NETGEAR GSM7328S - ProSafe Switch - Stackable Cli Manual

ProSafe 7300S Managed

Switches CLI Manual,

Version 8.0

NETGEAR , Inc.

350 East Plumeria Drive

San Jose, CA 95134

202-10528-01

July 2009

© 2009 by NETGEAR, Inc. All rights reserved.

Trademarks

NETGEAR and the NETGEAR logo are registered trademarks, and ProSafe is a trademark of NETGEAR, Inc.

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this document are copyright Intoto, Inc.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein.

EN 55 022 Declaration of Conformance

This is to certify that the ProSafe 7300S Series Layer-3 Managed Stackable Switch is shielded against the generation of radio interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by the application of EN 55 022 Class B (CISPR 22).

Certificate of the Manufacturer/Importer

It is hereby certified that the ProSafe 7300S Series Layer-3 Managed Stackable Switch has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions.

The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations.

Bestätigung des Herstellers/Importeurs

Es wird hiermit bestätigt, daß dasProSafe 7300S Series Layer-3 Managed Stackable Switch gemäß der im BMPT-

AmtsblVfg 243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die

Anmerkungen in der Betriebsanleitung.

Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.

Voluntary Control Council for Interference (VCCI) Statement

This equipment is in the Class B category (information equipment to be used in a residential area or an adjacent area thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing

Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling.

ii v1.0, July 2009

Product and Publication Details

Model Number:

Publication Date:

Product Family:

GSM7328S, GSM7352S, GSM7328FS, GSM7328Sv2, and

GSM7352Sv2

July 2009 managed switch

Product Name: ProSafe 7300S Series Layer-3 Managed Stackable Switch

Home or Business Product: Business

Language:

Publication Part Number:

English

202-10528-01

Publication Version Number 1.0

v1.0, July 2009 iii

About This Manual

This document describes command-line interface (CLI) commands you use to view and configure

7300S Series Stackable Switch software. You can access the CLI by using a direct connection to the serial port or by using telnet or SSH over a remote network connection.

Note: This document contains both standalone and stacking commands.

Audience

This document is for system administrators who configure and operate switches using 7300S

Series Stackable Switch software. It provides an understanding of the configuration options of the software.

This document assumes that the reader has an understanding of the software base and has read the appropriate specification for the relevant networking device platform. It also assumes that the reader has a basic knowledge of Ethernet and networking concepts.

About Managed Switch Software

The Managed Switch software has two purposes:

• Assist attached hardware in switching frames, based on Layer 2, 3, or 4 information contained in the frames.

• Provide a complete device management portfolio to the network administrator. ix v1.0, July 2009

7300S Managed Switches CLI Manual, Version 8.0

Scope

This manual covers the layer 3 managed switches (GSM7328S, GSM7352S, GSM7328FS,

GSM7328Sv2, and GSM7352Sv2). Some of the commands described in this manual can only be used on GSM7328Sv2 and GSM7352Sv2 switches. These commands are noted in text.

The following figure shows the GSM7328S and GSM7352S switches. Newer documentation refers to these two switches as GSM7328Sv1 and GSM7352Sv1. Also shown are the

GSM7328Sv2 and GSM7352Sv2 switches.

Version 1 Switches

GSM7328Sv1

GSM7352Sv1

Version 2 Switches

GSM7328Sv2

GSM7352Sv2 x v1.0, July 2009


Conventions and Formats

The conventions, formats, and scope of this manual are described in the following paragraphs:

• Typographical Conventions .

This manual uses the following typographical conventions::

Italic

Bold

Fixed italic

Emphasis, books, CDs, file and server names, extensions

User input, IP addresses, GUI screen text

Command prompt, CLI text, code

URL links

• Formats .

This manual uses the following formats to highlight special messages:

Note: This format is used to highlight information of importance or special interest.

Tip: This format is used to highlight a procedure that will save time or resources.

Warning: Ignoring this type of note may result in a malfunction or damage to the equipment.

Danger: This is a safety warning. Failure to take heed of this notice may result in personal injury or death.

For more information about network, Internet, firewall, and VPN technologies, go to: http:// kbserver.netgear.com

.

xi v1.0, July 2009


How to Print This Manual

To print this manual, your computer must have the free Adobe Acrobat reader installed in order to view and print PDF files. The Acrobat reader is available on the Adobe Web site at http://www.adobe.com

.

Revision History

Table 1-1.

Part Number

Version

Number

Date

202-10528-01 1.0

Description

July 2009 7300S Managed Switches CLI Manual, Version 8.0 v1.0, July 2009 xii

Contents

About This Manual

Audience ........................................................................................................................... xi

About Managed Switch Software ..................................................................................... xi

Scope ............................................................................................................................... xi

Chapter 1

Using the Command-Line Interface

Command Syntax ...........................................................................................................1-1

Command Conventions ..................................................................................................1-2

Common Parameter Values ...........................................................................................1-3

Unit/Slot/Port Naming Convention ..................................................................................1-3

Using the “No” Form of a Command ..............................................................................1-4

Managed Switch Modules ..............................................................................................1-5

Command Modes ...........................................................................................................1-5

Command Completion and Abbreviation ........................................................................1-9

CLI Error Messages ........................................................................................................1-9

CLI Line-Editing Conventions .......................................................................................1-10

Using CLI Help .............................................................................................................1-11

Accessing the CLI .........................................................................................................1-12

Chapter 2

Stacking Commands

Dedicated Port Stacking .................................................................................................2-1

Front Panel Stacking Commands .................................................................................2-10

Chapter 3

Switching Commands

Port Configuration Commands .......................................................................................3-2

Spanning Tree Protocol (STP) Commands ..................................................................3-11

VLAN Commands .........................................................................................................3-31

Double VLAN Commands ............................................................................................3-46

Voice VLAN Commands ...............................................................................................3-48 viii v1.0, July 2009

Managed Switch CLI Manual, Release 8.0

Provisioning (IEEE 802.1p) Commands .......................................................................3-51

Protected Ports Commands .........................................................................................3-52

Private Group Commands ............................................................................................3-54

GARP Commands ........................................................................................................3-56

GVRP Commands ........................................................................................................3-59

GMRP Commands .......................................................................................................3-61

Port-Based Network Access Control Commands .........................................................3-64

Storm-Control Commands ............................................................................................3-78

Port-Channel/LAG (802.3ad) Commands ....................................................................3-90

Port Mirroring ..............................................................................................................3-113

Static MAC Filtering ....................................................................................................3-115

DHCP Snooping Configuration Commands ...............................................................3-120

Dynamic ARP Inspection Commands ........................................................................3-131

IGMP Snooping Configuration Commands ................................................................3-139

IGMP Snooping Querier Commands ..........................................................................3-148

MLD Snooping Commands ........................................................................................3-153

MLD Snooping Querier Commands ...........................................................................3-162

Port Security Commands ............................................................................................3-166

LLDP (802.1AB) Commands ......................................................................................3-170

LLDP-MED Commands ..............................................................................................3-181

Denial of Service Commands .....................................................................................3-192

MAC Database Commands ........................................................................................3-204

ISDP Commands ........................................................................................................3-206

Chapter 4

Routing Commands

Address Resolution Protocol (ARP) Commands ............................................................4-1

IP Routing Commands ...................................................................................................4-8

Router Discovery Protocol Commands ........................................................................4-20

Virtual LAN Routing Commands................................................................................... 4-24

Virtual Router Redundancy Protocol Commands......................................................... 4-25

DHCP and BOOTP Relay Commands .........................................................................4-34

IP Helper Commands ...................................................................................................4-36

Open Shortest Path First (OSPF) Commands .............................................................4-39

Routing Information Protocol (RIP) Commands ...........................................................4-82

ICMP Throttling Commands .........................................................................................4-91 ix v1.0, July 2009


Chapter 5

IP Multicast Commands

Multicast Commands ......................................................................................................5-1

DVMRP Commands .......................................................................................................5-7

PIM-DM Commands .....................................................................................................5-12

PIM-SM Commands .....................................................................................................5-16

Internet Group Message Protocol (IGMP) Commands .................................................5-26

IGMP Proxy Commands ...............................................................................................5-35

Chapter 6

IPv6 Multicast Commands

IPv6 Multicast Forwarder ................................................................................................6-2

IPv6 PIM-DM Commands ...............................................................................................6-4

IPv6 PIM-SM Commands ...............................................................................................6-8

IPv6 MLD Commands ..................................................................................................6-16

IPv6 MLD-Proxy Commands ........................................................................................6-23

Chapter 7

IPv6 Commands

IPv6 Management Commands .......................................................................................7-2

Tunnel Interface Commands ..........................................................................................7-6

Loopback Interface Commands......................................................................................7- 8

IPv6 Routing Commands ..............................................................................................7-10

OSPFv3 Commands .....................................................................................................7-33

DHCPv6 Commands ....................................................................................................7-68

Chapter 8

Quality of Service (QoS) Commands

Class of Service (CoS) Commands ................................................................................8-2

Differentiated Services (DiffServ) Commands ................................................................8-8

DiffServ Class Commands ...........................................................................................8-10

DiffServ Policy Commands ...........................................................................................8-19

DiffServ Service Commands ........................................................................................8-25

DiffServ Show Commands ...........................................................................................8-26

MAC Access Control List (ACL) Commands ................................................................8-32

IP Access Control List (ACL) Commands .....................................................................8-37

IPv6 Access Control List (ACL) Commands .................................................................8-44

Auto-Voice over IP Commands ....................................................................................8-48 x v1.0, July 2009


Chapter 9

Utility Commands

Auto Install Commands ..................................................................................................9-2

Dual Image Commands ..................................................................................................9-4

System Information and Statistics Commands ...............................................................9-6

Logging Commands .....................................................................................................9-18

System Utility and Clear Commands ............................................................................9-24

Simple Network Time Protocol (SNTP) Commands .....................................................9-34

DHCP Server Commands ............................................................................................9-40

DNS Client Commands ................................................................................................9-55

Packet Capture Commands .........................................................................................9-61

Serviceability Packet Tracing Commands ....................................................................9-63

Cable Test Command................................................................................................... 9-83 sFlow Commands......................................................................................................... 9-84

Chapter 10

Management Commands

Configuring the Switch Management CPU ...................................................................11-2

Network Interface Commands ......................................................................................11-4

Console Port Access Commands .................................................................................11-8

Telnet Commands ......................................................................................................11-11

Secure Shell (SSH) Commands .................................................................................11-16

Management Security Commands .............................................................................11-19

Hypertext Transfer Protocol (HTTP) Commands .......................................................11-20

Access Commands .....................................................................................................11-28

User Account Commands ...........................................................................................11-29

SNMP Commands ......................................................................................................11-40

RADIUS Commands ...................................................................................................11-52

TACACS+ Commands ................................................................................................11-67

Configuration Scripting Commands ............................................................................11-71

Pre-login Banner and System Prompt Commands .....................................................11-73

Chapter 11

Log Messages

Core ..............................................................................................................................11-1

Utilities ..........................................................................................................................11-4

Management .................................................................................................................11-6 xi v1.0, July 2009


Switching ....................................................................................................................11-10

QoS ............................................................................................................................11-16

Routing/IPv6 Routing ..................................................................................................11-17

Multicast .....................................................................................................................11-21

Stacking ......................................................................................................................11-23

Technologies ..............................................................................................................11-23

O/S Support ................................................................................................................11-26

Chapter 12

Captive Portal Commands

Capitve Portal Global Commands ................................................................................12-1

Captive Portal Configuration Commands .....................................................................12-5

Captive Portal Status Commands ..............................................................................12-14

Captive Portal Client Connection Commands ............................................................12-19

Captive Portal Interface Commands ...........................................................................12-23

Captive Portal Local User Commands .......................................................................12-24

Captive Portal User Group Commands ......................................................................12-31

Chapter 13

List of Commands v1.0, July 2009 xii

Chapter 1

Using the Command-Line Interface

The command-line interface (CLI) is a text-based way to manage and monitor the system. You can access the CLI by using a direct serial connection or by using a remote logical connection with telnet or SSH.

This chapter describes the CLI syntax, conventions, and modes. It contains the following sections:

• “Command Syntax” on page 1-1

• “Command Conventions” on page 1-2

• “Common Parameter Values” on page 1-3

• “Unit/Slot/Port Naming Convention” on page 1-3

• “Using the “No” Form of a Command” on page 1-4

• “Managed Switch Modules” on page 1-5

• “Command Modes” on page 1-5

• “Command Completion and Abbreviation” on page 1-9

• “CLI Error Messages” on page 1-9

• “CLI Line-Editing Conventions” on page 1-10

• “Using CLI Help” on page 1-11

• “Accessing the CLI” on page 1-12

Command Syntax

A command is one or more words that might be followed by one or more parameters. Parameters can be required or optional values.

Some commands, such as show network or clear vlan, do not require parameters. Other commands, such as network parms , require that you supply a value after the command. You must type the parameter values in a specific order, and optional parameters follow required parameters. The following example describes the network parms command syntax:

Format network parms <ipaddr> <netmask> [gateway]

1-1 v1.0, July 2009


• network parms is the command name.

• <ipaddr> and <netmask> are parameters and represent required values that you must enter after you type the command keywords.

• [gateway] is an optional parameter, so you are not required to enter a value in place of the parameter.

The CLI Command Reference lists each command by the command name and provides a brief description of the command. Each command reference also contains the following information:

• Format shows the command keywords and the required and optional parameters.

• Mode identifies the command mode you must be in to access the command.

• Default shows the default value, if any, of a configurable setting on the device.

The show commands also contain a description of the information that the command shows.

Command Conventions

In this document, the command name is in bold font. Parameters are in italic font . You must replace the parameter name with an appropriate value, which might be a name or number.

Parameters are order dependent.

The parameters for a command might include mandatory values, optional values, or keyword choices. Table 1 describes the conventions this document uses to distinguish between value types.

Table 1. Parameter Conventions

Symbol

<> angle brackets

[] square brackets

{} curly braces

| Vertical bars

[{}] Braces within square brackets

Example Description

<value>

[value]

Indicates that you must enter a value in place of the brackets and text inside them.

Indicates an optional parameter that you can enter in place of the brackets and text inside them.

{choice1 | choice2}

Indicates that you must select a parameter from the list of choices.

choice1 | choice2 Separates the mutually exclusive choices.

[{choice1 | choice2}]

Indicates a choice within an optional element.

Using the Command-Line Interface v1.0, July 2009

1-2


Common Parameter Values

Parameter values might be names (strings) or numbers.To use spaces as part of a name parameter, enclose the name value in double quotes. For example, the expression “System Name with

Spaces” forces the system to accept the spaces. Empty strings (““) are not valid user-defined strings. Table 2 describes common parameter values and value formatting.

Table 2. Parameter Descriptions

Parameter Description ipaddr ipv6-address

This parameter is a valid IP address. You can enter the IP address in the following formats: a (32 bits) a.b (8.24 bits) a.b.c (8.8.16 bits) a.b.c.d (8.8.8.8)

In addition to these formats, the CLI accepts decimal, hexadecimal and octal formats through the following input formats (where n is any valid hexadecimal, octal or decimal number):

0xn (CLI assumes hexadecimal format)

0n (CLI assumes octal format with leading zeros) n (CLI assumes decimal format)

FE80:0000:0000:0000:020F:24FF:FEBF:DBCB, or

FE80:0:0:0:20F:24FF:FEBF:DBCB, or

FE80::20F24FF:FEBF:DBCB, or

FE80:0:0:0:20F:24FF:128:141:49:32

For additional information, refer to RFC 3513.

Interface or unit/slot/port

Valid unit, slot, and port number separated by forward slashes. For example, 0/1 represents slot number 0 and port number 1.

Logical Interface Represents a logical slot and port number. This is applicable in the case of a portchannel (LAG). You can use the logical unit/slot/port to configure the port-channel.

Character strings Use double quotation marks to identify character strings, for example, “System Name with Spaces”. An empty string (“”) is not valid.

Unit/Slot/Port Naming Convention

Managed switch software references physical entities such as cards and ports by using a unit/slot/ port naming convention. The software also uses this convention to identify certain logical entities, such as Port-Channel interfaces.

Using the Command-Line Interface 1-3 v1.0, July 2009


The slot number has two uses. In the case of physical ports, it identifies the card containing the ports. In the case of logical and CPU ports it also identifies the type of interface or port.

Table 3. Type of Slots

Slot Type Description

Physical slot numbers Physical slot numbers begin with zero, and are allocated up to the maximum number of physical slots.

Logical slot numbers Logical slots immediately follow physical slots and identify port-channel (LAG) or router interfaces.

CPU slot numbers The CPU slots immediately follow the logical slots.

The port identifies the specific physical port or logical interface being managed on a given slot.

Table 4. Type of Ports

Port Type

Physical Ports

Logical Interfaces

CPU ports

Description

The physical ports for each slot are numbered sequentially starting from zero.

Port-channel or Link Aggregation Group (LAG) interfaces are logical interfaces that are only used for bridging functions.

VLAN routing interfaces are only used for routing functions.

Loopback interfaces are logical interfaces that are always up.

Tunnel interfaces are logical point-to-point links that carry encapsulated packets.

CPU ports are handled by the driver as one or more physical entities located on physical slots.

Note: In the CLI, loopback and tunnel interfaces do not use the unit/slot/port format. To specify a loopback interface, you use the loopback ID. To specify a tunnel interface, you use the tunnel ID.

Using the “No” Form of a Command

The no keyword is a specific form of an existing command and does not represent a new or distinct command. Almost every configuration command has a no form. In general, use the no form to reverse the action of a command or reset a value back to the default. For example, the no


1-4


shutdown configuration command reverses the shutdown of an interface. Use the command without the keyword no to re-enable a disabled feature or to enable a feature that is disabled by default. Only the configuration commands are available in the no form.

Managed Switch Modules

Managed switch software consists of flexible modules that can be applied in various combinations to develop advanced Layer 2/3/4+ products. The commands and command modes available on your switch depend on the installed modules. Additionally, for some show commands, the output fields might change based on the modules included in the software.

The software suite includes the following modules:

• Switching (Layer 2)

• Routing (Layer 3)

• IPv6—IPv6 routing

• Multicast

• Quality of Service

• Management (CLI, Web UI, and SNMP)

• IPv6 Management—Allows management of the device through an IPv6 through an IPv6 address without requiring the IPv6 Routing package in the system. The management address can be associated with the network port (front-panel switch ports), a routine interface (port or

VLAN) and the Service port.

• Stacking

Not all modules are available for all platforms or software releases.

Command Modes

The CLI groups commands into modes according to the command function. Each of the command modes supports specific software commands. The commands in one mode are not available until you switch to that particular mode, with the exception of the User EXEC mode commands. You can execute the User EXEC mode commands in the Privileged EXEC mode.


1-5


The command prompt changes in each command mode to help you identify the current mode.

Table 5 describes the command modes and the prompts visible in that mode.

Note: The command modes available on your switch depend on the software modules that are installed. For example, a switch that does not support BGPv4 does not have the Router BGPv4 Command Mode.

Table 5. CLI Command Modes

Command Mode

User EXEC

Privileged EXEC

Global Config

Prompt

Switch>

Switch#

Switch (Config)#

VLAN Config Switch (Vlan)#

Interface Config Switch (Interface <unit/slot/port>)#

Switch (Interface Loopback <id>)#

Line Config

Switch (Interface Tunnel <id>)#

Switch (line)#

Policy Map

Config

Policy Class

Config

Class Map Config

Ipv6_Class-Map

Config

Router OSPF

Config

Switch (Config-policy-map)#

Switch (Config-policy-class-map)#

Switch (Config-class-map)#

Switch (Config-class-map)#

Switch (Config-router)#

Mode Description

Contains a limited set of commands to view basic system information.

Allows you to issue any EXEC command, enter the VLAN mode, or enter the Global

Configuration mode.

Groups general setup commands and permits you to make modifications to the running configuration.

Groups all the VLAN commands.

Manages the operation of an interface and provides access to the router interface configuration commands.

Use this mode to set up a physical port for a specific logical connection operation.

Contains commands to configure outbound telnet settings and console interface settings.

Contains the QoS Policy-Map configuration commands.

