Cisco 4000 Series ISRs Software Configuration Guide

Last Modified: March 31, 2015

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Text Part Number: OL-29328-03

CONTENTS

Preface

Preface xv

Objectives xv

Important Information on Features and Commands xv

Related Documentation

DescriptionConvention

A string is a nonquoted set of characters shown in

italics. For example, when setting an SNMP

community string to public, do not use quotation

marks around the string or the string will include the

quotation marks.

string

Command syntax descriptions use the following conventions:

DescriptionConvention

Bold text indicates commands and keywords that you

enter exactly as shown.

bold

Italic text indicates arguments for which you supply

values.

italics

Square brackets enclose an optional element (keyword

or argument).

[x]

A vertical line indicates a choice within an optional

or required set of keywords or arguments.

Square brackets enclosing keywords or arguments

separated by a vertical line indicate an optional

choice.

[x | y]

Braces enclosing keywords or arguments separated

by a vertical line indicate a required choice.

{x | y}

Nested sets of square brackets or braces indicate optional or required choices within optional or required

elements. For example:

DescriptionConvention

Braces and a vertical line within square brackets

indicate a required choice within an optional element.

[x {y | z}]

Examples use the following conventions:

DescriptionConvention

Examples of information displayed on the screen are

set in Courier font.

screen

Examples of text that you must enter are set in Courier

bold font.

bold screen

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 xvii

Preface

Document Conventions

DescriptionConvention

Angle brackets enclose text that is not printed to the

screen, such as passwords.

< >

An exclamation point at the beginning of a line

indicates a comment line. (Exclamation points are

also displayed by the Cisco IOS XE software for

certain processes.)

Square brackets enclose default responses to system

prompts.

[ ]

Means reader be careful. In this situation, you might do something that could result in equipment damage

or loss of data.

Caution

Means reader take note. Notes contain helpful suggestions or references to materials that may not be

contained in this manual.

Note

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information,

see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco

technical documentation at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.

Cisco 4000 Series ISRs Software Configuration Guide

xviii OL-29328-03

Preface

Obtaining Documentation and Submitting a Service Request

CHAPTER 1

Read Me First

Important Information about Cisco IOS XE 16

Effective Cisco IOS XE Release 3.7.0E (for Catalyst Switching) and Cisco IOS XE Release 3.17S (for

Access and Edge Routing) the two releases evolve (merge) into a single version of converged release—the

Cisco IOS XE 16—providing one release covering the extensive range of access and edge products in the

Switching and Routing portfolio.

The Feature Information table in the technology configuration guide mentions when a feature was

introduced. It might or might not mention when other platforms were supported for that feature. To

determine if a particular feature is supported on your platform, look at the technology configuration guides

posted on your product landing page. When a technology configuration guide is displayed on your product

landing page, it indicates that the feature is supported on that platform.

Note

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 1

Cisco 4000 Series ISRs Software Configuration Guide

2 OL-29328-03

Read Me First

CHAPTER 2

Overview

This document is a summary of software functionality that is specific to the Cisco 4000 Series Integrated

Services Routers (ISRs).

The following table lists the router models that belong to the Cisco 4000 Series ISRs.

Table 1: Cisco 4000 Series Router Models

Cisco ISR 4300 SeriesCisco ISR 4400 Series

•

Cisco ISR 4321

•

Cisco ISR 4331

•

Cisco ISR 4351

•

Cisco ISR 4431

•

Cisco ISR 4451

Unless otherwise specified, the information in this document is applicable to both Cisco 4400 series and

Cisco 4300 series routers.

Note

The following sections are included in this chapter:

•

Introduction, page 3

•

Sections in this Document, page 4

•

Processes, page 5

Introduction

The Cisco 4000 series ISRs are modular routers with LAN and WAN connections that can be configured by

means of interface modules, including Cisco Enhanced Service Modules (SM-Xs), and Network Interface

Modules (NIMs). NIM slots also support removable storage for hosted applications.

The following features are provided for enterprise and service provider applications:

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 3

•

Enterprise Applications

◦

High-end branch gateway

◦

Regional site aggregation

◦

Key server or PfR master controller

◦

Device consolidation or "Rack in a Box"

•

Service Provider Applications

◦

High-end managed services in Customer-Premises Equipment (CPE)

◦

Services consolidation platform

◦

Route reflector or shadow router

◦

Flexible customer edge router

The router runs Cisco IOS XE software, and uses software components in many separate processes. This

modular architecture increases network resiliency, compared to standard Cisco IOS software.

Sections in this Document

Table 2: Sections in this Document

DescriptionSection

Provides a high-level description of the router and

describes the main internal processes of the router.

Overview, on page 3

Describes the basics of using Cisco IOS XE software

with the router.

Using Cisco IOS XE Software, on page 9

Describes the uses of a Gigabit Ethernet management

interface and a web user interface.

Using the Management Interfaces, on page 35

Describes software features that are common across

Cisco IOS XE platforms.

Console Port, Telnet, and SSH Handling, on page

Contains important information about filesystems,

packages, licensing, and installing software.

Installing the Software, on page 67

Describes the basic tasks required to configure a

router.

Basic Router Configuration, on page 107

Provides information about the chassis slot numbers

and subslots where the service modules are installed.

Slot and Subslot Configuration, on page 121

Provides information about managing and monitoring

the health of various components of the router.

Process Health Monitoring, on page 125

Cisco 4000 Series ISRs Software Configuration Guide

4 OL-29328-03

Overview

Sections in this Document

DescriptionSection

Provides information about syslog messages.System Messages, on page 133

Describes the tracing function where logs of internal

events on a router are recorded.

Trace Management, on page 141

Describes the environmental monitoring features on

a router.

Environmental Monitoring and PoE Management,

on page 147

Provides information about high availability features

on a router to ensure network-wide protection.

Configuring High Availability, on page 173

Lists examples that include software installation and

packaging.

Configuration Examples, on page 287

Includes information about modules that can be

attached to the router and provides related links to

further documentation. For further details on

configuring the modules (NIMs and SMs), also see

the Documentation Roadmap.

Managing Cisco Enhanced Services and Network

Interface Modules, on page 245

Processes

The list of background processes in the following table may be useful for checking router state and

troubleshooting. However, you do not need to understand these processes to understand most router operations.

Table 3: Individual Processes

Sub Package MappingAffected FRUsPurposeProcess

RPControl

SIPBase

ESPBase

SIP

ESP

Controls chassis

management functions,

including management of

the High Availability

(HA) state, environmental

monitoring, and FRU

state control.

Chassis Manager

RPControl

SIPBase

ESPBase

SIP

ESP

Provides an interface

between the IOS process

and many of the

information gathering

functions of the

underlying platform

kernel and operating

system.

Host Manager

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 5

Overview

Processes

Sub Package MappingAffected FRUsPurposeProcess

RPControl

SIPBase

ESPBase

SIP

ESP

Provides IOS logging

services to processes

running on each FRU.

Logger

RPIOSRPImplements all

forwarding and routing

features for the router.

IOS

RPControl

ESPBase

ESP

Manages downloading of

configuration details to

the ESP and the

communication of

forwarding plane

information, such as

statistics, to the IOS

process.

Forwarding Manager

RPControlRPProvide integration

between platform policy

applications, such as

authentication and the

IOS process.

Pluggable Services

RPControlRPProvides user interface

(UI) features relating to

non-IOS components of

the consolidated package.

These features are also

available for use in

diagnostic mode when the

IOS process fails.

Shell Manager

SIPSPAIO ModuleExchanges configuration

and other control

messages with a NIM, or

Enhanced Service Module

(SM-X).

IO Module process

ESPBaseESPManages CPP hardware

forwarding engine on the

ESP.

CPP driver process

ESPBaseESPManages HA state for the

CPP hardware forwarding

engine.

CPP HA process

Cisco 4000 Series ISRs Software Configuration Guide

6 OL-29328-03

Overview

Processes

Sub Package MappingAffected FRUsPurposeProcess

ESPBaseESPPerforms high-latency

tasks for the CPP-facing

functionality in the ESP

instance of the

Forwarding Manager

process.

CPP SP process

For further details of router capabilities and models, see the Hardware Installation Guide for the Cisco 4000

Series Integrated Services Routers.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 7

Overview

Processes

Cisco 4000 Series ISRs Software Configuration Guide

8 OL-29328-03

Overview

Processes

CHAPTER 3

Using Cisco IOS XE Software

This chapter describes the basics of using the Cisco IOS XE software and includes the following section:

•

Accessing the CLI Using a Router Console, page 9

Accessing the CLI Using a Router Console

Before You Begin

There are two serial ports: a console (CON) port and an auxiliary (AUX) port. Use the CON port to access

the command-line interface (CLI) directly or when using Telnet.

The following sections describe the main methods of accessing the router:

•

Accessing the CLI Using a Directly-Connected Console, on page 9

•

Using SSH to Access Console, on page 11

•

Accessing the CLI from a Remote Console Using Telnet, on page 11

•

Accessing the CLI from a USB Serial Console Port, on page 13

Accessing the CLI Using a Directly-Connected Console

The CON port is an EIA/TIA-232 asynchronous, serial connection with no-flow control and an RJ-45 connector.

The CON port is located on the front panel of the chassis.

The following sections describe the procedure to access the control interface:

•

Connecting to the Console Port, on page 10

•

Using the Console Interface, on page 10

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 9

Connecting to the Console Port

Step 1

Configure your terminal emulation software with the following settings:

•

9600 bits per second (bps)

•

8 data bits

•

No parity

•

No flow control

Step 2

Connect to the CON port using the RJ-45-to-RJ-45 cable and the RJ-45-to-DB-25 DTE adapter or the RJ-45-to-DB-9

DTE adapter (labeled Terminal).

Using the Console Interface

Step 1

Enter the following command:

Router> enable

Step 2

(Go to Step 3 if the enable password has not been configured.) At the password prompt, enter your system password:

Password: enablepass

When your password is accepted, the privileged EXEC mode prompt is displayed.

Router#

You now have access to the CLI in privileged EXEC mode and you can enter the necessary commands to complete your

desired tasks.

Step 3

If you enter the setup command, see “Using Cisco Setup Command Facility” in the “Initial Configuration” section of the

Hardware Installation Guide for the Cisco 4000 Series Integrated Services Routers.

Step 4

To exit the console session, enter the quit command:

Router# quit

Cisco 4000 Series ISRs Software Configuration Guide

10 OL-29328-03

Using Cisco IOS XE Software

Accessing the CLI Using a Directly-Connected Console

Using SSH to Access Console

Secure Shell (SSH) is a protocol which provides a secure remote access connection to network devices. To

enable SSH support on the device:

Step 1

Configure the hostname:

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname xxx_lab

Here, host name is the router hostname or IP address.

Step 2

Configure the DNS domain of the router:

xxx_lab(config)# xxx.cisco.com

Step 3

Generate an SSH key to be used with SSH:

xxx_lab(config)# crypto key generate rsa

The name for the keys will be: xxx_lab.xxx.cisco.com Choose the size of the key modulus in the range

of 360 to 4096 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few

minutes.

How many bits in the modulus [512]: 1024 % Generating 1024 bit RSA keys, keys will be non-exportable...

[OK] (elapsed time was 0 seconds)

xxx_lab(config)#

Step 4

By default, the vtys? transport is Telnet. In this case, Telnet is disabled and only SSH is supported:

xxx_lab(config)#line vty 0 4

xxx_lab(config-line)#transport input SSH

Step 5

Create a username for SSH authentication and enable login authentication:

xxx_lab(config)# username jsmith privilege 15 secret 0 p@ss3456

xxx_lab(config)#line vty 0 4

xxx_lab(config-line)# login local

Step 6

Verify remote connection to the device using SSH.

Accessing the CLI from a Remote Console Using Telnet

The following topics describe the procedure to access the CLI from a remote console using Telnet:

•

Preparing to Connect to the Router Console Using Telnet, on page 11

•

Using Telnet to Access a Console Interface, on page 12

Preparing to Connect to the Router Console Using Telnet

To access the router remotely using Telnet from a TCP/IP network, configure the router to support virtual

terminal lines using the line vty global configuration command. Configure the virtual terminal lines to require

users to log in and specify a password.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 11

Using Cisco IOS XE Software

Using SSH to Access Console

See the Cisco IOS Terminal Services Command Reference document for more information about the line vty

global configuration command.

To prevent disabling login on a line, specify a password with the password command when you configure

the login command.

If you are using authentication, authorization, and accounting (AAA), configure the login authentication

command. To prevent disabling login on a line for AAA authentication when you configure a list with the

configuration command.

For more information about AAA services, see the Cisco IOS XE Security Configuration Guide: Secure

Connectivity and the Cisco IOS Security Command Reference documents. For more information about the

In addition, before you make a Telnet connection to the router, you must have a valid hostname for the router

or have an IP address configured on the router. For more information about the requirements for connecting

to the router using Telnet, information about customizing your Telnet services, and using Telnet key sequences,

see the Cisco IOS Configuration Fundamentals Configuration Guide.

Using Telnet to Access a Console Interface

Step 1

From your terminal or PC, enter one of the following commands:

•

connect host [port] [keyword]

•

telnet host [port] [keyword]

Here, host is the router hostname or IP address, port is a decimal port number (23 is the default), and keyword is a

supported keyword. For more information about these commands, see the Cisco IOS Terminal Services Command

Reference document.

If you are using an access server, specify a valid port number, such as telnet 172.20.52.40 2004, in addition to

the hostname or IP address.

Note

The following example shows how to use the telnet command to connect to a router named router:

unix_host% telnet router

Trying 172.20.52.40...

Connected to 172.20.52.40.

Escape character is '^]'.

unix_host% connect

Step 2

Enter your login password:

User Access Verification

Password: mypassword

If no password has been configured, press

Return.

Note

Step 3

From user EXEC mode, enter the enable command:

Router> enable

Step 4

At the password prompt, enter your system password:

Password: enablepass

Step 5

When the enable password is accepted, the privileged EXEC mode prompt is displayed:

Cisco 4000 Series ISRs Software Configuration Guide

12 OL-29328-03

Using Cisco IOS XE Software

Accessing the CLI from a Remote Console Using Telnet

Router#

Step 6

You now have access to the CLI in privileged EXEC mode and you can enter the necessary commands to complete your

desired tasks.

Step 7

To exit the Telnet session, use the exit or logout command.

Router# logout

Accessing the CLI from a USB Serial Console Port

The router provides an additional mechanism for configuring the system: a type B miniport USB serial console

that supports remote administration of the router using a type B USB-compliant cable. See the “Connecting

to a Console Terminal or Modem” section in the Hardware Installation Guide for the Cisco 4000 Series

Integrated Services Routers.

