Megsunda: /* NTP-D27 Set Up the ONS 15454 SDH for Firewall Access */

2009-01-15T14:44:07Z

NTP-D27 Set Up the ONS 15454 SDH for Firewall Access

New page

This chapter explains how to provision a single Cisco ONS 15454 SDH node and turn it up for service, including node name, date and time, timing references, network attributes such as IP address and default router, users and user security, and card protection groups.

== Before You Begin ==

Complete the procedures applicable to your site plan from the following chapters:
* [[ONS 15454 SDH Procedure Guide R8.5.1 -- Install the Shelf and FMECs#Install the Shelf and FMECs|Install the Shelf and FMECs]]
* [[ONS 15454 SDH Procedure Guide R8.5.1 -- Install Cards and Fiber-Optic Cable#Install Cards and Fiber-Optic Cable|Install Cards and Fiber-Optic Cable]]
* [[ONS 15454 SDH Procedure Guide R8.5.1 -- Connect the PC and Log into the GUI#Connect the PC and Log into the GUI|Connect the PC and Log into the GUI]]

This section lists the chapter procedures (NTPs). Turn to a procedure for applicable tasks (DLPs).
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]-Complete this procedure first.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D30 Create Users and Assign Security|NTP-D30 Create Users and Assign Security]]-Continue with this procedure to create Cisco Transport Controller (CTC) users and assign their security levels.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D316 Set Up Name, Date, Time, and Contact Information|NTP-D316 Set Up Name, Date, Time, and Contact Information]]-Continue with this procedure to set the node name, date, time, location, and contact information.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D279 Set Power Monitor Thresholds|NTP-D279 Set Power Monitor Thresholds]]-Continue with this procedure to set the node battery power thresholds.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D169 Set Up CTC Network Access|NTP-D169 Set Up CTC Network Access]]-Continue with this procedure to provision the IP address, default router, subnet mask, and network configuration settings.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D364 Set Up the ONS 15454 in Secure Mode|NTP-D364 Set Up the ONS 15454 in Secure Mode]]-Continue with this procedure to connect the CTC in secure mode.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-A360 Enable EMS Secure Access|NTP-A360 Enable EMS Secure Access]]-Continue with this procedure to enable EMS secure access and provide enhanced SFTP and SSH security.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D27 Set Up the ONS 15454 SDH for Firewall Access|NTP-D27 Set Up the ONS 15454 SDH for Firewall Access]]-Continue with this procedure if the ONS 15454 SDH will be accessed behind firewalls.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D28 Set Up Timing|NTP-D28 Set Up Timing]]-Continue with this procedure to set up the node's SDH timing references.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D170 Create Protection Groups|NTP-D170 Create Protection Groups]]-Complete this procedure, as needed, to set up 1:1, 1:N, or 1+1 protection groups for ONS 15454 SDH electrical and optical cards.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D171 Set Up SNMP|NTP-D171 Set Up SNMP]]-Complete this procedure if Simple Network Management Protocol (SNMP) will be used for network monitoring.
# [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D326 Provision OSI|NTP-D326 Provision OSI]]-Complete this procedure if the ONS 15454 SDH will be connected in networks with network elements (NEs) that are based on the Open System Interconnection (OSI) protocol stack. This procedure provisions the Target Identifier Address Resolution Protocol (TARP), OSI routers, manual area addresses, subnetwork points of attachment, and IP-over-OSI tunnels.

== NTP-D24 Verify Card Installation ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure verifies that the ONS 15454 SDH node is ready for turn-up.
|-
|

'''Tools/Equipment'''
|

An engineering work order, site plan, or other document specifying the ONS 15454 SDH card installation.
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Install the Shelf and FMECs#Install the Shelf and FMECs|Install the Shelf and FMECs]]

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Install Cards and Fiber-Optic Cable#Install Cards and Fiber-Optic Cable|Install Cards and Fiber-Optic Cable]]
|-
|