Consists of class creation, deletion, and matching commands. The class match commands specify Layer 2, Layer 3, and general match criteria.

Contains the QoS class map configuration commands for IPv4.

Contains the QoS class map configuration commands for IPv6.

Contains the OSPF configuration commands.



Table 5. CLI Command Modes (continued)

Command Mode Prompt

Router OSPFv3

Config

Switch (Config rtr)#

Router RIP Config Switch (Config-router)#

Router BGP

Config

Switch (Config-router)#

MAC Access-list

Config

Switch (Config-mac-access-list)#

TACACS Config Switch (Tacacs)#

Switch (Config dhcp-pool)# DHCP Pool

Config

DHCPv6 Pool

Config

Switch (Config dhcp6-pool)#

Mode Description

Contains the OSPFv3 configuration commands.

Contains the RIP configuration commands.

Contains the BGP4 configuration commands.

Allows you to create a MAC Access-List and to enter the mode containing MAC Access-List configuration commands.

Contains commands to configure properties for the TACACS servers.

Contains the DHCP server IP address pool configuration commands.

Contains the DHCPv6 server IPv6 address pool configuration commands.

Stack Global

Config Mode

ARP Access-List

Config Mode

Switch (Config stack)#

Switch (Config-arp-access-list)#

Table 6 explains how to enter or exit each mode.

Allows you to access the Stack Global Config

Mode.

Contains commands to add ARP ACL rules in an ARP Access List.

Table 6. CLI Mode Access and Exit

Command Mode Access Method Exit or Access Previous Mode

User EXEC

Privileged EXEC From the User EXEC mode, enter enable .

Global Config

VLAN Config

This is the first level of access.

From the Privileged EXEC mode, enter configure.

From the Privileged EXEC mode, enter vlan database.

To exit, enter logout .

To exit to the User EXEC mode, enter exit or press Ctrl-Z.

To exit to the Privileged EXEC mode, enter exit , or press Ctrl-Z .

To exit to the Privileged EXEC mode, enter or press Ctrl-Z .

exit ,

Interface Config From the Global Config mode, enter

interface <unit/slot/port> or interface loopback <id> or interface tunnel <id>

To exit to the Global Config mode, enter exit . To return to the Privileged EXEC mode, enter Ctrl-

Z .



Table 6. CLI Mode Access and Exit (continued)

Command Mode

Line Config

Policy-Map

Config

Policy-Class-Map

Config

Class-Map

Config

Ipv6-Class-Map

Config

Router OSPF

Config

Router OSPFv3

Config

Router RIP

Config

Router BGP

Config

MAC Access-list

Config

Access Method

From the Global Config mode, enter lineconfig .

From the Global Config mode, enter policy-map <name> in .

From the Policy Map mode enter class .

Exit or Access Previous Mode


Z .


Z .

To exit to the Policy Map mode, enter exit . To return to the Privileged EXEC mode, enter Ctrl-

Z .


Z .

From the Global Config mode, enter class-map , and specify the optional keyword ipv4 to specify the Layer 3 protocol for this class.

See “class-map” on page 8-10 for more information.

From the Global Config mode, enter class-map and specify the optional keyword ipv6 to specify the Layer 3 protocol for this class.

See “class-map” on page 8-10 for more information.

From the Global Config mode, enter router ospf .

From the Global Config mode, enter ipv6 router ospf .

From the Global Config mode, enter router rip .

From the Global Config mode, enter

router bgp <asnumber> .

From the Global Config mode, enter mac access-list extended

<name> .


Z .


Z .


Z .


Z .


Z .


Z .



Table 6. CLI Mode Access and Exit (continued)

Command Mode Access Method Exit or Access Previous Mode

TACACS Config From the Global Config mode, enter tacacs-server host

<ip-addr> , where <ip-addr> is the IP address of the TACACS server on your network.


Z .

DHCP Pool

Config

From the Global Config mode, enter ip dhcp pool <pool-name> .


Z .

DHCPv6 Pool

Config

From the Global Config mode, enter ip dhcpv6 pool <pool-name> .


Z .

Stack Global

Config Mode

From the Global Config mode, enter the stack command.

ARP Access-List

Config Mode

From the Global Config mode, enter the arp access-list command .

To exit to the Global Config mode, enter the exit command. To return to the Privileged EXEC mode, enter Ctrl-Z .

To exit to the Global Config mode, enter the exit command. To return to the Privileged

EXEC mode, enter Ctrl-Z .

Command Completion and Abbreviation

Command completion finishes spelling the command when you type enough letters of a command to uniquely identify the command keyword. Once you have entered enough letters, press the

SPACEBAR or TAB key to complete the word.

Command abbreviation allows you to execute a command when you have entered there are enough letters to uniquely identify the command. You must enter all of the required keywords and parameters before you enter the command.

CLI Error Messages

If you enter a command and the system is unable to execute it, an error message appears. Table 7 describes the most common CLI error messages.


1-9


Table 7. CLI Error Messages

Message Text

% Invalid input detected at '^' marker.

Command not found / Incomplete command. Use ? to list commands.

Ambiguous command

Description

Indicates that you entered an incorrect or unavailable command.

The carat (^) shows where the invalid text is detected. This message also appears if any of the parameters or values are not recognized.

Indicates that you did not enter the required keywords or values.

Indicates that you did not enter enough letters to uniquely identify the command.

CLI Line-Editing Conventions

Table 8 describes the key combinations you can use to edit commands or increase the speed of command entry. You can access this list from the CLI by entering help from the User or

Privileged EXEC modes.

Table 8. CLI Editing Conventions

Key Sequence

DEL or Backspace

Ctrl-A

Ctrl-E

Ctrl-F

Ctrl-B

Ctrl-D

Ctrl-U, X

Ctrl-K

Ctrl-W

Ctrl-T

Ctrl-P

Ctrl-R

Ctrl-N

Ctrl-Y

Description

Delete previous character

Go to beginning of line

Go to end of line

Go forward one character

Go backward one character

Delete current character

Delete to beginning of line

Delete to end of line

Delete previous word

Transpose previous character

Go to previous line in history buffer

Rewrites or pastes the line

Go to next line in history buffer

Prints last deleted character



Table 8. CLI Editing Conventions (continued)

Key Sequence

Ctrl-Q

Ctrl-S

Ctrl-Z

Tab, <SPACE>

Exit

?

Description

Enables serial flow

Disables serial flow

Return to root command prompt

Command-line completion

Go to next lower command prompt

List available commands, keywords, or parameters

Using CLI Help

Enter a question mark (?) at the command prompt to display the commands available in the current mode.

(switch) >?

enable Enter into user privilege mode.

help Display help for various special keys.

logout Exit this session. Any unsaved changes are lost.

ping Send ICMP echo packets to a specified IP address.

quit Exit this session. Any unsaved changes are lost.

show Display Switch Options and Settings.

telnet Telnet to a remote host.

Enter a question mark (?) after each word you enter to display available command keywords or parameters.

(switch) #network ?

javamode Enable/Disable.

mgmt_vlan Configure the Management VLAN ID of the switch.

parms Configure Network Parameters of the router.

protocol Select DHCP, BootP, or None as the network config

protocol.

If the help output shows a parameter in angle brackets, you must replace the parameter with a value.

(switch) #network parms ?

<ipaddr> Enter the IP address.


1-11


If there are no additional command keywords or parameters, or if additional parameters are optional, the following message appears in the output:

<cr> Press Enter to execute the command

You can also enter a question mark (?) after typing one or more characters of a word to list the available command or parameters that begin with the letters, as shown in the following example:

(switch) #show m?

mac-addr-table mac-address-table monitor

Accessing the CLI

You can access the CLI by using a direct console connection or by using a telnet or SSH connection from a remote management host.

For the initial connection, you must use a direct connection to the console port. You cannot access the system remotely until the system has an IP address, subnet mask, and default gateway. You can set the network configuration information manually, or you can configure the system to accept these settings from a BOOTP or DHCP server on your network. For more information, see

“Network Interface Commands” on page 10-4 .


1-12

Chapter 2

Stacking Commands

The Stacking Commands chapter includes the following sections:

• “Dedicated Port Stacking” on page 2-1

• “Front Panel Stacking Commands” on page 2-10

Note: The commands in this chapter are in one of two functional groups:

Note: Show commands display switch settings, statistics, and other information.

Note: Configuration commands configure features and options of the switch. For every configuration command, there is a show command that displays the configuration setting.

The Primary Management Unit is the unit that controls the stack.

Dedicated Port Stacking

This section describes the commands you use to configure dedicated port stacking.

stack

This command sets the mode to Stack Global Config.

Format

Mode stack

Global Config

2-1 v1.0, July 2009

member <unit> <switchindex>

Stack Global Config


member

This command configures a switch. The < unit > is the switch identifier of the switch to be added/removed from the stack. The < switchindex > is the index into the database of the supported switch types, indicating the type of the switch being preconfigured. The switch index is a 32-bit integer. This command is executed on the Primary Management Unit.

Format

Mode

Note: Switch index can be obtained by executing the show supported switchtype command in User EXEC mode.

no member

This command removes a switch from the stack. The <unit> is the switch identifier of the switch to be removed from the stack. This command is executed on the Primary Management Unit.

Format

Mode no member <unit>

Stack Global Config switch priority

This command configures the ability of a switch to become the Primary Management Unit. The

<unit> is the switch identifier. The <value> is the preference parameter that allows the user to specify, priority of one backup switch over another. The range for priority is 1 to 15. The switch with the highest priority value will be chosen to become the Primary Management Unit if the active Primary Management Unit fails. The switch priority defaults to the hardware management preference value 1. Switches that do not have the hardware capability to become the Primary

Management Unit are not eligible for management.

Default

Format

Mode enabled switch <unit> priority <value>

Global Config

Stacking Commands 2-2 v1.0, July 2009


switch renumber

This command changes the switch identifier for a switch in the stack. The < oldunit > is the current switch identifier on the switch whose identifier is to be changed. The < newunit > is the updated value of the switch identifier. Upon execution, the switch will be configured with the configuration information for the new switch, if any. The old switch configuration information will be retained, however the old switch will be operationally unplugged. This command is executed on the Primary Management Unit.

Note: If the management unit is renumbered, then the running configuration is no longer applied (i.e. the stack acts as if the configuration had been cleared)

Format

Mode switch <oldunit> renumber <newunit>

Global Config movemanagement

This command moves the Primary Management Unit functionality from one switch to another.

The < fromunit > is the switch identifier on the current Primary Management Unit. The

< tounit > is the switch identifier on the new Primary Management Unit. Upon execution, the entire stack (including all interfaces in the stack) is unconfigured and reconfigured with the configuration on the new Primary Management Unit. After the reload is complete, all stack management capability must be performed on the new Primary Management Unit. To preserve the current configuration across a stack move, execute the copy system:running-config nvram:startup-config (in Privileged EXEC) command before performing the stack move.

A stack move causes all routes and layer 2 addresses to be lost. This command is executed on the

Primary Management Unit. The system prompts you to confirm the management move.

Format

Mode movemanagement <fromunit> <tounit>

Stack Global Config

Stacking Commands v1.0, July 2009

2-3


slot

This command configures a slot in the system. The <unit/slot> is the slot identifier of the slot. The < cardindex > is the index into the database of the supported card types, indicating the type of the card being preconfigured in the specified slot. The card index is a 32-bit integer. If a card is currently present in the slot that is unconfigured, the configured information will be deleted and the slot will be re-configured with default information for the card.

Format

Mode slot <unit/slot> <cardindex>

Global Config

Note: Card index can be obtained by executing show supported cardtype command in

User EXEC mode.

no slot

This command removes configured information from an existing slot in the system.

Format

Mode no slot <unit/slot> <cardindex>

Global Config

Note: Card index can be obtained by executing show supported cardtype command in

User EXEC mode.

set slot disable

This command configures the administrative mode of the slot(s). If you specify [all] , the command is applied to all slots, otherwise the command is applied to the slot identified by

<unit/slot> .



If a card or other module is present in the slot, this administrative mode will effectively be applied to the contents of the slot. If the slot is empty, this administrative mode will be applied to any module that is inserted into the slot. If a card is disabled, all the ports on the device are operationally disabled and shown as “unplugged” on management screens.

Format

Mode set slot disable [<unit/slot> | all]

Global Config no set slot disable

This command unconfigures the administrative mode of the slot(s). If you specify [all] , the command removes the configuration from all slots, otherwise the configuration is removed from the slot identified by <unit/slot> .

If a card or other module is present in the slot, this administrative mode removes the configuration from the contents of the slot. If the slot is empty, this administrative mode removes the configuration from any module inserted into the slot. If a card is disabled, all the ports on the device are operationally disabled and shown as “unplugged” on management screens.

Format

Mode no set slot disable [<unit/slot> | all]

Global Config set slot power

This command configures the power mode of the slot(s) and allows power to be supplied to a card located in the slot. If you specify [all] , the command is applied to all slots, otherwise the command is applied to the slot identified by <unit/slot> .

Use this command when installing or removing cards. If a card or other module is present in this slot, the power mode is applied to the contents of the slot. If the slot is empty, the power mode is applied to any card inserted into the slot.

Format

Mode set slot power [<unit/slot> | all]

Global Config



no set slot power

This command unconfigures the power mode of the slot(s) and prohibits power from being supplied to a card located in the slot. If you specify [all] , the command prohibits power to all slots, otherwise the command prohibits power to the slot identified by <unit/slot> .

Use this command when installing or removing cards. If a card or other module is present in this slot, power is prohibited to the contents of the slot. If the slot is empty, power is prohibited to any card inserted into the slot.

Format

Mode no set slot power [<unit/slot> | all]

Global Config reload (Stack)

This command resets the entire stack or the identified <unit> .

The <unit> is the switch identifier. The system prompts you to confirm that you want to reset the switch.

Format

Mode reload [<unit>]

User EXEC show slot

This command displays information about all the slots in the system or for a specific slot.

Format

Mode

show slot [<unit/slot>]

User EXEC

Term

Slot

Slot Status

Admin State

Power State

Configured Card

Model Identifier

Definition

The slot identifier in a < unit/slot > format.

The slot is empty, full, or has encountered an error

The slot administrative mode is enabled or disabled.

The slot power mode is enabled or disabled.

The model identifier of the card preconfigured in the slot. Model Identifier is a 32character field used to identify a card.



Term

Pluggable

Definition

Cards are pluggable or non-pluggable in the slot.

Power Down Indicates whether the slot can be powered down.

If you supply a value for <unit/slot> , the following additional information appears:

Term

Inserted Card


Inserted Card

Description

Configured Card

Description

Definition

The model identifier of the card inserted in the slot. Model Identifier is a 32-character field used to identify a card. This field is displayed only if the slot is full.

The card description. This field is displayed only if the slot is full.

The card description of the card preconfigured in the slot.

show supported cardtype

This commands displays information about all card types or specific card types supported in the system.

Format

Mode

show supported cardtype [<cardindex>]

User EXEC

If you do not supply a value for <cardindex> , the following output appears:

Term Definition

Card Index (CID) The index into the database of the supported card types. This index is used when preconfiguring a slot.

Card Model

Identifier

The model identifier for the supported card type.

If you supply a value for <cardindex> , the following output appears:

Term Definition

Card Type


The 32-bit numeric card type for the supported card.

The model identifier for the supported card type.

Card Description The description for the supported card type.



show switch

This command displays information about all units in the stack or a single unit when you specify the unit value.

Format

Mode show switch [<unit>]

Privileged EXEC

Term

Switch

Definition

The unit identifier assigned to the switch.

When you do not specify a value for <unit> , the following information appears:

Term Definition

Management

Status

Preconfigured


Indicates whether the switch is the Primary Management Unit, a stack member, or the status is unassigned.

The model identifier of a preconfigured switch ready to join the stack. The Model

Identifier is a 32-character field assigned by the device manufacturer to identify the device.

Plugged-In Model

Identifier

The model identifier of the switch in the stack. Model Identifier is a 32-character field assigned by the device manufacturer to identify the device.

Switch Status

Code Version

The switch status. Possible values for this state are: OK, Unsup ported, Code

Mismatch, Config Mismatch, or Not Present.

The detected version of code on this switch.

When you specify a value for <unit> , the following information appears:

Term

Management

Status

Hardware

Management

Preference

Admin

Management

Preference

Switch Type


Definition

Indicates whether the switch is the Primary Management Unit, a stack member, or the status is unassigned.

The hardware management preference of the switch. The hardware management preference can be disabled or unassigned.

The administrative management preference value assigned to the switch. This preference value indicates how likely the switch is to be chosen as the Primary

Management Unit.

The 32-bit numeric switch type.

The model identifier for this switch. Model Identifier is a 32-character field assigned by the device manufacturer to identify the device.



Term Definition

Switch Status The switch status. Possible values are OK, Unsupported, Code Mismatch, Config

Mismatch, or Not Present.

The switch description.

Switch

Description

Expected Code

Version

Detected Code

Version

Detected Code in

Flash

Up Time

The expected code version.

The version of code running on this switch. If the switch is not present and the data is from pre-configuration, then the code version is “None”.

The version of code that is currently stored in FLASH memory on the switch. This code executes after the switch is reset. If the switch is not present and the data is from preconfiguration, then the code version is “None”.

The system up time.

show supported switchtype

This commands displays information about all supported switch types or a specific switch type.

Format

Mode

show supported switchtype [<switchindex>]

User EXEC

Privileged EXEC

If you do not supply a value for <switchindex> , the following output appears:

Term Definition

Switch Index (SID) The index into the database of supported switch types. This index is used when preconfiguring a member to be added to the stack.


Management

Preference

Code Version

The model identifier for the supported switch type.

The management preference value of the switch type.

The code load target identifier of the switch type.

If you supply a value for <switchindex> , the following output appears:

Term

Switch Type

Definition

The 32-bit numeric switch type for the supported switch.



Term


Switch

Description

Definition

The model identifier for the supported switch type.

The description for the supported switch type.

Front Panel Stacking Commands

This section describes the commands you use to view and configure front panel stacking information.

stack-port

This command sets front panel stacking per port to either stack or ethernet mode.

Default

Format

Mode stack stack-port <unit/slot/port> [{ethernet | stack}]

Stack Global Config show stack-port

This command displays summary stack-port information for all interfaces.

Format

Mode show stack-port

Privileged EXEC

Term

QOS Mode

For Each Interface:

Definition

Front Panel Stacking QOS Mode for all Interfaces.

Term

Unit

Interface

Definition

The unit number.

The slot and port numbers.


2-10


Term Definition

Configured Stack

Mode

Stack or Ethernet.

Running Stack

Mode

Stack or Ethernet.

Link Status

Link Speed

Status of the link.

Speed (Gbps) of the stack port link.

show stack-port counters

This command displays summary data counter information for all interfaces.

Table 9:

Format

Mode show stack-port counters

Privileged EXEC

Term

Unit

Interface

Tx Data Rate

Tx Error Rate

Tx Total Error

Rx Data Rate

Rx Error Rate

Rx Total Errors

Definition

The unit number.


Trashing data rate in megabits per second on the stacking port.

Platform-specific number of transmit errors per second.

Platform-specific number of total transmit errors since power-up.

Receive data rate in megabits per second on the stacking port.

Platform-specific number of receive errors per second.

Platform-specific number of total receive errors since power-up.

show stack-port diag

This command shows front panel stacking diagnostics for each port and is only intended for Field

Application Engineers (FAEs) and developers. An FAE will advise on the necessity to run this command and capture this information.

Format

Mode show stack-port diag

Privileged EXEC



Term

Unit

Interface

Diagnostic Entry1



Definition

The unit number.


80 character string used for diagnostics.




2-12

Chapter 3

Switching Commands

This chapter describes the switching commands available in the managed switch CLI.

