Вы находитесь на странице: 1из 57

IOS XR

Practical Introduction

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

IOS XR Introduction Agenda (AUDIO)

Brief History of IOS XR


Command Modes and Node Addresses
Configuration Model
Command Authorization
Basic Security
Software Installation

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

History of IOS XR
IOS originally optimized for slow CPUs

(circa 1987)

CPUs performing all switching operations


No pre-emptive multitasking
No process memory protection

IOS XR started in 1997 as IOS NG


Engineering-initiated clean up project
Initially focused on 7200

Called ENA in 2000 focused on GSR


2001 refocused on CRS-1
2004 Official release on CRS-1 (version 2.0)
2005 Released on 12000 (version 3.0)

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

XR Command Modes
SDR Exec Normal operations - monitoring routing and CEF
RP/0/RP0/CPU0:router#

show ipv4 interfaces brief


show install active

show running-config
show cef summary location 0/5/CPU0

SDR Config Configuration for L3 Node


RP/0/RP0/CPU0:router(config)#
router bgp 100
mpls ldp

taskgroup admins
policy-map foo
ipv4 access-list block-junk

Admin Chassis operations, outside of SDRs


RP/0/RP0/CPU0:router(admin)#

show controllers fabric plane all (CRS)


show controllers fabric clock (12K)

config-register 0x0
install add (also in SDR)

Admin Config
RP/0/RP0/CPU0:router(admin-config)#
sdr backbone location 0/5/*
pairing reflector location 0/3/* 0/4/*
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Node Addressing on CRS-1


[RACK]/SM0/SP

POWER
SUPPLIES
CRS-1

interface gig [RACK/SLOT/BAY/PORT]

CABLE MGMT

PLIM

FAN
CTRL

PLIM

POWER
SUPPLIES
AIR OUT
FAN TRAY

[RACK]/0/CPU0

[RACK]/RP1/CPU0

F
A
B
MSC R MSC
I
C

[RACK]/0/SM0

CABLE MGMT

PLIM

R R
P P

PLIM

AIR
INTAKE

XR Training / lwigley

CABLE MGMT
RP/0/RP0/CPU0:CRS(admin)#show platform
Node
Type
PLIM
State
Config State
-------------------------------------------------------------------------0/0/SP
UNKNOWN(SP)
N/A
PRESENT
PWR,NSHUT,MON
0/2/SP
MSC(SP)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/2/CPU0
MSC
4OC192-POS/DPT IOS XR RUN
PWR,NSHUT,MON
0/5/SP
MSC(SP)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/5/CPU0
MSC
Jacket Card
IOS XR RUN
PWR,NSHUT,MON
0/5/0
MSC(SPA)
8X1GE
OK
PWR,NSHUT,MON
0/7/SP
UNKNOWN(SP)
N/A
PRESENT
PWR,NSHUT,MON
0/RP0/CPU0
RP(Active)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/SM0/SP
FC/S(SP)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/SM1/SP
FC/S(SP)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/SM2/SP
FC/S(SP)
N/A
IOS XR RUN
PWR,NSHUT,MON
0/SM3/SP
FC/S(SP)
N/A
IOS XR RUN
WR,NSHUT,MON

2006 Cisco Systems, Inc. All rights reserved.

F
A
B
MSC R MSC
I
C
FAN TRAY

Cisco Confidential

Configuration Model and Tools

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Configuration Key Concepts


Two Stage Commit
Config History Database
Rollback
Atomic vs. Best Effort
Multiple Config Sessions

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Two Stage Commit


Active Configuration
Before Commit

Enter Proposed Changes

Active Configuration
After Commit

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0

Commit
Changes take effect

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
Interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
Cisco Confidential

Two Stage Commit Verification


Syntax first, then full check during commit
Active Configuration
Before Commit

Syntax Check
after each line

Active Configuration
After Commit

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0

Semantic Check

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

during commit

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
Interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
Cisco Confidential

Commit History and Labels


Commit History
interface gig 0/3/0/5
ipv4 address 9.9.9.9/24

#1

router ospf 100


area 0
interface gig 0/3/0/5

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

#2

BGP Change

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2

Enter Proposed Changes

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0

#3
#4

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Commit

Unique ID Automatically
Generated
Earlier commit
with optional label
Changes added to
commit history
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
Interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
Cisco Confidential

