Cisco Broadband Cable Command Reference Guide

Chapter 2 Cisco Cable Modem Termination System Commands
cable shared-secondary-secret
Syntax Description
OL-1581-05
cable shared-secondary-secret
To configure one or more secondary shared-secret keys that CMs can use to successfully process the
DOCSIS configuration file and register with the CMTS, use the cable shared-secondary-secret
command in cable interface configuration mode. To remove the secondary shared secrets, use the no
form of this command.
cable shared-secondary secret index index-num [0 | 7] authentication-key
no cable shared-secondary secret index index-num
Defaults No secondary shared secret is used. If no encryption option is specified, the key is stored in the
configuration file if the service password-encryption command has also been given.
Command Modes Interface configuration (cable interface only)
Command History
index index-num Specifies the order in which the CMTS will use the secondary shared-secrets
to verify the CM during the registration process. The valid range is 1 to 16.
0 (Optional) Specifies that an unencrypted message will follow.
7 (Optional) Specifies that an encrypted message will follow.
authentication-key Text string specifying the shared secret string. When you also use the service
password-encryption command, the key is stored in encrypted form. The
text string can be any arbitrary string up to 80 characters in length.
Release Modification
12.2(8)BC2 This command was introduced.
Usage Guidelines The cable shared-secondary-secret command can be used to supplement the cable shared-secret
command so as to prevent unauthorized interception and alteration of the DOCSIS configuration file that
is downloaded to the CM during the registration process. The DOCSIS specification allows for a CM
and CMTS to use a shared secret (a secret encryption string) to calculate the MD5 Message Integrity
Check (MIC) value for the DOCSIS configuration file that is downloaded to the CM.
The CM must use the proper shared secret encryption string to successfully decrypt and process the
configuration file, and then register with the CMTS. If the CM does not have the proper encryption
string, it will be unable to calculate the proper MIC value, and the show cable modem command will
show reject(m) for the modem to indicate a MIC authentication failure.
The cable shared-secondary-secret command allows a cable operator to specify up to 16 alternate
DOCSIS shared secrets. If a CM has a MIC authentication failure during registration, the CMTS then
checks the MIC values using the alternate shared secrets. If a match is found, the CM is allowed online.
If none of the alternate MIC values match the value returned by the CM, the CMTS refuses to allow the
CM to come online and instead logs a MIC authentication failure.
Cisco Broadband Cable Command Reference Guide
2-141