The Switching Commands chapter includes the following sections:

• “Port Configuration Commands” on page 3-2

• “show port description” on page 3-9

• “VLAN Commands” on page 3-31

• “Double VLAN Commands” on page 3-46

• “Voice VLAN Commands” on page 3-48

• “Provisioning (IEEE 802.1p) Commands” on page 3-51

• “Protected Ports Commands” on page 3-52

• “Private Group Commands” on page 3-54

• “GVRP Commands” on page 3-59

• “GMRP Commands” on page 3-61

• “Port-Based Network Access Control Commands” on page 3-64

• “Storm-Control Commands” on page 3-78

• “Port-Channel/LAG (802.3ad) Commands” on page 3-90

• “Port Mirroring” on page 3-113

• “Static MAC Filtering” on page 3-115

• “DHCP Snooping Configuration Commands” on page 3-120

• “Dynamic ARP Inspection Commands” on page 3-131

• “IGMP Snooping Configuration Commands” on page 3-139

• “IGMP Snooping Querier Commands” on page 3-148

• “MLD Snooping Commands” on page 3-153

• “MLD Snooping Querier Commands” on page 3-162 v1.0, July 2009

3-1


• “Port Security Commands” on page 3-166

• “LLDP (802.1AB) Commands” on page 3-170

• “LLDP-MED Commands” on page 3-181

• “Denial of Service Commands” on page 3-192

• “MAC Database Commands” on page 3-204

• “ISDP Commands” on page 3-206

Warning: The commands in this chapter are in one of three functional groups:

• Show commands display switch settings, statistics, and other information.

• Configuration commands configure features and options of the switch. For every configuration command, there is a show command that displays the configuration setting.

• Clear commands clear some or all of the settings to factory defaults.

Port Configuration Commands

This section describes the commands you use to view and configure port settings. interface

This command gives you access to the Interface Config mode, which allows you to enable or modify the operation of an interface (port).

Format

Mode interface <unit/slot/port>

Global Config

Switching Commands v1.0, July 2009

3-2


interface range

This command gives you access to a range of port interfaces, allowing the same port configuration to be applied to a set of ports.

Format

Mode

interface range <unit/slot/port>-<unit/slot/port>

Global Config interface vlan

This command gives you access to to the vlan virtual interface mode, which allows certain port configurations (for example, the IP address) to be applied to the VLAN interface. Type a question mark (?) after entering the interface configuration mode to see the available options.

Format

Mode interface vlan <vlan id>

Global Config interface lag

This command gives you access to the LAG (link aggregation, or port channel) virtual interface, which allows certain port configurations to be applied to the LAG interface. Type a question mark

(?) after entering the interface configuration mode to see the available options.

Note: The IP address cannot be assigned to a LAG virtual interface. The interface must be put under a VLAN group and an IP address assigned to the VLAN group..

Format

Mode interface lag <lag id>

Global Config auto-negotiate

This command enables automatic negotiation on a port.

Default enabled

Switching Commands 3-3 v1.0, July 2009

Format

Mode auto-negotiate

Interface Config no auto-negotiate

This command disables automatic negotiation on a port.


Note: Automatic sensing is disabled when automatic negotiation is disabled.

auto-negotiate all

Format

Mode no auto-negotiate

Interface Config

This command enables automatic negotiation on all ports.

Default

Format

Mode enabled auto-negotiate all

Global Config no auto-negotiate all

This command disables automatic negotiation on all ports.

Format

Mode no auto-negotiate all

Global Config


3-4


description

Use this command to create an alpha-numeric description of the port.

Format

Mode description <description>

Interface Config mtu

Use the mtu command to set the maximum transmission unit (MTU) size, in bytes, for frames that ingress or egress the interface. You can use the mtu command to configure jumbo frame support for physical and port-channel (LAG) interfaces. For the standard 7000 seriesimplementation, the

MTU size is a valid integer between 1522 - 9216 for tagged packets and a valid integer between

1518 - 9216 for untagged packets.

Note: To receive and process packets, the Ethernet MTU must include any extra bytes that Layer-2 headers might require. To configure the IP MTU size, which is the maximum size of the IP packet (IP Header + IP payload), see “ip mtu” on page 4-

12 .

Default

Format

Mode

1518 (untagged) mtu <1518-9216>

Interface Config no mtu

This command sets the default MTU size (in bytes) for the interface.

Format

Mode no mtu

Interface Config


3-5


shutdown

This command disables a port.

Note: You can use the shutdown command on physical and port-channel (LAG) interfaces, but not on VLAN routing interfaces.

Default

Format

Mode enabled shutdown

Interface Config no shutdown

This command enables a port.

Format

Mode no shutdown

Interface Config shutdown all

This command disables all ports.

Note: You can use the shutdown all command on physical and port-channel (LAG) interfaces, but not on VLAN routing interfaces.

Default

Format

Mode enabled shutdown all

Global Config



no shutdown all

This command enables all ports.

Format

Mode no shutdown all

Global Config speed

This command sets the speed and duplex setting for the interface.

Format

Mode speed {<100 | 10> <half-duplex | full-duplex>}

Interface Config

Acceptable

Values

100h

100f

10h

10f

Definition

100BASE-T half duplex

100BASE-T full duplex


10BASE-T full duplex speed all

This command sets the speed and duplex setting for all interfaces.

Format

Mode speed all {<100 | 10> <half-duplex | full-duplex>}

Global Config

Acceptable

Values

100h

100f

10h

10f

Definition







show port

This command displays port information.

Format

Mode show port {<unit/slot/port> | all}

Privileged EXEC

Term Definition

Interface

Type

Admin Mode

Physical Mode

Valid unit, slot, and port number separated by forward slashes.

If not blank, this field indicates that this port is a special type of port. The possible values are:

• Mirror - this port is a monitoring port. For more information, see “Port Mirroring” on page 3-113 .

• PC Mbr - this port is a member of a port-channel (LAG).

• Probe - this port is a probe port.

The Port control administration state. The port must be enabled in order for it to be allowed into the network. - May be enabled or disabled. The factory default is enabled.

The desired port speed and duplex mode. If auto-negotiation support is selected, then the duplex mode and speed is set from the auto-negotiation process. Note that the maximum capability of the port (full duplex -100M) is advertised. Otherwise, this object determines the port's duplex mode and transmission rate. The factory default is Auto.

Physical Status The port speed and duplex mode.

Link Status The Link is up or down.

Link Trap

LACP Mode

This object determines whether or not to send a trap when link status changes. The factory default is enabled.

LACP is enabled or disabled on this port.

show port protocol

This command displays the Protocol-Based VLAN information for either the entire system, or for the indicated group.

Format

Mode show port protocol {<groupid> | all}

Privileged EXEC



Term

Group Name

Group ID

Protocol(s)

VLAN

Interface(s)

Definition

The group name of an entry in the Protocol-based VLAN table.

The group identifier of the protocol group.

The type of protocol(s) for this group.

The VLAN associated with this Protocol Group.

Lists the unit/slot/port interface(s) that are associated with this Protocol Group.

show port description

This command displays the port description for every port.

Format

Mode

Term

Interface

Description show port description <unit/slot/port>

Privileged EXEC

Definition

Valid slot and port number separated by forward slashes

Shows the port description configured via the “description” command show port status

This command displays the Protocol-Based VLAN information for either the entire system, or for the indicated group.

Format

Mode show port status {<unit/slot/port> | all}

Privileged EXEC

Term

Interface

Media Type

STP Mode

Switching Commands

Definition

Valid slot and port number separated by forward slashes.

“Copper” or “Fiber” for combo port.

Indicate the spanning tree mode of the port.

v1.0, July 2009

3-9


Term

Physical Mode

Physical Status

Link Status

Loop Status

Partner Flow

Control

Definition

Either “Auto” or fixed speed and duplex mode.

The actual speed and duplex mode.

Whether the link is Up or Down.

Whether the port is in loop state or not.

Whether the remote side is using flow control or not.


3-10


Spanning Tree Protocol (STP) Commands

This section describes the commands you use to configure Spanning Tree Protocol (STP). STP helps prevent network loops, duplicate messages, and network instability.

spanning-tree

This command sets the spanning-tree operational mode to enabled.

Default

Format

Mode enabled spanning-tree

Global Config no spanning-tree

This command sets the spanning-tree operational mode to disabled. While disabled, the spanningtree configuration is retained and can be changed, but is not activated.

Format

Mode no spanning-tree

Global Config spanning-tree bpdufilter default

Use this command to enable BPDU Filter on all the edge port interfaces.

Default

Format

Mode disabled spanning-tree bpdufilter

Global Config no spanning-tree bpdufilter default

Use this command to disable BPDU Filter on all the edge port interfaces.



Default

Format

Mode enabled no spanning-tree bpdufilter default

Global Config spanning-tree bpduflood

Use this command to enable BPDU Flood on the interface.

Default

Format

Mode disabled spanning-tree bpduflood

Interface Config no spanning-tree bpduflood

Use this command to disable BPDU Flood on the interface.

Default

Format

Mode enabled no spanning-tree bpduflood

Interface Config spanning-tree bpduguard

Use this command to enable BPDU Guard on the switch.

Format

Mode spanning-tree bpduguard

Global Config no spanning-tree bpduguard

Use this command to disable BPDU Guard on the switch.



Default

Format

Mode disabled no spanning-tree bpduguard

Global Config spanning-tree bpdumigrationcheck

Use this command to force a transmission of rapid spanning tree (RSTP) and multiple spanning tree (MSTP) BPDUs. Use the <unit/slot/port> parameter to transmit a BPDU from a specified interface, or use the all keyword to transmit BPDUs from all interfaces. This command forces the BPDU transmission when you execute it, so the command does not change the system configuration or have a “no” version.

Format

Mode spanning-tree bpdumigrationcheck {<unit/slot/port> | all}

Global Config spanning-tree configuration name

This command sets the Configuration Identifier Name for use in identifying the configuration that this switch is currently using. The <name> is a string of up to 32 characters.

Default

Format

Mode base MAC address in hexadecimal notation spanning-tree configuration name <name>

Global Config no spanning-tree configuration name

This command resets the Configuration Identifier Name to its default.

Format

Mode no spanning-tree configuration name

Global Config



spanning-tree configuration revision

This command sets the Configuration Identifier Revision Level for use in identifying the configuration that this switch is currently using. The Configuration Identifier Revision Level is a number in the range of 0 to 65535.

Default

Format

Mode

0 spanning-tree configuration revision <0-65535>

Global Config no spanning-tree configuration revision

This command sets the Configuration Identifier Revision Level for use in identifying the configuration that this switch is currently using to the default value.

Format

Mode no spanning-tree configuration revision

Global Config spanning-tree edgeport

This command specifies that this port is an Edge Port within the common and internal spanning tree. This allows this port to transition to Forwarding State without delay.

Default

Format

Mode enabled spanning-tree edgeport

Interface Config no spanning-tree edgeport

This command specifies that this port is not an Edge Port within the common and internal spanning tree.

Format

Mode no spanning-tree edgeport

Interface Config



spanning-tree forceversion

This command sets the Force Protocol Version parameter to a new value.

Default

Format

Mode

802.1s

spanning-tree forceversion <802.1d | 802.1s | 802.1w>

Global Config

• Use 802.1d to specify that the switch transmits ST BPDUs rather than MST BPDUs (IEEE

802.1d functionality supported).

• Use 802.1s to specify that the switch transmits MST BPDUs (IEEE 802.1s functionality supported).

• Use 802.1w to specify that the switch transmits RST BPDUs rather than MST BPDUs (IEEE

802.1w functionality supported). no spanning-tree forceversion

This command sets the Force Protocol Version parameter to the default value.

Format

Mode no spanning-tree forceversion

Global Config spanning-tree forward-time

This command sets the Bridge Forward Delay parameter to a new value for the common and internal spanning tree. The forward-time value is in seconds within a range of 4 to 30, with the value being greater than or equal to “(Bridge Max Age / 2) + 1”.

Default

Format

Mode

15 spanning-tree forward-time <4-30>

Global Config



no spanning-tree forward-time

This command sets the Bridge Forward Delay parameter for the common and internal spanning tree to the default value.

Format

Mode no spanning-tree forward-time

Global Config spanning-tree guard

This command selects whether loop guard or root guard is enabled on an interface. If neither is enabled, then the port operates in accordance with the multiple spanning tree protocol.

Default

Format

Mode none spanning-tree guard { none | root | loop }

Interface Config no spanning-tree guard

This command disables loop guard or root guard on the interface.

Format

Mode no spanning-tree guard

Interface Config spanning-tree max-age

This command sets the Bridge Max Age parameter to a new value for the common and internal spanning tree. The max-age value is in seconds within a range of 6 to 40, with the value being less than or equal to 2 x (Bridge Forward Delay - 1) .

Default

Format

Mode

20 spanning-tree max-age <6-40>

Global Config


no spanning-tree max-age

Global Config


no spanning-tree max-age

This command sets the Bridge Max Age parameter for the common and internal spanning tree to the default value.

Format

Mode spanning-tree max-hops

This command sets the MSTP Max Hops parameter to a new value for the common and internal spanning tree. The max-hops value is a range from 6 to 40.

Default

Format

Mode

20 spanning-tree max-hops <1-127>

Global Config no spanning-tree max-hops

This command sets the Bridge Max Hops parameter for the common and internal spanning tree to the default value.

Format

Mode no spanning-tree max-hops

Global Config spanning-tree mst

This command sets the Path Cost or Port Priority for this port within the multiple spanning tree instance or in the common and internal spanning tree. If you specify an <mstid> parameter that corresponds to an existing multiple spanning tree instance, the configurations are done for that multiple spanning tree instance. If you specify 0 (defined as the default CIST ID) as the

<mstid> , the configurations are done for the common and internal spanning tree instance.


Format

Mode


If you specify the cost option, the command sets the path cost for this port within a multiple spanning tree instance or the common and internal spanning tree instance, depending on the

<mstid> parameter. You can set the path cost as a number in the range of 1 to 200000000 or auto . If you select auto the path cost value is set based on Link Speed.

If you specify the external-cost option, this command sets the external-path cost for MST instance

‘0’ i.e. CIST instance. You can set the external cost as a number in the range of 1 to 200000000 or auto . If you specify auto, the external path cost value is set based on Link Speed.

If you specify the port-priority option, this command sets the priority for this port within a specific multiple spanning tree instance or the common and internal spanning tree instance, depending on the <mstid> parameter. The port-priority value is a number in the range of 0 to 240 in increments of 16.

Default • cost—auto

• external-cost—auto

• port-priority—128 spanning-tree mst

< mstid> {{cost <1-200000000> | auto} | {externalcost <1-200000000> | auto} | port-priority <0-240>}

Interface Config no spanning-tree mst

This command sets the Path Cost or Port Priority for this port within the multiple spanning tree instance, or in the common and internal spanning tree to the respective default values. If you specify an <mstid> parameter that corresponds to an existing multiple spanning tree instance, you are configuring that multiple spanning tree instance. If you specify 0 (defined as the default

CIST ID) as the <mstid> , you are configuring the common and internal spanning tree instance.

If the you specify cost , this command sets the path cost for this port within a multiple spanning tree instance or the common and internal spanning tree instance, depending on the <mstid> parameter, to the default value, i.e. a path cost value based on the Link Speed.

If you specify external-cost , this command sets the external path cost for this port for mst ‘0’ instance, to the default value, i.e. a path cost value based on the Link Speed.

If you specify port-priority , this command sets the priority for this port within a specific multiple spanning tree instance or the common and internal spanning tree instance, depending on the

<mstid> parameter, to the default value.



Format

Mode no spanning-tree mst <mstid> <cost | external-cost | port-priority>

Interface Config spanning-tree mst instance

This command adds a multiple spanning tree instance to the switch. The parameter <mstid> is a number within a range of 1 to 4094, that corresponds to the new instance ID to be added. The maximum number of multiple instances supported by the switch is 4.

Default

Format

Mode none spanning-tree mst instance <mstid>

Global Config no spanning-tree mst instance

This command removes a multiple spanning tree instance from the switch and reallocates all

VLANs allocated to the deleted instance to the common and internal spanning tree. The parameter

<mstid> is a number that corresponds to the desired existing multiple spanning tree instance to be removed.

Format

Mode no spanning-tree mst instance <mstid>

Global Config spanning-tree mst priority

This command sets the bridge priority for a specific multiple spanning tree instance. The parameter <mstid> is a number that corresponds to the desired existing multiple spanning tree instance. The priority value is a number within a range of 0 to 61440 in increments of 4096.


3-19


If you specify 0 (defined as the default CIST ID) as the <mstid> , this command sets the Bridge

Priority parameter to a new value for the common and internal spanning tree. The bridge priority value is a number within a range of 0 to 61440. The twelve least significant bits are masked according to the 802.1s specification. This causes the priority to be rounded down to the next lower valid priority.

Default

Format

Mode

32768 spanning-tree mst priority <mstid> <0-61440>

Global Config no spanning-tree mst priority

This command sets the bridge priority for a specific multiple spanning tree instance to the default value. The parameter <mstid> is a number that corresponds to the desired existing multiple spanning tree instance.

If 0 (defined as the default CIST ID) is passed as the <mstid> , this command sets the Bridge

Priority parameter for the common and internal spanning tree to the default value.

Format

Mode no spanning-tree mst priority <mstid>

Global Config spanning-tree mst vlan

This command adds an association between a multiple spanning tree instance and one or more

VLANs so that the VLAN(s) are no longer associated with the common and internal spanning tree.

The parameter <mstid> is a number that corresponds to the desired existing multiple spanning tree instance. The vlan range can be specified as a list or as a range of values. To specify a list of

VLANs, enter a list of VLAN IDs, each separated by a comma with no spaces in between. To specify a range of VLANs, separate the beginning and ending VLAN ID with a dash ("-").

Format

Mode spanning-tree mst vlan <mstid> <vlanid>

Global Config



no spanning-tree mst vlan

This command removes an association between a multiple spanning tree instance and one or more

VLANs so that the VLAN(s) are again associated with the common and internal spanning tree.

Format

Mode no spanning-tree mst vlan <mstid> <vlanid>

Global Config spanning-tree port mode

This command sets the Administrative Switch Port State for this port to enabled.

Default

Format

Mode disabled spanning-tree port mode

Interface Config no spanning-tree port mode

This command sets the Administrative Switch Port State for this port to disabled.

Format

Mode no spanning-tree port mode

Interface Config spanning-tree port mode all

This command sets the Administrative Switch Port State for all ports to enabled.

Default

Format

Mode disabled spanning-tree port mode all

Global Config


3-21


no spanning-tree port mode all

This command sets the Administrative Switch Port State for all ports to disabled.

Format

Mode no spanning-tree port mode all

Global Config spanning-tree edgeport all

This command specifies that every port is an Edge Port within the common and internal spanning tree. This allows all ports to transition to Forwarding State without delay.

Format

Mode spanning-tree edgeport all

Global Config no spanning-tree edgeport all

This command disables Edge Port mode for all ports within the common and internal spanning tree.

Format

Mode no spanning-tree edgeport all

Global Config spanning-tree bpduforwarding

Normally a switch will not forward Spanning Tree Protocol (STP) BPDU packets if STP is disabled. However, if in some network setup, the user wishes to forward BDPU packets received from other network devices, this command can be used to enable the forwarding.

Default

Format

Mode

2 spanning-tree bpduforwarding

Global Config


3-22


no spanning-tree bpduforwarding

This command will cause the STP BPDU packets received from the network to be dropped if STP is disabled.

Format

Mode no spanning-tree bpduforwarding

Global Config show spanning-tree

This command displays spanning tree settings for the common and internal spanning tree. The following details are displayed.

Format

Mode show spanning-tree

• Privileged EXEC

• User EXEC

Term Definition

Bridge Priority Specifies the bridge priority for the Common and Internal Spanning tree (CST). The value lies between 0 and 61440. It is displayed in multiples of 4096.

Bridge Identifier The bridge identifier for the CST. It is made up using the bridge priority and the base

MAC address of the bridge.

Time Since

Topology

Change

Time in seconds.

Topology

Change Count

Topology

Change

Designated

Root

Number of times changed.

Boolean value of the Topology Change parameter for the switch indicating if a topology change is in progress on any port assigned to the common and internal spanning tree.

The bridge identifier of the root bridge. It is made up from the bridge priority and the base

MAC address of the bridge.

Root Path Cost Value of the Root Path Cost parameter for the common and internal spanning tree.

Root Port

Identifier

Identifier of the port to access the Designated Root for the CST

Root Port Max

Age

Derived value.



Term Definition

Root Port

Bridge Forward

Delay

Derived value.

Hello Time

Bridge Hold

Time

Configured value of the parameter for the CST.