Using Keyboard Shortcuts

Commands are not case sensitive. You can abbreviate commands and parameters if the abbreviations contain

enough letters to be different from any other currently available commands or parameters.

The following table lists the keyboard shortcuts for entering and editing commands.

Table 4: Keyboard Shortcuts

PurposeKey Name

Move the cursor back one character.Ctrl-B or the Left Arrow key

Move the cursor forward one character.Ctrl-F or the Right Arrow key

Move the cursor to the beginning of the command

line.

Ctrl-A

Move the cursor to the end of the command line.Ctrl-E

Move the cursor back one word.Esc B

Move the cursor forward one word.Esc F

Using the History Buffer to Recall Commands

The history buffer stores the last 20 commands you entered. History substitution allows you to access these

commands without retyping them, by using special abbreviated commands.

The following table lists the history substitution commands.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 13

Using Cisco IOS XE Software

Accessing the CLI from a USB Serial Console Port

Table 5: History Substitution Commands

PurposeCommand

Recalls commands in the history buffer, beginning

with the most recent command. Repeat the key

sequence to recall successively older commands.

Ctrl-P or the Up Arrow key

Returns to more recent commands in the history

buffer after recalling commands with Ctrl-P or the

Up Arrow key.

Ctrl-N or the Down Arrow key

While in EXEC mode, lists the last few commands

you entered.

Router# show history

The arrow keys function only on ANSI-compatible terminals such as VT100s.

Understanding Command Modes

The command modes available in Cisco IOS XE are the same as those available in traditional Cisco IOS. Use

the CLI to access Cisco IOS XE software. Because the CLI is divided into many different modes, the commands

available to you at any given time depend on the mode that you are currently in. Entering a question mark (?)

at the CLI prompt allows you to obtain a list of commands available for each command mode.

When you log in to the CLI, you are in user EXEC mode. User EXEC mode contains only a limited subset

of commands. To have access to all commands, you must enter privileged EXEC mode, normally by using a

password. From privileged EXEC mode, you can issue any EXEC command—user or privileged mode—or

you can enter global configuration mode. Most EXEC commands are one-time commands. For example, show

commands show important status information, and clear commands clear counters or interfaces. The EXEC

commands are not saved when the software reboots.

Configuration modes allow you to make changes to the running configuration. If you later save the running

configuration to the startup configuration, these changed commands are stored when the software is rebooted.

To enter specific configuration modes, you must start at global configuration mode. From global configuration

mode, you can enter interface configuration mode and a variety of other modes, such as protocol-specific

modes.

ROM monitor mode is a separate mode used when the Cisco IOS XE software cannot load properly. If a valid

software image is not found when the software boots or if the configuration file is corrupted at startup, the

software might enter ROM monitor mode.

The following table describes how to access and exit various common command modes of the Cisco IOS XE

software. It also shows examples of the prompts displayed for each mode.

Table 6: Accessing and Exiting Command Modes

Exit MethodPromptAccess MethodCommand Mode

Use the logout command.Router>Log in.User EXEC

Cisco 4000 Series ISRs Software Configuration Guide

14 OL-29328-03

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

Exit MethodPromptAccess MethodCommand Mode

To return to user EXEC

mode, use the disable

command.

Router#From user EXEC mode,

use the enable command.

Privileged EXEC

To return to privileged

EXEC mode from global

configuration mode, use

the exit or end command.

Router(config)#From privileged EXEC

mode, use the configure

terminal command.

Global configuration

To return to global

configuration mode, use

the exit command.

To return to privileged

EXEC mode, use the end

command.

Router(config-if)#From global configuration

mode, specify an interface

using an interface

command.

Interface configuration

If failure of the Cisco IOS

process is the reason for

entering diagnostic mode,

the Cisco IOS problem

must be resolved and the

router rebooted to get out

of diagnostic mode.

If the router is in

diagnostic mode because

of a transport-map

configuration, access the

router through another

port or by using a method

that is configured to

connect to the Cisco IOS

CLI.

Router(diag)#The router boots up or

accesses diagnostic mode

in the following

scenarios:

•

In some cases,

diagnostic mode

will be reached

when the Cisco IOS

process or processes

fail. In most

scenarios, however,

the router will

reload.

•

A user-configured

access policy is

configured using the

transport-map

command that

directs a user into

diagnostic mode.

•

A break signal

(Ctrl-C,

Ctrl-Shift-6, or the

send break

command) is

entered and the

router is configured

to go to diagnostic

mode when the

break signal is

received.

Diagnostic

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 15

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

Exit MethodPromptAccess MethodCommand Mode

To exit ROM monitor

mode, manually boot a

valid image or perform a

reset with autoboot set so

that a valid image is

loaded.

rommon#>From privileged EXEC

mode, use the reload

EXEC command. Press

the Break key during the

first 60 seconds while the

system is booting.

ROM monitor

Understanding Diagnostic Mode

The router boots up or accesses diagnostic mode in the following scenarios:

•

The IOS process or processes fail, in some scenarios. In other scenarios, the system resets when the IOS

process or processes fail.

•

A user-configured access policy was configured using the transport-map command that directs the

user into the diagnostic mode.

•

A send break signal (Ctrl-C or Ctrl-Shift-6) was entered while accessing the router, and the router was

configured to enter diagnostic mode when a break signal was sent.

In the diagnostic mode, a subset of the commands that are available in user EXEC mode are made available

to the users. Among other things, these commands can be used to:

•

Inspect various states on the router, including the IOS state.

•

Replace or roll back the configuration.

•

Provide methods of restarting the IOS or other processes.

•

Reboot hardware, such as the entire router, a module, or possibly other hardware components.

•

Transfer files into or off of the router using remote access methods such as FTP, TFTP, and SCP.

The diagnostic mode provides a more comprehensive user interface for troubleshooting than previous routers,

which relied on limited access methods during failures, such as ROMMON, to diagnose and troubleshoot

Cisco IOS problems. The diagnostic mode commands can work when the Cisco IOS process is not working

properly. These commands are also available in privileged EXEC mode on the router when the router is

working normally.

Getting Help

Entering a question mark (?) at the CLI prompt displays a list of commands available for each command

mode. You can also get a list of keywords and arguments associated with any command by using the

context-sensitive help feature.

To get help that is specific to a command mode, a command, a keyword, or an argument, use one of the

following commands.

Cisco 4000 Series ISRs Software Configuration Guide

16 OL-29328-03

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

PurposeCommand

Provides a brief description of the help system in any

command mode.

help

Provides a list of commands that begin with a

particular character string.

There is no space between the command and

the question mark.

Note

abbreviated-command-entry?

Completes a partial command name.abbreviated-command-entry<Tab>

Lists all the commands that are available for a

particular command mode.

Lists the keywords or arguments that you must enter

next on the command line.

There is a space between the command and

the question mark.

Note

command ?

Finding Command Options: Example

This section provides information about how to display the syntax for a command. The syntax can consist of

optional or required keywords and arguments. To display keywords and arguments for a command, enter a

question mark (?) at the configuration prompt or after entering a part of a command followed by a space. The

Cisco IOS XE software displays a list and brief descriptions of the available keywords and arguments. For

example, if you are in global configuration mode and want to see all the keywords and arguments for the arap

command, you should type arap ?.

The <cr> symbol in command help output stands for carriage return. On older keyboards, the carriage return

key is the Return key. On most modern keyboards, the carriage return key is the Enter key. The <cr> symbol

at the end of command help output indicates that you have the option to press Enter to complete the command

and that the arguments and keywords in the list preceding the <cr> symbol are optional. The <cr> symbol by

itself indicates that no more arguments or keywords are available, and that you must press Enter to complete

the command.

The following table shows examples of using the question mark (?) to assist you in entering commands.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 17

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

Table 7: Finding Command Options

CommentCommand

Enter the enable command and password to access

privileged EXEC commands. You are in privileged

EXEC mode when the prompt changes to a “ # ”

from the “ > ”, for example, Router> to Router#

Router> enable

Password: <password>

Router#

Enter the configure terminal privileged EXEC

command to enter global configuration mode. You

are in global configuration mode when the prompt

changes to Router (config)#

Router# configure terminal

Enter configuration commands, one per line. End

with CNTL/Z.

Router(config)#

Enter interface configuration mode by specifying

the interface that you want to configure, using the

interface GigabitEthernet global configuration

command.

Enter ? to display what you must enter next on the

command line.

When the <cr> symbol is displayed, you can press

Enter to complete the command.

You are in interface configuration mode when the

prompt changes to Router(config-if)#

Router(config)# interface GigabitEthernet ?

<0-0> GigabitEthernet interface number

<0-2> GigabitEthernet interface number

Router(config)# interface GigabitEthernet 1/?

<0-4> Port Adapter number

Router (config)# interface GigabitEthernet

1/3/?

<0-15> GigabitEthernet interface number

Router (config)# interface GigabitEthernet

1/3/8?

. <0-3>

Router (config)# interface GigabitEthernet

1/3/8.0

Router(config-if)#

Enter ? to display a list of all the interface

configuration commands available for the interface.

This example shows only some of the available

interface configuration commands.

Cisco 4000 Series ISRs Software Configuration Guide

18 OL-29328-03

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

CommentCommand

Router(config-if)# ?

Interface configuration commands:

ip Interface Internet

Protocol

config commands

keepalive Enable keepalive

lan-name LAN Name command

llc2 LLC2 Interface

Subcommands

load-interval Specify interval for load

calculation

for an interface

locaddr-priority Assign a priority group

logging Configure logging for

interface

loopback Configure internal

loopback on an

interface

mac-address Manually set interface

MAC address

mls mls router sub/interface

commands

mpoa MPOA interface

configuration commands

mtu Set the interface

Maximum Transmission Unit

(MTU)

netbios Use a defined NETBIOS

access list

or enable

name-caching

no Negate a command or set

its defaults

nrzi-encoding Enable use of NRZI

encoding

ntp Configure NTP

Router(config-if)#

Enter the command that you want to configure for

the interface. This example uses the ip command.

Enter ? to display what you must enter next on the

command line. This example shows only some of

the available interface IP configuration commands.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 19

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

CommentCommand

Router(config-if)# ip ?

Interface IP configuration subcommands:

access-group Specify access control

for packets

accounting Enable IP accounting on

this interface

address Set the IP address of an

interface

authentication authentication

subcommands

bandwidth-percent Set EIGRP bandwidth limit

broadcast-address Set the broadcast address

of an interface

cgmp Enable/disable CGMP

directed-broadcast Enable forwarding of

directed broadcasts

dvmrp DVMRP interface commands

hello-interval Configures IP-EIGRP hello

interval

helper-address Specify a destination

address for UDP broadcasts

hold-time Configures IP-EIGRP hold

time

Router(config-if)# ip

Enter the command that you want to configure for

the interface. This example uses the ip address

command.

Enter ? to display what you must enter next on the

command line. In this example, you must enter an

IP address or the negotiated keyword.

A carriage return (<cr>) is not displayed.

Therefore, you must enter additional keywords or

arguments to complete the command.

Router(config-if)# ip address ?

A.B.C.D IP address

negotiated IP Address negotiated

over PPP

Router(config-if)# ip address

Enter the keyword or argument that you want to

use. This example uses the 172.16.0.1 IP address.

Enter ? to display what you must enter next on the

command line. In this example, you must enter an

IP subnet mask.

<cr> is not displayed. Therefore, you must enter

additional keywords or arguments to complete the

command.

Router(config-if)# ip address 172.16.0.1 ?

A.B.C.D IP subnet mask

Router(config-if)# ip address 172.16.0.1

255.255.255.0 ?

secondary Make this IP address a

secondary address

<cr>

Router(config-if)# ip address 172.16.0.1

255.255.255.0

Cisco 4000 Series ISRs Software Configuration Guide

20 OL-29328-03

Using Cisco IOS XE Software

Using the History Buffer to Recall Commands

CommentCommand

Enter the IP subnet mask. This example uses the

255.255.255.0 IP subnet mask.

Enter ? to display what you must enter next on the

command line. In this example, you can enter the

secondary keyword, or you can press Enter.

<cr> is displayed. Press Enter to complete the

command, or enter another keyword.

Press Enter to complete the command.

Router(config-if)# ip address 172.16.0.1

255.255.255.0

Router(config-if)#

Using the no and default Forms of Commands

Almost every configuration command has a no form. In general, use the no form to disable a function. Use

the command without the no keyword to re-enable a disabled function or to enable a function that is disabled

by default. For example, IP routing is enabled by default. To disable IP routing, use the no ip routing command;

to re-enable IP routing, use the ip routing command. The Cisco IOS software command reference publications

provide the complete syntax for the configuration commands and describe what the no form of a command

does.

Many CLI commands also have a default form. By issuing the <command> default command-name, you

can configure the command to its default setting. The Cisco IOS software command reference publications

describe the function from a default form of the command when the default form performs a different function

than the plain and no forms of the command. To see what default commands are available on your system,

enter default ? in the appropriate command mode.

Saving Configuration Changes

Use the copy running-config startup-config command to save your configuration changes to the startup

configuration so that the changes will not be lost if the software reloads or a power outage occurs. For example:

Router# copy running-config startup-config

Building configuration...

It may take a few minutes to save the configuration. After the configuration has been saved, the following

output is displayed:

[OK]

Router#

This task saves the configuration to the NVRAM.

Managing Configuration Files

The startup configuration file is stored in the nvram: file system and the running configuration files are stored

in the system: file system. This configuration file storage setup is also used on several other Cisco router

platforms.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 21

Using Cisco IOS XE Software

Using the no and default Forms of Commands

As a matter of routine maintenance on any Cisco router, users should back up the startup configuration file

by copying the startup configuration file from NVRAM to one of the router’s other file systems and, additionally,

to a network server. Backing up the startup configuration file provides an easy method of recovering the

startup configuration file if the startup configuration file in NVRAM becomes unusable for any reason.

The copy command can be used to back up startup configuration files.

Examples of backing up the startup configuration file in NVRAM are shown in Backing Up Configuration

Files, on page 298.

For more detailed information on managing configuration files, see the “Managing Configuration Files” section

in the Cisco IOS XE Configuration Fundamentals Configuration Guide.

Filtering Output from the show and more Commands

You can search and filter the output of show and more commands. This functionality is useful if you need to

sort through large amounts of output or if you want to exclude output that you need not see.

To use this functionality, enter a show or more command followed by the “pipe” character ( | ); one of the

keywords begin, include, or exclude; and a regular expression on which you want to search or filter (the

expression is case sensitive):

show command | {append | begin | exclude | include | redirect | section | tee} regular-expression

The output matches certain lines of information in the configuration file.