10

Rollback a Specific Commit

(config)#load rollback changes BGP_Change (or commit id)


Commit History
interface gig 0/3/0/5
ipv4 address 9.9.9.9/24

#1

router ospf 100


area 0
interface gig 0/3/0/5

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

#2

BGP_Change

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0

no router bgp 100

2006 Cisco Systems, Inc. All rights reserved.

router ospf 100


area 0
no interface gig 0/3/0/5

no router bgp 100

interface gig 0/3/0/2


no ipv4 address 9.19.9.9/24

#4

interface gig 0/3/0/0


no ipv4 address 9.9.9.9/24

#5

Commit

XR Training / lwigley

interface gig 0/3/0/5


no ipv4 address 9.9.9.9/24

#3

no router bgp 100

Target Configuration

Rollback

Another entry in commit


history generated

router ospf 100


area 0
no interface gig 0/3/0/2

router ospf 100


area 0
no interface gig 0/3/0/0

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
Interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
Cisco Confidential

11

Rollback To Previous Commit

(config)#load rollback changes to BGP_Change (or commit id)


Commit History
interface gig 0/3/0/5
ipv4 address 9.9.9.9/24

#1

router ospf 100


area 0
interface gig 0/3/0/5

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

#2

BGP_Change

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0

no router
interface
no ipv4
interface
no ipv4

no router
interface
no ipv4
interface
no ipv4
router
area
no
no

bgp 100
gig 0/3/0/2
address 9.19.9.9/24
gig 0/3/0/0
address 9.9.9.9/24

bgp 100
gig 0/3/0/2
address 9.19.9.9/24
gig 0/3/0/0
address 9.9.9.9/24

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

interface gig 0/3/0/5


no ipv4 address 9.9.9.9/24
router ospf 100
area 0
no interface gig 0/3/0/5

interface gig 0/3/0/2


no ipv4 address 9.19.9.9/24

#4

interface gig 0/3/0/0


no ipv4 address 9.9.9.9/24

#5

Commit

All changes back to and


including those made with
the commit referenced

no router bgp 100

#3

router ospf 100


area 0
no interface gig 0/3/0/2
no interface gig 0/3/0/0

ospf 100
0
interface gig 0/3/0/2
interface gig 0/3/0/0

Rollback

router ospf 100


area 0
no interface gig 0/3/0/2

router ospf 100


area 0
no interface gig 0/3/0/0
no router
interface
no ipv4
interface
no ipv4
router
area
no
no

bgp 100
gig 0/3/0/2
address 9.19.9.9/24
gig 0/3/0/0
address 9.9.9.9/24

ospf 100
0
interface gig 0/3/0/2
interface gig 0/3/0/0

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Cisco Confidential

12

Rollback Last X Commits


(config)#load rollback changes last 2

Commit History
interface gig 0/3/0/5
ipv4 address 9.9.9.9/24

#1

router ospf 100


area 0
interface gig 0/3/0/5

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

#2

BGP_Change

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0

interface
no ipv4
interface
no ipv4
router
area
no
no

interface
no ipv4
interface
no ipv4
router
area
no
no

gig 0/3/0/2
address 9.19.9.9/24
gig 0/3/0/0
address 9.9.9.9/24

ospf 100
0
interface gig 0/3/0/2
interface gig 0/3/0/0

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

interface gig 0/3/0/5


no ipv4 address 9.9.9.9/24
router ospf 100
area 0
no interface gig 0/3/0/5

no router bgp 100

#3

interface gig 0/3/0/2


no ipv4 address 9.19.9.9/24

#4

interface gig 0/3/0/0


no ipv4 address 9.9.9.9/24

#5

gig 0/3/0/2
address 9.19.9.9/24
gig 0/3/0/0
address 9.9.9.9/24

ospf 100
0
interface gig 0/3/0/2
interface gig 0/3/0/0

Rollback

Commit

router ospf 100


area 0
no interface gig 0/3/0/2

router ospf 100


area 0
no interface gig 0/3/0/0

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2
interface gig 0/3/0/0

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Cisco Confidential

13

Load Changes from Last 2 Commits


(config)#load commit changes last 2

Commit History
interface gig 0/3/0/5
ipv4 address 9.9.9.9/24

#1

router ospf 100


area 0
interface gig 0/3/0/5

router bgp 100


address-family ipv4 unicast
neighbor 5.5.5.5
remote-as 87

#2

BGP_Change

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
router ospf 100
area 0
interface gig 0/3/0/2