Minimum time between transmission of Configuration Bridge Protocol Data Units

(BPDUs).

Bridge max-hops count for the device.

Bridge Max

Hops

CST Regional

Root

Regional Root

Path Cost

Associated

FIDs

Associated

VLANs

Bridge Identifier of the CST Regional Root. It is made up using the bridge priority and the base MAC address of the bridge.

Path Cost to the CST Regional Root.

List of forwarding database identifiers currently associated with this instance.

List of VLAN IDs currently associated with this instance.

show spanning-tree brief

This command displays spanning tree settings for the bridge. The following information appears.

Format

Mode

Term

Bridge Priority

Bridge Identifier show spanning-tree brief

• Privileged EXEC

• User EXEC

Bridge Max Age

Bridge Max Hops

Bridge Hello Time

Bridge Forward Delay

Bridge Hold Time

Definition

Configured value.

The bridge identifier for the selected MST instance. It is made up using the bridge priority and the base MAC address of the bridge.

Configured value.

Bridge max-hops count for the device.

Configured value.

Configured value.

Minimum time between transmission of Configuration Bridge Protocol Data

Units (BPDUs).



show spanning-tree interface

This command displays the settings and parameters for a specific switch port within the common and internal spanning tree. The <unit/slot/port > is the desired switch port. The following details are displayed on execution of the command.

Format

Mode show spanning-tree interface <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

Hello Time

Port Mode

BPDU Guard Effect

Root Guard

Loop Guard

TCN Guard

Admin hello time for this port.

Enabled or disabled.



BPDU Filter Mode

BPDU Flood Mode

Auto Edge


Enable or disable the propagation of received topology change notifications and topology changes to other ports.



To enable or disable the feature that causes a port that has not seen a BPDU for

‘edge delay’ time, to become an edge port and transition to forwarding faster.

Time since port was reset, displayed in days, hours, minutes, and seconds.

Port Up Time Since

Counters Last Cleared

STP BPDUs

Transmitted

Spanning Tree Protocol Bridge Protocol Data Units sent.

STP BPDUs Received Spanning Tree Protocol Bridge Protocol Data Units received.

RSTP BPDUs

Transmitted

Rapid Spanning Tree Protocol Bridge Protocol Data Units sent.

RSTP BPDUs Received Rapid Spanning Tree Protocol Bridge Protocol Data Units received.

MSTP BPDUs

Transmitted

Multiple Spanning Tree Protocol Bridge Protocol Data Units sent.

MSTP BPDUs Received Multiple Spanning Tree Protocol Bridge Protocol Data Units received.



show spanning-tree mst port detailed

This command displays the detailed settings and parameters for a specific switch port within a particular multiple spanning tree instance. The parameter <mstid> is a number that corresponds to the desired existing multiple spanning tree instance. The <unit/slot/port > is the desired switch port.

Format

Mode show spanning-tree mst port detailed <mstid> <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

MST Instance ID The ID of the existing MST instance.

Port Identifier The port identifier for the specified port within the selected MST instance. It is made up from the port priority and the interface number of the port.

Port Priority The priority for a particular port within the selected MST instance. The port priority is displayed in multiples of 16.

Port Forwarding

State

Current spanning tree state of this port.

Port Role

Auto-Calculate

Port Path Cost

Each enabled MST Bridge Port receives a Port Role for each spanning tree. The port role is one of the following values: Root Port, Designated Port, Alternate Port, Backup

Port, Master Port or Disabled Port

Indicates whether auto calculation for port path cost is enabled.

Port Path Cost Configured value of the Internal Port Path Cost parameter.

Designated

Root

The Identifier of the designated root for this port.

Root Path Cost The path cost to get to the root bridge for this instance. The root path cost is zero if the bridge is the root bridge for that instance.

Designated

Bridge

Bridge Identifier of the bridge with the Designated Port.

Designated Port

Identifier

Port on the Designated Bridge that offers the lowest cost to the LAN.

Loop

Inconsistent

State

The current loop inconsistent state of this port in this MST instance. When in loop inconsistent state, the port has failed to receive BPDUs while configured with loop guard enabled. Loop inconsistent state maintains the port in a "blocking" state until a subsequent BPDU is received.



Term Definition

Transitions Into

Loop

Inconsistent

State

The number of times this interface has transitioned into loop inconsistent state.

Transitions Out of Loop

Inconsistent

State

The number of times this interface has transitioned out of loop inconsistent state.

If you specify 0 (defined as the default CIST ID) as the <mstid> , this command displays the settings and parameters for a specific switch port within the common and internal spanning tree.

The <unit/slot/port > is the desired switch port. In this case, the following are displayed.

Term Definition

Port Identifier The port identifier for this port within the CST.

Port Priority The priority of the port within the CST.

Port Forwarding

State

The forwarding state of the port within the CST.

Port Role

Auto-Calculate

Port Path Cost

The role of the specified interface within the CST.

Indicates whether auto calculation for port path cost is enabled or not (disabled).

Port Path Cost The configured path cost for the specified interface.

Auto-Calculate

External Port

Path Cost

Indicates whether auto calculation for external port path cost is enabled.

External Port

Path Cost

The cost to get to the root bridge of the CIST across the boundary of the region. This means that if the port is a boundary port for an MSTP region, then the external path cost is used.

Designated

Root

Identifier of the designated root for this port within the CST.

Root Path Cost The root path cost to the LAN by the port.

Designated

Bridge

The bridge containing the designated port.

Designated Port

Identifier

Port on the Designated Bridge that offers the lowest cost to the LAN.



Term Definition

Topology

Change

Acknowledgem ent

Hello Time

Edge Port

Edge Port

Status

Value of flag in next Configuration Bridge Protocol Data Unit (BPDU) transmission indicating if a topology change is in progress for this port.

The hello time in use for this port.

The configured value indicating if this port is an edge port.

The derived value of the edge port status. True if operating as an edge port; false otherwise.

Derived value indicating if this port is part of a point to point link.

Point To Point

MAC Status

CST Regional

Root

The regional root identifier in use for this port.

CST Internal

Root Path Cost

Loop

Inconsistent

State

The internal root path cost to the LAN by the designated external port.

The current loop inconsistent state of this port in this MST instance. When in loop inconsistent state, the port has failed to receive BPDUs while configured with loop guard enabled. Loop inconsistent state maintains the port in a "blocking" state until a subsequent BPDU is received.

Transitions Into

Loop

Inconsistent

State

The number of times this interface has transitioned into loop inconsistent state.

Transitions Out of Loop

Inconsistent

State

The number of times this interface has transitioned out of loop inconsistent state.

show spanning-tree mst port summary

This command displays the settings of one or all ports within the specified multiple spanning tree instance. The parameter <mstid> indicates a particular MST instance. The parameter { <unit/ slot/port > | all} indicates the desired switch port or all ports.

If you specify 0 (defined as the default CIST ID) as the <mstid> , the status summary displays for one or all ports within the common and internal spanning tree.

Format

Mode show spanning-tree mst port summary <mstid> {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC



Term Definition

MST Instance ID The MST instance associated with this port.

Interface Valid unit, slot, and port number separated by forward slashes.

STP Mode

Type

Indicates whether spanning tree is enabled or disabled on the port.

Currently not used.

STP State

Port Role

The forwarding state of the port in the specified spanning tree instance.

The role of the specified port within the spanning tree.

Desc Indicates whether the port is in loop inconsistent state or not. This field is blank if the loop guard feature is not available.

show spanning-tree mst summary

This command displays summary information about all multiple spanning tree instances in the switch. On execution, the following details are displayed.

Format

Mode show spanning-tree mst summary

• Privileged EXEC

• User EXEC

Term Definition

MST Instance ID

List

List of multiple spanning trees IDs currently configured.

For each

MSTID:

• Associated

FIDs

• Associated

VLANs

• List of forwarding database identifiers associated with this instance.

• List of VLAN IDs associated with this instance.


3-29


show spanning-tree summary

This command displays spanning tree settings and parameters for the switch. The following details are displayed on execution of the command.

Format

Mode show spanning-tree summary

• Privileged EXEC

• User EXEC

Term Definition

Spanning Tree

Adminmode

Spanning Tree

Version


Version of 802.1 currently supported (IEEE 802.1s, IEEE 802.1w, or IEEE 802.1d) based upon the Force Protocol Version parameter.


BPDU Guard

Mode

BPDU Filter

Mode

Configuration

Name

Configuration

Revision Level


Identifier used to identify the configuration currently being used.

Identifier used to identify the configuration currently being used.

Configuration

Digest Key

A generated Key used in the exchange of the BPDUs.

Configuration

Format Selector

Specifies the version of the configuration format being used in the exchange of BPDUs.

The default value is zero.

MST Instances List of all multiple spanning tree instances configured on the switch.

show spanning-tree vlan

This command displays the association between a VLAN and a multiple spanning tree instance.

The <vlanid> corresponds to an existing VLAN ID.

Format

Mode show spanning-tree vlan <vlanid>

• Privileged EXEC

• User EXEC



Term Definition

VLAN Identifier The VLANs associated with the selected MST instance.

Associated

Instance

Identifier for the associated multiple spanning tree instance or “CST” if associated with the common and internal spanning tree.

VLAN Commands

This section describes the commands you use to configure VLAN settings.

vlan database

This command gives you access to the VLAN Config mode, which allows you to configure VLAN characteristics.

Format

Mode vlan database

Privileged EXEC network mgmt_vlan

This command configures the Management VLAN ID.

Default

Format

Mode

1 network mgmt_vlan <1-4093>

Privileged EXEC no network mgmt_vlan

This command sets the Management VLAN ID to the default.

Format

Mode no network mgmt_vlan

Privileged EXEC



vlan

This command creates a new VLAN and assigns it an ID. The ID is a valid VLAN identification number (ID 1 is reserved for the default VLAN). The vlan-list contains VlanId's in range <1-

4093>. Separate non-consecutive IDs with ',' and no spaces and no zeros in between the range; Use

'-' for range.

Format

Mode vlan <vlan-list>

VLAN Config no vlan

This command deletes an existing VLAN. The ID is a valid VLAN identification number (ID 1 is reserved for the default VLAN). The vlan-list contains VlanId's in range <1-4093>. Separate nonconsecutive IDs with ',' and no spaces and no zeros in between the range; Use '-' for range.

Format

Mode no vlan <vlan-list>

VLAN Config vlan acceptframe

This command sets the frame acceptance mode per interface. For VLAN Only mode, untagged frames or priority frames received on this interface are discarded. For Admit All mode, untagged frames or priority frames received on this interface are accepted and assigned the value of the interface VLAN ID for this port. With either option, VLAN tagged frames are forwarded in accordance with the IEEE 802.1Q VLAN Specification.

Default

Format

Mode all vlan acceptframe {vlanonly | all}

Interface Config


3-32


no vlan acceptframe

This command resets the frame acceptance mode for the interface to the default value.

Format

Mode no vlan acceptframe

Interface Config vlan ingressfilter

This command enables ingress filtering. If ingress filtering is disabled, frames received with

VLAN IDs that do not match the VLAN membership of the receiving interface are admitted and forwarded to ports that are members of that VLAN.

Default

Format

Mode disabled vlan ingressfilter

Interface Config no vlan ingressfilter

This command disables ingress filtering. If ingress filtering is disabled, frames received with

VLAN IDs that do not match the VLAN membership of the receiving interface are admitted and forwarded to ports that are members of that VLAN.

Format

Mode no vlan ingressfilter

Interface Config vlan makestatic

This command changes a dynamically created VLAN (one that is created by GVRP registration) to a static VLAN (one that is permanently configured and defined). The ID is a valid VLAN identification number. VLAN range is 2-4093.

Format

Mode vlan makestatic <2-4093>

VLAN Config



vlan name

This command changes the name of a VLAN. The name is an alphanumeric string of up to 32 characters, and the ID is a valid VLAN identification number. ID range is 1-4093.

Default

Format

Mode

• VLAN ID 1 - default

• other VLANS - blank string vlan name <1-4093> <name>

VLAN Config no vlan name

This command sets the name of a VLAN to a blank string.

Format

Mode no vlan name <1-4093>

VLAN Config vlan participation

This command configures the degree of participation for a specific interface in a VLAN. The ID is a valid VLAN identification number, and the interface is a valid interface number .

Format

Mode vlan participation {exclude | include | auto} <1-4093>

Interface Config

Participation options are:

Participation

Options include exclude auto

Definition

The interface is always a member of this VLAN. This is equivalent to registration fixed.

The interface is never a member of this VLAN. This is equivalent to registration forbidden.

The interface is dynamically registered in this VLAN by GVRP. The interface will not participate in this VLAN unless a join request is received on this interface. This is equivalent to registration normal.



vlan participation all

This command configures the degree of participation for all interfaces in a VLAN. The ID is a valid VLAN identification number.

Format

Mode vlan participation all {exclude | include | auto} <1-4093>

Global Config

You can use the following participation options:

Participation

Options include exclude auto

Definition

The interface is always a member of this VLAN. This is equivalent to registration fixed.

The interface is never a member of this VLAN. This is equivalent to registration forbidden.

The interface is dynamically registered in this VLAN by GVRP. The interface will not participate in this VLAN unless a join request is received on this interface. This is equivalent to registration normal.

vlan port acceptframe all

This command sets the frame acceptance mode for all interfaces.

Default

Format

Mode all vlan port acceptframe all {vlanonly | all}

Global Config

The modes defined as follows:

Mode Definition

VLAN Only mode

Untagged frames or priority frames received on this interface are discarded.

Admit All mode Untagged frames or priority frames received on this interface are accepted and assigned the value of the interface VLAN ID for this port.

With either option, VLAN tagged frames are forwarded in accordance with the IEEE 802.1Q

VLAN Specification.



no vlan port acceptframe all

This command sets the frame acceptance mode for all interfaces to Admit All. For Admit All mode, untagged frames or priority frames received on this interface are accepted and assigned the value of the interface VLAN ID for this port. With either option, VLAN tagged frames are forwarded in accordance with the IEEE 802.1Q VLAN Specification.

Format

Mode no vlan port acceptframe all

Global Config vlan port ingressfilter all

This command enables ingress filtering for all ports. If ingress filtering is disabled, frames received with VLAN IDs that do not match the VLAN membership of the receiving interface are admitted and forwarded to ports that are members of that VLAN.

Default

Format

Mode disabled vlan port ingressfilter all

Global Config no vlan port ingressfilter all

This command disables ingress filtering for all ports. If ingress filtering is disabled, frames received with VLAN IDs that do not match the VLAN membership of the receiving interface are admitted and forwarded to ports that are members of that VLAN.

Format

Mode no vlan port ingressfilter all

Global Config vlan port pvid all

This command changes the VLAN ID for all interface.

Default

Format

Mode

1 vlan port pvid all <1-4093>

Global Config


3-36

no vlan port pvid all

This command sets the VLAN ID for all interfaces to 1.

Format

Mode no vlan port pvid all

Global Config


vlan port tagging all

This command configures the tagging behavior for all interfaces in a VLAN to enabled. If tagging is enabled, traffic is transmitted as tagged frames. If tagging is disabled, traffic is transmitted as untagged frames. The ID is a valid VLAN identification number.

Format

Mode vlan port tagging all <1-4093>

Global Config no vlan port tagging all

This command configures the tagging behavior for all interfaces in a VLAN to disabled. If tagging is disabled, traffic is transmitted as untagged frames. The ID is a valid VLAN identification number.

Format

Mode no vlan port tagging all

Global Config vlan protocol group

This command adds protocol-based VLAN groups to the system. The < groupName> is a character string of 1 to 16 characters. When it is created, the protocol group will be assigned a unique number that will be used to identify the group in subsequent commands.

Format

Mode vlan protocol group <groupname>

Global Config



vlan protocol group add protocol

This command adds the <protocol> to the protocol-based VLAN identified by <groupid> .

A group may have more than one protocol associated with it. Each interface and protocol combination can only be associated with one group. If adding a protocol to a group causes any conflicts with interfaces currently associated with the group, this command fails and the protocol is not added to the group. The possible values for protocol are ip, arp, and ipx .

Default

Format

Mode none vlan protocol group add protocol <groupid> <protocol>

Global Config no vlan protocol group add protocol

This command removes the < protocol> from this protocol-based VLAN group that is identified by this < groupid> . The possible values for protocol are ip, arp, and ipx .

Format

Mode no vlan protocol group add protocol <groupid> <protocol>

Global Config vlan protocol group remove

This command removes the protocol-based VLAN group that is identified by this <groupid> .

Format

Mode vlan protocol group remove <groupid>

Global Config protocol group

This command attaches a <vlanid> to the protocol-based VLAN identified by <groupid> .

A group may only be associated with one VLAN at a time, however the VLAN association can be changed.



Default

Format

Mode none protocol group <groupid> <vlanid>

VLAN Config no protocol group

This command removes the <vlanid> from this protocol-based VLAN group that is identified by this <groupid> .

Format

Mode no protocol group <groupid> <vlanid>

VLAN Config protocol vlan group

This command adds the physical interface to the protocol-based VLAN identified by

<groupid> . You can associate multiple interfaces with a group, but you can only associate each interface and protocol combination with one group. If adding an interface to a group causes any conflicts with protocols currently associated with the group, this command fails and the interface(s) are not added to the group.

Default

Format

Mode none protocol vlan group <groupid>

Interface Config no protocol vlan group

This command removes the interface from this protocol-based VLAN group that is identified by this <groupid> .

Format

Mode no protocol vlan group <groupid>

Interface Config



protocol vlan group all

This command adds all physical interfaces to the protocol-based VLAN identified by

<groupid> . You can associate multiple interfaces with a group, but you can only associate each interface and protocol combination with one group. If adding an interface to a group causes any conflicts with protocols currently associated with the group, this command will fail and the interface(s) will not be added to the group.

Default

Format

Mode none protocol vlan group all <groupid>

Global Config no protocol vlan group all

This command removes all interfaces from this protocol-based VLAN group that is identified by this <groupid> .

Format

Mode no protocol vlan group all <groupid>

Global Config vlan pvid

This command changes the VLAN ID per interface.

Default

Format

Mode

1 vlan pvid <1-4093>

Interface Config no vlan pvid

This command sets the VLAN ID per interface to 1.

Format

Mode no vlan pvid

Interface Config


3-40

vlan tagging <vlan-list>

Interface Config


vlan tagging

This command configures the tagging behavior for a specific interface in a VLAN to enabled. If tagging is enabled, traffic is transmitted as tagged frames. If tagging is disabled, traffic is transmitted as untagged frames. The vlan-list contains VlanId's in range <1-4093>. Separate nonconsecutive IDs with ',' and no spaces and no zeros in between the range; Use '-' for range.

Format

Mode no vlan tagging

This command configures the tagging behavior for a specific interface in a VLAN to disabled. If tagging is disabled, traffic is transmitted as untagged frames. The vlan-list contains VlanId's in range <1-4093>. Separate non-consecutive IDs with ',' and no spaces and no zeros in between the range; Use '-' for range.

Format

Mode no vlan tagging <vlan-list>

Interface Config vlan association subnet

This command associates a VLAN to a specific IP-subnet.

Format

Mode vlan association subnet <ipaddr> <netmask> <1-4093>

VLAN Config no vlan association subnet

This command removes association of a specific IP-subnet to a VLAN.

Format

Mode no vlan association subnet <ipaddr> <netmask>

VLAN Config



vlan association mac

This command associates a MAC address to a VLAN.

Format

Mode vlan association mac <macaddr> <1-4093>

VLAN database no vlan association mac

This command removes the association of a MAC address to a VLAN.

Format

Mode no vlan association mac <macaddr>

VLAN database show vlan

This command displays a list of all configured VLAN

.

Format

Mode show vlan

• Privileged EXEC

• User EXEC

Term

VLAN ID

VLAN Name

VLAN Type

Definition

There is a VLAN Identifier (VID) associated with each VLAN. The range of the VLAN ID is 1 to 4093.

A string associated with this VLAN as a convenience. It can be up to 32 alphanumeric characters long, including blanks. The default is blank. VLAN ID 1 always has a name of

“Default.” This field is optional.

