Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
866
configure cable host authorization <on|off>
To create a static mapping between an IP address and a CM/CPE MAC pair use the following command:
configure [no] cable host authorization <cm-mac> cpe <cpe mac> <IP address>
The NO version of the command above deletes the static mapping.
To see which MAC addresses are associated with which IP addresses, use the following command:
show cable modem detail <cm-mac>
If a secondary IP is being used by a given MAC address, the system response labels it SEC IP, not SUBNET.
To determine if source verify is enabled for a given mac-id, enter the following command:
show interface cable-mac <mac-identifier>
The following is a partial output for this command, highlighting the source verify setting:
Cable-mac 1
NOTE: MAC 1 is in bundle mastered by MAC 1.
cable-mac 1.0, VRF: default, IP Address: 192.168.196.2/24
Description: CABLE-MAC1
Secondary IP Address(es):
10.1.1.1/30 192.168.198.2/24
Physical Address: 0001.5c31.4c01
MTU is 1500
DHCP Policy mode is disabled (primary mode)
DHCP Server Helper Address(es):
10.43.210.1 for Traffic Type "any"
Directed Broadcast is disabled
ICMP unreachables are always sent
Multicast reserved groups joined: None
Source-verify is set to DHCP
Advanced CM Configuration File Verification
A common type of theft-of-service occurs when users replace or modify their assigned configuration files in order to gain a
higher level of service. Another type of theft-of-service occurs when subscribers crack the Message Integrity Check (MIC) in
order to generate their own high bandwidth configurations with valid MICs. The implementation of this feature consists of
two parts, TFTP Enforcement to ensure that modems are using the configuration files downloaded from the proper server,
and Dynamic Shared Secret Verification, which uses a MIC modified by the C4/c CMTS to verify that these files have not
been altered.