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
router ospf 100
area 0
interface gig 0/3/0/0

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
!
interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
router ospf 100
area 0
interface gig 0/3/0/0
interface gig 0/3/0/2

interface gig 0/3/0/2


ipv4 address 9.19.9.9/24
!
interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
router ospf 100
area 0
interface gig 0/3/0/0
interface gig 0/3/0/2

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Rollback
interface gig 0/3/0/5
no ipv4 address 9.9.9.9/24
router ospf 100
area 0
no interface gig 0/3/0/5

no router bgp 100

#3

interface gig 0/3/0/2


no ipv4 address 9.19.9.9/24

#4

interface gig 0/3/0/0


no ipv4 address 9.9.9.9/24

#5

Commit

router ospf 100


area 0
no interface gig 0/3/0/2

router ospf 100


area 0
no interface gig 0/3/0/0

interface
no ipv4
interface
no ipv4

gig 0/3/0/0
address 9.9.9.9/24
gig 0/3/0/2
address 9.19.9.9/24

router ospf 100


area 0
no interface gig 0/3/0/2
no interface gig 0/3/0/0

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1
hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router ospf 100
area 0
area 1
interface pos 0/4/0/0
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Cisco Confidential

14

Commit Atomic Default Commit Behavior


All or Nothing Any semantic failure stops commit
Active Configuration
Before Commit

Syntax Check
after each line

PASSES

Active Configuration
After Commit

No Change

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
taskgroup bgp
task read bgp
task write bgp

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Semantic Check
during commit

FAILS

BGP cannot be
taskgroup name

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

15

Commit Best Effort

Commit as much as possible, even if semantic check fails


Active Configuration
Before Commit

Syntax Check
after each line

PASSES

Active Configuration
After Commit

Partial Commit

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24
taskgroup bgp
task read bgp
task write bgp

Semantic Check
during commit

FAILS

BGP cannot be
taskgroup name

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

hostname Backbone-CRS
line default
exec-timeout 1440 0
!
interface gig 0/3/0/0
ipv4 address 9.9.9.9/24
!
taskgroup ops
task read boot
task write boot
task execute bgp
!
router static
address-family ipv4 unicast
0.0.0.0/0 7.1.9.1
7.7.7.77/32 7.1.9.1

Target Configuration
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

16

Behavior With Multiple Commits


Two or more users in config mode at same time

Use config exclusive to block


other users from committing

Enter Proposed Changes

Enter Proposed Changes

interface gig 0/3/0/0


ipv4 address 9.9.9.9/24

interface gig 0/3/0/0


ipv4 address 9.9.9.7/24

router ospf 100


area 0
interface gig 0/3/0/0
area 1
interface pos 0/4/0/0

router ospf 100


area 2
interface gig 0/3/0/0
area 4
interface pos 0/4/0/0

First to Commit

Second to Commit

Normal Commit

One or more commits have occurred from


other configuration sessions since this
session started or since the last commit
was made from this session.
You can use the 'show configuration commit
changes command to browse the changes.
Do you wish to proceed with this commit
anyway? [no]:

only first users changes

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

17

Other Commit/Config Options


commit confirmed - Automatic rollback if not confirmed
commit replace Replaces active config with target (WARNING)
commit label Adds label which can be used to reference commit
commit comment Adds a comment (cannot be referenced)
clear Clear target config, go to top level, stay in config mode
abort Clear target config mode, exit config mode

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

18

Preconfiguration / OIR
Interfaces can be preconfigured
Configuration will become active when matching HW inserted