Type of VLAN, which can be Default (VLAN ID = 1) or static (one that is configured and permanently defined), or Dynamic (one that is created by GVRP registration). show vlan <vlanid>

This command displays detailed information, including interface information, for a specific

VLAN. The ID is a valid VLAN identification number.



Format

Mode

Term

VLAN ID

VLAN Name

VLAN Type

Interface

Current

Configured

Tagging show vlan <vlanid>

• Privileged EXEC

• User EXEC

Definition

There is a VLAN Identifier (VID) associated with each VLAN. The range of the VLAN ID is 1 to 3965.



Type of VLAN, which can be Default (VLAN ID = 1) or static (one that is configured and permanently defined), or Dynamic (one that is created by GVRP registration).

Valid unit, slot, and port number separated by forward slashes. It is possible to set the parameters for all ports by using the selectors on the top line.

The degree of participation of this port in this VLAN. The permissible values are:

• Include - This port is always a member of this VLAN. This is equivalent to registration fixed in the IEEE 802.1Q standard.

• Exclude - This port is never a member of this VLAN. This is equivalent to registration forbidden in the IEEE 802.1Q standard.

• Autodetect - To allow the port to be dynamically registered in this VLAN via GVRP. The port will not participate in this VLAN unless a join request is received on this port. This is equivalent to registration normal in the IEEE 802.1Q standard.

The configured degree of participation of this port in this VLAN. The permissible values are:

• Include - This port is always a member of this VLAN. This is equivalent to registration fixed in the IEEE 802.1Q standard.

• Exclude - This port is never a member of this VLAN. This is equivalent to registration forbidden in the IEEE 802.1Q standard.

• Autodetect - To allow the port to be dynamically registered in this VLAN via GVRP. The port will not participate in this VLAN unless a join request is received on this port. This is equivalent to registration normal in the IEEE 802.1Q standard.

The tagging behavior for this port in this VLAN.

• Tagged - Transmit traffic for this VLAN as tagged frames.

• Untagged - Transmit traffic for this VLAN as untagged frames.

show vlan brief

This command displays a list of all configured VLANs.


3-43


Format

Mode

Term

VLAN ID

VLAN Name

VLAN Type show vlan brief

• Privileged EXEC

• User EXEC

Definition

There is a VLAN Identifier (vlanid) associated with each VLAN. The range of the VLAN

ID is 1 to 3965.



Type of VLAN, which can be Default (VLAN ID = 1) or static (one that is configured and permanently defined), or a Dynamic (one that is created by GVRP registration). show vlan port

This command displays VLAN port information.

Format

Mode

Term

Interface

Port VLAN ID

Acceptable

Frame Types

Ingress

Filtering show vlan port {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Definition

Valid unit, slot, and port number separated by forward slashes. It is possible to set the parameters for all ports by using the selectors on the top line.

The VLAN ID that this port will assign to untagged frames or priority tagged frames received on this port. The value must be for an existing VLAN. The factory default is 1.

The types of frames that may be received on this port. The options are 'VLAN only' and

'Admit All'. When set to 'VLAN only', untagged frames or priority tagged frames received on this port are discarded. When set to 'Admit All', untagged frames or priority tagged frames received on this port are accepted and assigned the value of the Port VLAN ID for this port. With either option, VLAN tagged frames are forwarded in accordance to the

802.1Q VLAN specification.

May be enabled or disabled. When enabled, the frame is discarded if this port is not a member of the VLAN with which this frame is associated. In a tagged frame, the VLAN is identified by the VLAN ID in the tag. In an untagged frame, the VLAN is the Port VLAN ID specified for the port that received this frame. When disabled, all frames are forwarded in accordance with the 802.1Q VLAN bridge specification. The factory default is disabled.



Term Definition

GVRP May be enabled or disabled.

Default Priority The 802.1p priority assigned to tagged packets arriving on the port.

show vlan association subnet

This command displays the VLAN associated with a specific configured IP-Address and net mask.

If no IP address and net mask are specified, the VLAN associations of all the configured IPsubnets are displayed.

Format

Mode

Term

IP Subnet

IP Mask

VLAN ID show vlan association subnet [<ipaddr> <netmask>]

Privileged EXEC

Definition

The IP address assigned to each interface.

The subnet mask.

There is a VLAN Identifier (VID) associated with each VLAN.

show vlan association mac

This command displays the VLAN associated with a specific configured MAC address. If no

MAC address is specified, the VLAN associations of all the configured MAC addresses are displayed.

Format

Mode show vlan association mac [<macaddr>]

Privileged EXEC

Term Definition

MAC Address A MAC address for which the switch has forwarding and or filtering information. The format is 6 or 8 two-digit hexadecimal numbers that are separated by colons, for example

01:23:45:67:89:AB. In an IVL system the MAC address will be displayed as 8 bytes.

VLAN ID There is a VLAN Identifier (VID) associated with each VLAN.



Double VLAN Commands

This section describes the commands you use to configure double VLAN (DVLAN). Double

VLAN tagging is a way to pass VLAN traffic from one customer domain to another through a

Metro Core in a simple and cost effective manner. The additional tag on the traffic helps differentiate between customers in the MAN while preserving the VLAN identification of the individual customers when they enter their own 802.1Q domain.

dvlan-tunnel ethertype

This command configures the ether-type for all interfaces. The ether-type may have the values of

802.1Q

, vMAN , or custom . If the ether-type has a value of custom , the optional value of the custom ether type must be set to a value from 0 to 65535.

Default

Format

Mode vman dvlan-tunnel ethertype {802.1Q | vman | custom} [0-65535]

Global Config mode dot1q-tunnel

This command is used to enable Double VLAN Tunneling on the specified interface.

Default

Format

Mode disabled mode dot1q-tunnel

Interface Config no mode dot1q-tunnel

This command is used to disable Double VLAN Tunneling on the specified interface. By default,

Double VLAN Tunneling is disabled.

Format

Mode no mode dot1q-tunnel

Interface Config


3-46


mode dvlan-tunnel

Use this command to enable Double VLAN Tunneling on the specified interface.

Default

Format

Mode

Note: When you use the mode dvlan-tunnel command on an interface, it becomes a service provider port. Ports that do not have double VLAN tunneling enabled are customer ports.

disabled mode dvlan-tunnel

Interface Config no mode dvlan-tunnel

This command is used to disable Double VLAN Tunneling on the specified interface. By default,

Double VLAN Tunneling is disabled.

Format

Mode no mode dvlan-tunnel

Interface Config show dot1q-tunnel

Use this command without the optional parameters to display all interfaces enabled for Double

VLAN Tunneling. Use the optional parameters to display detailed information about Double

VLAN Tunneling for the specified interface or all interfaces.

Format

Mode

Term

Interface

Mode show dot1q-tunnel [interface {<unit/slot/port> | all}]

• Privileged EXEC

• User EXEC

Definition


The administrative mode through which Double VLAN Tunneling can be enabled or disabled. The default value for this field is disabled.



Term

EtherType

Definition

A 2-byte hex EtherType to be used as the first 16 bits of the DVLAN tunnel. There are three different EtherType tags. The first is 802.1Q, which represents the commonly used value of 0x8100. The second is vMAN, which represents the commonly used value of

0x88A8. If EtherType is not one of these two values, then it is a custom tunnel value, representing any value in the range of 0 to 65535.

show dvlan-tunnel

Use this command without the optional parameters to display all interfaces enabled for Double

VLAN Tunneling. Use the optional parameters to display detailed information about Double

VLAN Tunneling for the specified interface or all interfaces.

Format

Mode

Term

Interface

Mode

EtherType show dvlan-tunnel [interface {<unit/slot/port> | all}]

• Privileged EXEC

• User EXEC

Definition


The administrative mode through which Double VLAN Tunneling can be enabled or disabled. The default value for this field is disabled.

A 2-byte hex EtherType to be used as the first 16 bits of the DVLAN tunnel. There are three different EtherType tags. The first is 802.1Q, which represents the commonly used value of 0x8100. The second is vMAN, which represents the commonly used value of

0x88A8. If EtherType is not one of these two values, then it is a custom tunnel value, representing any value in the range of 0 to 65535.

Voice VLAN Commands

This section describes the commands you use for Voice VLAN. Voice VLAN enables switch ports to carry voice traffic with defined priority so as to enable separation of voice and data traffic coming onto the port. The benefits of using Voice VLAN is to ensure that the sound quality of an

IP phone could be safeguarded from deteriorating when the data traffic on the port is high.



Also the inherent isolation provided by VLANs ensures that inter-VLAN traffic is under management control and that network- attached clients cannot initiate a direct attack on voice components. QoS-based on IEEE 802.1P class of service (CoS) uses classification and scheduling to sent network traffic from the switch in a predictable manner. The system uses the source MAC of the traffic traveling through the port to identify the IP phone data flow.

voice vlan (Global Config)

Use this command to enable the Voice VLAN capability on the switch.

Default

Format

Mode disabled voice vlan

Global Config no voice vlan (Global Config)

Use this command to disable the Voice VLAN capability on the switch.

Format

Mode no voice vlan

Global Config voice vlan (Interface Config)

Use this command to enable the Voice VLAN capability on the interface.

Default

Format

Mode disabled voice vlan { <id> | dot1p <priority> | none | untagged}

Interface Config

You can configure Voice VLAN in one of three different ways:

Parameter dot1p

Description

Configure the IP phone to use 802.1p priority tagging for voice traffic and to use the default native VLAN (VLAN 0) to carry all traffic. Valid <priority> range is 0 to 7.



Parameter none untagged

Description

Allow the IP phone to use its own configuration to send untagged voice traffic.

Configure the phone to send untagged voice traffic.

no voice vlan (Interface Config)

Use this command to disable the Voice VLAN capability on the interface.

Format

Mode no voice vlan

Interface Config voice vlan data priority

Use this command to either trust or untrust the data traffic arriving on the Voice VLAN port.

Default

Format

Mode trust voice vlan data priority {untrust | trust}

Interface Config show voice vlan

Format

Mode show voice vlan [interface {<unit/slot/port> | all}]

Privileged EXEC

When the interface parameter is not specified, only the global mode of the Voice VLAN is displayed.

Term

Administrative

Mode

Definition

The Global Voice VLAN mode.

When the interface is specified:



.

Term Definition

Voice VLAN Interface Mode The admin mode of the Voice VLAN on the interface.

Voice VLAN ID The Voice VLAN ID

Voice VLAN Priority

Voice VLAN Untagged

The do1p priority for the Voice VLAN on the port.

The tagging option for the Voice VLAN traffic.

Voice VLAN CoS Override The Override option for the voice traffic arriving on the port.

Voice VLAN Status The operational status of Voice VLAN on the port.

Provisioning (IEEE 802.1p) Commands

This section describes the commands you use to configure provisioning, which allows you to prioritize ports.

vlan port priority all

This command configures the port priority assigned for untagged packets for all ports presently plugged into the device. The range for the priority is 0-7. Any subsequent per port configuration will override this configuration setting.

Format

Mode vlan port priority all <priority>

Global Config vlan priority

This command configures the default 802.1p port priority assigned for untagged packets for a specific interface. The range for the priority is 0–7.

Default

Format

Mode

0 vlan priority <priority>

Interface Config



Protected Ports Commands

This section describes commands you use to configure and view protected ports on a switch.

Protected ports do not forward traffic to each other, even if they are on the same VLAN. However, protected ports can forward traffic to all unprotected ports in their group. Unprotected ports can forward traffic to both protected and unprotected ports. Ports are unprotected by default.

If an interface is configured as a protected port, and you add that interface to a Port Channel or

Link Aggregation Group (LAG), the protected port status becomes operationally disabled on the interface, and the interface follows the configuration of the LAG port. However, the protected port configuration for the interface remains unchanged. Once the interface is no longer a member of a

LAG, the current configuration for that interface automatically becomes effective.

switchport protected (Global Config)

Use this command to create a protected port group. The <groupid> parameter identifies the set of protected ports. Use the name <name> pair to assign a name to the protected port group. The name can be up to 32 alphanumeric characters long, including blanks. The default is blank.

Note: Port protection occurs within a single switch. Protected port configuration does not affect traffic between ports on two different switches. No traffic forwarding is possible between two protected ports.

Format

Mode switchport protected <groupid> name <name>

Global Config no switchport protected (Global Config)

Use this command to remove a protected port group. The groupid parameter identifies the set of protected ports. Use the name keyword to remove the name from the group.

Format

Mode

NO switchport protected <groupid> name

Global Config



switchport protected (Interface Config)

Use this command to add an interface to a protected port group. The <groupid> parameter identifies the set of protected ports to which this interface is assigned. You can only configure an interface as protected in one group.

Note: Port protection occurs within a single switch. Protected port configuration does not affect traffic between ports on two different switches. No traffic forwarding is possible between two protected ports.

Default

Format

Mode unprotected switchport protected <groupid>

Interface Config no switchport protected (Interface Config)

Use this command to configure a port as unprotected. The groupid parameter identifies the set of protected ports to which this interface is assigned.

Format

Mode no switchport protected <groupid>

Interface Config show switchport protected

This command displays the status of all the interfaces, including protected and unprotected interfaces.

Format

Mode

Term

Group ID show switchport protected <groupid>

• Privileged EXEC

• User EXEC

Definition

The number that identifies the protected port group.



Term Definition

Name An optional name of the protected port group. The name can be up to 32 alphanumeric characters long, including blanks. The default is blank.

List of Physical

Ports

List of ports, which are configured as protected for the group identified with <groupid>. If no port is configured as protected for this group, this field is blank.

show interfaces switchport

This command displays the status of the interface (protected/unprotected) under the groupid.

Format

Mode show interfaces switchport <unit/slot/port> <groupid>

• Privileged EXEC

• User EXEC

Term Definition

Name A string associated with this group as a convenience. It can be up to 32 alphanumeric characters long, including blanks. The default is blank. This field is optional.

Protected port Indicates whether the interface is protected or not. It shows TRUE or FALSE. If the group is a multiple groups then it shows TRUE in Group <groupid>.

Private Group Commands

This section describes commands used to configure private group and view private group configuration information.

Private group can be used to create a group of ports that can or can not share traffic to each others in the same VLAN group. The main application is to isolate a group of users from another without using VLAN.

switchport private-group

This command is used to assign one port or a range of ports to private group <privategroup-name>

(or <private-group-id>).

The ingress traffic from a port in private group can be forwarded to other ports either in the same private group or anyone in the same VLAN that are not in a private group.



By default, a port does not belong to any private group. A port cannot be in more than one private group. An error message should return when that occurred. To change a port’s private group, first the port must be removed from its private group.

Default

Format

Mode port not associated with any group.

switchport private-group [<privategroup-name>|<privategroup-id>]

Interface Config no switchport private group

This command is used to remove the specified port from the given private group.

Format

Mode no switchport private-group [<privategroup-name>|<privategroup-id>]

Interface Config private-group name

This command is used to create a private group with name <private-group-name>. The name string can be up to 24 bytes of non-blank characters. The total number of private groups is 192 such that the valid range for the ID is <1-192>.

The <private-group-id> field is optional. If not specified, a group id not used will be assigned automatically.

The mode can be either “isolated” or “community”. When in “isolated” mode, the member port in the group cannot forward its egress traffic to any other members in the same group. By default, the mode is “community” mode that each member port can forward traffic to other members in the same group, but not to members in other groups.

Format

Mode

{<privategroup-name> mode [community|isolated]|<groupid>}

Global Config


3-55


no private-group name

This command is used to remove the specified private group.

Format

Mode private-group name <privategroup-name>

Global Config show private-group

This command displays the private groups’ information.

Format

Mode show private-groupname [<private-group-name>|<private-groupid>|port <unit/slot/port>]

Priviledged EXEC

Term Definition

Interface

Port VLANID

Private Group

ID

Valid slot and port number separated by forward slashes.

The VLAN ID associated with the port .

Total number of private groups is 192.

Private Group

Name

The name string can be up to 24 bytes of non-blank characters

Private Group The mode can be either “isolated” or “community”.

GARP Commands

This section describes the commands you use to configure Generic Attribute Registration Protocol

(GARP) and view GARP status. The commands in this section affect both GARP VLAN

Registration Protocol (GVRP) and Garp Multicast Registration Protocol (GMRP). GARP is a protocol that allows client stations to register with the switch for membership in VLANS (by using

GVMP) or multicast groups (by using GVMP).



set garp timer join

This command sets the GVRP join time for one port (Interface Config mode) or all (Global Config mode) and per GARP. Join time is the interval between the transmission of GARP Protocol Data

Units (PDUs) registering (or re-registering) membership for a VLAN or multicast group. This command has an effect only when GVRP is enabled. The time is from 10 to 100 (centiseconds).

The value 20 centiseconds is 0.2 seconds.

Default

Format

Mode

20 set garp timer join <10-100>

• Interface Config

• Global Config no set garp timer join

This command sets the GVRP join time (for one or all ports and per GARP) to the default and only has an effect when GVRP is enabled.

Format

Mode no set garp timer join


• Global Config set garp timer leave

This command sets the GVRP leave time for one port (Interface Config mode) or all ports (Global

Config mode) and only has an effect when GVRP is enabled. Leave time is the time to wait after receiving an unregister request for a VLAN or a multicast group before deleting the VLAN entry.

This can be considered a buffer time for another station to assert registration for the same attribute in order to maintain uninterrupted service. The leave time is 20 to 600 (centiseconds). The value

60 centiseconds is 0.6 seconds.

Default

Format

Mode

60 set garp timer leave <20-600>


• Global Config


no set garp timer leave


• Global Config


no set garp timer leave

This command sets the GVRP leave time on all ports or a single port to the default and only has an effect when GVRP is enabled.

Format

Mode set garp timer leaveall

This command sets how frequently Leave All PDUs are generated. A Leave All PDU indicates that all registrations will be unregistered. Participants would need to rejoin in order to maintain registration. The value applies per port and per GARP participation. The time may range from 200 to 6000 (centiseconds). The value 1000 centiseconds is 10 seconds. You can use this command on all ports (Global Config mode) or a single port (Interface Config mode), and it only has an effect only when GVRP is enabled.

Default

Format

Mode

1000 set garp timer leaveall <200-6000>


• Global Config no set garp timer leaveall

This command sets how frequently Leave All PDUs are generated the default and only has an effect when GVRP is enabled.

Format

Mode no set garp timer leaveall


• Global Config show garp

This command displays GARP information.



Format

Mode show garp

• Privileged EXEC

• User EXEC

Term Definition

GMRP Admin Mode The administrative mode of GARP Multicast Registration Protocol (GMRP) for the system.

GVRP Admin Mode The administrative mode of GARP VLAN Registration Protocol (GVRP) for the system.

GVRP Commands

This section describes the commands you use to configure and view GARP VLAN Registration

Protocol (GVRP) information. GVRP-enabled switches exchange VLAN configuration information, which allows GVRP to provide dynamic VLAN creation on trunk ports and automatic VLAN pruning.

Note: If GVRP is disabled, the system does not forward GVRP messages.

set gvrp adminmode

This command enables GVRP on the system.

Default

Format

Mode disabled set gvrp adminmode

Privileged EXEC no set gvrp adminmode

This command disables GVRP.


3-59


Format

Mode no set gvrp adminmode

Privileged EXEC set gvrp interfacemode

This command enables GVRP on a single port (Interface Config mode) or all ports (Global Config mode).

Default

Format

Mode disabled set gvrp interfacemode


• Global Config no set gvrp interfacemode

This command disables GVRP on a single port (Interface Config mode) or all ports (Global Config mode). If GVRP is disabled, Join Time, Leave Time and Leave All Time have no effect.

Format

Mode no set gvrp interfacemode


• Global Config show gvrp configuration

This command displays Generic Attributes Registration Protocol (GARP) information for one or all interfaces.

Format

Mode

Term

Interface show gvrp configuration {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Definition




Term Definition

Join Timer

Leave Timer

The interval between the transmission of GARP PDUs registering (or re-registering) membership for an attribute. Current attributes are a VLAN or multicast group. There is an instance of this timer on a per-Port, per-GARP participant basis. Permissible values are 10 to 100 centiseconds (0.1 to 1.0 seconds). The factory default is 20 centiseconds

(0.2 seconds). The finest granularity of specification is one centisecond (0.01 seconds).