'''Required/As Needed'''
|

Required
|-
|

'''Onsite/Remote'''
|

Onsite
|-
|

'''Security Level'''
|

Retrieve or higher
|}

# Verify that two TCC2/TCC2P cards are installed in Slots 7 and 11.
# Verify that the green ACT (active) LED is illuminated on one TCC2/TCC2P card and the amber STBY (standby) LED is illuminated on the second TCC2/TCC2P card.
#: '''Note: ''' If the TCC2/TCC2P cards are not installed, or if their LEDs are not operating as described, do not proceed. Repeat the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D300 to D399#DLP-D332 Install the TCC2/TCC2P Cards|"DLP-D332 Install the TCC2/TCC2P Cards"]] task, or refer to the ''Cisco ONS 15454 SDH Troubleshooting Guide'' to resolve installation problems before proceeding to Step 3.
# Verify that cross-connect cards (XC-VXL-2.5G, XC-VXL-10G, XC-VXC-10G) are installed in Slots 8 and 10. The cross-connect cards must be the same type.
# Verify that the green ACT (active) LED is illuminated on one cross-connect card and the amber STBY (standby) LED is illuminated on the second cross-connect card.
#: '''Note: ''' If the cross-connect cards are not installed, or if their LEDs are not illuminated as described, do not proceed. Repeat the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D300 to D399#DLP-D333 Install the XC-VXL-10G, XC-VXL-2.5G, or XC-VXC-10G Cards|"DLP-D333 Install the XC-VXL-10G, XC-VXL-2.5G, or XC-VXC-10G Cards"]] task, or refer to the ''Cisco ONS 15454 SDH Troubleshooting Guide'' to resolve installation problems before proceeding to Step 5.
# If your site plan requires an AIC-I card, verify that the AIC-I card is installed in Slot 9 and its ACT (active) LED displays a solid green light.
# Verify that electrical cards (E1-42, E3-12, DS3i-N-12, or STM1E) are installed in the ONS 15454 SDH slots as designated by your installation plan.
# If your site requires an Ethernet card, verify that the Ethernet card (E100T-12, E100T-12-G, E1000-2, E1000-2-G, G1K-4, ML1000-2, ML100T-12, ML-100X-8, CE-1000-4, ML-MR-10, or CE-MR-10) is installed in Slots 1 to 6 or 12 to 17, and that its ACT (active) LED displays a solid green light.
# If an E1000-2, E1000-2-G, G1000-4, G1K-4, ML1000-2, ML100X-8, CE-1000-4, ML-MR-10, or CE-MR-10 Ethernet card is installed, verify that it has a Gigabit Interface Converter (GBIC) or Small Form-factor Pluggable (SFP/XFP) installed. If not, see the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D300 to D399#DLP-D335 Install GBIC or SFP/XFP Devices|"DLP-D335 Install GBIC or SFP/XFP Devices"]] task.
# Verify that STM-N cards (STM-1, STM-1-8, STM-4, STM-4-4, STM-16, STM-16 any slot (AS), STM-64, MRC-12, and MRC-2.5G-4) are installed in the slots designated by your site plan. STM-1, STM-4, and STM-16 AS cards can be installed in Slots 1 to 6 or 12 to 17. The STM-1-8 and STM-4-4 can only be installed in Slots 1 to 4 or 14 to 17, and the STM-16 and STM-64 can only be installed in Slots 5 to 6 and 12 to 13.
# Verify that all installed STM-N cards display a solid amber STBY LED.
# If transponder or muxponder cards are installed (TXP_MR_10G, TXP_MR_2.5G, TXPP_MR_2.5G, MXP_MR_2.5G, MXPP_MR_2.5G, MXP_2.5G_10G, TXP_MR_10E, TXP_MR_10E_L, TXP_MR_10E_C, MXP_2.5G_10E, MXP_2.5G_10E_C, MXP_2.5G_10E_L, MXP_MR_10DME_L, MXP_MR_10DME_C, ADM-10G, GE_XP, or 10GE_XP), verify that they are installed in Slots 1 to 6 or 12 to 17 and have GBIC or SFP connectors are installed. For information about installing and provisioning TXP and MXP cards, refer to the ''Cisco ONS 15454 DWDM Procedure Guide''.
# If Fibre Channel (FC_MR-4) cards are installed, verify that the FC_MR-4 card is installed in Slots 1 to 6 or 12 to 17 and displays a solid green ACT (Active) LED.
# Verify that fiber-optic cables are installed and connected to the locations indicated in the site plan. If the fiber-optic cables are not installed, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Install Cards and Fiber-Optic Cable#NTP-D19 Install Fiber-Optic Cables on Optical Cards|NTP-D19 Install Fiber-Optic Cables on Optical Cards]].
# Verify that fiber is routed correctly in the shelf assembly and fiber boots are installed properly. If the fiber is not routed on the shelf assembly, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Install Cards and Fiber-Optic Cable#NTP-D245 Route Fiber-Optic Cables|NTP-D245 Route Fiber-Optic Cables]]. If the fiber boots are not installed, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D45 Install the Fiber Boot|"DLP-D45 Install the Fiber Boot"]] task.
# Verify that the software release shown on the LCD matches the software release indicated in your site plan. If the release does not match, perform one of the following procedures:
#* Perform a software upgrade using a Cisco ONS 15454 SDH software CD. Refer to the release-specific software upgrade document for instructions.