Example

In this example, a modifier of the show interface command (include protocol) is used to provide only the

output lines in which the expression protocol is displayed:

Router# show interface | include protocol

GigabitEthernet0/0/0 is administratively down, line protocol is down

0 unknown protocol drops

GigabitEthernet0/0/1 is administratively down, line protocol is down

0 unknown protocol drops

GigabitEthernet0/0/2 is administratively down, line protocol is down

0 unknown protocol drops

GigabitEthernet0/0/3 is administratively down, line protocol is down

0 unknown protocol drops

GigabitEthernet0 is up, line protocol is up

0 unknown protocol drops

Loopback0 is up, line protocol is up

0 unknown protocol drops

Powering Off a Router

Before You Begin

Before you turn off the power supply, ensure that the chassis is grounded and you perform a soft shutdown.

Cisco 4000 Series ISRs Software Configuration Guide

22 OL-29328-03

Using Cisco IOS XE Software

Filtering Output from the show and more Commands

To perform a soft shutdown and then power off a router, perform the following steps.

Step 1

Ensure that the configuration register is configured to drop to ROMMON. See Configuring the Configuration Register

for Autoboot, on page 70.

Step 2

Enter the reload command to halt the system:

Router# reload

System configuration has been modified. Save? [yes/no]:

Proceed with reload? [confirm]

Step 3

After the ROMMON prompt is displayed, move the router's power supply switch to the Off position.

Finding Support Information for Platforms and Cisco Software Images

The Cisco IOS XE software is packaged in feature sets consisting of software images that support specific

platforms. The group of feature sets that are available for a specific platform depends on which Cisco software

images are included in a release. To identify the set of software images available in a specific release or to

find out if a feature is available in a given Cisco IOS XE software image, you can use Cisco Feature Navigator

or see the Release Notes for Cisco IOS XE.

Using Cisco Feature Navigator

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco

Feature Navigator is a tool that enables you to determine which Cisco IOS XE software images support a

specific software release, feature set, or platform. To use the navigator tool, an account on Cisco.com is not

required.

Using Software Advisor

Cisco maintains the Software Advisor tool. See Tools and Resources. Use the Software Advisor tool to see

if a feature is supported in a Cisco IOS XE release, to locate the software document for that feature, or to

check the minimum software requirements of Cisco IOS XE software with the hardware installed on your

router. You must be a registered user on Cisco.com to access this tool.

Using Software Release Notes

See the Release Notes document for the Cisco 4000 Series for information about the following:

•

Memory recommendations

•

Open and resolved severity 1 and 2 caveats

Release notes are intended to be release-specific for the most current release, and the information provided

in these documents may not be cumulative in providing information about features that first appeared in

previous releases. For cumulative feature information, refer to the Cisco Feature Navigator at: http://

www.cisco.com/go/cfn/.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 23

Using Cisco IOS XE Software

Finding Support Information for Platforms and Cisco Software Images

CLI Session Management

An inactivity timeout is configurable and can be enforced. Session locking provides protection from two users

overwriting changes that the other has made. To prevent an internal process from using all the available

capacity, some spare capacity is reserved for CLI session access. For example, this allows a user to remotely

access a router.

•

Changing the CLI Session Timeout, on page 24

•

Locking a CLI Session, on page 24

Information About CLI Session Management

An inactivity timeout is configurable and can be enforced. Session locking provides protection from two users

overwriting changes that each other has made. To prevent an internal process from using all the available

capacity, some spare capacity is reserved for CLI session access. For example, this allows a user to remotely

access the router.

Changing the CLI Session Timeout

Step 1

configure terminal

Enters global configuration mode

Step 2

line console 0

Step 3

session-timeout minutes

The value of minutes sets the amount of time that the CLI waits before timing out. Setting the CLI session timeout

increases the security of a CLI session. Specify a value of 0 for minutes to disable session timeout.

Step 4

show line console 0

Verifies the value to which the session timeout has been set, which is shown as the value for " Idle Session ".

Locking a CLI Session

Before You Begin

To configure a temporary password on a CLI session, use the lock command in EXEC mode. Before you can

use the lock command, you need to configure the line using the lockable command. In this example the line

is configured as lockable, and then the lock command is used and a temporary password is assigned.

Step 1

Router# configure terminal

Enters global configuration mode.

Step 2

Enter the line upon which you want to be able to use the lock command.

Cisco 4000 Series ISRs Software Configuration Guide

24 OL-29328-03

Using Cisco IOS XE Software

CLI Session Management

Router(config)# line console 0

Step 3

Router(config)# lockable

Enables the line to be locked.

Step 4

Router(config)# exit

Step 5

Router# lock

The system prompts you for a password, which you must enter twice.

Password: <password>

Again: <password>

Locked

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 25

Using Cisco IOS XE Software

CLI Session Management

Cisco 4000 Series ISRs Software Configuration Guide

26 OL-29328-03

Using Cisco IOS XE Software

CLI Session Management

CHAPTER 4

Smart Licensing

This chapter provides an overview of the Cisco Smart Licensing Client feature and describes the several

tools and processes required to complete the products registration and authorization.

This chapter includes this section:

•

Smart Licensing Client, page 27

Smart Licensing Client

Smart Licensing Client feature is a standardized licensing platform that simplifies the Cisco software experience

and helps you to understand how Cisco software is used across your network. Smart Licensing is the next

eneration licensing platform for all Cisco software products.

Prerequisites for Cisco Smart Licensing Client

•

Ensure that Call Home is not disabled before using the Smart Licensing Client feature.

Restrictions for Cisco Smart Licensing Client

•

Cisco 4000 Series ISR platforms support Cisco One Suites License, Technology Package License,

Throughput License, and HSECK9 license in Cisco Smart Licensing from Cisco IOS Release 15.6(1)S.

•

Cisco ISR G2 platforms support only Cisco One Suites in Cisco Smart Licensing from Cisco IOS Release

15.5(1)T.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 27

Information About Cisco Smart Licensing Client

Cisco Smart Licensing - An Overview

A new licensing model, based on a single technology, has been designed for Cisco called Smart Licensing

that is intended to provide Enterprise Level Agreement-like capabilities for all of Cisco's products.

Smart Licensing is software based licensing end-to-end platform that consists of several tools and processes

to authorize customers the usage and reporting of the Cisco products. The feature has the capability to capture

the customers order and communicates with Cisco Cloud License Service through Smart Call Home transport

media to complete the products registration and authorization on desired performance and technology level.

The Smart Licensing feature is aimed at giving users an experience of a single, standardized licensing solution

for all Cisco products.

To know more about Smart Call Home, please refer to Smart Call Home.

Transitioning from CISL to Smart Licensing

In the Smart Licensing Model, customers can activate licensed objects without the use of a special software

key or upgrade license file. The customers simply activate the new functionality using the appropriate product

commands and configurations and the functionality is activated. A software reboot may or may not be required

depending on the product capabilities and requirements.

Similarly, downgrading or removing an advanced feature, performance, or functionality would require a

removal of the configuration or command.

Once either of these actions has been taken, the change in license state is noted by the Smart Software Manager

upon next synchronization and an appropriate action is then taken.

Cisco One Suites

Cisco ONE Suites is a new way for customers to purchase infrastructure software. Cisco ONE offers a

simplified purchasing model, centered on common customer scenarios in the data center, wide area network,

and local access networks. To know more about Cisco One Suites, please refer to Cisco ONE Suites.

Cisco 4000 Series ISRs Software Configuration Guide

28 OL-29328-03

Smart Licensing

Information About Cisco Smart Licensing Client

How to Activate Cisco Smart Licensing Client

Enable Smart Licensing

SUMMARY STEPS

enable

configure terminal

license smart enable

exit

write memory

show license all

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Example:

Device> enable

•

Enter your password if prompted.

Enters global configuration mode.configure terminal

Example:

Device# configure terminal

Step 2

Activates Smart Licensing on the device.license smart enable

Step 3

Example:

Device# license smart enable

When you enable Smart Licensing, the Cisco Software

License (CSL) and all licensing calls pass through the Smart

Agent.

Note

For the ‘no’ case, if Smart Licensing is already registered, the Smart

Agent performs the ”license smart deregister” operation that

deactivates Smart Licensing. Reload the device to activate the CSL

on the device.

Exits the global configuration mode.exit

Example:

Device# exit

Step 4

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 29

Smart Licensing

How to Activate Cisco Smart Licensing Client

PurposeCommand or Action

Saves the running configuration to NVRAM.write memory

Example:

Device# write memory

Step 5

(Optional) Displays summary information about all licenses.show license all

Example:

Device# show license all

Step 6

Smart License Disable

SUMMARY STEPS

enable

configure terminal

no license smart enable

exit

write memory

reload

show license all

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Example:

Device> enable

•

Enter your password if prompted.

Enters global configuration mode.configure terminal

Example:

Device# configure terminal

Step 2

Deactivates Smart Licensing on the device.no license smart enable

Step 3

Cisco 4000 Series ISRs Software Configuration Guide

30 OL-29328-03

Smart Licensing

How to Activate Cisco Smart Licensing Client

PurposeCommand or Action

Example:

Device(config)# no license smart

enable

When you enable Smart Licensing, the Cisco Software License

(CSL) and all licensing calls pass through the Smart Agent.

For the ‘no’ case, if Smart Licensing is already registered, the

Smart Agent performs the ”license smart deregister” operation

that deactivates Smart Licensing. Reload the device to activate

the CSL on the device.

Note

Exits the global configuration mode.exit

Example:

Device(config)# exit

Step 4

Saves the running configuration to NVRAM.write memory

Example:

Device# write memory

Step 5

(Optional) Restarts the device to enable the new feature set.reload

Step 6

Example:

Device# reload

Reload the device if you have not reloaded the device after

configuring the Cisco One Suites.

Note

(Optional) Displays summary information about all licenses.show license all

Example:

Device# show license all

Step 7

Device Registration

SUMMARY STEPS

enable

license smart register idtoken idtoken [force]

license smart deregister

license smart renew [ID | auth]

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 31

Smart Licensing

How to Activate Cisco Smart Licensing Client

PurposeCommand or Action

Example:

Device> enable

•

Enter your password if prompted.

Registers the device with the back-end server. Token id can be

obtained from your virtual a/c in the Smart Licensing server.

license smart register idtoken idtoken [force]

Example:

Device# license smart register idtoken

123

Step 2

•

force: To forcefully register your device irrespective of either

the device is registered or not.

The device supplies the token ID to the Cisco server, which

sends back a “Device Certificate” that is valid for 365 days.

Note

Deregisters the device from the backend server.license smart deregister

Example:

Device# license smart deregister

Step 3

(Optional) Manually renews the ID certification or authorization.license smart renew [ID | auth]

Example:

Device# license smart renew ID

Step 4

Troubleshooting for Cisco Smart Licensing Client

You can troubleshoot Smart Licensing enabling issues using the following commands on the device:

•

show version

•

show running-config

•

show license summary

•

show license all

•

show license tech support

•

debug smart_lic error

•

debug smart_lic trace

Cisco 4000 Series ISRs Software Configuration Guide

32 OL-29328-03

Smart Licensing

Troubleshooting for Cisco Smart Licensing Client

Configuration Examples for Cisco Smart Licensing Client

Example: Displays summary information about all licenses

The following example shows how to use the show license all command to display summary information

about all licenses.

Device#show license all

Smart Licensing Status

======================

Smart Licensing is ENABLED

Registration:

Status: REGISTERED

Smart Account: BU Production Test

Virtual Account: ISR4K

Export-Controlled Functionality: Allowed

Initial Registration: SUCCEEDED on Sep 04 15:40:03 2015 PDT

Last Renewal Attempt: None

Next Renewal Attempt: Mar 02 15:40:02 2016 PDT

Registration Expires: Sep 03 15:34:53 2016 PDT

License Authorization:

Status: AUTHORIZED on Sep 04 15:40:09 2015 PDT

Last Communication Attempt: SUCCEEDED on Sep 04 15:40:09 2015 PDT

Next Communication Attempt: Oct 04 15:40:08 2015 PDT

Communication Deadline: Dec 03 15:35:01 2015 PDT

License Usage

==============

ISR_4400_FoundationSuite (ISR_4400_FoundationSuite):

Description: Cisco ONE Foundation Perpetual License ISR 4400

Count: 1

Version: 1.0

Status: AUTHORIZED

ISR_4400_AdvancedUCSuite (ISR_4400_AdvancedUCSuite):

Description: Cisco ONE Advanced UC Perpetual License ISR 4400

Count: 1

Version: 1.0

Status: AUTHORIZED

ISR_4451_2G_Performance (ISR_4451_2G_Performance):

Description: Performance on Demand License for 4450 Series

Count: 1

Version: 1.0

Status: AUTHORIZED

Product Information

===================

UDI: PID:ISR4451-X/K9,SN:FOC17042FJ9

Agent Version

=============

Smart Agent for Licensing: 1.4.0_rel/16

Component Versions: SA:(1_4_rel)1.0.15, SI:(dev22)1.2.6, CH:(dev5)1.0.32, PK:(dev18)1.0.17

Device#

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 33

Smart Licensing

Configuration Examples for Cisco Smart Licensing Client

Example: Enabling Smart Licensing

The following example shows how to use the license smart enable command to confirm if the Cisco ONE

Suite is enabled.

The warning message that is displayed in the following example applies only for Cisco ISR G2 platform.

For Cisco 4000 Series ISR platform, it does not display warning message when you enable the smart

license.

Note

Device# license smart enable

Currently only Cisco ONE license suites are supported by Smart Licensing.

Please make sure your Cisco ONE suites are enabled before turning on Smart Licensing.

Any other licenses outside of Cisco ONE suites would be disabled and made unusable in Smart

Licensing.

If you have any questions, please get in touch with your Cisco representative before using

this mmode.

Please confirm Cisco ONE suites are enabled? [yes/no]: yes

Cisco 4000 Series ISRs Software Configuration Guide

34 OL-29328-03

Smart Licensing

Configuration Examples for Cisco Smart Licensing Client

CHAPTER 5

Using the Management Interfaces

The following management interfaces are provided for external users and applications:

•

Gigabit Ethernet Management Interface, page 35

•

Enabling SNMP, page 41

Gigabit Ethernet Management Interface

•

Gigabit Ethernet Management Interface Overview, on page 35

•

Default Gigabit Ethernet Configuration, on page 36

•

Gigabit Ethernet Port Numbering, on page 36

•

Gigabit Ethernet Management Interface VRF, on page 36

•

Common Gigabit Ethernet Management Tasks, on page 37

•

Configuring IP Addresses in ROMMON and the Ethernet Management Port, on page 41

Gigabit Ethernet Management Interface Overview

The router provides an Ethernet management port named GigabitEthernet0.