Future interface can be assigned to routing protocols


OIR moves configuration to preconfigured state

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

19

Monitoring Configuration
From Config Mode

show Display target config for current sub-mode


show config Display entire target config
show config merged Display target and active config together
show config running Display active config
show config rollback Display possible rollback options
show config failed Display config that failed semantic check

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

20

Monitoring Configuration (check audio)


From SDR Exec Mode

RP/0/RP0/CPU0:CRS#show running-config
Building configuration...
!! Last configuration change at 12:17:03 UTC Wed Jun 28 2006 by ww
!
hostname CRS
line default
exec-timeout 1440 0

RP/0/RP0/CPU0:CRS#show config commit list


SNo. Label/ID
User
Line
Client
~~~~ ~~~~~~~~
~~~~
~~~~
~~~~~~
1
1000000296 ww
con0_RP0_C CLI
2
1000000295 ww
con0_RP0_C CLI
3
1000000294 ww
vty0
CLI
4
1000000293 admin
vty0
CLI
5
1000000292 admin
vty0
CLI

Time Stamp
~~~~~~~~~~
12:17:03 UTC
12:16:47 UTC
12:09:03 UTC
06:47:51 UTC
06:47:18 UTC

Wed
Wed
Wed
Wed
Wed

Jun
Jun
Jun
Jun
Jun

28
28
28
28
28

2006
2006
2006
2006
2006

RP/0/RP0/CPU0:CRS#show config commit changes last 5


Building configuration...
hostname CRS
policy-map edge
class prec_5
bandwidth remaining percent 50
RP/0/RP0/CPU0:CRS#show config sessions
Session
Line
User
00000201-0014e0da-00000000 vty0
ww

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Date
Wed Jun 28 12:58:14 2006

Lock
*

Cisco Confidential

21

Configuration Notes
Default configurations not shown
show running isnt effective for system inventory

Unconfigured interfaces not shown


Individual config blocks can be displayed
RP/0/RP0/CPU0:CRS#show run router bgp
router bgp 65000
address-family ipv4 unicast
!
neighbor 10.254.254.1
remote-as 1
address-family ipv4 unicast
route-policy inbound in
!
!
neighbor 192.168.0.1
remote-as 2
address-family ipv4 unicast
route-policy inbound in
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

22

Task Based Command Authorization

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

23

Command Authorization Key Concepts


Tasks
Task Groups
User Groups
Inheritance
On-Box vs. TACACS/RADIUS

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

24

Tasks
Building blocks for on-box authorization scheme
4 types of permissions per task
Read

Tasks

Write

aaa

config-services

hsrp

netflow

sbc

acl

crypto

interface

network

snmp

Execute

admin

diag

inventory

ospf

sonet-sdh

atm

disallowed

ip-services

ouni

static

Debug

basic-services

drivers

ipv4

pkg-mgmt

sysmgr

bcdl

eigrp

ipv6

pos-dpt

system

bfd

ext-access

isis

ppp

transport

bgp

fabric

logging

qos

tty-access

boot

fault-mgr

lpts

rib

tunnel

bundle

filesystem

monitor

rip

universal

cdp

firewall

mpls-ldp

root-lr

vlan

cef

fr

mpls-static

root-system

vrrp

cisco-support

hdlc

mpls-te

route-map

config-mgmt

host-services

multicast

route-policy

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

25

Task and User Group Example


Read

Write

Execute

Debug

aaa

aaa

aaa

aaa

acl

acl

acl

acl

admin

admin

admin

admin

atm

atm

atm

atm

basic-services basic-services basic-services


bcdl

bcdl

bcdl

bcdl

bfd

bfd

bfd

bfd

bgp

bgp

bgp

bgp

taskgroup basic-admin
task read acl
task read bfd
task read bgp
task write acl
task write bfd
task write bgp
task debug bgp
XR Training / lwigley

basic-services

2006 Cisco Systems, Inc. All rights reserved.

usergroup noc-staff
taskgroup operator
taskgroup basic-admin
inherit usergroup all-users
!
usergroup allusers
taskgroup basic-stuff
Cisco Confidential

26

Which Tasks are Required?


RP/0/5/CPU0:iox(config)#describe router bgp 100