#* Replace the TCC2/TCC2P cards with cards containing the correct release. Refer to the ''Cisco ONS 15454 SDH Troubleshooting Guide''.
# Continue with the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D30 Create Users and Assign Security|NTP-D30 Create Users and Assign Security]].
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D30 Create Users and Assign Security ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure creates ONS 15454 SDH users and assigns their security levels.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Superuser only
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task at the node where you want to create users. If you are already logged in, continue with Step 2.
#: '''Note: ''' You must log in as a Superuser to create additional users. The CISCO15 user provided with each ONS 15454 SDH can be used to set up other ONS 15454 SDH users. You can add up to 500 users to one ONS 15454 SDH.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D74 Create a New User on a Single Node|"DLP-D74 Create a New User on a Single Node"]] task or the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D75 Create a New User on Multiple Nodes|"DLP-D75 Create a New User on Multiple Nodes"]] task as needed.
#: '''Note: ''' You must add the same user name and password to each node a user will access.
# If you want to modify the security policy settings, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Change Node Settings#NTP-D205 Modify Users and Change Security|NTP-D205 Modify Users and Change Security]].
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D316 Set Up Name, Date, Time, and Contact Information ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions identification information for the node, including the node name, a contact name and phone number, the location of the node, and the date, time, and time zone.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Superuser only
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task for the node you will turn up. If you are already logged in, continue with Step 2.
# Click the '''Provisioning > General'''tabs.
# Enter the following information in the fields listed:
#* Node Name-Type a name for the node. For TL1 compliance, names must begin with an alpha character and have no more than 20 alphanumeric characters.
#* Contact-(Optional) Type the name of the node contact person and the phone number, up to 255 characters.
#* Latitude-(Optional) Enter the node latitude: N (North) or S (South), degrees, and minutes.
#* Longitude-(Optional) Enter the node longitude: E (East) or W (West), degrees, and minutes.
#: '''Tip: ''' You can also position nodes manually on the network view map. Press '''Ctrl''' then drag and drop the node icon. To create a logical network map for all ONS 15454 SDH users, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Network#NTP-D172 Create a Logical Network Map|NTP-D172 Create a Logical Network Map]].
#: '''Note: ''' The latitude and longitude values only indicate the geographical position of the nodes in the actual network and not the CTC node position.
#* Description-Type a description of the node. The description can be a maximum of 255 characters.
#* Use NTP/SNTP Server-When checked, CTC uses a Network Time Protocol (NTP) or Simple Network Time Protocol (SNTP) server to set the date and time of the node.
::If you do not use an SNTP or NTP server, complete the Date and Time fields. The ONS 15454 SDH will use these fields for alarm dates and times. By default, CTC displays all alarms in the CTC computer time zone for consistency. To change the display to the node time zone, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D112 Display Alarms and Conditions Using Time Zone|"DLP-D112 Display Alarms and Conditions Using Time Zone"]] task.
:: '''Note: ''' Using an NTP or SNTP server ensures that all ONS 15454 SDH network nodes use the same date and time reference. The server synchronizes the node's time after power outages or software upgrades.
:: If you check the Use NTP/SNTP Server check box, type the IP address of one of the following:
::* An NTP/SNTP server connected to the ONS 15454 SDH
::* Another ONS 15454 SDH with NTP/SNTP enabled that is connected to the ONS 15454 SDH
:: If you check gateway network element (GNE) for the ONS 15454 SDH SOCKS proxy server, (see the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D200 to D299#DLP-D249 Provision IP Settings|"DLP-D249 Provision IP Settings"]] task), external ONS 15454 SDH nodes must reference the gateway ONS 15454 SDH for NTP/SNTP timing. For more information about the SOCKS proxy server feature, refer to the "Management Network Connectivity" chapter in the ''Cisco ONS 15454 SDH Reference Manual''.