The Ethernet management port allows you to perform management tasks on the router. It is an interface that

should not, and often cannot, forward network traffic, but can be used to access the router via Telnet and

Secure Shell (SSH) to perform management tasks on the router. The interface is most useful before a router

has begun routing, or in troubleshooting scenarios when other forwarding interfaces are inactive.

The following are some key aspects of the Ethernet management interface:

•

The router has one Ethernet management interface named GigabitEthernet0.

•

IPv4 and IPv6 are the only routed protocols supported for the interface.

•

The management interface provides a way to access the router even if forwarding interfaces are not

functional, or the system process is down.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 35

•

The Ethernet management interface is a part of its own virtual routing and forwarding (VRF). This is

discussed in more detail in Gigabit Ethernet Management Interface VRF, on page 36.

Default Gigabit Ethernet Configuration

By default, a forwarding VRF is configured for the Ethernet management interface with a special group named

Mgmt-intf. You cannot change this configuration. Configuring a forwarding VRF for the interface with a

special group named Mgmt-intf allows you to isolate the traffic on the Ethernet management interface away

from the forwarding plane. Otherwise, the interface can be configured like other Gigabit Ethernet interfaces

for most functions.

For example, the default configuration is:

Router(config)# interface GigabitEthernet0

Router(config-if)# vrf forwarding Mgmt-intf

Gigabit Ethernet Port Numbering

The Gigabit Ethernet management port is always GigabitEthernet0 and the port can be accessed in global

configuration mode as shown in the following example:

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# interface gigabitethernet0

Router(config-if)#

Gigabit Ethernet Management Interface VRF

The Gigabit Ethernet management interface is automatically a part of its own VRF. This VRF, which is named

Mgmt-intf, is automatically configured on the router and is dedicated to the Ethernet management interface;

no other interfaces can join this VRF, and no other interfaces can be placed in the management VRF. The

management Ethernet interface VRF does not participate in the MPLS VPN VRF or any other network-wide

VRF.

Placing the Gigabit Ethernet management interface in its own VRF has the following effects on the management

Ethernet interface:

• Requires configuring multiple features—Because Cisco IOS CLI may be different for certain management

Ethernet functions compared to other routers, you should configure or use many of the VRF's features.

• Prevents transit traffic from traversing the router—Because all the module interfaces and the management

Ethernet interface are automatically in different VRFs, no transit traffic can enter the management

Ethernet interface and leave a module interface, or vice versa.

• Improves security of the interface—Because the Mgmt-intf VRF has its own routing table because of

being in its own VRF, routes can be added to the routing table of the management Ethernet interface

only if you explicitly enter them.

The management Ethernet interface VRF supports both IPv4 and IPv6 address families.

Cisco 4000 Series ISRs Software Configuration Guide

36 OL-29328-03

Using the Management Interfaces

Default Gigabit Ethernet Configuration

You can configure only the Gigabit Ethernet management interface (and a loopback interface) as a part

of the Mgmt-intf VRF. You cannot configure other interfaces in this VRF.

Note

Common Gigabit Ethernet Management Tasks

You can access the Ethernet management interface to perform the following tasks on your router.

The following is not a comprehensive list of all the tasks that can be performed using the Ethernet

management interface.

Note

•

Viewing the VRF Configuration, on page 37

•

Viewing Detailed Information for the Gigabit Ethernet Management VRF, on page 38

•

Setting a Default Route in the Management Ethernet Interface VRF, on page 38

•

Setting the Gigabit Ethernet Management IP Address, on page 38

•

Using Telnet over the Gigabit Ethernet Management Interface, on page 38

•

Pinging over the Gigabit Ethernet Management Interface, on page 39

•

Copying a File Using TFTP or FTP, on page 39

•

Setting up the Software Clock Using the NTP Server, on page 39

•

Logging, on page 40

•

SNMP-Related Services, on page 40

•

Assigning a Domain Name, on page 40

•

Assigning DNS, on page 40

•

Configuring a RADIUS or TACACS+ Server Group, on page 40

•

Attaching an ACL to VTY Lines, on page 41

Viewing the VRF Configuration

To view the VRF configuration for the Gigabit Ethernet management interface, use the show running-config

vrf command. The following example shows the default VRF configuration:

Router# show running-config vrf

Building configuration...

Current configuration : 351 bytes

vrf definition Mgmt-intf

address-family ipv4

exit-address-family

address-family ipv6

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 37

Using the Management Interfaces

Common Gigabit Ethernet Management Tasks

exit-address-family

(some output removed for brevity)

Viewing Detailed Information for the Gigabit Ethernet Management VRF

To view detailed information about the Gigabit Ethernet management VRF, enter the show vrf detail Mgmt-intf

command, as shown in the following example:

Router# show vrf detail Mgmt-intf

VRF Mgmt-intf (VRF Id = 4085); default RD <not set>; default VPNID <not set>

Interfaces:

Gi0

Address family ipv4 (Table ID = 4085 (0xFF5)):

No Export VPN route-target communities

No Import VPN route-target communities

No import route-map

No export route-map

VRF label distribution protocol: not configured

VRF label allocation mode: per-prefix

Address family ipv6 (Table ID = 503316481 (0x1E000001)):

No Export VPN route-target communities

No Import VPN route-target communities

No import route-map

No export route-map

VRF label distribution protocol: not configured

VRF label allocation mode: per-prefix

Setting a Default Route in the Management Ethernet Interface VRF

You can set a default route in the Gigabit Ethernet management interface VRF by entering the following

command:

Router(config)# ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 next-hop-IP-address

To set a default route in the management Ethernet interface VRF with an IPv6 address, enter the following

command:

Router(config)# ipv6 route vrf Mgmt-intf : : /next-hop-IPv6-address/

Setting the Gigabit Ethernet Management IP Address

You can set the IP address of the Gigabit Ethernet management port as you would for the IP address on any

other interface.

To configure an IPv4 address on the Ethernet management interface, enter the following commands:

Router(config)# interface GigabitEthernet 0

Router(config-if)# ip address A.B.C.D A.B.C.D

To configure an IPv6 address on the Ethernet management interface, enter the following commands:

Router(config)# interface GigabitEthernet 0

Router(config-if)# ipv6 address X:X:X:X::X

Using Telnet over the Gigabit Ethernet Management Interface

You can use Telnet to connect to a router through the Gigabit Ethernet management interface VRF using the

telnet command and the router’s IP address.

Cisco 4000 Series ISRs Software Configuration Guide

38 OL-29328-03

Using the Management Interfaces

Common Gigabit Ethernet Management Tasks

To use Telnet to connect to the IPv4 address of a router, enter the following command:

Router# telnet 172.17.1.1 /vrf Mgmt-intf

To use Telnet to connect to the IPv6 address of a router, enter the following command:

Router# telnet 2001:db8::abcd /vrf Mgmt-intf

Pinging over the Gigabit Ethernet Management Interface

You can ping other interfaces using the Ethernet management interface through the VRF.

To ping the interface with the IPv4 address, enter the following command:

Router# ping vrf Mgmt-intf 172.17.1.1

To ping the interface with the IPv6 address, enter the following command:

Router# ping vrf Mgmt-intf 2001:db8::abcd

Copying a File Using TFTP or FTP

To copy a file using TFTP through the Ethernet management interface, the ip tftp source-interface

GigabitEthernet 0 command must be entered before entering the copy tftp command because the copy tftp

command has no option of specifying a VRF name.

Similarly, to copy a file using FTP through the Ethernet management interface, the ip ftp source-interface

GigabitEthernet 0 command must be entered before entering the copy ftp command because the copy ftp

command has no option of specifying a VRF name.

The following is an example of copying a file using TFTP:

Router(config)# ip tftp source-interface gigabitEthernet 0

The following is an example of copying a file using FTP:

Router(config)# ip ftp source-interface gigabitEthernet 0

Building configuration...

- Omitted lines -

ip ftp source-interface GigabitEthernet0

ip tftp source-interface GigabitEthernet0

Setting up the Software Clock Using the NTP Server

To allow the software clock to be synchronized by a Network Time Protocol (NTP) time server over the

Gigabit Ethernet management interface, enter the ntp server vrf Mgmt-intf command and specify the IP

address of the device providing the update.

To set up the NTP server over the Ethernet management interface with an IPv4 address, enter the following

command:

Router(config)# ntp server vrf Mgmt-intf 172.17.1.1

To set up the NTP server over the Ethernet management interface with an IPv6 address, enter the following

command:

Router(config)# ntp server vrf Mgmt-intf 2001:db8::abcd

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 39

Using the Management Interfaces

Common Gigabit Ethernet Management Tasks

Logging

To specify the Gigabit Ethernet management interface as the source IP or IPv6 address for logging, enter the

logging host ip-address vrf Mgmt-intf command:

Router(config)# logging host 172.17.1.1 vrf Mgmt-intf

SNMP-Related Services

To specify the Gigabit Ethernet management interface as the source of all SNMP trap messages, enter the

snmp-server source-interface traps gigabitethernet 0 command:

Router(config)# snmp-server source-interface traps gigabitethernet 0

Assigning a Domain Name

Assign the IP domain name for the Gigabit Ethernet management interface through the VRF.

To define the default domain name as the Gigabit Ethernet management VRF interface, enter the ip

domain-name vrf Mgmt-intf domain command:

Router(config)# ip domain-name vrf Mgmt-intf cisco.com

Assigning DNS

To specify the Ethernet management interface VRF as a name server, enter the ip name-server vrf Mgmt-intf

IPv4-or-IPv6-address command:

Router(config)# ip name-server vrf Mgmt-intf A.B.C.D

Router(config)# ip name-server vrf Mgmt-intf X:X:X:X::X

Configuring a RADIUS or TACACS+ Server Group

To group the Management VRF as part of an AAA server group, enter the ip vrf forward Mgmt-intf command

when configuring the AAA server group.

The same concept is true for configuring a TACACS+ server group. To group the Management VRF as part

of a TACACS+ server group, enter the ip vrf forwarding Mgmt-intf command when configuring the

TACACS+ server group.

The following is an example of configuring a RADIUS server group:

Router(config)# aaa group server radius hello

Router(config-sg-radius)# ip vrf forwarding Mgmt-intf

The following is an example of configuring a TACACS+ server group:

Router(config)# aaa group server tacacs+ hello

Router(config-sg-tacacs+)# ip vrf forwarding Mgmt-intf

Cisco 4000 Series ISRs Software Configuration Guide

40 OL-29328-03

Using the Management Interfaces

Logging

Attaching an ACL to VTY Lines

To ensure an access control list (ACL) is attached to vty lines that are and are not using VRF, use the vrf-also

keyword:

Router(config)# line vty 0 4

Router(config-line)# access-class 90 in vrf-also

Router(config-line)# IPv6 access-class my-vty-acl in vrf-also

Configuring IP Addresses in ROMMON and the Ethernet Management Port

IP addresses can be configured in ROMMON using the IP_ADDRESS= and IP_SUBNET_MASK=

commands. You can also configure IP addresses using the ip address command in the interface configuration

mode.

Before the system is booted and the Cisco IOS process is running on a router, the IP address that is set in

ROMMON acts as the IP address of the Ethernet management interface.

After the Cisco IOS process starts and is in control of the Ethernet management interface, the IP address

specified when configuring the GigabitEthernet0 interface in the Cisco IOS CLI becomes the IP address of

the Ethernet management interface.

The ROMMON-defined IP address is used only until the Cisco IOS process is active. For this reason, the IP

addresses specified in ROMMON and in the Cisco IOS XE commands should be identical to ensure that the

Gigabit Ethernet management interface functions properly.

Enabling SNMP

For further information about enabling SNMP, see SNMP-Related Services, on page 40 and Configuring

SNMP Support.

Web User Interface Management

You can access your router using a web user interface. The web user interface allows you to monitor router

performance using an easy-to-read graphical interface. Most aspects of your router can be monitored using

the web user interface which enables you to perform the following functions:

•

View information in an easy-to-read graphical format.

•

Monitor most software processes, including processes related to the Cisco IOS and non-Cisco IOS

subpackages within the Cisco IOS XE consolidated package.

•

Monitor most hardware components, including all RPs, NIMs, and SM-Xs installed on your router.

•

Access legacy web user interface in addition to the enhanced web user interface.

•

Gather show command output.

This section consists of the following topics:

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 41

Using the Management Interfaces

Attaching an ACL to VTY Lines

•

Legacy Web User Interface Overview, on page 42

•

Graphics-Based Web User Interface Overview, on page 43

•

Overview of Persistent Web User Interface Transport Maps, on page 44

•

Enabling Web User Interface Access, on page 45

•

Configuration Examples, on page 49

Legacy Web User Interface Overview

Previous Cisco routers have a legacy web user interface that can be used to monitor the router. This legacy

web user interface presents information in a straightforward manner without using any graphics. On the router,

this interface is part of the larger web user interface and can be accessed by clicking the IOS Web UI option

in the left-hand menu.

On your router, the legacy web user interface can be used only to configure and monitor the Cisco IOS

subpackages. In some scenarios, most notably when an ip http command has been successfully entered to

enable the HTTP or HTTPS server while a properly configured web user interface transport map has not yet

been applied on the router, the legacy web user interface will be accessible while the graphics-based web user

interface will be inaccessible.

Cisco 4000 Series ISRs Software Configuration Guide

42 OL-29328-03

Using the Management Interfaces

Web User Interface Management

An example showing the IOS web user interface home page is shown in the following figure.

Figure 1: Legacy Web User Interface Home Page

Graphics-Based Web User Interface Overview

The graphics-based web user interface on your router displays router information in the form of graphics-based

tables, graphs, or charts, depending on the type of the information. You can access all the monitoring-related

information stored in both the Cisco IOS and non-Cisco IOS subpackages, and also a complete view of your

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 43

Using the Management Interfaces

Web User Interface Management

router using the web user interface. The following figure is an example of the graphics-based web user interface

home page.

Figure 2: Graphics-Based Web User Interface Home Page

Overview of Persistent Web User Interface Transport Maps

You must configure a persistent web user interface transport map to enable the graphics-based web user

interface on your router. When successfully configured and applied to your router, the persistent web user

interface transport map defines how the router handles incoming requests from the web user interface. In the

Cisco 4000 Series ISRs Software Configuration Guide

44 OL-29328-03

Using the Management Interfaces

Web User Interface Management

persistent web user interface transport map, you can define whether the graphics-based web user interface

can be accessed through HTTP, HTTPS, or both protocols. You can apply only one persistent web user

interface map to your router.