The period of time to wait after receiving an unregister request for an attribute before deleting the attribute. Current attributes are a VLAN or multicast group. This may be considered a buffer time for another station to assert registration for the same attribute in order to maintain uninterrupted service. There is an instance of this timer on a per-Port, per-GARP participant basis. Permissible values are 20 to 600 centiseconds (0.2 to 6.0 seconds). The factory default is 60 centiseconds (0.6 seconds).

LeaveAll Timer This Leave All Time controls how frequently LeaveAll PDUs are generated. A LeaveAll

PDU indicates that all registrations will shortly be deregistered. Participants will need to rejoin in order to maintain registration. There is an instance of this timer on a per-Port, per-GARP participant basis. The Leave All Period Timer is set to a random value in the range of LeaveAllTime to 1.5*LeaveAllTime. Permissible values are 200 to 6000 centiseconds (2 to 60 seconds). The factory default is 1000 centiseconds (10 seconds).

Port GVMRP

Mode

The GVRP administrative mode for the port, which is enabled or disabled (default). If this parameter is disabled, Join Time, Leave Time and Leave All Time have no effect.

GMRP Commands

This section describes the commands you use to configure and view GARP Multicast Registration

Protocol (GMRP) information. Like IGMP snooping, GMRP helps control the flooding of multicast packets.GMRP-enabled switches dynamically register and de-register group membership information with the MAC networking devices attached to the same segment. GMRP also allows group membership information to propagate across all networking devices in the bridged LAN that support Extended Filtering Services.

Note: If GMRP is disabled, the system does not forward GMRP messages.

set gmrp adminmode

This command enables GARP Multicast Registration Protocol (GMRP) on the system.


3-61


Default

Format

Mode disabled set gmrp adminmode

Privileged EXEC no set gmrp adminmode

This command disables GARP Multicast Registration Protocol (GMRP) on the system.

Format

Mode no set gmrp adminmode

Privileged EXEC set gmrp interfacemode

This command enables GARP Multicast Registration Protocol on a single interface (Interface

Config mode) or all interfaces (Global Config mode). If an interface which has GARP enabled is enabled for routing or is enlisted as a member of a port-channel (LAG), GARP functionality is disabled on that interface. GARP functionality is subsequently re-enabled if routing is disabled and port-channel (LAG) membership is removed from an interface that has GARP enabled.

Default

Format

Mode disabled set gmrp interfacemode


• Global Config no set gmrp interfacemode

This command disables GARP Multicast Registration Protocol on a single interface or all interfaces. If an interface which has GARP enabled is enabled for routing or is enlisted as a member of a port-channel (LAG), GARP functionality is disabled. GARP functionality is subsequently re-enabled if routing is disabled and port-channel (LAG) membership is removed from an interface that has GARP enabled.



Format

Mode no set gmrp interfacemode


• Global Config show gmrp configuration

This command displays Generic Attributes Registration Protocol (GARP) information for one or all interfaces.

Format

Mode show gmrp configuration {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term Definition

Interface

Join Timer

Leave Timer

The unit/slot/port of the interface that this row in the table describes.

The interval between the transmission of GARP PDUs registering (or re-registering) membership for an attribute. Current attributes are a VLAN or multicast group. There is an instance of this timer on a per-port, per-GARP participant basis. Permissible values are 10 to 100 centiseconds (0.1 to 1.0 seconds). The factory default is 20 centiseconds

(0.2 seconds). The finest granularity of specification is 1 centisecond (0.01 seconds).

The period of time to wait after receiving an unregister request for an attribute before deleting the attribute. Current attributes are a VLAN or multicast group. This may be considered a buffer time for another station to assert registration for the same attribute in order to maintain uninterrupted service. There is an instance of this timer on a per-Port, per-GARP participant basis. Permissible values are 20 to 600 centiseconds (0.2 to 6.0 seconds). The factory default is 60 centiseconds (0.6 seconds).

LeaveAll Timer This Leave All Time controls how frequently LeaveAll PDUs are generated. A LeaveAll

PDU indicates that all registrations will shortly be deregistered. Participants will need to rejoin in order to maintain registration. There is an instance of this timer on a per-Port, per-GARP participant basis. The Leave All Period Timer is set to a random value in the range of LeaveAllTime to 1.5*LeaveAllTime. Permissible values are 200 to 6000 centiseconds (2 to 60 seconds). The factory default is 1000 centiseconds (10 seconds).

Port GMRP

Mode

The GMRP administrative mode for the port. It may be enabled or disabled. If this parameter is disabled, Join Time, Leave Time and Leave All Time have no effect.



show mac-address-table gmrp

This command displays the GMRP entries in the Multicast Forwarding Database (MFDB) table.

Format

Mode show mac-address-table gmrp

Privileged EXEC

Term

Mac Address

Type

Description

Interfaces

Definition

A unicast MAC address for which the switch has forwarding and or filtering information.

The format is 6 or 8 two-digit hexadecimal numbers that are separated by colons, for example 01:23:45:67:89:AB. In an IVL system the MAC address is displayed as 8 bytes.

The type of the entry. Static entries are those that are configured by the end user.

Dynamic entries are added to the table as a result of a learning process or protocol.

The text description of this multicast table entry.

The list of interfaces that are designated for forwarding (Fwd:) and filtering (Flt:).

Port-Based Network Access Control Commands

This section describes the commands you use to configure port-based network access control

(802.1x). Port-based network access control allows you to permit access to network services only to and devices that are authorized and authenticated.

clear dot1x statistics

This command resets the 802.1x statistics for the specified port or for all ports.

Format

Mode clear dot1x statistics {<unit/slot/port> | all}

Privileged EXEC clear radius statistics

This command is used to clear all RADIUS statistics.



Format

Mode clear radius statistics

Privileged EXEC dot1x guest-vlan

This command configures VLAN as guest vlan on a per port basis. The command specifies an active VLAN as an IEEE 802.1x guest VLAN. The range is 1 to the maximumVLAN ID supported by the platform.

Default

Format

Mode disabled dot1x guest-vlan <vlan-id>

Interface Config no dot1x guest-vlan

This command disables Guest VLAN on the interface.

Default

Format

Mode disabled no dot1x guest-vlan

Interface Config dot1x initialize

This command begins the initialization sequence on the specified port. This command is only valid if the control mode for the specified port is “auto” or “mac-based”. If the control mode is not 'auto' or “mac-based”, an error will be returned.

Format

Mode dot1x initialize <unit/slot/port>

Privileged EXEC



dot1x max-req

This command sets the maximum number of times the authenticator state machine on this port will transmit an EAPOL EAP Request/Identity frame before timing out the supplicant. The <count> value must be in the range 1 - 10.

Default

Format

Mode

2 dot1x max-req <count>

Interface Config no dot1x max-req

This command sets the maximum number of times the authenticator state machine on this port will transmit an EAPOL EAP Request/Identity frame before timing out the supplicant.

Format

Mode no dot1x max-req

Interface Config dot1x max-users

Use this command to set the maximum number of clients supported on the port when MAC-based dot1x authentication is enabled on the port. The maximum users supported per port is dependent on the product. The <count> value is in the range 1 - 16.

Default

Format

Mode

16 dot1x max-users <count>

Interface Config no dot1x max-users

This command resets the maximum number of clients allowed per port to its default value.

Format

Mode no dot1x max-req

Interface Config


3-66


dot1x port-control

This command sets the authentication mode to use on the specified port. Select forceunauthorized to specify that the authenticator PAE unconditionally sets the controlled port to unauthorized. Select force-authorized to specify that the authenticator PAE unconditionally sets the controlled port to authorized. Select auto to specify that the authenticator PAE sets the controlled port mode to reflect the outcome of the authentication exchanges between the supplicant, authenticator and the authentication server. If the mac-based option is specified, then

MAC-based dot1x authentication is enabled on the port.

Default

Format

Mode auto dot1x port-control {force-unauthorized | force-authorized | auto | mac-based}

Interface Config no dot1x port-control

This command sets the 802.1x port control mode on the specified port to the default value.

Format

Mode no dot1x port-control

Interface Config dot1x port-control all

This command sets the authentication mode to use on all ports. Select force-unauthorized to specify that the authenticator PAE unconditionally sets the controlled port to unauthorized.

Select force-authorized to specify that the authenticator PAE unconditionally sets the controlled port to authorized. Select auto to specify that the authenticator PAE sets the controlled port mode to reflect the outcome of the authentication exchanges between the supplicant, authenticator and the authentication server. If the mac-based option is specified, then MACbased dot1x authentication is enabled on the port.

Default

Format auto dot1x port-control all {force-unauthorized | force-authorized | auto

| mac-based}

Global Config Mode


no dot1x port-control all

Global Config


no dot1x port-control all

This command sets the authentication mode on all ports to the default value.

Format

Mode dot1x re-authenticate

This command begins the re-authentication sequence on the specified port. This command is only valid if the control mode for the specified port is “auto” or “mac-based”. If the control mode is not

“auto” or “mac-based”, an error will be returned.

Format

Mode dot1x re-authenticate <unit/slot/port>

Privileged EXEC dot1x re-authentication

This command enables re-authentication of the supplicant for the specified port.

Default

Format

Mode disabled dot1x re-authentication

Interface Config no dot1x re-authentication

This command disables re-authentication of the supplicant for the specified port.

Format

Mode no dot1x re-authentication

Interface Config



dot1x system-auth-control

Use this command to enable the dot1x authentication support on the switch. While disabled, the dot1x configuration is retained and can be changed, but is not activated.

Default

Format

Mode disabled dot1x system-auth-control

Global Config no dot1x system-auth-control

This command is used to disable the dot1x authentication support on the switch.

Format

Mode no dot1x system-auth-control

Global Config dot1x timeout

This command sets the value, in seconds, of the timer used by the authenticator state machine on this port. Depending on the token used and the value (in seconds) passed, various timeout configurable parameters are set. The following tokens are supported:

Tokens Definition guest-vlanperiod

The time, in seconds, for which the authenticator waits to see if any EAPOL packets are received on a port before authorizing the port and placing the port in the guest vlan (if configured). The guest vlan timer is only relevant when guest vlan has been configured on that specific port.

reauth-period The value, in seconds, of the timer used by the authenticator state machine on this port to determine when re-authentication of the supplicant takes place. The reauth-period must be a value in the range 1 - 65535.

quiet-period tx-period

The value, in seconds, of the timer used by the authenticator state machine on this port to define periods of time in which it will not attempt to acquire a supplicant. The quietperiod must be a value in the range 0 - 65535.

The value, in seconds, of the timer used by the authenticator state machine on this port to determine when to send an EAPOL EAP Request/Identity frame to the supplicant. The quiet-period must be a value in the range 1 - 65535.



Tokens Definition supp-timeout The value, in seconds, of the timer used by the authenticator state machine on this port to timeout the supplicant. The supp-timeout must be a value in the range 1 - 65535.

server-timeout The value, in seconds, of the timer used by the authenticator state machine on this port to timeout the authentication server. The supp-timeout must be a value in the range 1 -

65535.

Default

Format

Mode

• guest-vlan-period: 90 seconds

• reauth-period: 3600 seconds

• quiet-period: 60 seconds

• tx-period: 30 seconds

• supp-timeout: 30 seconds

• server-timeout: 30 seconds dot1x timeout {{guest-vlan-period <seconds>} |{reauth-period

<seconds>} | {quiet-period <seconds>} | {tx-period <seconds>} |

{supp-timeout <seconds>} | {server-timeout <seconds>}}

Interface Config no dot1x timeout

This command sets the value, in seconds, of the timer used by the authenticator state machine on this port to the default values. Depending on the token used, the corresponding default values are set.

Format

Mode no dot1x timeout {guest-vlan-period | reauth-period | quiet-period | tx-period | supp-timeout | server-timeout}

Interface Config dot1x unauthenticated-vlan

Use this command to configure the unauthenticated VLAN associated with that port. The unauthenticated VLAN ID can be a valid VLAN ID from 0-Maximum supported VLAN ID (4093 for 7000 series). The unauthenticated VLAN must be statically configured in the VLAN database to be operational. By default, the unauthenticated VLAN is 0, i.e. invalid and not operational.



Default

Format

Mode

0 dot1x unauthenticated-vlan <vlan id>

Interface Config no dot1x unauthenticated-vlan

This command resets the unauthenticated-vlan associated with the port to its default value.

Format

Mode no dot1x unauthenticated-vlan

Interface Config dot1x user

This command adds the specified user to the list of users with access to the specified port or all ports. The <user> parameter must be a configured user.

Format

Mode dot1x user <user> {<unit/slot/port> | all}

Global Config no dot1x user

This command removes the user from the list of users with access to the specified port or all ports.

Format

Mode no dot1x user <user> {<unit/slot/port> | all}

Global Config


3-71


show authentication methods

This command displays information about the authentication methods.

Format

Mode show authentication methods

Privileged EXEC

The following is an example of this command:

Login Authentication Method Lists

________________________________

Console_Default: None

Network_Default:Local

Enable Authentication Lists

_____________________

Console_Default: Enable None

Network_Default:Enable

Line Login Method List Enable Method Lists

_____________________

Console Console_Default Console_Default

Telnet Network_Default Network_Default

SSH Network_Default Network_Default http : Local https : Local dot1x : show dot1x

This command is used to show a summary of the global dot1x configuration, summary information of the dot1x configuration for a specified port or all ports, the detailed dot1x configuration for a specified port and the dot1x statistics for a specified port - depending on the tokens used.

Format show dot1x [{summary {<unit/slot/port> | all} | detail <unit/slot/ port> | statistics <unit/slot/port>]

Privileged EXEC Mode

If you do not use the optional parameters <unit/slot/port> or <vlanid> , the command displays the global dot1x mode and the VLAN Assignment mode.



Term

Administrative

Mode

VLAN

Assignment

Mode

Definition

Indicates whether authentication control on the switch is enabled or disabled.

Indicates whether assignment of an authorized port to a RADIUS assigned VLAN is allowed (enabled) or not (disabled).

If you use the optional parameter summary {<unit/slot/port> | all} , the dot1x configuration for the specified port or all ports are displayed.

Term Definition

Interface

Operating

Control Mode

The interface whose configuration is displayed.

Control Mode The configured control mode for this port. Possible values are force-unauthorized | forceauthorized | auto | mac-based | authorized | unauthorized.

The control mode under which this port is operating. Possible values are authorized | unauthorized.

Reauthenticatio n Enabled

Port Status

Indicates whether re-authentication is enabled on this port.

Indicates whether the port is authorized or unauthorized. Possible values are authorized

| unauthorized.

If you use the optional parameter ' detail <unit/slot/port >', the detailed dot1x configuration for the specified port is displayed.

Term Definition

Port

Protocol

Version

PAE

Capabilities

The interface whose configuration is displayed.

The protocol version associated with this port. The only possible value is 1, corresponding to the first version of the dot1x specification.

The port access entity (PAE) functionality of this port. Possible values are Authenticator or Supplicant.

Control Mode The configured control mode for this port. Possible values are force-unauthorized | forceauthorized | auto | mac-based.

Authenticator

PAE State

Current state of the authenticator PAE state machine. Possible values are Initialize,

Disconnected, Connecting, Authenticating, Authenticated, Aborting, Held,

ForceAuthorized, and ForceUnauthorized. When MAC-based authentication is enabled on the port, this parameter is deprecated.



Term Definition

Backend

Authentication

State

Quiet Period

Current state of the backend authentication state machine. Possible values are Request,

Response, Success, Fail, Timeout, Idle, and Initialize. When MAC-based authentication is enabled on the port, this parameter is deprecated.

The timer used by the authenticator state machine on this port to define periods of time in which it will not attempt to acquire a supplicant. The value is expressed in seconds and will be in the range 0 and 65535.

Transmit Period The timer used by the authenticator state machine on the specified port to determine when to send an EAPOL EAP Request/Identity frame to the supplicant. The value is expressed in seconds and will be in the range of 1 and 65535.

Guest-VLAN ID The guest VLAN identifier configured on the interface.

Guest VLAN

Period

The time in seconds for which the authenticator waits before authorizing and placing the port in the Guest VLAN, if no EAPOL packets are detected on that port.

Supplicant

Timeout

The timer used by the authenticator state machine on this port to timeout the supplicant.

The value is expressed in seconds and will be in the range of 1 and 65535.

Server Timeout The timer used by the authenticator on this port to timeout the authentication server. The value is expressed in seconds and will be in the range of 1 and 65535.

Maximum

Requests

VLAN Id

The maximum number of times the authenticator state machine on this port will retransmit an EAPOL EAP Request/Identity before timing out the supplicant. The value will be in the range of 1 and 10.

The VLAN assigned to the port by the radius server. This is only valid when the port control mode is not Mac-based.

VLAN Assigned

Reason

The reason the VLAN identified in the VLAN Idfield has been assigned to the port.

Possible values are RADIUS, Unauthenticated VLAN, Guest VLAN, default, and Not

Assigned. When the VLAN Assigned Reason is ‘Not Assigned’t, it means that the port has not been assigned to any VLAN by dot1x. This only valid when the port control mode is not MAC-based.

Reauthenticatio n Period

The timer used by the authenticator state machine on this port to determine when reauthentication of the supplicant takes place. The value is expressed in seconds and will be in the range of 1 and 65535.

Reauthenticatio n Enabled

Indicates if reauthentication is enabled on this port. Possible values are ‘True” or “False”.

Key

Transmission

Enabled

Control

Direction

Indicates if the key is transmitted to the supplicant for the specified port. Possible values are True or False.

The control direction for the specified port or ports. Possible values are both or in.



Term Definition

Maximum Users The maximum number of clients that can get authenticated on the port in the MAC-based dot1x authentication mode. This value is used only when the port control mode is not

MAC-based.

Unauthenticate d VLAN ID

Indicates the unauthenticated VLAN configured for this port. This value is valid for the port only when the port control mode is not MAC-based.

Session

Timeout

Session

Termination

Action

Indicates the time for which the given session is valid. The time period in seconds is returned by the RADIUS server on authentication of the port. This value is valid for the port only when the port control mode is not MAC-based.

This value indicates the action to be taken once the session timeout expires. Possible values are Default, Radius-Request. If the value is Default, the session is terminated the port goes into unauthorized state. If the value is Radius-Request, then a reauthentication of the client authenticated on the port is performed. This value is valid for the port only when the port control mode is not MAC-based.

The show dot1x detail <unit/slot/port> command will display the following MACbased dot1x fields if the port-control mode for that specific port is MAC-based. For each client authenticated on the port, the show dot1x detail <unit/slot/port> command will display the following MAC-based dot1x parameters if the port-control mode for that specific port is MACbased.

Term Definition

Supplicant

MAC-Address

Authenticator

PAE State

The MAC-address of the supplicant.

Current state of the authenticator PAE state machine. Possible values are Initialize,

Disconnected, Connecting, Authenticating, Authenticated, Aborting, Held,

ForceAuthorized, and ForceUnauthorized.

Backend

Authentication

State

Current state of the backend authentication state machine. Possible values are Request,

Response, Success, Fail, Timeout, Idle, and Initialize.

VLAN-Assigned The VLAN assigned to the client by the radius server.

Logical Port The logical port number associated with the client.

If you use the optional parameter statistics <unit/slot/port> , the following dot1x statistics for the specified port appear.



Term Definition

Port The interface whose statistics are displayed.

EAPOL Frames

Received

The number of valid EAPOL frames of any type that have been received by this authenticator.

EAPOL Frames

Transmitted

The number of EAPOL frames of any type that have been transmitted by this authenticator.

The number of EAPOL start frames that have been received by this authenticator.

EAPOL Start

Frames

Received

EAPOL Logoff

Frames

Received

The number of EAPOL logoff frames that have been received by this authenticator.

The protocol version number carried in the most recently received EAPOL frame.

Last EAPOL

Frame Version

Last EAPOL

Frame Source

EAP Response/

Id Frames

Received

EAP Response

Frames

Received

The source MAC address carried in the most recently received EAPOL frame.

The number of EAP response/identity frames that have been received by this authenticator.

The number of valid EAP response frames (other than resp/id frames) that have been received by this authenticator.

EAP Request/Id

Frames

Transmitted

The number of EAP request/identity frames that have been transmitted by this authenticator.