'''Caution! ''' If you reference another ONS 15454 SDH for the NTP/SNTP server, make sure the second ONS 15454 SDH references an NTP/SNTP server and not the first ONS 15454 SDH (that is, do not create an NTP/SNTP timing loop by having two ONS 15454 SDH nodes reference each other).
:* Date-If Use NTP/SNTP Server is not selected, type the current date in the format mm/dd/yyyy, for example, September 24, 2004 is 09/24/2004.
:* Time-If Use NTP/SNTP Server is not selected, type the current time in the format hh:mm:ss, for example, 11:24:58. The ONS 15454 SDH uses a 24-hour clock, so 10:00 PM is entered as 22:00:00.
:: '''Note: ''' To change the global date format from American to European, select the appropriate format on the General tab of the CTC Preferences window. American format is mm/dd/yyyy, for example, September 24, 2004 is 09/24/2004. European format is dd/mm/yyyy, for example, September 24, 2004 is 24/09/2004.
:* Time Zone-Click the field and choose a city within your time zone from the drop-down list. The list displays the 80 World Time Zones from -11 through 0 (GMT) to +14. Continental United States time zones are GMT-05:00 (Eastern), GMT-06:00 (Central), GMT-07:00 (Mountain), and GMT-08:00 (Pacific).
:* Use Daylight Savings Time-Check this check box if the time zone that you chose uses Daylight Savings Time.
<ol start=4><li>Click '''Apply'''.</li>
<li>In the confirmation dialog box, click '''Yes'''.</li>
<li>Review the node information. If you need to make corrections, repeat Steps 3 through 5 to enter the corrections. If the information is correct, continue with the [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D279 Set Power Monitor Thresholds|NTP-D279 Set Power Monitor Thresholds]].</li></ol>
:: '''Stop'''. '''You have completed this procedure'''.

== NTP-D279 Set Power Monitor Thresholds ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions extreme high, high, low, and extreme low input battery power thresholds within a -48 VDC environment. When the thresholds are crossed, the TCC2/TCC2P generates warning alarms in CTC.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

Required
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Provisioning or higher
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task for the node you will set up. If you are already logged in, continue with Step 2.
# In node view, click the '''Provisioning > General > Power Monitor''' tabs.
# To change the extreme low battery voltage threshold in 0.5 VDC increments, choose a voltage from the ELWBATVG(Vdc) drop-down list.
# To change the low battery voltage threshold in 0.5 VDC increments, choose a voltage from the LWBATVG(Vdc) drop-down list.
# To change the high battery voltage threshold in 0.5 VDC increments, choose a voltage from the HIBATVG(Vdc) drop-down list.
# To change the extreme high battery voltage threshold in 0.5 VDC increments, choose a voltage from the EHIBATVG(Vdc) drop-down list.
# Click '''Apply'''.
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D169 Set Up CTC Network Access ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions network access for a node, including its subnet mask, default router, Dynamic Host Configuration Protocol (DHCP) server, Internet Inter-Orb Protocol (IIOP) listener port, SOCKS proxy server settings, dual IP address setting, static routes, Open Shortest Path First (OSPF) protocol, Routing Information Protocol (RIP), and designated SOCKS servers.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