You must configure the legacy web user interface prior to enabling the graphics-based web user interface on

your router. You can use the ip http command set to configure the legacy web user interface.

The ip http command settings define which ports are used by HTTP or HTTPS for both the legacy and

graphics-based web user interface.

For information on configuring the entire graphics-based web user interface, including the configuration of

persistent web user interface transport maps on your router, see Configuring Web User Interface Access, on

page 45.

Enabling Web User Interface Access

To enable the web user interface for your router, perform these tasks:

•

Configuring Web User Interface Access, on page 45

•

Accessing the Web User Interface, on page 46

•

Web User Interface Authentication, on page 47

•

Domain Name System and the Web User Interface, on page 47

•

Clocks and the Web User Interface, on page 47

•

Using Auto Refresh, on page 48

Configuring Web User Interface Access

Before You Begin

•

You must configure the legacy web user interface before you enable the graphics-based web user interface

on your router. Access to the web user interface on your router is disabled by default.

•

You must specify the default route in the Gigabit Ethernet management VRF interface before configuring

the web user interface on your router. The web user interface is disabled when the Gigabit Ethernet

management interface is not configured, or is not functioning. For information on configuring a default

route in the Gigabit Ethernet management interface on your router, see Setting a Default Route in the

Management Ethernet Interface VRF, on page 38.

Step 1

(Optional) Enter the show clock command in privileged EXEC mode to ensure that the clock setting on your router is

accurate:

Router# show clock

*19:40:20.598 UTC Fri Jan 21 2013

If the router time is not properly set, use the clock set and clock timezone commands to set the system clock.

For more information about how clock settings on both the router and the web browser can impact the web user

interface, see Clocks and the Web User Interface, on page 47.

Note

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 45

Using the Management Interfaces

Web User Interface Management

Step 2

Enter the configure terminal command to enter global configuration mode.

Step 3

Enter the following commands to enable the legacy web user interface:

• ip http server—Enables HTTP on port 80, which is the default HTTP port.

• ip http port port-number—Enables HTTP on the nondefault user-specified port. Default port number is 80.

• ip http secure-server—Enables HTTPS on port 443, the default HTTPS port.

• ip http secure-port port-number—Enables HTTPS on the nondefault user-specified port.

You can now access the legacy web user interface.

Step 4

Create and name a persistent web user interface transport map by entering the transport-map type persistent webui

transport-map - name command.

Step 5

Enable HTTP, HTTPS, or both by entering the following commands in the transport map configuration mode:

• server—Enables HTTP.

• secure-server—Enables HTTPS.

Port numbers cannot be set within the transport map. The port numbers that you defined in Step 3 are also used with

these settings in the persistent web user interface transport map.

Step 6

(Optional) Enter the show transport-map name transport-map-name in privileged EXEC command to verify that your

transport map is properly configured.

Step 7

Enter the transport-map type persistent webui transport-map - name command in global configuration mode to enable

the transport map.

Accessing the Web User Interface

Step 1

Open your web browser. The web user interface supports the following web browsers:

•

Microsoft Internet Explorer 6 or later

•

Mozilla Firefox 2.0 or later

Step 2

Enter the address of the router in the Address field of the web browser. The format for the router address is

http://<routername or management-ethernet-ip-address>:[http-port] or https://<routername or

management-ethernet-ip-address>:[https-port]. The addresses depend upon your web browser user interface configurations

and whether your router is participating in DNS.

The following examples are acceptable Address-field entries:

HTTP Using Default Port Example

http://172.16.5.1

HTTPS Using Default Port Example

https://172.16.5.1

HTTP Using NonDefault Port Example

http://172.16.5.1:94

Cisco 4000 Series ISRs Software Configuration Guide

46 OL-29328-03

Using the Management Interfaces

Web User Interface Management

HTTPS Using NonDefault Port Example

https://172.16.5.1:530/

HTTP Using Default Port Participating in DNS Example

http://router1

HTTPS Using Default Port Participating in DNS Example

https://router1

HTTP Using NonDefault Port Participating in DNS Example

http://router1:94

HTTPS Using NonDefault Port Participating in DNS Example

https://router1:530/

Step 3

When prompted, enter your username and password.

The username and password combination required to enter the web user interface is the same combination

required to access the router.

Note

The graphics-based web user interface, similar to the figure in Graphics-Based Web User Interface Overview, on page

43 is displayed.

For additional information on the commands and the options available with each command, see the Cisco IOS Configuration

Fundamentals Command Reference.

Web User Interface Authentication

When accessing the web user interface for your router, you must enter the same username and password as

the ones configured on your router for authentication purposes. The web browser prompts all users for a

username and password combination, and the web browser verifies this information with the router before

allowing access to the web user interface.

Only users with a privilege level of 15 can access the web user interface. Authentication of web user interface

traffic is governed by the authentication configuration for all other traffic.

To configure authentication on your router, see "Configuring Authentication" in the Cisco IOS Security

Configuration Guide.

Domain Name System and the Web User Interface

The Domain Name System (DNS) is a distributed database in which you can map hostnames to IP addresses

through the DNS protocol from a DNS server.

If the router is configured to participate in the DNS, users can access the web user interface by entering

http://<dns-hostname> as the web browser address.

For information on configuring the DNS, see "Configuring DNS" in the IP Addressing: DNS Configuration

Guide, Cisco IOS XE Release 3S.

Clocks and the Web User Interface

Certain web browsers can reject the request to view the web user interface if the time seen by the web browser

differs from the time seen on the router by an hour or more. We recommend checking the router time using

the show clock command before configuring the router. You can set the router's system time using the clock

set and clock timezone commands.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 47

Using the Management Interfaces

Web User Interface Management

Similarly, the web browser's clock source, which is usually the personal computer, must display accurate time

to properly access the web user interface.

Your access is being denied for one of the following reasons:

– Your previous session has timed-out.

– You have been logged out from elsewhere.

– You have not yet logged in.

– The resource requires a higher privilege level login.

If web user interface is inaccessible even after fixing one or more of the possible causes of the issue listed

above, check your router's clock setting and your PC clock setting to ensure that both the clocks are displaying

the correct day and time and retry accessing your web user interface.

Clock-related issues may occur when one clock changes to day light savings time while the other remains

unchanged.

Note

Using Auto Refresh

The web user interface does not refresh content automatically by default. To set an auto-refresh interval,

follow these steps:

Step 1

Select the Refresh every check box on your graphical web user interface home page.

A check mark is displayed in the check box. (See the following figure.)

Figure 3: Auto-Refresh Check Box on the Graphic-Based Web User Interface

Cisco 4000 Series ISRs Software Configuration Guide

48 OL-29328-03

Using the Management Interfaces

Web User Interface Management

Step 2

Set the frequency of the auto-refresh interval using the drop-down menu.

Step 3

Set the frequency of the auto-refresh interval using the drop-down menu.

Step 4

Click the Start button to the right of the drop-down menu.

Immediately after clicking the Start button, it becomes the Stop button and a countdown timer is displayed on the right

of this Stop button as shown in the following figure.

Figure 4: Stop Button with Auto Refresh Counter

Configuration Examples

Enabling the web user interface using the default HTTP port: Example

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# ip http server

Router(config)# transport-map type persistent webui http-webui

Router(config-tmap)# server

Router(config-tmap)# exit

Router(config)# exit

Router# show transport-map name http-webui

Transport Map:

Name: http-webui

Type: Persistent Webui Transport

Webui:

Server: enabled

Secure Server: disabled

Router# configure terminal

Router(config)# transport type persistent webui input http-webui

*Sep. 21 02:43:55.798: %UICFGEXP-6-SERVER_NOTIFIED_START: R0/0: psd: Server wui has been

notified to start

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 49

Using the Management Interfaces

Web User Interface Management

Enabling the web user interface using the default HTTPs port: Example

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# ip http secure-server

Router(config)# transport-map type persistent webui https-webui

Router(config-tmap)# secure-server

Router(config-tmap)# exit

Router(config)# transport type persistent webui input https-webui

*Sep. 21 02:38:43.597: %UICFGEXP-6-SERVER_NOTIFIED_START: R0/0: psd: Server wui has been

notified to start

Enabling the web user interface using the default HTTP and HTTPS ports: Example

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# ip http server

Router(config)# ip http secure-server

Router(config)# transport-map type persistent webui http-https-webui

Router(config-tmap)# server

Router(config-tmap)# secure-server

Router(config-tmap)# exit

Router(config)# transport type persistent webui input http-https-webui

*Sep 21 02:47:22.981: %UICFGEXP-6-SERVER_NOTIFIED_START: R0/0: psd: Server wui has been

notified to start

Cisco 4000 Series ISRs Software Configuration Guide

50 OL-29328-03

Using the Management Interfaces

Web User Interface Management

CHAPTER 6

Console Port, Telnet, and SSH Handling

This chapter includes the following sections:

•

Notes and Restrictions for Console Port, Telnet, and SSH, page 51

•

Console Port Overview, page 52

•

Console Port Handling Overview, page 52

•

Telnet and SSH Overview, page 52

•

Persistent Telnet and Persistent SSH Overview, page 52

•

Configuring a Console Port Transport Map, page 53

•

Configuring Persistent Telnet, page 55

•

Configuring Persistent SSH, page 57

•

Viewing Console Port, SSH, and Telnet Handling Configurations, page 60

•

Configuring Auxiliary Port for Modem Connection , page 65

Notes and Restrictions for Console Port, Telnet, and SSH

•

Telnet and Secure Shell (SSH) settings configured in the transport map override any other Telnet or

SSH settings when the transport map is applied to the Ethernet management interface.

•

Only local usernames and passwords can be used to authenticate users entering a Ethernet management

interface. AAA authentication is not available for users accessing the router through a Ethernet

management interface using persistent Telnet or persistent SSH.

•

Applying a transport map to a Ethernet management interface with active Telnet or SSH sessions can

disconnect the active sessions. Removing a transport map from an interface, however, does not disconnect

any active Telnet or SSH session.

•

Configuring the diagnostic and wait banners is optional, but recommended. The banners are especially

useful as indicators to users about the status of their Telnet or SSH attempts.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 51

Console Port Overview

The console port on the router is an EIA/TIA-232 asynchronous, serial connection with no flow control and

an RJ-45 connector. The console port is used to access the router and is located on the front panel of the Route

Processor.

For information on accessing the router using the console port, see Using Cisco IOS XE Software, on page

Console Port Handling Overview

If you are using the console port to access the router, you are automatically directed to the Cisco IOS

command-line interface (CLI).

If you are trying to access the router through the console port and send a break signal (by entering Ctrl-C or

Ctrl-Shift-6, or by entering the send break command at the Telnet prompt) before connecting to the CLI,

you are directed to a diagnostic mode if the non-RPIOS subpackages are accessible. These settings can be

changed by configuring a transport map for the console port and applying that transport map to the console

interface.

Telnet and SSH Overview

Telnet and SSH on the router can be configured and handled like Telnet and SSH on other Cisco platforms.

For information on traditional Telnet, see the line command in the Cisco IOS Terminal Services Command

Reference, Release 12.2 document.

For information on configuring traditional SSH, see the “Configuring Secure Shell” chapter in the Cisco IOS

Terminal Services Command Reference, Release 12.2 document.

On the router, persistent Telnet and persistent SSH allow network administrators to more clearly define the

treatment of incoming traffic when users access the router through the management ethernet port using Telnet

or SSH. Notably, persistent Telnet and persistent SSH provide more robust network access by allowing the

router to be configured to be accessible through the Ethernet management port using Telnet or SSH even

when the Cisco IOS process has failed.

Persistent Telnet and Persistent SSH Overview

In traditional Cisco routers, accessing the router using Telnet or SSH is not possible if the Cisco IOS software

fails. When Cisco IOS fails on a traditional Cisco router, the only method of accessing the router is through

the console port. Similarly, if all the active Cisco IOS processes have failed on a router that is not using

persistent Telnet or persistent SSH, the only method of accessing the router is through the console port.

However, with persistent Telnet and persistent SSH, you can configure a transport map that defines the

treatment of incoming Telnet or SSH traffic on the Ethernet management interface. Among the many

configuration options, a transport map can be configured to direct all traffic to the Cisco IOS CLI, diagnostic

mode, or to wait for a Cisco IOS VTY line to become available and then direct users to diagnostic mode when

a user sends a break signal while waiting for the IOS VTY line to become available. If a user uses Telnet or

SSH to access diagnostic mode, that Telnet or SSH connection will be usable even in scenarios when no Cisco

IOS process is active. Therefore, persistent Telnet and persistent SSH introduce the ability to access the router

Cisco 4000 Series ISRs Software Configuration Guide

52 OL-29328-03

Console Port, Telnet, and SSH Handling

Console Port Overview

via diagnostic mode when the Cisco IOS process is not active. For information on diagnostic mode, see Using

Cisco IOS XE Software. For information on the options that are can be configured using persistent Telnet or

persistent SSH transport maps, see Configuring Persistent Telnet, on page 55 and Configuring Persistent

SSH, on page 57.

Configuring a Console Port Transport Map

This task describes how to configure a transport map for a console port interface on the router.

SUMMARY STEPS

enable

configure terminal

transport-map type console transport-map-name

connection wait [allow [interruptible] | none [disconnect]]

(Optional) banner [diagnostic | wait] banner-message

exit

transport type console console-line-number input transport-map-name

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Example:

Router> enable

Enter your password if prompted.

Enters global configuration mode.configure terminal

Example:

Router# configure terminal

Step 2

Creates and names a transport map for handling console connections,

and enters transport map configuration mode.

transport-map type console

transport-map-name

Example:

Router(config)# transport-map type

console consolehandler

Step 3

Specifies how a console connection will be handled using this transport

map.

connection wait [allow [interruptible] | none

[disconnect]]

Step 4

Example:

Router(config-tmap)# connection wait

none

• allow interruptible—The console connection waits for a Cisco

IOS VTY line to become available, and also allows users to enter

diagnostic mode by interrupting a console connection that is waiting

for a Cisco IOS VTY line to become available. This is the default

setting.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 53

Console Port, Telnet, and SSH Handling

Configuring a Console Port Transport Map

PurposeCommand or Action

Users can interrupt a waiting connection by entering Ctrl-C

or Ctrl-Shift-6.

Note

• none—The console connection immediately enters diagnostic mode.

(Optional) Creates a banner message that will be seen by users entering

diagnostic mode or waiting for the Cisco IOS VTY line because of the

console transport map configuration.

