Subscriber Management Packet Filtering Extension for DOCSIS 2.0

The Cisco converged broadband router supports management of data packet filtering based on the subscriber’s preferences and criteria. Packet filtering enhances security to the cable network by allowing only the specific packets to flow to the Customer Premise Equipment (CPE) while dropping the unwanted data packets from the cable network.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http:/​/​tools.cisco.com/​ITDIT/​CFN/​. An account on http:/​/​www.cisco.com/​ is not required.

Contents

Hardware Compatibility Matrix for Cisco cBR Series Routers


Note

The hardware components introduced in a given Cisco IOS-XE Release are supported in all subsequent releases unless otherwise specified.

Table 1 Hardware Compatibility Matrix for the Cisco cBR Series Routers

Cisco CMTS Platform

Processor Engine

Interface Cards

Cisco cBR-8 Converged Broadband Router

Cisco IOS-XE Release 3.15.0S and Later Releases

Cisco cBR-8 Supervisor:

  • PID—CBR-CCAP-SUP-160G

  • PID—CBR-CCAP-SUP-60G1

  • PID—CBR-SUP-8X10G-PIC

Cisco IOS-XE Release 3.15.0S and Later Releases

Cisco cBR-8 CCAP Line Cards:

  • PID—CBR-LC-8D30-16U30

  • PID—CBR-LC-8D31-16U30

  • PID—CBR-RF-PIC

  • PID—CBR-RF-PROT-PIC

Cisco cBR-8 Downstream PHY Modules:

  • PID—CBR-D30-DS-MOD

  • PID—CBR-D31-DS-MOD

Cisco cBR-8 Upstream PHY Modules:

  • PID—CBR-D30-US-MOD

1 Effective with Cisco IOS-XE Release 3.17.0S, CBR-CCAP-SUP-60G supports 8 cable line cards. The total traffic rate is limited to 60Gbps, the total number of downstream service flow is limited to 72268, and downstream unicast low-latency flow does not count against the limits.

Prerequisites for Configuring Subscriber Management Packet Filtering

The software prerequisites for the subscriber management packet filtering feature are:

  • The latest software image is loaded and working on the Cable Modem Termination System (CMTS) and the cable modems (CM).
  • The configuration information on the main supervisor (SUP) and the standby SUP should be the same before the switchover.

Restriction for Configuring Subscriber Management Packet Filtering

  • This feature can define up to 254 filtering groups. The number of filters in each group is 255.

Information About Configuring Subscriber Management Packet Filtering

A filter group specifies what filters are applied to the packets going to or coming from each specific CM or CPE device. It defines the rules or criteria to filter or drop a packet. Every packet that has to be filtered can either be accepted to send or filtered to be dropped. The criteria to filter a packet depends on the subscriber’s preferences. The filter group can be applied to different subscriber management groups.

Cable subscriber management can be established using the following configuration methods:

  • CMTS router configuration (via CLI)
  • SNMP configuration

The process of configuring the subscriber management packet filtering is:

  1. The packet filter group defines the action for a packet. The packet can be let to go to the CPE or dropped off the cable network based on the subscriber’s packet criteria.
  2. The CM sends a registration request to the CMTS. The registration request contains provisioning information that defines the association of a Packet Filtering Group (PFG) with the CM and its subscribers.
  3. The specific downstream or upstream PFGs are used to bind the CM, CPE, embedded Multimedia Terminal Adaptor (eMTA), embedded Set-Top Box (eSTB) and embedded portal server (ePS) to a specific PFG.
  4. The CMTS identifies the CPE device based on the CPE’s DHCP information.

Note
For the filter group to work for CMs, a CM must re-register after the CMTS router is configured.

How to Configure Subscriber Management Packet Filtering

This section describes the configuration tasks that are performed to manage subscriber packet filtering on the Cisco CMTS platforms. You can use the command-line interface (CLI) commands to complete the configuration.

Configuring the Filter Group

This section describes the tasks to configure the packet filter group. Follow the summary steps to complete the configuration.

To create, configure, and activate a DOCSIS filter group that filters packets on the basis of the TCP/IP and UDP/IP headers, use the cable filter group command in global configuration mode.

Procedure
     Command or ActionPurpose
    Step 1enable


    Example: 
    Router> enable


    Example: 
    Router#
     

    Enables privileged EXEC mode. Enter your password if prompted.

     
    Step 2configure terminal


    Example: 
    Router# configure terminal


    Example: 
    Router(config)#
     

    Enters global configuration mode.

     
    Step 3cable filter group group-id index index-num [option option-value]


    Example: 
    Router(config)# cable filter group 10 index 10 src-ip 10.7.7.7
     

    Creates, configures, and activates a DOCSIS filter group that filters packets.