Package:
c12k-rout
c12k-rout V3.3.0[00] Routing protocols for 124xx
Vendor : Cisco Systems
Desc
: Routing protocols for 124xx
Build : Built on Wed May 10 10:30:27 UTC 2006
Source : By edde-bld1 in /vws/aga/production/3.3.0
Card(s): RP, DRP, DRPSC
Restart information:
Default:
parallel impacted processes restart
Component:
ipv4-bgp V[r33x/3]

IPv4 Border Gateway Protocol (BGP)

User needs ALL of the following taskids:


bgp (READ WRITE)

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

27

On-Box vs. Off-Box Authorization


On-Box authorization must use task model
Off-Box authorization with RADIUS/TACACS
Can configure per-command authorization

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

28

Basic XR Security

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

29

XR Access List Concepts


All ACLs are Named
Numbers ok, but treated as text

ACLs have sequence numbers


Allows removal of specific line
resequence command to renumber

ipv4 access-list ingress-filter


10 permit tcp any any eq 2342
20 permit udp any host 7.7.7.7
30 deny ipv4 any host 6.6.6.6
40 permit ipv4 any any

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

30

LPTS and GTSM in Line Card HW


Local Packet Transport Services
Provides per-type rate limiting for traffic to the router
(More info in SW Arch Section)

Generic TTL Security Mechanism


Filter routing packets with invalid TTL

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

31

Management Interfaces (New in 3.5)


Specific interfaces must be flagged for mgmt traffic
Incoming telnet/SNMP/XML on these interfaces only
Function is on by default
Only MgmtEth for mgmt traffic
Must configure additional interfaces
control-plane
management-plane
inband
interface all
allow Telnet

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

32

Software Installation

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

33

Software Install Terminology

Mini?

PIE?
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Package?

SMU?
Cisco Confidential

34

Packages Bundles of Software

MGBL

SEC

Optional
MPLS

MCAST

Routing
Line card
Forwarding

Mandatory

Admin
Base
OS-MBI

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

35

PIE Package Installation Envelope


PIEs are a delivery mechanism for packages
Used to deliver
Major release New functionality (3.3, 3.4, 3.5)
Maintenance release SW fixes (3.3.1, 3.3.2)
SMU Fix for a specific bug

Includes authentication info


Installed from admin or SDR exec mode
(self study students check speaker notes)

.vm files are the other delivery mechanism


.vm files are bootable images
Used as the Initial Install for GSR migration

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

36

Mini Bundle of Mandatory Packages


Composite image with mandatory packages
Two types - .vm and .pie (both approx 80MB)
Multiple uses
Quickly run an image without installing it

(.vm)

Initial install of IOS XR on 12000 series (.vm)


Recovery if system is corrupted (.vm)
Major/Maintenance upgrade (.pie)

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

37

Release Deliverables
From CCO - CRS-1-iosxr-3.5.0.tar
Which includes
Unicast Routing Composite PIE (aka mini)
Routing, LC, Forwarding, Admin, Base, MBI (min boot image)
Optional PIEs
Manageability
MPLS
Multicast
Security

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

38

Release Deliverables 3.5.2 RP


RP/0/RP0/CPU0:CRS#show install active detail

Node 0/RP0/CPU0 [RP]


Boot Image: /disk0/hfr-os-mbi-3.5.2/mbihfr-rp.vm
Active Packages:
disk0:hfr-mgbl-3.5.2
disk0:hfr-mpls-3.5.2
disk0:comp-hfr-mini-3.5.2
disk0:hfr-rout-3.5.2
disk0:hfr-lc-3.5.2
disk0:hfr-fwdg-3.5.2
disk0:hfr-admin-3.5.2
disk0:hfr-base-3.5.2
disk0:hfr-os-mbi-3.5.2

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

39

Release Deliverables 3.5.2 SP & LC