(Optional) banner [diagnostic | wait]

banner-message

Example:

Router(config-tmap)# banner diagnostic

Step 5

• diagnostic—Creates a banner message seen by users directed to

diagnostic mode because of the console transport map configuration.

Users can interrupt a waiting connection by entering Ctrl-C

or Ctrl-Shift-6.

Note

Enter TEXT message. End with the

character 'X'.

--Welcome to Diagnostic Mode--

• wait—Creates a banner message seen by users waiting for Cisco

IOS VTY to become available.

Router(config-tmap)#

• banner-message—Banner message, which begins and ends with

the same delimiting character.

Exits transport map configuration mode to re-enter global configuration

mode.

exit

Example:

Router(config-tmap)# exit

Step 6

Applies the settings defined in the transport map to the console interface.

transport type console console-line-number

input transport-map-name

Step 7

The transport-map-name for this command must match the

transport-map-name defined in the transport-map type console

command.

Example:

Router(config)# transport type console

0 input consolehandler

Examples

The following example shows how to create a transport map to set console port access policies and attach to

console port 0:

Router(config)# transport-map type console consolehandler

Router(config-tmap)# connection wait allow interruptible

Router(config-tmap)# banner diagnostic X

Enter TEXT message. End with the character 'X'.

--Welcome to diagnostic mode--

Router(config-tmap)# banner wait X

Enter TEXT message. End with the character 'X'.

Waiting for IOS vty line

Router(config-tmap)# exit

Router(config)# transport type console 0 input consolehandler

Cisco 4000 Series ISRs Software Configuration Guide

54 OL-29328-03

Console Port, Telnet, and SSH Handling

Configuring a Console Port Transport Map

Configuring Persistent Telnet

For a persistent Telnet connection to access an Cisco IOS vty line on the router, local login authentication

must be configured for the vty line (the login command in line configuration mode). If local login authentication

is not configured, users will not be able to access Cisco IOS using a Telnet connection into the management

Ethernet interface with an applied transport map. Diagnostic mode will still be accessible in this scenario.

SUMMARY STEPS

enable

configure terminal

transport-map type persistent telnet transport-map-name

connection wait [allow [interruptible] | none [disconnect]]

(Optional) banner [diagnostic | wait] banner-message

transport interface gigabitethernet 0

exit

transport type persistent telnetinput transport-map-name

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Example:

Router> enable

•

Enter your password if prompted.

Enters global configuration mode.configure terminal

Example:

Router# configure terminal

Step 2

Creates and names a transport map for handling persistent Telnet connections,

and enters transport map configuration mode.

transport-map type persistent telnet

transport-map-name

Example:

Router(config)# transport-map type

persistent telnet telnethandler

Step 3

Specifies how a persistent Telnet connection will be handled using this

transport map:

connection wait [allow [interruptible] |

none [disconnect]]

Step 4

Example:

Router(config-tmap)# connection wait

none

• allow—The Telnet connection waits for a Cisco IOS vty line to become

available, and exits the router if interrupted.

• allow interruptible—The Telnet connection waits for the Cisco IOS

vty line to become available, and also allows user to enter diagnostic

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 55

Console Port, Telnet, and SSH Handling

Configuring Persistent Telnet

PurposeCommand or Action

mode by interrupting a Telnet connection waiting for the Cisco IOS

vty line to become available. This is the default setting.

Users can interrupt a waiting connection by entering Ctrl-C

or Ctrl-Shift-6.

Note

• none—The Telnet connection immediately enters diagnostic mode.

• none disconnect—The Telnet connection does not wait for the Cisco

IOS vty line and does not enter diagnostic mode, so all Telnet

connections are rejected if no vty line is immediately available in the

Cisco IOS software.

(Optional) Creates a banner message that will be seen by users entering

diagnostic mode or waiting for the Cisco IOS vty line because of the

persistent Telnet configuration.

(Optional) banner [diagnostic | wait]

banner-message

Example:

Router(config-tmap)# banner

Step 5

• diagnostic—Creates a banner message seen by users directed into

diagnostic mode because of the persistent Telnet configuration.

diagnostic X

Users can interrupt a waiting connection by entering Ctrl-C

or Ctrl-Shift-6.

Note

Enter TEXT message. End with the

character 'X'.

--Welcome to Diagnostic Mode--

• wait—Creates a banner message seen by users waiting for the vty line

to become available.

Router(config-tmap)#

• banner-message—The banner message, which begins and ends with

the same delimiting character.

Applies the transport map settings to the management Ethernet interface

(interface gigabitethernet 0).

transport interface gigabitethernet 0

Example:

Router(config-tmap)# transport

interface gigabitethernet 0

Step 6

Persistent Telnet can be applied only to the management Ethernet interface

on the router. This step must be taken before applying the transport map to

the management Ethernet interface.

Exits transport map configuration mode to re-enter global configuration

mode.

exit

Example:

Router(config-tmap)# exit

Step 7

Applies the settings defined in the transport map to the management Ethernet

interface.

transport type persistent telnetinput

transport-map-name

Step 8

Example:

Router(config)# transport type

persistent telnet input telnethandler

The transport-map-name for this command must match the

transport-map-name defined in the transport-map type persistent telnet

command.

Cisco 4000 Series ISRs Software Configuration Guide

56 OL-29328-03

Console Port, Telnet, and SSH Handling

Configuring Persistent Telnet

Examples

In the following example, a transport map that will make all Telnet connections wait for a Cisco IOS XE vty

line to become available before connecting to the router, while also allowing the user to interrupt the process

and enter diagnostic mode, is configured and applied to the management Ethernet interface (interface

gigabitethernet 0).

A diagnostic and a wait banner are also configured.

The transport map is then applied to the interface when the transport type persistent telnet input command

is entered to enable persistent Telnet.

Router(config)# transport-map type persistent telnet telnethandler

Router(config-tmap)# connection wait allow interruptible

Router(config-tmap)# banner diagnostic X

Enter TEXT message. End with the character 'X'.

--Welcome to diagnostic mode--

Router(config-tmap)# banner wait X

Enter TEXT message. End with the character 'X'.

Waiting for IOS IOS Process--

Router(config-tmap)# transport interface gigabitethernet 0

Router(config-tmap)# exit

Router(config)# transport type persistent telnet input telnethandler

Configuring Persistent SSH

This task describes how to configure persistent SSH on the router.

SUMMARY STEPS

enable

configure terminal

transport-map type persistent ssh transport-map-name

connection wait [allow [interruptible] | none [disconnect]]

rsa keypair-name rsa-keypair-name

(Optional) authentication-retries number-of-retries

(Optional) banner [diagnostic | wait] banner-message

(Optional) time-out timeout-interval

transport interface gigabitethernet 0

10.

exit

11.

transport type persistent ssh input transport-map-name

DETAILED STEPS

PurposeCommand or Action

Enables privileged EXEC mode.enable

Step 1

Example:

Router> enable

Enter your password if prompted.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 57

Console Port, Telnet, and SSH Handling

Configuring Persistent SSH

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

Router# configure terminal

Step 2

Creates and names a transport map for handling persistent SSH

connections, and enters transport map configuration mode.

transport-map type persistent ssh

transport-map-name

Example:

Router(config)# transport-map type

persistent telnet telnethandler

Step 3

Specifies how a persistent SSH connection will be handled using this

transport map:

connection wait [allow [interruptible] |

none [disconnect]]

Step 4

Example:

Router(config-tmap)# connection wait

interruptible

• allow—The SSH connection waits for a Cisco IOS VTY line to

become available, and exits the router if interrupted.

• allow interruptible—The SSH connection waits for the VTY line

to become available, and also allows a user to enter diagnostic mode

by interrupting an SSH connection waiting for the VTY line to

become available. This is the default setting.

Users can interrupt a waiting connection by entering Ctrl-C

or Ctrl-Shift-6.

Note

• none—The SSH connection immediately enters diagnostic mode.

• none disconnect—The SSH connection does not wait for the VTY

line and does not enter diagnostic mode. Therefore, all SSH

connections are rejected if no VTY line is immediately available.

Names the RSA keypair to be used for persistent SSH connections.

rsa keypair-name rsa-keypair-name

Step 5

Example:

Router(config)# rsa keypair-name

sshkeys

For persistent SSH connections, the RSA keypair name must be defined

using this command in transport map configuration mode. The RSA

keypair definitions defined elsewhere on the router, such as through the

use of the ip ssh rsa keypair-name command, do not apply to persistent

SSH connections.

No rsa-keypair-name is defined by default.

(Optional) Specifies the number of authentication retries before dropping

the connection.

(Optional) authentication-retries

number-of-retries

Step 6

Example:

Router(config-tmap)#

authentication-retries 4

The default number-of-retries is 3.

Cisco 4000 Series ISRs Software Configuration Guide

58 OL-29328-03

Console Port, Telnet, and SSH Handling

Configuring Persistent SSH

PurposeCommand or Action

(Optional) Creates a banner message that will be seen by users entering

diagnostic mode or waiting for the VTY line because of the persistent

SSH configuration.

(Optional) banner [diagnostic | wait]

banner-message

Example:

Router(config-tmap)# banner diagnostic

Step 7

• diagnostic—Creates a banner message seen by users directed to

diagnostic mode because of the persistent SSH configuration.

• wait—Creates a banner message seen by users waiting for the VTY

line to become available.

Enter TEXT message. End with the

character 'X'.

--Welcome to Diagnostic Mode--

Router(config-tmap)#

• banner-message—The banner message, which begins and ends with

the same delimiting character.

(Optional) Specifies the SSH time-out interval, in seconds.

(Optional) time-out timeout-interval

Step 8

Example:

Router(config-tmap)# time-out 30

The default timeout-interval is 120 seconds.

Applies the transport map settings to the Ethernet management interface

(interface gigabitethernet 0).

transport interface gigabitethernet 0

Example:

Router(config-tmap)# transport

interface gigabitethernet 0

Step 9

Persistent SSH can be applied only to the Ethernet management interface

on the router.

Exits transport map configuration mode to re-enter global configuration

mode.

exit

Example:

Router(config-tmap)# exit

Step 10

Applies the settings defined in the transport map to the Ethernet

management interface.

transport type persistent ssh input

transport-map-name

Step 11

Example:

Router(config)# transport type

persistent ssh input sshhandler

The transport-map-name for this command must match the

transport-map-name defined in the transport-map type persistent ssh

command.

Examples

The following example shows a transport map that will make all SSH connections wait for the VTY line to

become active before connecting to the router being configured and applied to the Ethernet management

interface (interface gigabitethernet 0). The RSA keypair is named sshkeys.

This example only uses the commands required to configure persistent SSH.

Router(config)# transport-map type persistent ssh sshhandler

Router(config-tmap)# connection wait allow

Router(config-tmap)# rsa keypair-name sshkeys

Router(config-tmap)# transport interface gigabitethernet 0

Enter TEXT message. End with the character 'X'.

--Welcome to diagnostic mode--

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 59

Console Port, Telnet, and SSH Handling

Configuring Persistent SSH

Router(config-tmap)# banner wait X

Enter TEXT message. End with the character 'X'.

--Waiting for IOS IOS Process--

Router(config-tmap)# transport interface gigabitethernet 0

Router(config-tmap)# exit

Router(config)# transport type persistent telnet input telnethandler

In the following example, a transport map is configured and will apply the following settings to users attempting

to access the Ethernet management port via SSH:

•

SSH users will wait for the VTY line to become active, but will enter diagnostic mode if the attempt to

access the Cisco IOS software through the VTY line is interrupted.

•

The RSA keypair name is sshkeys.

•

The connection allows one authentication retry.

•

The banner --Welcome to Diagnostic Mode-- will appear if diagnostic mode is entered as a result

of SSH handling through this transport map.

•

The banner --Waiting for vty line-- will appear if the connection is waiting for the VTY line to

become active.

•

The transport map is then applied to the interface when the transport type persistent ssh input command

is entered to enable persistent SSH:

Router(config)# transport-map type persistent ssh sshhandler

Router(config-tmap)# connection wait allow interruptible

Router(config-tmap)# rsa keypair-name sshkeys

Router(config-tmap)# authentication-retries 1

Router(config-tmap)# banner diagnostic X

Enter TEXT message. End with the character 'X'.

--Welcome to diagnostic mode--

Router(config-tmap)# banner wait X

Enter TEXT message. End with the character 'X'.

--Waiting for vty line--

Router(config-tmap)# time-out 30

Router(config-tmap)# transport interface gigabitethernet 0

Router(config-tmap)# exit

Router(config)# transport type persistent ssh input sshhandler

Viewing Console Port, SSH, and Telnet Handling Configurations

Use the following commands to view console port, SSH, and Telnet handling configurations:

•

show transport-map

•

show platform software configuration access policy

Use the show transport-map command to view transport map configurations.

show transport-map [all | name transport-map-name | type [console | persistent [ssh | telnet]]]

This command can be used either in user EXEC mode or privileged EXEC mode.

Cisco 4000 Series ISRs Software Configuration Guide

60 OL-29328-03

Console Port, Telnet, and SSH Handling

Viewing Console Port, SSH, and Telnet Handling Configurations

Example

The following example shows transport maps that are configured on the router: a console port

(consolehandler), persistent SSH (sshhandler), and persistent Telnet transport (telnethandler):

Router# show transport-map all

Transport Map:

Name: consolehandler

Type: Console Transport

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for the IOS CLI

bshell banner:

Welcome to Diagnostic Mode

Transport Map:

Name: sshhandler

Type: Persistent SSH Transport

Interface:

GigabitEthernet0

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS prompt

Bshell banner:

Welcome to Diagnostic Mode

SSH:

Timeout: 120

Authentication retries: 5

RSA keypair: sshkeys

Transport Map:

Name: telnethandler

Type: Persistent Telnet Transport

Interface:

GigabitEthernet0

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS process

Bshell banner:

Welcome to Diagnostic Mode

Transport Map:

Name: telnethandling1

Type: Persistent Telnet Transport

Connection:

Wait option: Wait Allow

Router# show transport-map type console

Transport Map:

Name: consolehandler

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 61

Console Port, Telnet, and SSH Handling

Viewing Console Port, SSH, and Telnet Handling Configurations

Type: Console Transport

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for the IOS CLI

Bshell banner:

Welcome to Diagnostic Mode

Router# show transport-map type persistent ssh

Transport Map:

Name: sshhandler

Type: Persistent SSH Transport

Interface:

GigabitEthernet0

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS prompt

Bshell banner:

Welcome to Diagnostic Mode

SSH:

Timeout: 120

Authentication retries: 5

RSA keypair: sshkeys

Router# show transport-map type persistent telnet

Transport Map:

Name: telnethandler

Type: Persistent Telnet Transport

Interface:

GigabitEthernet0

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS process

Bshell banner:

Welcome to Diagnostic Mode

Transport Map:

Name: telnethandling1

Type: Persistent Telnet Transport

Connection:

Wait option: Wait Allow

Router# show transport-map name telnethandler

Transport Map:

Name: telnethandler

Type: Persistent Telnet Transport

Interface:

GigabitEthernet0

Connection:

Cisco 4000 Series ISRs Software Configuration Guide

62 OL-29328-03

Console Port, Telnet, and SSH Handling

Viewing Console Port, SSH, and Telnet Handling Configurations

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS process

Bshell banner:

Welcome to Diagnostic Mode

Router# show transport-map name consolehandler

Transport Map:

Name: consolehandler

Type: Console Transport

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for the IOS CLI

Bshell banner:

Welcome to Diagnostic Mode

Router# show transport-map name sshhandler

Transport Map:

Name: sshhandler

Type: Persistent SSH Transport

Interface:

GigabitEthernet0

Connection:

Wait option: Wait Allow Interruptable

Wait banner:

Waiting for IOS prompt

Bshell banner:

Welcome to Diagnostic Mode

SSH:

Timeout: 120

Authentication retries: 5

RSA keypair: sshkeys

Router#

Use the show platform software configuration access policy command to view the current configurations

for handling the incoming console port, SSH, and Telnet connections. The output of this command provides

the current wait policy for each type of connection (Telnet, SSH, and console), as well as information on the

currently configured banners.

