synchronized by a time server, use the following global configuration command:
Command Task

ntp server ip-address [version number] [key keyid] [source interface] [prefer]

Configure the system clock to allow it to be synchronized by a time server.

To use a particular source address in NTP packets, use the following global configuration command:
Command Task

ntp source interface type card/subcard/port

Configure a particular source address in NTP packets.

To authenticate the identity of a system to which NTP will synchronize, use the following global configuration command:
Command Task

ntp trusted-key key-number

Configure an NTP synchronize number.

To periodically update the ATM switch calendar from NTP, use the following global configuration command:
Command Task

ntp update-calendar

Update an NTP calendar.

Example

The following example configures the ATM switch to synchronize its clock and calendar to an NTP server, using ethernet0, and other features:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# ntp server 198.92.30.32

Switch(config)# ntp source ethernet0

Switch(config)# ntp authenticate

Switch(config)# ntp max-associations 2000

Switch(config)# ntp trusted-key 22507

Switch(config)# ntp update-calendar

Display the NTP Configuration

To show the status of NTP associations, use the following privileged EXEC commands:
Command Task

show ntp associations [detail]

Display NTP associations.

show ntp status

Display the NTP status.

Examples

The following example displays detail NTP configuration:

Switch# show ntp associations detail

198.92.30.32 configured, our_master, sane, valid, stratum 3
ref ID 171.69.2.81, time B6C04E67.6E779000 (18:18:15.431 UTC Thu Feb 27 1997)
our mode client, peer mode server, our poll intvl 128, peer poll intvl 128
root delay 109.51 msec, root disp 377.38, reach 377, sync dist 435.638
delay -3.88 msec, offset 7.7674 msec, dispersion 1.57
precision 2**17, version 3
org time B6C04F19.437D8000 (18:21:13.263 UTC Thu Feb 27 1997)
rcv time B6C04F19.41018C62 (18:21:13.253 UTC Thu Feb 27 1997)
xmt time B6C04F19.41E3EB4B (18:21:13.257 UTC Thu Feb 27 1997)
filtdelay =    -3.88   -3.39   -3.49   -3.39   -3.36   -3.46   -3.37   -3.16
filtoffset =    7.77    6.62    6.60    5.38    4.13    4.43    6.28   12.37
filterror =     0.02    0.99    1.48    2.46    3.43    4.41    5.39    6.36

The following example displays the NTP status:

Switch# show ntp status

Clock is synchronized, stratum 4, reference is 198.92.30.32
nominal freq is 250.0000 Hz, actual freq is 249.9999 Hz, precision is 2**24
reference time is B6C04F19.41018C62 (18:21:13.253 UTC Thu Feb 27 1997)
clock offset is 7.7674 msec, root delay is 113.39 msec
root dispersion is 386.72 msec, peer dispersion is 1.57 msec

Configuring the Clock and Calendar

If no other source of time is available, you can manually configure the current time and date after the system is restarted. The time will remain accurate until the next system restart. Cisco recommends that you use manual configuration only as a last resort.

Note If you have an outside source to which the ATM switch can synchronize, you do not need to manually set the system clock.

Configure the Clock

To configure, read, and set the ATM switch as a time source for a network based on its calendar, perform the following steps in global configuration mode:
Step Command Task
1

clock calendar-valid

Set the ATM switch as the default clock.

2

clock summer-time zone recurring [week day month hh:mm week day month hh:mm [offset]]

Configure the system to automatically switch to summer time (daylight savings time), use one of the formats of the clock summer-time configuration command.

3

clock timezone zone hours [minutes]

Configure the system time zone.

To manually read and set the calendar into the ATM switch system clock, perform the following steps in privileged EXEC mode:
Step Command Task
1

clock read-calendar

Manually read the calendar.

2

clock set hh:mm:ss day month year

Manually set the system clock.

3

clock update-calendar

Set the calendar.

To display the system clock information , use the following EXEC command
Command Task

show clock [detail]

Display the system clock.

:

Configure the Calendar

To set the system calendar, use the following privileged EXEC command:
Command Task

calendar set hh:mm:ss day month year

Configure the calendar.

To display the system calendar information, use the following EXEC command:
Command Task

show calendar

Display the calendar setting.

Configuring the Terminal Access Control Access System

You can configure the ATM switch to use one of three special TCP/IP protocols related to Terminal Access Controller Access Control System (TACACS): regular TACACS, extended TACACS, or AAA/TACACS+. TACACS services are provided by and maintained in a database on a TACACS server running on a workstation. You must have access to and configure a TACACS server before configuring the TACACS features described in this publication on your Cisco device. Cisco's basic TACACS support is modeled after the original Defense Data Network (DDN) application.