Required
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Superuser only
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task. If you are already logged in, continue with Step 2.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D200 to D299#DLP-D249 Provision IP Settings|"DLP-D249 Provision IP Settings"]] task to provision the ONS 15454 SDH IP address, subnet mask, default router, DHCP, IIOP listener port, and SOCKS proxy server settings.
#: '''Tip: ''' If you cannot log into the node, you might be able to change its IP address, default router, and network mask by using the LCD on the ONS 15454 SDH front panel. See the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D64 Set the IP Address, Default Router, and Network Mask Using the LCD|"DLP-D64 Set the IP Address, Default Router, and Network Mask Using the LCD"]] task for instructions. However, you cannot use the LCD to provision any other network settings.
# If you want to turn on the ONS 15454 secure mode, which allows two IP addresses to be provisioned for the node if TCC2P cards are installed, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D84 Enable Node Secure Mode|"DLP-D84 Enable Node Secure Mode"]] task. Refer to the "Management Network Connectivity" chapter in the ''Cisco ONS 15454 SDH Reference Manual'' for information about secure mode.
# If static routes are needed, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D65 Create a Static Route|"DLP-D65 Create a Static Route"]] task. Refer to the "CTC Network Connectivity" chapter in the ''Cisco ONS 15454 SDH Reference Manual'' for further information about static routes.
# If the ONS 15454 SDH is connected to a LAN or WAN that uses OSPF and you want to share routing information between the LAN or WAN and the ONS network, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D200 to D299#DLP-D250 Set Up or Change Open Shortest Path First Protocol|"DLP-D250 Set Up or Change Open Shortest Path First Protocol"]] task.
# If the ONS 15454 SDH is connected to a LAN or WAN that uses RIP, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D200 to D299#DLP-D251 Set Up or Change Routing Information Protocol|"DLP-D251 Set Up or Change Routing Information Protocol"]] task.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D200 to D299#DLP-D289 Provision the Designated SOCKS Servers|"DLP-D289 Provision the Designated SOCKS Servers"]] task after the network is provisioned and one or more of the following conditions exist:
#* SOCKS proxy is enabled.
#* The ratio of ENEs to GNEs is greater than eight to one.
#* Most ENEs do not have LAN connectivity.
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D364 Set Up the ONS 15454 in Secure Mode ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions ONS 15454s and CTC computers for secure access.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D169 Set Up CTC Network Access|NTP-D169 Set Up CTC Network Access]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Superuser
|}

# In node view, click the '''Provisioning > Security > Access''' pane.
# Under the '''EMS Access''' area, change the '''Access State''' to '''Secure'''.
# Click '''Apply'''. The CTC disconnects and reconnects through a secure socket connection.
# To create a secure connection, enter '''https://node-address'''.

:'''Note: ''' After setting up a CTC connection in secure mode, http requests are automatically redirected to https mode.
<ol start=5><li>A first time connection is authenticated by the '''Website Certification is Not Known''' dialog box. Accept the certificate and click '''OK'''. The '''Security Error: Domain Name Mismatch''' dialog box appears. Click '''OK''' to continue. </li></ol>
:: '''Stop'''. '''You have completed this procedure'''.

== NTP-A360 Enable EMS Secure Access ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure enables EMS secure access. This procedure enables enhanced SFTP and SSH security .
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D169 Set Up CTC Network Access|NTP-D169 Set Up CTC Network Access]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Superuser
|}

# In shelf view, click the '''Provisioning > Security > Access pane'''.
# Under the '''EMS Access''' area, change the '''Access State''' to '''Secure'''.
# Click '''Apply'''. The CTC disconnects and reconnects through a secure socket connection.
# Set the listener port value by choosing "Other constant" radio button.
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D27 Set Up the ONS 15454 SDH for Firewall Access ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions ONS 15454 SDH nodes and CTC computers for access through firewalls.
|-
|

'''Tools/Equipment'''
|

IIOP listener port number provided by your LAN or firewall administrator
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Provisioning or higher
|}

# Log into a node that is behind the firewall. See the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task for instructions. If you are already logged in, continue with Step 2.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D67 Provision the IIOP Listener Port on the ONS 15454 SDH|"DLP-D67 Provision the IIOP Listener Port on the ONS 15454 SDH"]] task.
:: [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#Figure 4-1: ONS 15454 SDH Nodes Residing Behind a Firewall|Figure 4-1]] shows ONS 15454 SDH nodes in a protected network and the CTC computer in an external network. For the computer to access the ONS 15454 SDH nodes, you must provision the IIOP listener port specified by your firewall administrator on the ONS 15454 SDH.