EAP Request

Frames

Transmitted

Invalid EAPOL

Frames

Received

The number of EAP request frames (other than request/identity frames) that have been transmitted by this authenticator.

The number of EAPOL frames that have been received by this authenticator in which the frame type is not recognized.

EAP Length

Error Frames

Received

The number of EAPOL frames that have been received by this authenticator in which the frame type is not recognized.

show dot1x clients

This command displays 802.1x client information.



Format

Mode show dot1x clients { <unit/slot/port> | all}

Privileged EXEC

Term Definition

Logical

Interface

The logical port number associated with a client.

Interface

User Name

The physical port to which the supplicant is associated.

The user name used by the client to authenticate to the server.

Supplicant MAC

Address

The supplicant device MAC address.

Session Time The time since the supplicant is logged on.

Filter ID Identifies the Filter ID returned by the RADIUS server when the client was authenticated.

This is a configured DiffServ policy name on the switch.

VLAN ID

Session

Timeout

The VLAN assigned to the port.

VLAN Assigned The reason the VLAN identified in the VLAN ID field has been assigned to the port.

Possible values are RADIUS, Unauthenticated VLAN, or Default. When the VLAN

Assigned reason is Default, it means that the VLAN was assigned to the port because the PVID of the port was that VLAN ID.

This value indicates the time for which the given session is valid. The time period in seconds is returned by the RADIUS server on authentication of the port. This value is valid for the port only when the port-control mode is not MAC-based.

Session

Termination

Action

This value indicates the action to be taken once the session timeout expires. Possible values are Default and Radius-Request. If the value is Default, the session is terminated and client details are cleared. If the value is Radius-Request, then a reauthentication of the client is performed.

show dot1x users

This command displays 802.1x port security user information for locally configured users.

Format

Mode show dot1x users

Privileged EXEC

<unit/slot/port>

Term

Users

Definition

Users configured locally to have access to the specified port.


3-77


Storm-Control Commands

This section describes commands you use to configure storm-control and view storm-control configuration information. A traffic storm is a condition that occurs when incoming packets flood the LAN, which creates performance degredation in the network. The Storm-Control feature protects against this condition.

The 7000 series provides broadcast, multicast, and unicast story recovery for individual interfaces.

Unicast Storm-Control protects against traffic whose MAC addresses are not known by the system. For broadcast, multicast, and unicast storm-control, if the rate of traffic ingressing on an interface increases beyond the configured threshold for that type, the traffic is dropped.

To configure storm-control, you will enable the feature for all interfaces or for individual interfaces, and you will set the threshold (storm-control level) beyond which the broadcast, multicast, or unicast traffic will be dropped. The Storm-Control feature allows you to limit the rate of specific types of packets through the switch on a per-port, per-type, basis.

Configuring a storm-control level also enables that form of storm-control. Disabling a stormcontrol level (using the “no” version of the command) sets the storm-control level back to the default value and disables that form of storm-control. Using the “no” version of the “stormcontrol” command (not stating a “level”) disables that form of storm-control but maintains the configured “level” (to be active the next time that form of storm-control is enabled.)

Note: The actual rate of ingress traffic required to activate storm-control is based on the size of incoming packets and the hard-coded average packet size of 512 bytes - used to calculate a packet-per-second (pps) rate - as the forwarding-plane requires pps versus an absolute rate kbps. For example, if the configured limit is 10%, this is converted to ~25000 pps, and this pps limit is set in forwarding plane

(hardware). You get the approximate desired output when 512bytes packets are used.

storm-control broadcast

Use this command to enable broadcast storm recovery mode for a specific interface. If the mode is enabled, broadcast storm recovery is active and, if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of broadcast traffic will be limited to the configured threshold.



Default

Format

Mode enabled storm-control broadcast

Interface Config no storm-control broadcast

Use this command to disable broadcast storm recovery mode for a specific interface.

Format

Mode no storm-control broadcast

Interface Config storm-control broadcast level

Use this command to configure the broadcast storm recovery threshold for an interface as a percentage of link speed and enable broadcast storm recovery. If the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped. Therefore, the rate of broadcast traffic is limited to the configured threshold.

Default

Format

Mode

5 storm-control broadcast level <0-100>

Interface Config no storm-control broadcast level

This command sets the broadcast storm recovery threshold to the default value for an interface and disables broadcast storm recovery.

Format

Mode no storm-control broadcast level

Interface Config



storm-control broadcast rate

Use this command to configure the broadcast storm recovery threshold for an interface in packets per second. If the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped. Therefore, the rate of broadcast traffic is limited to the configured threshold.

Default

Format

Mode

0 storm-control broadcast rate <0-14880000>

Interface Config no storm-control broadcast rate

This command sets the broadcast storm recovery threshold to the default value for an interface and disables broadcast storm recovery.

Format

Mode no storm-control broadcast rate

Interface Config storm-control broadcast (Global Config)

This command enables broadcast storm recovery mode for all interfaces. If the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of broadcast traffic will be limited to the configured threshold.

Default

Format

Mode disabled storm-control broadcast

Global Config no storm-control broadcast

This command disables broadcast storm recovery mode for all interfaces.



Format

Mode no storm-control broadcast

Global Config storm-control broadcast level (Global Config)

This command configures the broadcast storm recovery threshold for all interfaces as a percentage of link speed and enables broadcast storm recovery. If the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of broadcast traffic will be limited to the configured threshold.This command also enables broadcast storm recovery mode for all interfaces.

Default

Format

Mode

5 storm-control broadcast level <0-100>

Global Config no storm-control broadcast level

This command sets the broadcast storm recovery threshold to the default value for all interfaces and disables broadcast storm recovery.

Format

Mode no storm-control broadcast level

Global Config storm-control broadcast rate (Global Config)

Use this command to configure the broadcast storm recovery threshold for all interfaces in packets per second. If the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped. Therefore, the rate of broadcast traffic is limited to the configured threshold.

Default 0


Format

Mode


storm-control broadcast rate <0-14880000>

Global Config no storm-control broadcast rate


Format


Global Config storm-control multicast

This command enables multicast storm recovery mode for an interface. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of multicast traffic will be limited to the configured threshold.

Default

Format

Mode disabled storm-control multicast

Interface Config no storm-control multicast

This command disables multicast storm recovery mode for an interface.

Format

Mode no storm-control multicast

Interface Config


3-82


storm-control multicast level

This command configures the multicast storm recovery threshold for an interface as a perecentage of link speed and enables multicast storm recovery mode. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of multicast traffic will be limited to the configured threshold.

Default

Format

Mode

5 storm-control multicast level <0-100>

Interface Config no storm-control multicast level

This command sets the multicast storm recovery threshold to the default value for an interface and disables multicast storm recovery.

Format

Mode no storm-control multicast level <0-100>

Interface Config storm-control multicast rate

Use this command to configure the multicast storm recovery threshold for an interface in packets per second. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped. Therefore, the rate of multicast traffic is limited to the configured threshold.

Default

Format

Mode

0 storm-control multicast rate <0-14880000>

Interface Config no storm-control multicast rate




Format

Mode no storm-control multicast rate

Interface Config storm-control multicast (Global Config)

This command enables multicast storm recovery mode for all interfaces. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of multicast traffic will be limited to the configured threshold.

Default

Format

Mode disabled storm-control multicast

Global Config no storm-control multicast

This command disables multicast storm recovery mode for all interfaces.

Format

Mode no storm-control multicast

Global Config storm-control multicast level (Global Config)

This command configures the multicast storm recovery threshold for all interfaces as a percentage of link speed and enables multicast storm recovery mode. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of multicast traffic will be limited to the configured threshold.

Default

Format

Mode

5 storm-control multicast level <0-100>

Global Config



no storm-control multicast level

This command sets the multicast storm recovery threshold to the default value for all interfaces and disables multicast storm recovery.

Format

Mode no storm-control multicast level

Global Config storm-control multicast rate (Global Config)

Use this command to configure the multicast storm recovery threshold for all interfaces in packets per second. If the mode is enabled, multicast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped. Therefore, the rate of multicast traffic is limited to the configured threshold.

Default

Format

Mode

0 storm-control multicast rate <0-14880000>

Global Config no storm-control broadcast rate


Format


Global Config storm-control unicast

This command enables unicast storm recovery mode for an interface. If the mode is enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of unknown unicast traffic will be limited to the configured threshold.



Default

Format

Mode disabled storm-control unicast

Interface Config no storm-control unicast

This command disables unicast storm recovery mode for an interface.

Format

Mode no storm-control unicast

Interface Config storm-control unicast level

This command configures the unicast storm recovery threshold for an interface as a percentage of link speed, and enables unicast storm recovery. If the mode is enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of unknown unicast traffic will be limited to the configured threshold.This command also enables unicast storm recovery mode for an interface.

Default

Format

Mode

5 storm-control unicast level <0-100>

Interface Config no storm-control unicast level

This command sets the unicast storm recovery threshold to the default value for an interface and disables unicast storm recovery.

Format

Mode no storm-control unicast level

Interface Config



storm-control unicast rate

Use this command to configure the unicast storm recovery threshold for an interface in packets per second. If the mode is enabled, unicast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped.

Therefore, the rate of unicast traffic is limited to the configured threshold.

Default

Format

Mode

0 storm-control unicast rate <0-14880000>

Interface Config no storm-control unicast rate

This command sets the unicast storm recovery threshold to the default value for an interface and disables unicast storm recovery.

Format

Mode no storm-control unicast rate

Interface Config storm-control unicast (Global Config)

This command enables unicast storm recovery mode for all interfaces. If the mode is enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of unknown unicast traffic will be limited to the configured threshold.

Default

Format

Mode disabled storm-control unicast

Global Config no storm-control unicast

This command disables unicast storm recovery mode for all interfaces.



Format

Mode no storm-control unicast

Global Config storm-control unicast level (Global Config)

This command configures the unicast storm recovery threshold for all interfaces as a percentage of link speed, and enables unicast storm recovery. If the mode is enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. Therefore, the rate of unknown unicast traffic will be limited to the configured threshold.

Default

Format

Mode

5 storm-control unicast level <0-100>

Global Config no storm-control unicast level

This command sets the unicast storm recovery threshold to the default value and disables unicast storm recovery for all interfaces.

Format

Mode no storm-control unicast level

Global Config storm-control unicast rate (Global Config)

Use this command to configure the unicast storm recovery threshold for all interfaces in packets per second. If the mode is enabled, unicast storm recovery is active, and if the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic is dropped.

Therefore, the rate of unicast traffic is limited to the configured threshold.

Default

Format

Mode

0 storm-control unicast rate <0-14880000>

Global Config


no storm-control unicast rate

Global Config


no storm-control unicast rate


Format

Mode storm-control flowcontrol

This command enables 802.3x flow control for the switch and only applies to full-duplex mode ports.

Note: 802.3x flow control works by pausing a port when the port becomes oversubscribed and dropping all traffic for small bursts of time during the congestion condition. This can lead to high-priority and/or network control traffic loss.

Default

Format

Mode disabled storm-control flowcontrol

Global Config no storm-control flowcontrol

This command disables 802.3x flow control for the switch.

Note: This command only applies to full-duplex mode ports.

Format

Mode no storm-control flowcontrol

Global Config


3-89


show storm-control

This command displays switch configuration information. If you do not use any of the optional parameters, this command displays global storm control configuration parameters:

• Broadcast Storm Control Mode may be enabled or disabled. The factory default is disabled.

• 802.3x Flow Control Mode may be enabled or disabled. The factory default is disabled.

• Broadcast Storm Control Level The broadcast storm control level. The factory default is 5%.

• Multicast Storm Control Mode may be enabled or disabled. The factory default is disabled.

• Multicast Storm Control Level The multicast storm control level. The factory default is 5%.

• Unicast Storm Control Mode may be enabled or disabled. The factory default is disabled.

• Unicast Storm Control Level The unicast storm control level. The factory default is 5%.

Use the all keyword to display the per-port configuration parameters for all interfaces, or specify the unit/slot/port to display information about a specific interface.

Format

Mode show storm-control [all | <unit/slot/port>]

Privileged EXEC

Term

Bcast Mode

Bcast Level

Mcast Mode

Mcast Level

Ucast Mode

Ucast Level

Definition

Shows whether the broadcast storm control mode is enabled or disabled. The factory default is disabled.

The broadcast storm control level.

Shows whether the multicast storm control mode is enabled or disabled.

The multicast storm control level.

Shows whether the Unknown Unicast or DLF (Destination Lookup Failure) storm control mode is enabled or disabled.

The Unknown Unicast or DLF (Destination Lookup Failure) storm control level.

Port-Channel/LAG (802.3ad) Commands

This section describes the commands you use to configure port-channels, which are also known as link aggregation groups (LAGs). Link aggregation allows you to combine multiple full-duplex

Ethernet links into a single logical link. Network devices treat the aggregation as if it were a single link, which increases fault tolerance and provides load sharing. The LAG feature initially load



shares traffic based upon the source and destination MAC address.Assign the port-channel (LAG)

VLAN membership after you create a port-channel. If you do not assign VLAN membership, the port-channel might become a member of the management VLAN which can result in learning and switching issues.

A port-channel (LAG) interface can be either static or dynamic, but not both. All members of a port channel must participate in the same protocols.) A static port-channel interface does not require a partner system to be able to aggregate its member ports.

Note: If you configure the maximum number of dynamic port-channels (LAGs) that your platform supports, additional port-channels that you configure are automatically static.

port-channel

This command configures a new port-channel (LAG) and generates a logical unit/slot/port number for the port-channel. The <name> field is a character string which allows the dash “-” character as well as alphanumeric characters. Use the show port channel command to display the unit/ slot/port number for the logical interface.

Note: Before you include a port in a port-channel, set the port physical mode. For more information, see “speed” on page 3-7 .

Format

Mode port-channel <name>

Global Config no port-channel

This command deletes a port-channel (LAG).

Format

Mode no port-channel {<logical unit/slot/port> | all}

Global Config



addport

This command adds one port to the port-channel (LAG). The interface is a logical unit/slot/port number or a group ID of a configured port-channel.

Note: Before adding a port to a port-channel, set the physical mode of the port. For more information, see “speed” on page 3-7

Format

Mode addport {<logical unit/slot/port>|<lag-group-id>}

Interface Config deleteport (Interface Config)

This command deletes the port from the port-channel (LAG). The interface is a logical unit/slot/ port number or a group ID of a configured port-channel.

Format

Mode deleteport {<logical unit/slot/port>|<lag-group-id>}

Interface Config deleteport (Global Config)

This command deletes all configured ports from the port-channel (LAG). The interface is a logical unit/slot/port number of a configured port-channel. To clear the port channels, see “clear portchannel” on page 9-28

.

Format

Mode deleteport <logical unit/slot/port> all

Global Config


3-92


lacp admin key

Use this command to configure the administrative value of the key for the port-channel. The value range of < key > is 0 to 65535.

Default

Format

Mode

0x8000 lacp admin key < key >

Interface Config

Note: This command is only applicable to port-channel interfaces.

no lacp admin key

Use this command to configure the default administrative value of the key for the port-channel.

Format

Mode no lacp admin key

Interface Config lacp collector max-delay

Use this command to configure the port-channel collector max delay. The valid range of < delay > is 0-65535.

Default

Format

Mode

0x8000 lacp collector max-delay < delay >

Interface Config

Note: This command is only applicable to port-channel interfaces.



no lacp collector max delay

Use this command to configure the default port-channel collector max delay.

Format

Mode no lacp collector max-delay

Interface Config lacp actor admin

Use this command to configure the LACP actor admin parameters.

lacp actor admin key

Use this command to configure the administrative value of the LACP actor admin key. The valid range for < key > is 0-65535.

Default

Format

Mode

Internal Interface Number of this Physical Port lacp actor admin key < key >

Interface Config

Note: This command is only applicable to physical interfaces.

no lacp actor admin key

Use this command to configure the default administrative value of the key.

Format

Mode no lacp actor admin key

Interface Config



lacp actor admin state individual

Use this command to set LACP actor admin state to individual.

Format

Mode lacp actor admin state individual

Interface Config


no lacp actor admin state individual

Use this command to set the LACP actor admin state to aggregation.

Format

Mode no lacp actor admin state individual

Interface Config lacp actor admin state longtimeout

Use this command to set LACP actor admin state to longtimeout.

Format

Mode lacp actor admin state longtimeout

Interface Config



3-95


no lacp actor admin state longtimeout

Use this command to set the LACP actor admin state to short timeout.

Format

Mode no lacp actor admin state longtimeout

Interface Config


lacp actor admin state passive

Use this command to set the LACP actor admin state to passive.

Format

Mode lacp actor admin state passive

Interface Config


no lacp actor admin state passive

Use this command to set the LACP actor admin state to active.

Format

Mode no lacp actor admin state passive

Interface Config


3-96


lacp actor port priority

Use this command to configure the priority value assigned to the Aggregation Port. The valid range for < priority > is 0 to 255.

Default

Format

Mode

0x80 lacp actor port priority <priority>

Interface Config


no lacp actor port priority

Use this command to configure the default priority value assigned to the Aggregation Port.

Format

Mode no lacp actor port priority

Interface Config lacp actor system priority

Use this command to configure the priority value associated with the LACP Actor’s SystemID.

The range for < priority > is 0 to 65535.

Default

Format

Mode

32768 lacp actor system priority < priority >

Interface Config




no lacp actor system priority

Use this command to configure the priority value associated with the Actor’s SystemID.

Format

Mode no lacp actor system priority

Interface Config lacp partner admin key

Use this command to configure the administrative value of the Key for the protocol partner. The valid range for < key > is 0 to 65535.

Default

Format

Mode

0x0 lacp partner admin key

Interface Config


no lacp partner admin key

Use this command to configure the administrative value of the Key for the protocol partner.

Format

Mode no lacp partner admin key < key >

Interface Config lacp partner admin state individual

Use this command to set LACP partner admin state to individual.

Format

Mode lacp partner admin state individual

Interface Config




no lacp partner admin state individual

Use this command to set the LACP partner admin state to aggregation.

Format

Mode no lacp partner admin state individual

Interface Config lacp partner admin state longtimeout

Use this command to set LACP partner admin state to longtimeout.

Format

Mode lacp partner admin state longtimeout

Interface Config


no lacp partner admin state longtimeout

Use this command to set the LACP partner admin state to short timeout.

Format

Mode no lacp partner admin state longtimeout

Interface Config



3-99


lacp partner admin state passive

Use this command to set the LACP partner admin state to passive.

Format

Mode lacp partner admin state passive

Interface Config


no lacp partner admin state passive

Use this command to set the LACP partner admin state to active.

Format

Mode no lacp partner admin state passive

Interface Config lacp partner port id

Use this command to configure the LACP partner port id. The valid range for < port-id > is 0 to

65535.

Default

Format

Mode

0x80 lacp partner portid < port-id >

Interface Config




no lacp partner port id

Use this command to set the LACP partner port id to the default.

Format

Mode no lacp partner portid

Interface Config lacp partner port priority

Use this command to configure the LACP partner port priority. The valid range for < priority > is 0 to 255.

Default

Format

Mode

0x0 lacp partner port priority < priority >

Interface Config


no lacp partner port priority

Use this command to configure the default LACP partner port priority.

Format

Mode no lacp partner port priority

Interface Config


3-101


lacp partner system id

Use this command to configure the 6-octet MAC Address value representing the administrative value of the Aggregation Port’s protocol Partner’s System ID. The valid range of < system-id > is 00:00:00:00:00:00 - FF:FF:FF:FF:FF.

Default

Format

Mode

00:00:00:00:00:00 lacp partner system id < system-id >

Interface Config


no lacp partner system id

Use this command to configure the default value representing the administrative value of the

Aggregation Port’s protocol Partner’s System ID.

Format

Mode no lacp partner system id

Interface Config lacp partner system priority

Use this command to configure the administrative value of the priority associated with the

Partner’s System ID. The valid range for < priority > is 0 to 255.

Default

Format

Mode

0x0 lacp partner system priority < priority >

Interface Config




no lacp partner system priority

Use this command to configure the default administrative value of priority associated with the

Partner’s System ID.