A comparative description of the supported versions follows. Table 4-1 compares the versions by commands.

You can establish TACACS-style password protection on both user and privileged levels of the system EXEC.


Table 4-1: TACACS Command Comparison
Command TACACS Extended TACACS TACACS+

aaa accounting

X

aaa authentication arap

X

aaa authentication enable default

X

aaa authentication login

X

aaa authentication local override

X

aaa authentication ppp

X

aaa authorization

X

aaa new-model

X

arap authentication

X

arap use-tacacs

X

X

enable last-resort

X

X

enable use-tacacs

X

X

login authentication

X

login tacacs

X

X

ppp authentication

X

X

X

ppp use-tacacs

X

X

X

tacacs-server attempts

X

X

X

tacacs-server authenticate

X

X

tacacs-server extended

X

tacacs-server host

X

X

X

tacacs-server key

X

tacacs-server last-resort

X

X

tacacs-server notify

X

X

tacacs-server optional-passwords

X

X

tacacs-server retransmit

X

X

X

tacacs-server timeout

X

X

X

Enable TACACS and Extended TACACS

This sections describes the features available with TACACS and Extended TACACS. The Extended TACACS software is available using FTP (see the README file in the ftp.cisco.com directory).

Note Many original TACACS and extended TACACS commands cannot be used after you have initialized AAA/TACACS+. To identify which commands can be used with the three versions, refer to Table 4-1.

The following sections describe TACACS configuration and refer you to additional resources:

Configure AAA Access Control with TACACS+

To enable the AAA access control model that includes TACACS+, use the following global configuration command:
Command Task

aaa new-model

Enable the AAA access control model.

Configure AAA Accounting

To enable the AAA accounting of requested services for billing or security purposes when using TACACS+, perform the following steps in global configuration mode:
Step Command Task
1

aaa accounting system

Perform accounting for all system-level events not associated with users, such as reloads.

2

aaa accounting network

Run accounting for all network-related service requests, including SLIP, PPP, PPP NCPs, and ARAP.

3

aaa accounting connection

Run accounting for outbound Telnet and rlogin.

4

aaa accounting exec

Run accounting for Execs (user shells). This keyword might return user profile information such as autocommand information.

5

aaa accounting command

Run accounting for all commands at the specified privilege level.

6

start-stop tacacs+

Send a start record accounting notice at the beginning of a process and a stop record at the end of a process. The start accounting record is sent in the background. The requested user process begins regardless of whether or not the start accounting record was received by the accounting server.

7

wait-start tacacs+

As in start-stop, sends both a start and a stop accounting record to the accounting server. However, if you use the wait-start keyword, the requested user service does not begin until the start accounting record is acknowledged. A stop accounting record is also sent.

8

stop-only tacacs+

Send a stop record accounting notice at the end of the requested user process.

Configure TACAS Server

Refer to the Cisco Router Products Configuration Guide for details about the TACAS configuration tasks that include:

Configure PPP Authentication

Refer to the Cisco Dial Solutions Configuration Guide for details about the PPP Authentication configuration tasks that include:

Testing the System Management Functions

This section describes the commands used to monitor and display the system management functions.

Show Active Processes

To display information about the active processes, use the following privileged EXEC commands:
Command Task

show processes [cpu]

Display active processes.

show processes memory

Display memory utilization.

Show Protocols

To display the configured protocols, use the following privileged EXEC command :
Command Task

show protocols type card/subcard/port

Display the global and interface-specific status of any configured Level 3 protocol; for example, IP, DECnet, Internet Packet Exchange (IPX), and AppleTalk.

Show Stacks

To monitor the stack utilization of processes and interrupt routines, use the following privileged EXEC command:
Command Task

show stacks number

Display system stack trace information.

The show stacks display includes the reason for the last system reboot. If the system was reloaded because of a system failure, a saved system stack trace is displayed. This information is of use only to Cisco engineers analyzing crashes in the field. It is included here in case you need to read the displayed statistics to an engineer over the phone.

Show Routes

To discover the IP routes that the ATM switch packets will actually take when traveling to their destination, use the following EXEC command:
Command Task

traceroute [protocol] [destination]

Display packets through the network.

Show Environment

To display temperature and voltage information on the ATM switch console, use the following EXEC command:
Command Task

show environment

Display temperature and voltage information.

Check Basic Connectivity

To diagnose basic ATM and IP network connectivity, use the following privileged EXEC command:
Command Task

ping atm interface atm card/subcard/port vpi [vci] {[atm-prefix prefix] | [end-loopback] | [ip-address address] | [seg-loopback]}

Use ping to check the ATM network connection.


hometocprevnextglossaryfeedbacksearchhelp
Copyright 1989-1998 © Cisco Systems Inc.