Unlike the show transport-map command, the show platform software configuration access policy

command is available in diagnostic mode so that it can be entered in scenarios where you need transport map

configuration information, but cannot access the Cisco IOS CLI.

Example

Router# show platform software configuration access policy

The current access-policies

Method : telnet

Rule : wait

Shell banner:

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 63

Console Port, Telnet, and SSH Handling

Viewing Console Port, SSH, and Telnet Handling Configurations

Wait banner :

Method : ssh

Rule : wait

Shell banner:

Wait banner :

Method : console

Rule : wait with interrupt

Shell banner:

Wait banner :

Example

The following example shows the show platform software configuration access policy command being

issued both before and after a new transport map for SSH are configured. During the configuration, the

connection policy and banners are set for a persistent SSH transport map, and the transport map for SSH is

enabled.

Router# show platform software configuration access policy

The current access-policies

Method : telnet

Rule : wait with interrupt

Shell banner:

Welcome to Diagnostic Mode

Wait banner :

Waiting for IOS Process

Method : ssh

Rule : wait

Shell banner:

Wait banner :

Method : console

Rule : wait with interrupt

Shell banner:

Wait banner :

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# transport-map type persistent ssh sshhandler

Router(config-tmap)# connection wait allow interruptible

Router(config-tmap)# banner diagnostic X

Enter TEXT message. End with the character 'X'.

Welcome to Diag Mode

Router(config-tmap)# banner wait X

Enter TEXT message. End with the character 'X'.

Waiting for IOS

Router(config-tmap)# rsa keypair-name sshkeys

Router(config-tmap)# transport interface gigabitethernet 0

Router(config-tmap)# exit

Router(config)# transport type persistent ssh input sshhandler

Router(config)# exit

Router# show platform software configuration access policy

The current access-policies

Method : telnet

Rule : wait with interrupt

Shell banner:

Welcome to Diagnostic Mode

Wait banner :

Waiting for IOS process

Cisco 4000 Series ISRs Software Configuration Guide

64 OL-29328-03

Console Port, Telnet, and SSH Handling

Viewing Console Port, SSH, and Telnet Handling Configurations

Method : ssh

Rule : wait with interrupt

Shell banner:

Welcome to Diag Mode

Wait banner :

Waiting for IOS

Method : console

Rule : wait with interrupt

Shell banner:

Wait banner :

Configuring Auxiliary Port for Modem Connection

Cisco 4000 Series ISR supports connecting a modem to the router auxiliary port for EXEC dial in connectivity.

When a modem is connected to the auxiliary port, a remote user can dial in to the router and configure it. To

configure a modem on the auxiliary port, perform these steps:

Step 1

Connect the RJ-45 end of the adapter cable to the black AUX port on the router.

Step 2

Use the show line command to determine the async interface of the AUX port:

Router# show line

Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int

* 0 CTY - - - - - 0 0 0/0 -

1 AUX 9600/9600 - - - - - 0 0 0/0 -

2 VTY - - - - - 0 0 0/0 -

3 VTY - - - - - 0 0 0/0 -

4 VTY - - - - - 0 0 0/0 -

5 VTY - - - - - 0 0 0/0 -

6 VTY - - - - - 0 0 0/0 -

Step 3

Use the following commands to configure the router AUX line::

Router(config)# line 1

Router(config-line)#modem inOut

Router(config-line)#modem autoconfigure type usr_sportster

Router(config-line)#speed 115200 [Speed to be set according to the modem manual]

Router(config-line)#stopbits 1 [Stopbits to be set according to the modem manual]

Router(config-line)#transport input all

Router(config-line)#flowcontrol hardware [flowcontrol to be set according to the modem manual]

Router(config-line)#password cisco

Router(config-line)#login

Router(config-line)#end

Router(config)#enable password lab

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 65

Console Port, Telnet, and SSH Handling

Configuring Auxiliary Port for Modem Connection

Step 4

Use the reverse telnet method on the modem to verify the modem connectivity and configuration string:

Router(config)#int loopback 0

Router(config-if)#ip add 1.1.1.1 255.255.255.0

Router(config-if)#end

Router#telnet 1.1.1.1 2001

Trying 1.1.1.1, 2001 ... Open

User Access Verification

Password: <enter the password given under line configuration>

at <<<=== Modem command

OK <<<=== This OK indicates that the modem is connected successully to the AUX port.

Step 5

Use an analog phone to verify that the phone line is active and functions properly. Then, connect the analog phone line

to the modem.

Step 6

Initialize an EXEC modem call to the router from another device (PC) to test the modem connection.

Step 7

When the connection is established, the dial in client is prompted for a password. Enter the correct password.

Note: This password should match the one that is configured on the auxiliary port line.

Cisco 4000 Series ISRs Software Configuration Guide

66 OL-29328-03

Console Port, Telnet, and SSH Handling

Configuring Auxiliary Port for Modem Connection

CHAPTER 7

Installing the Software

This chapter includes the following sections:

•

Overview, page 67

•

ROMMON Images, page 68

•

Provisioning Files, page 68

•

File Systems, page 68

•

Autogenerated File Directories and Files, page 69

•

Flash Storage, page 70

•

Configuring the Configuration Register for Autoboot, page 70

•

Licensing, page 71

Overview

Installing software on the router involves installing a consolidated package (bootable image). This consists

of a bundle of subpackages (modular software units), with each subpackage controlling a different set of

functions.

These are the two main methods to install the software:

• Managing and Configuring a Router to Run Using a Consolidated Package, on page 76—This method

allows for individual upgrade of subpackages and generally has reduced boot times compared to the

method below. Use this method if you want to individually upgrade a module's software.

• Managing and Configuring a Router to Run Using Individual Packages, on page 80—This a simple

method that is similar to a typical Cisco router image installation and management that is supported

across Cisco routers.

It is better to upgrade software in a planned period of maintenance when an interruption in service is acceptable.

The router needs to be rebooted for a software upgrade to take effect.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 67

ROMMON Images

A ROMMON image is a software package used by ROM Monitor (ROMMON) software on a router. The

software package is separate from the consolidated package normally used to boot the router. For more

information on ROMMON, see the "ROM Monitor Overview and Basic Procedures" section in the Hardware

Installation Guide for the Cisco 4000 Series Integrated Services Routers.

An independent ROMMON image (software package) may occasionally be released and the router can be

upgraded with the new ROMMON software. For detailed instructions, see the documentation that accompanies

the ROMMON image.

A new version of the ROMMON image is not necessarily released at the same time as a consolidated

package for a router.

Note

Provisioning Files

This section provides background information about the files and processes used in Managing and Configuring

a Router to Run Using Individual Packages, on page 80.

The consolidated package on a router consists of a collection of subpackages and a provisioning file titled

packages.conf. To run the software, the usual method used is to boot the consolidated package, which is

copied into memory, expanded, mounted, and run within memory. The provisioning file's name can be renamed

but subpackage file's names cannot be renamed. The provisioning file and subpackage files must be kept in

the same directory. The provisioning file does not work properly if any individual subpackage file is contained

within a different directory.

An exception to this is that if a new or upgraded module firmware package is subsequently installed, it

need not be in the same directory as the provisioning file.

Note

Configuring a router to boot, using the provisioning file packages.conf, is beneficial because no changes have

to be made to the boot statement after the Cisco IOS XE software is upgraded.

Alternatively, for an example of booting using subpackages, see Configuring the Router to Boot Using

Subpackages, on page 292.

File Systems

The following table provides a list of file systems that can be seen on the Cisco 4000 series routers.

Table 8: Router File Systems

DescriptionFile System

Boot flash memory file system.bootflash:

Cisco 4000 Series ISRs Software Configuration Guide

68 OL-29328-03

Installing the Software

ROMMON Images

DescriptionFile System

Alias to the boot flash memory file system above.flash:

Hard disk file system (if NIM-SSD, NIM-HDD, or internal mSATA flash device is

present in the router).

The internal mSATA flash device is supported only on Cisco ISR4300 Series

routers.

Note

harddisk:

Cisco Networking Services file directory.cns:

Router NVRAM. You can copy the startup configuration to NVRAM or from

NVRAM.

nvram:

File system for Onboard Failure Logging (OBFL) files.obfl:

System memory file system, which includes the running configuration.system:

Archive file system.tar:

Temporary system files file system.tmpsys:

The Universal Serial Bus (USB) flash drive file systems.

The USB flash drive file system is visible only if a USB drive is installed

in usb0: or usb1: ports.

Note

usb0:

usb1:

usbtoken file system.

A usbtoken file system may not always be visible, because the file system

is only visible when a usbtoken is inserted.

Note

usbtoken0:

usbtoken1:

Use the ? help option, or use the copy command in command reference guides, if you find a file system that

is not listed in the table above.

Autogenerated File Directories and Files

This section discusses the autogenerated files and directories that can be created, and how the files in these

directories can be managed.

Table 9: Autogenerated Files

DescriptionFile or Directory

Crashinfo files may appear in the bootflash: file system.

These files provide descriptive information of a crash and may be useful for

tuning or troubleshooting purposes. However, the files are not part of router

operations, and can be erased without impacting the functioning of the router.

crashinfo files

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 69

Installing the Software

Autogenerated File Directories and Files

DescriptionFile or Directory

The storage area for .core files.

If this directory is erased, it will automatically regenerate itself at bootup.

The .core files in this directory can be erased without impacting any router

functionality, but the directory itself should not be erased.

core directory

This directory is created on bootup if a system check is performed. Its

appearance is completely normal and does not indicate any issues with the

router.

lost+found directory

The storage area for trace files.

Trace files are useful for troubleshooting. If the Cisco IOS process fails, for

instance, users or troubleshooting personnel can access trace files using

diagnostic mode to gather information related to the Cisco IOS failure.

Trace files, however, are not a part of router operations, and can be erased

without impacting the router's performance.

tracelogs directory

Important Notes About Autogenerated Directories

Important information about autogenerated directories include:

•

Autogenerated files on the bootflash: directory should not be deleted, renamed, moved, or altered in any

way unless directed by Cisco customer support.

Altering autogenerating files on the bootflash: may have unpredictable consequences

for system performance.

Note

•

Crashinfo, core, and trace files can be deleted.

Flash Storage

Subpackages are installed to local media storage, such as flash. For flash storage, use the dir bootflash:

command to list the file names.

Flash storage is required for successful operation of a router.Note

Configuring the Configuration Register for Autoboot

The configuration register can be used to change router behavior. This includes controlling how the router

boots. Set the configuration register to 0x0 to boot into ROM, by using one of the following commands:

Cisco 4000 Series ISRs Software Configuration Guide

70 OL-29328-03

Installing the Software

Flash Storage

•

In Cisco IOS configuration mode, use the config-reg 0x0 command.

•

From the ROMMON prompt, use the confreg 0x0 command.

For more information about the configuration register, see Use of the Configuration Register on All Cisco

Routers and Configuring a Router to Boot the Consolidated Package via TFTP Using the boot Command:

Example, on page 77.

Setting the configuration register to 0x2102 will set the router to autoboot the Cisco IOS XE software.Note

The console baud rate is set to 9600 after changing the confreg to 0x2102 or 0x0. If you cannot establish

a console session after setting confreg, or garbage output appears, change the setting on your terminal

emulation software to 9600.

Note

Licensing

•

Cisco Software Licensing, on page 71

•

Consolidated Packages, on page 71

•

Technology Packages, on page 72

•

Feature Licenses, on page 73

•

Unlicensed Feature: Example, on page 75

Cisco Software Licensing

Cisco software licensing consists of processes and components to activate Cisco IOS software feature sets by

obtaining and validating Cisco software licenses.

You can enable licensed features and store license files in the bootflash of your router. Licenses pertain to

consolidated packages, technology packages, or individual features.

An evaluation license is automatically converted to a Right to Use model after 60 days and this license is valid

permanently. The conversion to a permanent license applies only to evaluation licenses. For other features

supported on your router, you must purchase a permanent license.

See the "Configuring the Cisco IOS Software Activation Feature" chapter of the Software Activation

Configuration Guide, Cisco IOS XE Release 3S.

Consolidated Packages

One of the following two consolidated packages (images) is preinstalled on the router:

• universalk9—Contains the ipbasek9 base package and the securityk9, uck9, and appxk9 technology

packages.

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 71

Installing the Software

Licensing

• universalk9_npe—Contains the ipbasek9 base package and the securityk9_npe, uck9, and appxk9

technology packages. This image has limited crypto functionality.

The term npe stands for No Payload Encryption.Note

The terms super package and image also refer to a consolidated package.Note

To obtain software images for the router, go to http://software.cisco.com/download/navigator.html.

An image-based license is used to help bring up all the subsystems that correspond to a license. This license

is enforced only at boot time.

Apart from the universalk9 and universalk9_npe images, a Boot ROMMON image is available. For more

information, see ROMMON Images, on page 68.

For more information about identifying digitally signed Cisco software and how to show the digital signature

information of an image file, see the "Digitally Signed Cisco Software" section in the Loading and Managing

System Images Configuration Guide, Cisco IOS XE Release 3S.