===== Figure 4-1: ONS 15454 SDH Nodes Residing Behind a Firewall=====

[[Image:61331.jpg]]

<ol start=3><li>If the CTC computer resides behind a firewall, complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D68 Provision the IIOP Listener Port on the CTC Computer|"DLP-D68 Provision the IIOP Listener Port on the CTC Computer"]] task. </li></ol>

::[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#Figure 4-2: CTC Computer and ONS 15454 SDH Nodes Residing Behind Firewalls|Figure 4-2]] shows a CTC computer and ONS 15454 SDH behind firewalls. For the computer to access the ONS 15454 SDH, you must provision the IIOP port on the CTC computer and on the ONS 15454 SDH. Each firewall can use a different IIOP port.

===== Figure 4-2: CTC Computer and ONS 15454 SDH Nodes Residing Behind Firewalls=====

[[Image:61330.jpg]]

::'''Stop'''. '''You have completed this procedure'''.

== NTP-D28 Set Up Timing ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions the ONS 15454 SDH timing.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

Required
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Provisioning or higher
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task the ONS 15454 SDH node where you want to set up timing. If you are already logged in, continue with Step 2.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D69 Set Up External or Line Timing|"DLP-D69 Set Up External or Line Timing"]] task if an external building integrated timing supply (BITS) source is available. This is the most common SDH timing setup procedure.
# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D70 Set Up Internal Timing|"DLP-D70 Set Up Internal Timing"]] task if you cannot complete Step 2 (an external BITS source is not available). This task can only provide Stratum 3 timing.
#: '''Note: ''' For information about SDH timing, refer to the "Timing" chapter in the ''Cisco ONS 15454 SDH Reference Manual'' or ITU-T G.784.
#: '''Stop'''. '''You have completed this procedure'''.

== NTP-D170 Create Protection Groups ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure creates ONS 15454 SDH card protection groups.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Provisioning or higher
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task at the node where you want to create the protection group. If you are already logged in, continue with Step 2.
#: [[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#Table 4-1: Card Protection Types|Table 4-1]] describes the protection types available on the ONS 15454 SDH.

===== Table 4-1: Card Protection Types =====

{| border = 1
|-
!Type
!Cards
!Description and Installation Requirements
|-
|valign=top|

1:1
|valign=top|

DS3i-N-12

E3-12

STM1E
|valign=top|

Pairs one working card with one protect card. The protect card should be installed in an odd-numbered slot and the working card in an even-numbered slot next to the protect slot towards the TCC2/TCC2P, for example: protect in Slot 1, working in Slot 2; protect in Slot 3, working in Slot 4; protect in Slot 15, working in Slot 14. 1:1 protection can be revertive or nonrevertive. For more information, refer to the "Card Protection" chapter and the card reference material specific to the card in the ''Cisco ONS 15454 SDH Reference Manual''.
|-
|valign=top|

1:N
|valign=top|

E1-42N

DS3i-N-12
|valign=top|

1:N protection allows a single card to protect up to five (four for the DS3i-N-12 card) working cards of the same electrical level. An E1-42N card protects E1-42N cards and a DS3i-N-12 card protects DS3i-N-12 cards. For more information, refer to the "Card Protection" chapter and the card reference material specific to the card in the ''Cisco ONS 15454 SDH Reference Manual''.
|-
|valign=top|

1+1
|valign=top|

Any STM-N
|valign=top|

Pairs a working STM-N card/port with a protect STM-N card/port. For multiport STM-N cards, the protect port must match the working port on the working card. For example, Port 1 of an STM-1 card can only be protected by Port 1 of another STM-1 card. The ports on multiport cards must be either working or protect. You cannot mix working and protect ports on the same card. Cards do not need to be in adjoining slots. 1:1 protection can be revertive or nonrevertive, unidirectional or bidirecitonal.
|-
|valign=top|
Y Cable
|valign=top|

