Cisco routers running the Cisco IOS XR software can be partitioned into multiple independent routers known as Secure Domain Routers (SDRs). An user defined SDR is termed as named-SDR.

SDRs are a means of dividing a single physical system into multiple logically separated routers. The SDRs are spawned as Virtual Machines (VMs). Each SDR performs routing functions similar to a physical router, but they share resources with the rest of the system. For example, the software image, configurations, protocols, and routing tables are unique to a particular SDR. Other system functions, including chassis-control and switch fabric, are shared with the rest of the system.

On Cisco NCS 6000 Series routers, multiple SDRs (multi-SDR) can be created. A maximum of three SDRs are supported. A part of system resource like line cards, memory, CPUs are allocated to each SDR. By creating multiple SDRs, the system is converted from Single Owner Single Tenant (SOST) to Single Owner Multiple Tenant (SOMT) unit. Each SDR operates as independent unit. Hence, they are administered and managed individually. Also individual SDRs can be independently upgraded or downgraded as per need.

For more information on SDR attributes, see Multi-SDR Environment.

For more information on SDR software upgrade, see Software Upgrade in Multi-SDR Environment.

Creation of multiple named-SDRs involves these three stages:

1. Delete the default-SDR

2. Create a named-SDR

3. Assign inventory to the named-SDR

Note	A maximum of three named-SDRs can be created.

By default, console1 on active RP is used to access the XR VM. With named-SDRs, you can either use console1 or console2 of an active RP to access any of the named-SDR (XR VM). You can connect two named-SDRs (XRs) at any given time. The console 0 is reserved to access the System Admin VM.

Note	The RP on which XR VM gets created first, becomes active RP. It can be either RP0 or RP1.

By default, the system boots up in the Single Owner Single Tenant (SOST) mode. This setup is termed as default-SDR. Creating explicit user defined SDRs and assigning inventory to it, causes the system to transit from SOST mode to Single Owner Multiple Tenant (SOMT) mode. This setup is termed as multi-SDR and the user defined SDR is called as named-SDR.

These are the attributes of an multi-SDR setup:

• The system administrator for the admin plane, manages the system inventory and allocates resources to each named-SDR. The RPs and LCs can be allocated or deallocated to a named-SDR without affecting other SDRs in the system. RP resources like CPU and memory, and LC resources are configurable.

• Each named-SDR can be administered, managed, and operated independent of other named-SDRs in the system. Named-SDR is also independent of the admin plane.

• Each named-SDR can be run on a version of Cisco IOS XR software that is independent of the versions running on other named-SDRs and the admin plane.

• Each named-SDR can be upgraded (non-ISSU) independently of other named-SDRs in the system.

• AAA administrator needs to provide permissions to access the admin plane through named-SDR.

• RPs, fabric cards and other system resources are shared across multi-SDRs.

• Line cards cannot be shared among named-SDRs. But, multiple line cards can be allocated to a named-SDR.

• Depending on the named-SDR configuration, each SDR will have its own RP pair. RP Fail Over (RPFO) in a named-SDR, does not impact other SDRs as each SDR has its own RP pair.

• Hard disk is partitioned between the SDRs. Each named-SDR gets ~33GB of the system hard disk.

• XR management traffic in multi-SDR is tagged, which needs to be un-tagged. For more information, see XR Management Traffic in Multi-SDR Environment.

• There is no difference between the default-SDR and multi-SDR with respect to the XR features, provisioning of features, or the user interaction.

• Muti-SDR does not support full system upgrade.

• Due to smaller hard disk size, OS images cannot be stored in the hard disk of named-SDR.

• USB is accessible from System Admin VM and XR VM of default-SDR. However, in case of a named-SDR, USB is not accessible from the XR VM and can be accessed only from System Admin VM.

• Secure copy (SCP) operation for below mentioned cases is not supported from Cisco IOS XR Release 6.3.1 onwards:

  • between named-SDR (XR VM) and SysAdmin (System Admin VM)

  • from one named-SDR to another named-SDR

Note	On-the-fly modification of RP resources (CPU or memory) of a named-SDR is not recommended. To convert from SOMT to SOST, the system must be USB booted.

Each named SDR can be upgraded or downgraded individually. SMUs and packages installed on each SDR is independent of other SDRs. For upgrade/downgraded details, see System Setup and Software Installation Guide for Cisco NCS 6000 Series Routers.

Note

Full system upgrade is not supported in a multi-SDR setup. The full system upgrade means simultaneous upgrade of the System Admin VM and all named-SDRs. Named-SDRs need to be upgraded individually. Also, only one operation of upgrade, downgrade, SMU install, or SMU deactivation can be performed at a time. An Orchestrated Calvados Upgrade (OCU) cannot be performed on a Multi-SDR from Release 6.1.x to later releases (Release 6.2.x onwards).

System Admin VM can be upgraded or downgraded independent of named SDRs.

USB Accessibility

USB port is accessible only from System Admin VM. It is not accessible from named-SDR; hence, you cannot install image/SMU/Package from USB in multi-SDR mode.

Note

If type 8,9, or 10 is the secret key configured, then before downgrading to 6.6.3 and earlier versions, perform either of the following methods: Type a combination of secret type and encrypted key instead of plain text for the password. Example: username root group root-lr group cisco-support secret 10 $6$Mwaqg/jdBPOn4g/.$PrJP2KjsCbL6bZqmYOej5Ay67S/sSWJNlkiYhCTc/B/35E1kJBqffmBtn.ddQEH0O2CU7V.ZEMmqIg7uE8cfz0 This is because 6.6.3 and earlier versions do not support type 8,9, or 10 key type. Ensure that there are secret type 5 users on the system.

Each RP has single physical management port. Hence, management traffic of the named-SDR is tagged with the VLAN-ID that is specified during named-SDR configuration. Tagged management traffic of each named-SDR needs to be segregated by the user using an external switch. As XR VM is unaware of the VLAN tagging or multi-SDR, there is no change in the management port configuration for the XR VM.

In case of default-SDR, all management traffic is untagged.

sdr INET_RI
pairing-mode  inter-rack
resources card-type RP
  vm-memory 11
  vm-cpu    4
!
location 0/1
!
location 0/2
!
location 1/1
!
location 1/2
!
location 0/RP0
!     
location 0/RP1
!
location 1/RP0
!     
location 1/RP1
!
sdr SU_RI
pairing-mode  inter-rack
resources card-type RP
  vm-memory 11
  vm-cpu    4
!
location 0/4
!
location 1/4
!
location 0/5
!
location 1/5
!
location 0/7
!
location 0/RP0
!     
location 0/RP1
!
location 1/RP0
!     
location 1/RP1
!
sdr VPN_RI
pairing-mode  inter-rack
resources card-type RP
  vm-memory 11
  vm-cpu    4
!
location 0/3
!
location 1/3
!
Location 1/7
!
location 0/6
!
location 1/6
!
location 0/RP0
!     
location 0/RP1
!
location 1/RP0
!     
location 1/RP1
!