The following examples show how to obtain software authenticity information and internal details of a package:

•

Displaying Digitally Signed Cisco Software Signature Information, on page 299

•

Obtaining the Description of a Module or Consolidated Package, on page 302

Many features within the consolidated package are contained in the ipbasek9 base package. The license key

for the ipbasek9 package is activated by default.

Technology Packages

Technology packages contain software features within a consolidated package. To use different sets of features,

enable the licenses of selected technology packages. You can enable the licenses for any combination of

technology packages.

Each technology package has an evaluation license that converts to a Right to Use (RTU) license after 60

days and is then valid permanently.

The following is a list of technology packages:

•

securityk9, on page 72

•

uck9, on page 73

•

appxk9, on page 73

securityk9

The securityk9 technology package includes all crypto features, including IPsec, SSL/SSH, Firewall, and

Secure VPN.

Cisco 4000 Series ISRs Software Configuration Guide

72 OL-29328-03

Installing the Software

Technology Packages

The securityk9_npe package (npe = No Payload Encryption) includes all the features in the securityk9

technology package without the payload-encryption functionality. This is to fulfill export restriction

requirements. The securityk9_npe package is available only in the universalk9_npe image. The difference

in features between the securityk9 package and the securityk9_npe package is therefore the set of

payload-encryption-enabling features such as IPsec and Secure VPN.

uck9

The uck9 technology package includes the following Cisco Unified Communications features:

•

CUBE

•

CME-SRST

•

SBC

appxk9

The appxk9 technology package contains Application Experience features, which are similar to the features

in the DATA package of the Cisco Integrated Services Routers Generation 2 routers. For more information,

see: http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/

software-activation-on-integrated-services-routers-isr/white_paper_c11_556985.html#wp9000791.

There are many features in the appxk9 package, including MPLS, PfR, L2/L3 VPN, Broadband, and AVC.

Feature Licenses

To use each of the following features, enable a corresponding feature license, as explained in the following

sections:

•

HSECK9, on page 73

•

Performance, on page 74

•

CME-SRST, on page 74

HSECK9

The HSECK9 license is required for a feature to have full crypto functionality. Without the HSECK9 license,

only 225 secure tunnels and 85 Mbps of crypto bandwidth would be available. The HSECK9 license allows

features in the securityk9 technology package to use the maximum number of secure tunnels and crypto

bandwidth. To enable the HSECK9 license, purchase the FL-44-HSEC-K9 license from Cisco.com and

install it using the license install license-files command. For further information on obtaining and installing

feature licenses, see Configuring the Cisco IOS Software Activation Feature.

The HSECK9 feature does not have an evaluation license that converts to an RTU license after 60 days;

a feature license must be obtained.

Note

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 73

Installing the Software

Feature Licenses

To enable the license for the HSECK9 feature, the securityk9 technology package is also required. For more

information about the securityk9 technology package, see securityk9, on page 72.

Performance

The performance feature, which allows for increased throughput, is enabled by the performance license. This

feature is part of the ipbasek9 technology package. To enable the feature, order the performance license (part

number FL-44-PERF-K9). The license is displayed as the throughput license.

To configure the feature, use the platform hardware throughput level throughput command in the global

configuration mode:

platform hardware throughput level throughput

CME-SRST

The CME-SRST feature requires the uck9 technology package. To activate the CME-SRST feature license,

see Activating the CME-SRST Feature License, on page 74.

Activating the CME-SRST Feature License

Before You Begin

Ensure the following:

•

License for uck9 technology package is available.

•

The CME-SRST feature is configured.

SUMMARY STEPS

show license detail cme-srst

configure terminal

license accept end user agreement

exit

show license detail cme-srst

write memory

DETAILED STEPS

PurposeCommand or Action

Displays the available CME-SRST license.show license detail cme-srst

Step 1

Example:

Router# show license detail cme-srst

The EULA should be in NOT ACCEPTED

state.

Note

Cisco 4000 Series ISRs Software Configuration Guide

74 OL-29328-03

Installing the Software

Activating the CME-SRST Feature License

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

Router# configure terminal

Step 2

Configures a one-time acceptance of the EULA for the

CME-SRST license.

license accept end user agreement

Example:

Router# license accept end user agreement

Step 3

Accept the EULA by typing YES.

Exits global configuration mode.exit

Example:

Router# exit

Step 4

Displays the available CME-SRST license.show license detail cme-srst

Step 5

Example:

Router# show license detail cme-srst

The EULA should be in ACCEPTED

state.

Note

Saves configuration.write memory

Example:

Router# write memory

Step 6

Unlicensed Feature: Example

If you try to use a feature that is part of a package that is not enabled, an error message is displayed.

In the following example, the crypto map command is called during configuration and an error message is

displayed. This is because, the feature associated with crypto map is part of the securityk9 package and the

securityk9 package is not enabled.

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#crypto map

% Invalid input detected at '^' marker.

Use the show license feature command to view the license features that are enabled. In the following example,

the securityk9 and the uck9 packages are not enabled.

ipbasek9 is provided by default.Note

Router# show license feature

Feature name Enforcement Evaluation Subscription Enabled RightToUse

appxk9 yes yes no yes yes

uck9 yes yes no no yes

securityk9 yes yes no no yes

ipbasek9 no no no yes yes

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 75

Installing the Software

Unlicensed Feature: Example

LED Indicators

For information on LEDs on the router, see "LED Indicators" in the "Overview" section of the Hardware

Installation Guide for the Cisco 4000 Series Integrated Services Routers.

For information on LEDs on the SSD Carrier Card NIM, see "Overview of the SSD Carrier Card NIM

(NIM-SSD)" in the "Installing and Upgrading Internal Modules and FRUs" section of the Hardware Installation

Guide for the Cisco 4000 Series Integrated Services Routers.

Related Documentation

For further information on software licenses, see Software Activation on Cisco Integrated Services Routers

and Cisco Integrated Service Routers G2.

For further information on obtaining and installing feature licenses, see Configuring the Cisco IOS Software

Activation Feature.

How to Install and Upgrade the Software

To install or upgrade the software, use one of the following methods to use the software from a consolidated

package or an individual package. Also see Overview, on page 67.

•

Managing and Configuring a Router to Run Using a Consolidated Package, on page 76

•

Managing and Configuring a Router to Run Using Individual Packages, on page 80

Managing and Configuring a Router to Run Using a Consolidated Package

Do not use these procedures if you also need to install any optional subpackages or plan to upgrade

individual subpackages. See Managing and Configuring a Router to Run Using Individual Packages, on

page 80.

Note

•

Managing and Configuring a Consolidated Package Using copy and boot Commands, on page 76

•

Configuring a Router to Boot the Consolidated Package via TFTP Using the boot Command: Example,

on page 77

Managing and Configuring a Consolidated Package Using copy and boot Commands

To upgrade a consolidated package, copy the consolidated package to the bootflash: directory on the router

using the copy command. After making this copy of the consolidated package, configure the router to boot

using the consolidated package file.

The following example shows the consolidated package file being copied to the bootflash: file system via

TFTP. The config register is then set to boot using boot system commands, and the boot system commands

instruct the router to boot using the consolidated package stored in the bootflash: file system. The new

Cisco 4000 Series ISRs Software Configuration Guide

76 OL-29328-03

Installing the Software

LED Indicators

configuration is then saved using the copy running-config startup-config command, and the system is then

reloaded to complete the process.

Router# dir bootflash:

Directory of bootflash:/

11 drwx 16384 Dec 4 2007 04:32:46 -08:00 lost+found

86401 drwx 4096 Dec 4 2007 06:06:24 -08:00 .ssh

14401 drwx 4096 Dec 4 2007 06:06:36 -08:00 .rollback_timer

28801 drwx 4096 Mar 18 2008 17:31:17 -07:00 .prst_sync

43201 drwx 4096 Dec 4 2007 04:34:45 -08:00 .installer

928862208 bytes total (712273920 bytes free)

Router# copy tftp: bootflash:

Address or name of remote host []? 172.17.16.81

Source filename []? /auto/tftp-users/user/isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin

Destination filename [isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin]?

Accessing

tftp://172.17.16.81//auto/tftp-users/user/isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin

...

Loading /auto/tftp-users/user/isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin from

172.17.16.81 (via GigabitEthernet0):

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!

[OK - 208904396 bytes]

208904396 bytes copied in 330.453 secs (632176 bytes/sec)

Router# dir bootflash:

Directory of bootflash:/

11 drwx 16384 Dec 4 2007 04:32:46 -08:00 lost+found

86401 drwx 4096 Dec 4 2007 06:06:24 -08:00 .ssh

14401 drwx 4096 Dec 4 2007 06:06:36 -08:00 .rollback_timer

28801 drwx 4096 Mar 18 2008 17:31:17 -07:00 .prst_sync

43201 drwx 4096 Dec 4 2007 04:34:45 -08:00 .installer

12 -rw- 208904396 May 28 2008 16:17:34 -07:00

isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin

928862208 bytes total (503156736 bytes free)

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# boot system flash bootflash:isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin

Router(config)# config-reg 0x2102

Router(config)# exit

Router# show run | include boot

boot-start-marker

boot system flash bootflash:isr4400-universalk9.03.10.00.S.153-3.S-ext.SPA.bin

boot-end-marker

Router# copy run start

Destination filename [startup-config]?

Building configuration...

[OK]

Router# reload

Configuring a Router to Boot the Consolidated Package via TFTP Using the boot Command:

Example

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#boot system tftp://10.81.116.4/rtp-isr4400-54/isr4400.bin

Router(config)#config-register 0x2102

Router(config)#exit

Router# show run | include boot

boot-start-marker

boot system tftp://10.81.116.4/rtp-isr4400-54/isr4400.bin

boot-end-marker

license boot level adventerprise

Router# copy running-config startup-config

Destination filename [startup-config]?

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 77

Installing the Software

How to Install and Upgrade the Software

Building configuration...

[OK]

Router# reload

Proceed with reload? [confirm]

Sep 13 17:42:54.445 R0/0: %PMAN-5-EXITACTION: Process manager is exiting: process exit with

reload chassis code

Initializing Hardware ...

System integrity status: c0000600

Failures detected:

Boot FPGA corrupt

Key Sectors:(Primary,GOOD),(Backup,GOOD),(Revocation,GOOD)

Size of Primary = 2288 Backup = 2288 Revocation = 300

ROM:RSA Self Test Passed

ROM:Sha512 Self Test Passed

Self Tests Latency: 58 msec

System Bootstrap, Version 12.2(20120618:163328) [username-ESGROM_20120618_GAMMA 101],

DEVELOPMENT SOFTWARE

Compiled Mon 05/27/2014 12:39:32.05 by username

Current image running: Boot ROM0

Last reset cause: LocalSoft

Cisco ISR 4400 platform with 4194304 Kbytes of main memory

IP_ADDRESS: 172.18.42.119

IP_SUBNET_MASK: 255.255.255.0

DEFAULT_GATEWAY: 172.18.42.1

TFTP_SERVER: 10.81.116.4

TFTP_FILE: rtp-isr4400-54/isr4400.bin

TFTP_MACADDR: a4:4c:11:9d:ad:97

TFTP_VERBOSE: Progress

TFTP_RETRY_COUNT: 18

TFTP_TIMEOUT: 7200

TFTP_CHECKSUM: Yes

ETHER_PORT: 0

ETHER_SPEED_MODE: Auto Detect

link up...

Receiving rtp-isr4400-54/isr4400.bin from 10.81.116.4

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

File reception completed.

Boot image size = 424317088 (0x194a90a0) bytes

ROM:RSA Self Test Passed

ROM:Sha512 Self Test Passed

Self Tests Latency: 58 msec

Package header rev 1 structure detected

Calculating SHA-1 hash...done

validate_package: SHA-1 hash:

calculated 7294dffc:892a6c35:a7a133df:18c032fc:0670b303

expected 7294dffc:892a6c35:a7a133df:18c032fc:0670b303

Signed Header Version Based Image Detected

Using FLASH based Keys of type = PRIMARY KEY STORAGE

Using FLASH based Keys of type = ROLLOVER KEY STORAGE

RSA Signed DEVELOPMENT Image Signature Verification Successful.

Package Load Test Latency : 5116 msec

Image validated

%IOSXEBOOT-4-BOOT_ACTIVITY_LONG_TIME: (local/local): load_modules took: 2 seconds,

expected max time 2 seconds

Cisco 4000 Series ISRs Software Configuration Guide

78 OL-29328-03

Installing the Software

How to Install and Upgrade the Software

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

Rights clause at FAR sec. 52.227-19 and subparagraph

Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cisco IOS Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Experimental Version

15.4(20140527:095327)

[v154_3_s_xe313_throttle-BLD-BLD_V154_3_S_XE313_THROTTLE_LATEST_20140527_070027-ios 156]

Compiled Tue 27-May-14 21:28 by mcpre

licensed under the GNU General Public License ("GPL") Version 2.0. The

software code licensed under GPL Version 2.0 is free software that comes

with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such

GPL code under the terms of GPL Version 2.0. For more details, see the

documentation or "License Notice" file accompanying the IOS-XE software,

or the applicable URL provided on the flyer accompanying the IOS-XE

software.

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

Warning: the compile-time code checksum does not appear to be present.

cisco ISR4451/K9 (2RU) processor with 1133585K/6147K bytes of memory.

Processor board ID FGL1619100P

4 Gigabit Ethernet interfaces

32768K bytes of non-volatile configuration memory.

4194304K bytes of physical memory.

7393215K bytes of Compact flash at bootflash:.

7816688K bytes of USB flash at usb0:.

Press RETURN to get started!

Router>

Router>enable

Router# show version

Cisco IOS XE Software, Version BLD_V154_3_S_XE313_THROTTLE_LATEST_20140527_070027-ext

Cisco IOS Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Experimental Version

15.4(20140527:095327)

v154_3_s_xe313_throttle-BLD-BLD_V154_3_S_XE313_THROTTLE_LATEST_20140527_070027-ios 156]

IOS XE Version: BLD_V154_3_S_XE313_THROTTLE_LATEST

Cisco 4000 Series ISRs Software Configuration Guide

OL-29328-03 79

Installing the Software

How to Install and Upgrade the Software

licensed under the GNU General Public License ("GPL") Version 2.0. The

software code licensed under GPL Version 2.0 is free software that comes

with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such

GPL code under the terms of GPL Version 2.0. For more details, see the

documentation or "License Notice" file accompanying the IOS-XE software,

or the applicable URL provided on the flyer accompanying the IOS-XE

software.

ROM: IOS-XE ROMMON

Router uptime is 0 minutes

Uptime for this control processor is 3 minutes

System returned to ROM by reload

System image file is "tftp://10.81.116.4/rtp-isr4400-54/isr4400.bin"

Last reload reason: Reload Command