TXP_MR_10G

TXP_MR_10E

TXP_MR_2.5G

MXP_2.5G_10G

MXP_2.5G_10E

MXP_2.5G_10E_C

MXP_2.5G_10E_L

MXP_MR_2.5G

MXP_MR_10DME_C

MXP_MR_10DME_L

GE_XP (in 10GE or 20GE MXP card mode)

10GE_XP (in 10GE TXP card mode)
|valign=top|

Pairs a working transponder or muxponder card/port with a protect transponder or muxponder card/port. The protect port must be on a different card than the working port and it must be the same card type as the working port. The working and protect port numbers must be the same, that is, Port 1 can only protect Port 1, Port 2 can only protect Port 2, etc. To provision y-cable protection, see the ''Cisco ONS 15454 DWDM Procedure Guide''.
|-
|valign=top|

Splitter
|valign=top|

TXPP_MR_2.5G

MXPP_MR_2.5G
|valign=top|

Splitter protection is automatically provided with the TXPP_MR_2.5G and MXPP_MR_2.5G cards. For more information, refer to the ''Cisco ONS 15454 DWDM Procedure Guide''.
|-
|valign=top|

Unprotected
|valign=top|

Any
|

Unprotected cards can cause signal loss if a card fails or incurs a signal error. However, because no card slots are reserved for protection, unprotected schemes maximize the service available for use on the ONS 15454 SDH. Unprotected is the default protection type.
|}

<ol start=2><li>Complete one or more of the following tasks depending on the protection groups you want to create: </li></ol>
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D71 Create a 1:1 Protection Group|DLP-D71 Create a 1:1 Protection Group]]
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D72 Create a 1:N Protection Group|DLP-D72 Create a 1:N Protection Group]]
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D73 Create a 1+1 Protection Group|DLP-D73 Create a 1+1 Protection Group]]
:: '''Note: ''' If a protect card is not installed, you can complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D400 to D499#DLP-D442 Preprovision a Slot|"DLP-D442 Preprovision a Slot"]] task and continue with the card protection provisioning.
:: '''Note: ''' To provision Y-cable protection for TXP and MXP cards, refer to the ''Cisco ONS 15454 DWDM Procedure Guide''.
:: '''Stop. You have completed this procedure.'''

== NTP-D171 Set Up SNMP ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions the SNMP parameters so that you can use SNMP management software with the ONS 15454 SDH.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

Required if SNMP is used at your site.
|-
|

'''Onsite/Remote'''
|

Onsite or remote
|-
|

'''Security Level'''
|

Provisioning or higher
|}

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task at the node where you want to set up SNMP. If you are already logged in, continue with Step 2.
# In node view, click the '''Provisioning''' > '''SNMP '''tabs.
# In the Trap Destinations area, click '''Create'''.
# Complete the following in the Create SNMP Trap Destination dialog box ([[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#Figure 4-3: Creating an SNMP Trap Destination|Figure 4-3]]):
#* Destination IP Address-Type the IP address of your network management system. If the node you are logged into is an end network element (ENE), set the destination address to the GNE.
#* Community-Type the SNMP community name. For a description of SNMP community names, refer to the "SNMP" chapter in the ''Cisco ONS 15454 SDH Reference Manual''.
#: '''Note: ''' The community name is a form of authentication and access control. The community name assigned to the ONS 15454 SDH is case-sensitive and must match the community name of the network management system (NMS).
#* UDP Port-The default User Datagram Protocol (UDP) port for SNMP is 162. (More information about provisioning the UDP port is also given in the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D151 Set Up SNMP for a GNE|"DLP-D151 Set Up SNMP for a GNE"]] task on page 18-43 and [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D153 Set Up SNMP for an ENE|"DLP-D153 Set Up SNMP for an ENE"]] task.)
#: '''Note: ''' If the node is an ENE in a SOCKS proxy server network, the UDP port must be set to the GNE's SNMP relay port, which is 391.
#* Trap Version-Choose either SNMPv1 or SNMPv2. Refer to your NMS documentation to determine whether to use SNMP v1 or v2.