RP/0/RP0/CPU0:CRS#show install active detail

Node 0/2/SP [SP]


Boot Image: /disk0/hfr-os-mbi-3.5.2/sp/mbihfr-sp.vm
Active Packages:
disk0:comp-hfr-mini-3.5.2
disk0:hfr-admin-3.5.2
disk0:hfr-base-3.5.2
disk0:hfr-os-mbi-3.5.2
Node 0/2/CPU0 [LC]
Boot Image: /disk0/hfr-os-mbi-3.5.2/lc/mbihfr-lc.vm
Active Packages:
disk0:hfr-mpls-3.5.2
disk0:comp-hfr-mini-3.5.2
disk0:hfr-lc-3.5.2
disk0:hfr-fwdg-3.5.2
disk0:hfr-admin-3.5.2
disk0:hfr-base-3.5.2
disk0:hfr-os-mbi-3.5.2
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

40

EFT & Beta Release Numbering


IOS XR numbers releases differently than IOS
Internal & Beta builds are HIGHER than released build
Last part is reset to 0 for the major release (FCS)
EFT
Releases

3.2.8x
3.3.8x
XR Training / lwigley

Beta
Releases

3.0.9x
3.1.9x
3.2.9x
3.3.9x

2006 Cisco Systems, Inc. All rights reserved.

FCS
Version

3.0.0
3.1.0
3.2.0
3.3.0

Maintenance
Releases

3.0.1
3.1.1
3.2.1, 3.2.2
3.3.1, 3.3.2
Cisco Confidential

41

SMU Delivery
SMU is named by release and bugid
Usually 50-200kb PIE file
Examples
hfr-rout-3.2.2.CSCei63263.pie
hfr-base-3.2.2.CSCeh52427.pie

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

42

Potential Install Destinations

CRS-1
CRS has flash
to store image
on MSC

XR 12000

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

MEM DISK

MEM DISK

MEM DISK

RP0

RP1

DRP0

MEM DISK

DRP1

MEM

MEM

MEM

MEM

MEM

MEM

MEM

MEM

Flash

Flash

Flash

Flash

Flash

Flash

Flash

Flash

LC0

LC1

LC2

LC3

LC4

LC5

LC6

LC7

MEM DISK

MEM DISK

RP0

RP1

MEM DISK

DRP0

MEM DISK

DRP1

MEM

MEM

MEM

MEM

MEM

MEM

MEM

MEM

LC0

LC1

LC2

LC3

LC4

LC5

LC6

LC7

Cisco Confidential

43

TURBOBOOT Install (CRS-1)

Boot from .vm file and install to RP disks and LC flash


Step 1

Load mini .vm image into memory


Boot from disk or network

Routing
Line card

MEM DISK

MEM DISK

MEM DISK

RP0

RP1

DRP0

Forwarding

MEM DISK

DRP1

Admin
Base
OS-MBI

MEM

MEM

MEM

MEM

MEM

MEM

MEM

MEM

Flash

Flash

Flash

Flash

Flash

Flash

Flash

Flash

LC0

LC1

LC2

LC3

LC4

LC5

LC6

LC7

Disk0, Disk1, or TFTP Server

Step 2

Router installs packages to flash


disks on RPs and flash on LCs
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Step 3

Reload from disk

Cisco Confidential

44

TURBOBOOT Install (12000)


Step 1

Load mini .vm image into memory

Routing
Line card
Forwarding

MEM DISK

MEM DISK

MEM DISK

RP0

RP1

DRP0

MEM DISK

DRP1

Admin
Base

MEM

MEM

MEM

MEM

MEM

MEM

MEM

MEM

LC0

LC1

LC2

LC3

LC4

LC5

LC6

LC7

OS-MBI
Disk0, Disk1, or TFTP Server

Step 2

Router installs packages to


RP flash disks

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Step 3

Reload from disk

Cisco Confidential

45

TURBOBOOT In Action
\

TURBOBOOT: Copying the packages to disk0:


RP/0/7/CPU0:May 18 11:21:28.390 : instdir[196]: %INSTALL-INSTMGR-6INSTALL_OPERATION_STARTED : Install operation 1 'install copy-package mem: to
disk0:' started by user '(Unknown)'
Install operation 1 'install copy-package mem: to disk0:' started by user
'(Unknown)' at 11:21:28 UTC Thu May 18 2006.
Info:
Checking available free space in disk0:
Info:
Copying installed files from mem: to disk0:
Info:
Copying component 'boot-mbi-prp-drp' size > 9 MB.
Info:
Copying component 'c12000-boot-mbiprp.4k' size > 7 MB.
Info:
Copying component 'boot-mbi-prp' size > 9 MB.
Info:
Copying component 'installmgr' size > 2 MB.
Info:
Copying component 'config-cfgmgr' size > 1 MB.
Info:
Copying component 'doc-hfr-base' size > 2 MB.
Info:
Copying component 'ifmgr.4k' size > 1 MB.
Info:
Copying component 'ifmgr' size > 1 MB.
Info:
Copying component 'infra-distrib.4k' size > 1 MB.
Info:
Copying component 'infra-distrib' size > 1 MB.
Info:
Copying component 'doc-hfr-admin' size > 1 MB.
Info:
Copying component 'drivers-vpa-infra.4k' size > 1 MB.

