DescriptionState
The cable modem failed to negotiate a KEK with the
CMTS, typically because the cable modem failed
authentication. Check that the cable modem is
properly configured for BPI+ and is using valid digital
certificates. If the CMTS requires BPI+ for
registration, the cable modem will go offline and have
to reregister. Check that the cable modem is properly
registered in the CMTS provisioning system.
If a cable modem fails BPI+ authentication,
a message similar to the following appears
in the CMTS log:
Note
%CBR-5-UNAUTHSIDTIMEOUT: CMTS deleted BPI
unauthorized Cable Modem 00c0.abcd.ef01
reject(pk)
The cable modem failed to successfully negotiate a
TEK with the CMTS. If the CMTS requires BPI+ for
registration, the cable modem will have to reregister.
reject(pt)
Displaying the BPI+ Timer Values on the CMTS
To display the values for the KEK and TEK lifetime timers on a particular cable interface, use the show
interface cable x/y privacy [kek | tek] command.
Displaying the Certificate List on the CMTS
Use the show crypt ca certificates command to display the list of known certificates on the CMTS. For
example:
Router# show crypto ca certificates
Certificate
Status: Available
Certificate Serial Number: 7DBF85DDDD8358546BB1C67A16B3D832
Key Usage: General Purpose
Subject Name
Name: Cisco Systems
Validity Date:
start date: 00:00:00 UTC Sep 12 2001
end date: 23:59:59 UTC Sep 11 2021
Root certificate
Status: Available
Certificate Serial Number: 5853648728A44DC0335F0CDB33849C19
Key Usage: General Purpose
CN = DOCSIS Cable Modem Root Certificate Authority
OU = Cable Modems
O = Data Over Cable Service Interface Specifications
C = US
Validity Date:
start date: 00:00:00 UTC Feb 1 2001
end date: 23:59:59 UTC Jan 31 2031
Cisco cBR Series Converged Broadband Routers Quality of Services Configuration Guide for Cisco IOS XE Fuji
16.7.x
67
DOCSIS 1.1 for the Cisco CMTS Routers
Monitoring BPI+ Operations
To Next Page
Loading...
Need help?
General
