Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
871
file that contains an upgrade filename TLV that does not contain an upgrade server TLV, then the TFTP relay agent inserts
an upgrade server TLV with the IP address of the TFTP server. The upgrade server TLV is not added or altered unless the
configuration file contains an upgrade filename TLV and the upgrade server TLV is missing or zero. If the relay agent does
modify a configuration file by adding the IP address of a server, it recalculates and overwrites both the CM MIC and C4/c
CMTS MIC TLVs. And if the addition of a TLV by this feature causes the an additional TFTP data block to be sent to the
modem, then the TFTP relay agent coordinates how the CM and TFTP server will handle that extra data block. This TFTP
relay agent functionality makes it possible to use one set of CM configuration files across a large network where there are
multiple TFTP servers with different IP addresses.
Option 125, Sub-option 2
This applies only when the C4/c CMTS is acting as a TFTP relay agent when the TFTP Enforce feature or the Dynamic Secret
feature is enabled. This option uses the Vendor Identifying Vendor-Specific (TLV 125) for CableLabs (OID enterprise 4491)
and is called the DHCPv4 TFTP Servers Option. This option was introduced in DOCSIS 3.0 and applies only to DOCSIS 3.0
(and higher) IPv4 modems. When DHCP OFFER or ACK messages are sent to a DOCSIS 3.0 modem, and if those messages
contain option 125 data for enterprise 4491 and sub-option 2, then the C4/c CMTS derives the TFTP server address from
the first IP address contained in sub-option 2. Only the first TFTP server is supported. If other servers are specified in sub-
option 2, they are ignored. If this TLV and sub-option contain no data, then the C4/c CMTS derives the TFTP server address
from the siaddr field.
DHCPv6 Servers Address—Option 32
Because the C4/c CMTS acts as a TFTP relay agent for IPv6 CM registration, this option is always required. The C4/c CMTS
derives the TFTP server address from DHCPv6 advertise and reply messages that contain option 32. The C4/c CMTS
supports only the first TFTP server address specified in Option 32. If other servers are specified, they are ignored and
removed from the message.
Dual Shared Secret
The DOCSIS specification provides a method for the authentication of configuration files by the C4/c CMTS. A shared secret
(authentication string) is first configured by the MSO on the provisioning server; in some cases it is generated by the
provisioning server itself. The server uses this shared secret to calculate an MD5 Message Integrity Check (MIC) value,
which is included in the configuration file that it provides to a cable modem. When the modem sends a registration