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

46

PIE Installation Concepts


PIE install used once system is operational
Packages can be added or upgraded
System performs sanity checks
Install from SDR Exec or Admin Mode
Install from SDR impacts just that SDR

3 phase install
Add Copy package and unpack
Activate Restart processes/nodes with new code
Commit Lock activated packages through reload

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

47

install add Command

Copy image to disk, verify, and unpack


RP/0/0/CPU0:P4(admin)#install add tftp://172.21.116.8/c12k-mcast.pie-3.2.85.3I
Install: The idle timeout on this line will be suspended for synchronous install operations
Install: Starting install operation. Do not insert or remove cards until the operation
completes.
RP/0/0/CPU0:P4(admin)#
Install: Now operating in asynchronous mode. Do not attempt subsequent install operations
until this operation is complete.
Install 3: [ 0%] Install operation 'add /tftp://172.21.116.8/c12k-mcast.pie-3.2.85.3I to
disk0:' assigned request id: 3
Install 3: [ 1%] Downloading PIE file from /tftp://172.21.116.8/c12k-mcast.pie-3.2.85.3I
Install 3: [ 1%]
Transferred 3298994 Bytes
Install 3: [ 1%] Downloaded the package to the router
Install 3: [ 1%] Verifying the package
Install 3: [ 1%] [OK]
Install 3: [ 1%] Verification of the package successful [OK]
Install 3: [ 95%] Going ahead to install the package...
Install 3: [ 95%] Add of '/tftp://172.21.116.8/c12k-mcast.pie-3.2.85.3I' completed.
Install 3: [100%] Add successful.
Install 3: [100%] The following package(s) and/or SMU(s) are now available to be activated:
Install 3: [100%]
disk0:c12k-mcast-3.2.85
Install 3: [100%] Please carefully follow the instructions in the release notes when
activating any software
Install 3: [100%] Idle timeout on this line will now be resumed for synchronous install
operations

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

48

install activate Command


Begin executing new software

RP/0/0/CPU0:P4(admin)#install activate disk0:c12k-mcast-3.2.85


Install: The idle timeout on this line will be suspended for synchronous install
operations
Install: Starting install operation. Do not insert or remove cards until the operation...
RP/0/0/CPU0:P4(admin)#
Install: Now operating in asynchronous mode. Do not attempt subsequent install operations
until this operation is complete.
Install 3: [ 0%] Install operation 'activate disk0:c12k-mcast-3.2.85' assigned request id: 3
Install 3: [ 1%] Performing Inter-Package Card/Node/Scope Version Dependency Checks
Install 3: [ 1%] [OK]
Install 3: [ 1%] Checking API compatibility in software configurations...
Install 3: [ 1%] [OK]
Install 3: [ 10%] Updating software configurations.
Install 3: [ 10%] RP,DRP:
Install 3: [ 10%] Activating c12k-mcast-3.2.85
Install 3: [ 10%] Checking running configuration version compatibility with newly activated
Install 3: [ 10%] No incompatibilities found between the activated software and router
configuration.

RP/0/0/CPU0:Nov 12 14:24:01.249 : instdir[181]: %INSTMGR-6-SOFTWARE_CHANGE_END :


Software change transaction 3 is COMPLETE.
Install 3: [100%] Performing software change
Install 3: [100%] Activation operation successful.
Install 3: [100%] NOTE: The changes made to software configurations will not be
Install 3: [100%] persistent across RP reloads. Use the command 'install commit'
Install 3: [100%] to make changes persistent.
Install 3: [100%] Idle timeout on this line will now be resumed for synchronous
install operations
XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

49

install commit Command


Lock in activated software across reload

RP/0/0/CPU0:P5(admin)#install commit
Install: The idle timeout on this line will be suspended for synchronous
install operations