===== Figure 4-3: Creating an SNMP Trap Destination=====

[[Image:102063.jpg]]
<ol start=5><li>Click '''OK'''. The node IP address of the node where you provisioned the new trap destination appears in the Trap Destinations area.</li>
<li>Click the node IP address in the Trap Destinations area. Verify the SNMP information that appears in the Selected Destination list.</li>
<li>If you want to set up SNMP remote monitoring (RMON) on GNEs and ENEs, complete the following DLPs as required, depending on the protection groups that you want to create:</li>
:* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D151 Set Up SNMP for a GNE|DLP-D151 Set Up SNMP for a GNE]]
:* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D153 Set Up SNMP for an ENE|DLP-D153 Set Up SNMP for an ENE]]
:* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D162 Format and Enter NMS Community String for SNMP Command or Operation|DLP-D162 Format and Enter NMS Community String for SNMP Command or Operation]]
<li>Click '''Apply'''.</li></ol>
:: '''Stop'''. '''You have completed this procedure'''.

== NTP-D326 Provision OSI ==

{| border = 1
|-
|

'''Purpose'''
|

This procedure provisions the ONS 15454 SDH so it can be networked with other vendor NEs that use the OSI protocol stack for data communications network (DCN) communications. This procedure provisions the TARP, OSI routers, manual area addresses, subnetwork points of attachment, and IP-over-ConnectionLess Network Service (CLNS) tunnels.
|-
|

'''Tools/Equipment'''
|

None
|-
|

'''Prerequisite Procedures'''
|

[[ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node#NTP-D24 Verify Card Installation|NTP-D24 Verify Card Installation]]
|-
|

'''Required/As Needed'''
|

As needed
|-
|

'''Onsite/Remote'''
|

Onsite
|-
|

'''Security Level'''
|

Provisioning or higher
|}

'''Caution! ''' This procedure requires an understanding of OSI protocols, parameters, and functions. Before you begin, review the OSI reference sections in the "Management Network Connectivity" chapter in the ''Cisco ONS 15454 SDH Reference Manual''.

'''Caution! ''' Do not begin this procedure until you know the role of the ONS 15454 SDH within the OSI and IP network.

'''Note: ''' This procedure requires provisioning of non-ONS equipment including routers and third party NEs. Do not begin until you have the capability to complete that provisioning.

# Complete the [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D1 to D99#DLP-D60 Log into CTC|"DLP-D60 Log into CTC"]] task at the node where you want to provision the OSI routing mode. If you are already logged in, continue with Step 2.
# As needed, complete the following tasks:
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D165 Provision OSI Routing Mode|DLP-D165 Provision OSI Routing Mode]]-Complete this task first.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D166 Provision or Modify TARP Operating Parameters|DLP-D166 Provision or Modify TARP Operating Parameters]]-Complete this task next.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D167 Add a Static TID-to-NSAP Entry to the TARP Data Cache|DLP-D167 Add a Static TID-to-NSAP Entry to the TARP Data Cache]]-Complete this task as needed.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D169 Add a TARP Manual Adjacency Table Entry|DLP-D169 Add a TARP Manual Adjacency Table Entry]]-Complete this task as needed.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D171 Provision OSI Routers|DLP-D171 Provision OSI Routers]]-Complete this task as needed.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D172 Provision Additional Manual Area Addresses|DLP-D172 Provision Additional Manual Area Addresses]]-Complete this task as needed.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D173 Enable the OSI Subnet on the LAN Interface|DLP-D173 Enable the OSI Subnet on the LAN Interface]]-Complete this task as needed.
::* [[ONS 15454 SDH Procedure Guide R8.5.1 -- DLPs D100 to D199#DLP-D174 Create an IP-Over-CLNS Tunnel|DLP-D174 Create an IP-Over-CLNS Tunnel]]-Complete this task as needed.

::'''Stop. You have completed this procedure.'''

ONS 15454 SDH Procedure Guide R8.5.1 -- Turn Up a Node - Revision history

Pzimmerm: 1 revision

Megsunda: /* NTP-D27 Set Up the ONS 15454 SDH for Firewall Access */