     

    Defining the Upstream and Downstream MTA Filter Group

    This section describes the configuration tasks to define the upstream and downstream subscriber management filter groups for an embedded Multimedia Terminal Adaptor (eMTA.) Follow the summary steps to complete the configuration.

    Procedure
       Command or ActionPurpose
      Step 1enable


      Example: 
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.
       
      Step 2configure terminal


      Example: 
      Router# configure terminal
       

      Enters global configuration mode.

       
      Step 3 cable submgmt default filter-group mta {downstream | upstream} group-id

      Example: 
      Router(config)# cable submgmt default filter-group mta downstream 130
       

      Defines the upstream and downstream subscriber management filter groups for an MTA.

       

      Defining the Upstream and Downstream STB Filter Group

      This section describes the configuration tasks to define the upstream and downstream subscriber management filter groups for a Set-Top Box (STB.) Follow the summary steps to complete the configuration.

      Procedure
         Command or ActionPurpose
        Step 1enable


        Example: 
        Router> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.
         
        Step 2configure terminal


        Example: 
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 cable submgmt default filter-group stb {downstream | upstream} group-id

        Example: 
        Router(config)# cable submgmt default filter-group stb downstream 20
         

        Defines the upstream and downstream subscriber management filter groups for an STB.

         

        Defining the Upstream and Downstream PS Filter Group

        This section describes the configuration tasks to define the upstream and downstream subscriber management filter groups for a Portal Server (PS.) Follow the summary steps to complete the configuration.

        Procedure
           Command or ActionPurpose
          Step 1enable


          Example: 
          Router> enable


          Example: 
          Router#
           

          Enables privileged EXEC mode. Enter your password if prompted.

           
          Step 2configure terminal


          Example: 
          Router# configure terminal


          Example: 
          Router(config)#
           

          Enters global configuration mode.

           
          Step 3 cable submgmt default filter-group ps {downstream | upstream} group-id

          Example: 
          Router(config)# cable submgmt default filter-group ps downstream 10
           

          Defines the upstream and downstream subscriber management filter groups for a portal server.

           

          Configuration Examples for Subscriber Management Packet Filtering

          This section describes a sample configuration example for configuring the subscriber management packet filtering.

          Configuring the Filter Group: Example

          The following example shows configuration of a filter group that drops packets with a source IP address of 10.7.7.7 and a destination IP address of 10.8.8.8, and a source port number of 2000 and a destination port number of 3000. All protocol types and ToS and TCP flag values are matched: 

          Router(config)# cable filter group 10 index 10 src-ip 10.7.7.7
Router(config)# cable filter group 10 index 10 src-mask 255.255.0.0
Router(config)# cable filter group 10 index 10 dest-ip 10.8.8.8
Router(config)# cable filter group 10 index 10 dest-mask 255.255.0.0
Router(config)# cable filter group 10 index 10 ip-proto 256
Router(config)# cable filter group 10 index 10 src-port 2000
Router(config)# cable filter group 10 index 10 dest-port 3000
Router(config)# cable filter group 10 index 10 tcp-flags 0 0
Router(config)# cable filter group 10 index 10 match-action drop

          Defining the Upstream and Downstream MTA Filter Group: Example

          The following example shows configuration of an upstream and downstream MTA filter group. 

          Router# configure terminal
Router(config)# cable submgmt default filter-group mta downstream 10

          Defining the Upstream and Downstream STB Filter Group: Example

          The following example shows configuration of an upstream and downstream STB filter group. 

          Router#configure terminal
Router(config)#cable submgmt default filter-group stb downstream 20

          Defining the Upstream and Downstream PS Filter Group: Example

          The following example shows configuration of an upstream and downstream portal server filter group. 

          Router#configure terminal
Router(config)#cable submgmt default filter-group ps downstream 10

          Additional References

          The following sections provide references related to configuring the subscriber management packet filtering feature.

          Technical Assistance

          Description

          Link

          The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

          To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

          Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

          http:/​/​www.cisco.com/​techsupport

          Feature Information for Subscriber Management Packet Filtering

          Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http:/​/​tools.cisco.com/​ITDIT/​CFN/​. An account on http:/​/​www.cisco.com/​ is not required.


          Note

          The below table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

          Table 2 Feature Information for Subscriber Management Packet Filtering

          Feature Name

          Releases

          Feature Information

          Subscriber Management Packet Filtering

          Cisco IOS-XE Release 3.15.0S

          This feature was introduced on the Cisco cBR Series Converged Broadband Routers.