Install 5: [ 1%] Install operation 'commit' assigned request id: 5
Install 5: [100%] Committing uncommitted changes in software configurations.
Install 5: [100%] Commit operation successful.
Install 5: [100%] Idle timeout on this line will now be resumed for
synchronous operations

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

50

Deactivating Packages

RP/0/0/CPU0:P5(admin)#install deactivate disk0:c12k-rp-mgbl-3.2.85


Install: The idle timeout on this line will be suspended for synchronous install
operations
Install: Starting install operation. Do not insert or remove cards until the operation
completes.
RP/0/0/CPU0:P5(admin)#
Install: Now operating in asynchronous mode. Do not attempt subsequent install operations
until this operation is complete.
Install 8: [ 0%] Install operation 'deactivate disk0:c12k-mgbl-3.2.85' assigned
request id: 8
Install 8: [ 1%] Package 'disk0:c12k-mgbl-3.2.85' is not active and cannot be deactivated.
Install 8: [ 1%] Idle timeout on this line will now be resumed for synchronous
install operations

Package features no longer available


Package still installed
Package can be reactivated

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

51

Display Installation Log


RP/0/0/CPU0:P4(admin)#show install log
Request id 1 by cisco at Tue May 31 10:41:12 2005:
1 pie added to disk0:: /tftp://172.21.116.8/c12k-mcast.pie-3.2.85.3I
Request id 2 by cisco at Tue May 31 11:02:51 2005:
1 pie added to disk0:: /tftp://172.21.116.8/c12k-mpls.pie-3.2.85.3I
Request id 3 by cisco at Tue May 31 11:06:31 2005:
1 package activated: disk0:c12k-mpls-3.2.85 test - Failed - 'Install Manager
' detected the 'fatal' condition 'Package compatibility check failed, incompatib
ilities detected.'
Request id 4 by cisco at Wed Jun 01 10:20:52 2005:
1 pie added to disk0:: /disk0:c12k-mini.pie-3.2.85.3I
Request id 5 by cisco at Wed Jun 01 11:02:24 2005:
1 package activated: disk0:c12k-mini-3.2.85
More information available via the command 'show install log 5'
Request id 6 by cisco at Wed Jun 01 11:26:32 2005:
Committed loadpath changes
5 entries shown (max log size 50 entries)

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

52

Display Installation Entries

RP/0/RP0/CPU0:P1(admin)#show install log 2


Request id 2 by cisco at Tue Apr 05 21:16:16 2005:
1 pie added to disk0:: /tftp://10.0.0.100/hfr-mpls-p.pie-3.2.83.1i
Status Information Logs:
Downloading PIE file from /tftp://10.0.0.100/hfr-mpls-p.pie-3.2.83.1i
Downloaded the package to the router
Verifying the package
[OK]
Verification of the package successful [OK]
Going ahead to install the package...
Add of '/tftp://10.0.0.100/hfr-mpls-p.pie-3.2.83.1i' completed.
Add successful.
The following package(s) and/or SMU(s) are now available to be activated:
disk0:hfr-mpls-3.2.83
Please carefully follow the instructions in the release notes
when activating any software

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

53

Installation Notes
On CRS-1, LC software is stored on LCs

(MSCs)

On 12000, LC image must be loaded over fabric


Option to Install multiple packages at once
install add tftp://1.1.1.1/A tftp://1.1.1.1/B tftp://1.1.1.1/C

Option to add and activate at same time


install add tftp://1.1.1.1/A activate

System does sanity checking, can be overridden


Clock must be set correctly

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

54

Package Installation Process Summary


Install from SDR Exec or Admin mode
install add from tftp/ftp/disk to disk0:
install activate to trigger the actual upgrade
Will trigger any process/LC/RP resets that are needed

install commit to lock in upgrade

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

55

Q and A

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

56

XR Training / lwigley

2006 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

57