Format

Mode no lacp partner system priority

Interface Config port-channel static

This command enables the static mode on a port-channel (LAG) interface. By default the static mode for a new port-channel is disabled, which means the port-channel is dynamic. However if the maximum number of allowable dynamic port-channels are already present in the system, the static mode for a new port-channel enabled, which means the port-channel is static.You can only use this command on port-channel interfaces.

Default

Format

Mode disabled port-channel static

Interface Config no port-channel static

This command sets the static mode on a particular port-channel (LAG) interface to the default value. This command will be executed only for interfaces of type port-channel (LAG).

Format

Mode no port-channel static

Interface Config



port lacpmode

This command enables Link Aggregation Control Protocol (LACP) on a port.

Default

Format

Mode enabled port lacpmode

Interface Config no port lacpmode

This command disables Link Aggregation Control Protocol (LACP) on a port.

Format

Mode no port lacpmode

Interface Config port lacpmode enable all

This command enables Link Aggregation Control Protocol (LACP) on all ports.

Format

Mode port lacpmode enable all

Global Config no port lacpmode enable all

This command disables Link Aggregation Control Protocol (LACP) on all ports.

Format

Mode no port lacpmode enable all

Global Config


3-104


port lacptimeout (Interface Config)

This command sets the timeout on a physical interface of a particular device type ( actor or partner ) to either long or short timeout.

Default

Format

Mode long port lacptimeout {actor | partner} {long | short}

Interface Config no port lacptimeout

This command sets the timeout back to its default value on a physical interface of a particular device type ( actor or partner ).

Format

Mode no port lacptimeout {actor | partner}

Interface Config port lacptimeout (Global Config)

This command sets the timeout for all interfaces of a particular device type ( actor or partner ) to either long or short timeout.

Default

Format

Mode long port lacptimeout {actor | partner} {long | short}

Global Config no port lacptimeout

This command sets the timeout for all physical interfaces of a particular device type ( actor or partner ) back to their default values.

Format

Mode no port lacptimeout {actor | partner}

Global Config



port-channel adminmode

This command enables a port-channel (LAG). This command sets every configured port-channel with the same administrative mode setting.

Format

Mode port-channel adminmode all

Global Config no port-channel adminmode

This command disables a port-channel (LAG). This command clears every configured portchannel with the same administrative mode setting.

Format

Mode no port-channel adminmode [all]

Global Config port-channel linktrap

This command enables link trap notifications for the port-channel (LAG). The interface is a logical unit/slot/port for a configured port-channel. The option all

enables link trap notifications for all the

configured port-channels.

Default

Format

Mode enabled port-channel linktrap {<logical unit/slot/port> | all}

Global Config no port-channel linktrap

This command disables link trap notifications for the port-channel (LAG). The interface is a logical slot and port for a configured port-channel. The option all disables link trap notifications for all the configured port-channels.

Format

Mode no port-channel linktrap {<logical unit/slot/port> | all}

Global Config



hashing-mode

This command sets the hashing algorithm on Trunk ports. The command is available in the interface configuration mode for a port-channel. The mode range is in the range 1-6 as follows:

1. Source MAC, VLAN, EtherType, and port ID

2. Destination MAC, VLAN, EtherType, and port ID

3. Source IP and source TCP/UDP port

4. Destination IP and destination TCP/UDP port

5. Source/Destination MAC, VLAN, EtherType and port

6. Source/Destination IP and source/destination TCP/UDP port

Default

Format

Mode

3 hashing-mode <mode>

Interface Config no hashing-mode

This command sets the hashing algorithm on Trunk ports to default (3). The command is available in the interface configuration mode for a port-channel.

Format

Mode no hashing-mode

Interface Config port-channel load-balance

This command selects the load-balancing option used on a port-channel (LAG). Traffic is balanced on a port-channel (LAG) by selecting one of the links in the channel over which to transmit specific packets. The link is selected by creating a binary pattern from selected fields in a packet, and associating that pattern with a particular link.


3-107


Load-balancing is not supported on every device. The range of options for load-balancing may vary per device.

Default

Format

Mode

3 port-channel load-balance { 1 | 2 | 3 | 4 | 5 | 6 } { <unit/slot/ port> |< all >}

Interface Config

Global Config

Term

3

4

1

2

5

6

<unit/slot/ port>| all

Definition

Source MAC, VLAN, EtherType, and incoming port associated with the packet

Destination MAC, VLAN, EtherType, and incoming port associated with the packet

Source/Destination MAC, VLAN, EtherType, and incoming port associated with the packet

Source IP and Source TCP/UDP fields of the packet

Destination IP and Destination TCP/UDP Port fields of the packet

Source/Destination IP and source/destination TCP/UDP Port fields of the packet

Global Config Mode only: The interface is a logical unit/slot/port number of a configured portchannel. "All" applies the command to all currently configured port-channels.

no port-channel load-balance

This command reverts to the default load balancing configuration.

Format

Mode no port-channel load-balance {< unit/slot/port > | < all >}

Interface Config

Global Config

Term

<unit/slot/ port>| all

Definition

Global Config Mode only: The interface is a logical unit/slot/port number of a configured portchannel. "All" applies the command to all currently configured port-channels.


3-108


port-channel name

This command defines a name for the port-channel (LAG). The interface is a logical unit/slot/port for a configured port-channel, and <name> is an alphanumeric string up to 15 characters.

Format

Mode port-channel name {<logical unit/slot/port> | all | <name>}

Global Config port-channel system priority

Use this command to configure port-channel system priority. The valid range of <priority> is 0-

65535.

Default

Format

Mode

0x8000 port-channel system priority < priority >

Global Config no port-channel system priority

Use this command to configure the default port-channel system priority value.

Format

Mode no port-channel system priority

Global Config show lacp actor

Use this command to display LACP actor attributes.

Format

Mode show lacp actor {< unit/slot/port >|all}

Global Config

The following output parameters are displayed.

Parameter Description

System Priority The system priority assigned to the Aggregation Port.



Parameter

Admin Key

Port Priority

Admin State

Description

The administrative value of the Key.

The priority value assigned to the Aggregation Port.

The administrative values of the actor state as transmitted by the Actor in LACPDUs.

show lacp partner

Use this command to display LACP partner attributes.

Format

Mode show lacp actor {< unit/slot/port >|all}

Privileged EXEC

The following output parameters are displayed.


System Priority The administrative value of priority associated with the Partner’s System ID.

System ID The value representing the administrative value of the Aggregation Port’s protocol

Partner’s System ID.

Admin Key

Port Priority

The administrative value of the Key for the protocol Partner.

The administrative value of the port priority for the protocol Partner.

Port-ID

Admin State

The administrative value of the port number for the protocol Partner.

The administrative values of the actor state for the protocol Partner.

show port-channel brief

This command displays the static capability of all port-channel (LAG) interfaces on the device as well as a summary of individual port-channel interfaces.

Format

Mode show port-channel brief

• Privileged EXEC

• User EXEC



For each port-channel the following information is displayed:

Term

Logical

Interface

Port-channel

Name

Link-State

Trap Flag

Type

Mbr Ports

Active Ports

Definition

The unit/slot/port of the logical interface.

The name of port-channel (LAG) interface.

Shows whether the link is up or down.

Shows whether trap flags are enabled or disabled.

Shows whether the port-channel is statically or dynamically maintained.

The members of this port-channel.

The ports that are actively participating in the port-channel.

show port-channel

This command displays the static capability of all port-channels (LAGs) on the device as well as a summary of individual port-channels.

Format

Mode show port-channel

• Privileged EXEC

• User EXEC

Term

Static

Capability

Definition

This field displays whether or not the device has static capability enabled.

For each port-channel the following information is displayed:

Term

Name

Link-State

Mbr Ports

Active Ports

Definition

This field displays the name of the port-channel.


This field lists the ports that are members of this port-channel, in <unit/slot/port> notation.

The ports that are actively participating in the port-channel.



show port-channel

This command displays an overview of all port-channels (LAGs) on the switch.

Format

Mode show port-channel {<logical unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term Definition

Logical

Interface

Port-Channel

Name

Link State

Admin Mode

Type

Mbr Ports


The name of this port-channel (LAG). You may enter any string of up to 15 alphanumeric characters.

Indicates whether the Link is up or down.

May be enabled or disabled. The factory default is enabled.

The status designating whether a particular port-channel (LAG) is statically or dynamically maintained.

• Static - The port-channel is statically maintained.

• Dynamic - The port-channel is dynamically maintained.

A listing of the ports that are members of this port-channel (LAG), in unit/slot/port notation. There can be a maximum of eight ports assigned to a given port-channel

(LAG).

Device Timeout For each port, lists the timeout ( long or short ) for Device Type ( actor or partner ).

Port Speed Speed of the port-channel port.

Ports Active This field lists ports that are actively participating in the port-channel (LAG).

Load Balance

Option

The load balance option associated with this LAG. See “port-channel load-balance” on page 3-107 .

show port-channel system priority

Use this command to display the port-channel system priority.

Format

Mode show port-channel system priority

Privileged EXEC



Port Mirroring

Port mirroring, which is also known as port monitoring, selects network traffic that you can analyze with a network analyzer, such as a SwitchProbe device or other Remote Monitoring

(RMON) probe.

monitor session

This command configures a probe port and a monitored port for monitor session (port monitoring).

Use the source interface <unit/slot/port> parameter to specify the interface to monitor. Use rx to monitor only ingress packets, or use tx to monitor only egress packets. If you do not specify an {rx | tx} option, the destination port monitors both ingress and egress packets. Use the destination interface <unit/slot/port> to specify the interface to receive the monitored traffic. Use the mode parameter to enabled the administrative mode of the session. If enabled, the probe port monitors all the traffic received and transmitted on the physical monitored port.

Format

Mode monitor session <session-id> {source interface <unit/slot/port> [{rx

| tx}] | destination interface <unit/slot/port> | mode}

Global Config no monitor session

.

Use this command without optional parameters to remove the monitor session (port monitoring) designation from the source probe port, the destination monitored port and all VLANs. Once the port is removed from the VLAN, you must manually add the port to any desired VLANs. Use the source interface <unit/slot/port> parameter or destination interface

<unit/slot/port> to remove the specified interface from the port monitoring session. Use the mode parameter to disable the administrative mode of the session

Note: Since the current version of 7000 series software only supports one session, if you do not supply optional parameters, the behavior of this command is similar to the behavior of the no monitor command.


Format

Mode


no monitor session <session-id> [{source interface <unit/slot/port>

| destination interface <unit/slot/port> | mode}]

Global Config no monitor

This command removes all the source ports and a destination port for the and restores the default value for mirroring session mode for all the configured sessions.

Default

Format

Mode

Note: This is a stand-alone “no” command. This command does not have a “normal” form.

enabled no monitor

Global Config show monitor session

This command displays the Port monitoring information for a particular mirroring session.

Note: The <session-id> parameter is an integer value used to identify the session.

In the current version of the software, the <session-id> parameter is always one (1)

Format

Mode

Term

Session ID show monitor session <session-id>

Privileged EXEC

Definition

An integer value used to identify the session. Its value can be anything between 1 and the maximum number of mirroring sessions allowed on the platform.



Term

Admin Mode

Probe Port

Mirrored Port

Type

Definition

Indicates whether the Port Mirroring feature is enabled or disabled for the session identified with <session-id> . The possible values are Enabled and Disabled.

Probe port (destination port) for the session identified with <session-id> . If probe port is not set then this field is blank.

The port, which is configured as mirrored port (source port) for the session identified with

<session-id>

. If no source port is configured for the session then this field is blank.

Direction in which source port configured for port mirroring.Types are tx for transmitted packets and rx for receiving packets.

Static MAC Filtering

The commands in this section describe how to configure static MAC filtering. Static MAC filtering allows you to configure destination ports for a static multicast MAC filter irrespective of the platform. macfilter

This command adds a static MAC filter entry for the MAC address < macaddr > on the VLAN

< vlanid > . The value of the < macaddr > parameter is a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The restricted MAC Addresses are: 00:00:00:00:00:00,

01:80:C2:00:00:00 to 01:80:C2:00:00:0F, 01:80:C2:00:00:20 to 01:80:C2:00:00:21, and

FF:FF:FF:FF:FF:FF. The < vlanid > parameter must identify a valid VLAN.

The number of static mac filters supported on the system is different for MAC filters where source ports are configured and MAC filters where destination ports are configured.

• For unicast MAC address filters and multicast MAC address filters with source port lists, the maximum number of static MAC filters supported is 20.

• For multicast MAC address filters with destination ports configured, the maximum number of static filters supported is 256.

i.e. For current platforms, you can configure the following combinations:

• Unicast MAC and source port (max = 20)

• Multicast MAC and source port (max=20)

• Multicast MAC and destination port (only) (max=256)



• Multicast MAC and source ports and destination ports (max=20)

Format

Mode macfilter <macaddr> <vlanid>

Global Config no macfilter

This command removes all filtering restrictions and the static MAC filter entry for the MAC address <macaddr> on the VLAN <vlanid> . The <macaddr> parameter must be specified as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6.

The <vlanid> parameter must identify a valid VLAN.

Format

Mode no macfilter <macaddr> <vlanid>

Global Config macfilter adddest

Use this command to add the interface to the destination filter set for the MAC filter with the given

<macaddr> and VLAN of <vlanid> . The <macaddr> parameter must be specified as a 6byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The <vlanid> parameter must identify a valid VLAN.

Note: Configuring a destination port list is only valid for multicast MAC addresses.

Format

Mode macfilter adddest < macaddr > <vlanid>

Interface Config


3-116


no macfilter adddest

This command removes a port from the destination filter set for the MAC filter with the given


Format

Mode no macfilter adddest < macaddr > <vlanid>

Interface Config macfilter adddest all

This command adds all interfaces to the destination filter set for the MAC filter with the given


Note: Configuring a destination port list is only valid for multicast MAC addresses.

Format

Mode macfilter adddest all < macaddr > <vlanid>

Global Config no macfilter adddest all

This command removes all ports from the destination filter set for the MAC filter with the given


Format

Mode no macfilter adddest all < macaddr > <vlanid>

Global Config



macfilter addsrc

This command adds the interface to the source filter set for the MAC filter with the MAC address of < macaddr > and VLAN of < vlanid > . The < macaddr > parameter must be specified as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The <vlanid> parameter must identify a valid VLAN.

Format

Mode macfilter addsrc <macaddr> <vlanid>

Interface Config no macfilter addsrc

This command removes a port from the source filter set for the MAC filter with the MAC address of <macaddr> and VLAN of <vlanid> . The < macaddr > parameter must be specified as a 6byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The <vlanid> parameter must identify a valid VLAN.

Format

Mode no macfilter addsrc <macaddr> <vlanid>

Interface Config macfilter addsrc all

This command adds all interfaces to the source filter set for the MAC filter with the MAC address of <macaddr> and <vlanid> . You must specify the <macaddr> parameter as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The <vlanid> parameter must identify a valid VLAN.

Format

Mode macfilter addsrc all <macaddr> <vlanid>

Global Config no macfilter addsrc all

This command removes all interfaces to the source filter set for the MAC filter with the MAC address of <macaddr> and VLAN of <vlanid> . You must specify the <macaddr> parameter as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6.



The <vlanid> parameter must identify a valid VLAN.

Format

Mode no macfilter addsrc all <macaddr> <vlanid>

Global Config show mac-address-table static

This command displays the Static MAC Filtering information for all Static MAC Filters. If you select <all> , all the Static MAC Filters in the system are displayed. If you supply a value for

<macaddr>, you must also enter a value for <vlanid> , and the system displays Static MAC

Filter information only for that MAC address and VLAN.

Format

Mode show mac-address-table static {<macaddr> <vlanid> | all}

Privileged EXEC

Term Definition

MAC Address The MAC Address of the static MAC filter entry.

VLAN ID The VLAN ID of the static MAC filter entry.

Source Port(s) The source port filter set's slot and port(s).

Note: Only multicast address filters will have destination port lists.

show mac-address-table staticfiltering

This command displays the Static Filtering entries in the Multicast Forwarding Database (MFDB) table.

Format

Mode show mac-address-table staticfiltering

Privileged EXEC



Term

Mac Address

Type

Description

Interfaces

Definition

A unicast MAC address for which the switch has forwarding and or filtering information.

As the data is gleaned from the MFDB, the address will be a multicast address. The format is 6 or 8 two-digit hexadecimal numbers that are separated by colons, for example

01:23:45:67:89:AB. In an IVL system the MAC address will be displayed as 8 bytes.





DHCP Snooping Configuration Commands

This section describes commands you use to configure DHCP Snooping.

ip dhcp snooping

Use this command to enable DHCP Snooping globally.

Default

Format

Mode disabled ip dhcp snooping

Global Config no ip dhcp snooping

Use this command to disable DHCP Snooping globally.

Format

Mode no ip dhcp snooping

Global Config ip dhcp snooping vlan

Use this command to enable DHCP Snooping on a list of comma-separated VLAN ranges.



Default

Format

Mode disabled ip dhcp snooping vlan < vlan-list >

Global Config no ip dhcp snooping vlan

Use this command to disable DHCP Snooping on VLANs.

Format

Mode no ip dhcp snooping vlan < vlan-list >

Global Config ip dhcp snooping verify mac-address

Use this command to enable verification of the source MAC address with the client hardware address in the received DCHP message.

Default

Format

Mode enabled ip dhcp snooping verify mac-address

Global Config no ip dhcp snooping verify mac-address

Use this command to disable verification of the source MAC address with the client hardware address.

Format

Mode no ip dhcp snooping verify mac-address

Global Config ip dhcp snooping database

Use this command to configure the persistent location of the DHCP Snooping database. This can be local or a remote file on a given IP machine.



Default

Format

Mode local ip dhcp snooping database {local|tftp://hostIP/filename}

Global Config ip dhcp snooping database write-delay

Use this command to configure the interval in seconds at which the DHCP Snooping database will be persisted. The interval value ranges from 15 to 86400 seconds.

Default

Format

Mode

300 seconds ip dhcp snooping database write-delay < in seconds >

Global Config no ip dhcp snooping database write-delay

Use this command to set the write delay value to the default value.

Format

Mode no ip dhcp snooping database write-delay

Global Config ip dhcp snooping binding

Use this command to configure static DHCP Snooping binding.

Format

Mode ip dhcp snooping binding < mac-address > vlan < vlan id > < ip address > interface < interface id >

Global Config no ip dhcp snooping binding <mac-address>

Use this command to remove the DHCP static entry from the DHCP Snooping database.



Format

Mode no ip dhcp snooping binding < mac-address >

Global Config ip verify binding

Use this command to configure static IP source guard (IPSG) entries.

Format

Mode ip verify binding < mac-address > vlan < vlan id > < ip address > interface

< interface id >

Global Config no ip verify binding

Use this command to remove the IPSG static entry from the IPSG database.

Format

Mode no ip verify binding < mac-address > vlan < vlan id > < ip address > interface < interface id >

Global Config ip dhcp snooping limit

Use this command to control the rate at which the DHCP Snooping messages come. The default rate is 15 pps with a range from 0 to 30 pps. The default burst level is 1 second with a range of 1 to

15 seconds.

Default

Format

Mode

15 pps for rate limiting and 1 sec for burst interval ip dhcp snooping limit {rate pps [burst interval seconds]}

Interface Config no ip dhcp snooping limit

Use this command to set the rate at which the DHCP Snooping messages come, and the burst level, to the defaults.



Format

Mode no ip dhcp snooping limit

Interface Config ip dhcp snooping log-invalid

Use this command to control the logging DHCP messages filtration by the DHCP Snooping application.

Default

Format

Mode disabled ip dhcp snooping log-invalid

Interface Config no ip dhcp snooping log-invalid

Use this command to disable the logging DHCP messages filtration by the DHCP Snooping application.

Format

Mode no ip dhcp snooping log-invalid

Interface Config ip dhcp snooping trust

Use this command to configure the port as trusted.

Default

Format

Mode disabled ip dhcp snooping trust

Interface Config no ip dhcp snooping trust

Use this command to configure the port as untrusted.



Format

Mode no ip dhcp snooping trust

Interface Config ip verify source

Use this command to configure the IPSG source ID attribute to filter the data traffic in the hardware. Source ID is the combination of IP address and MAC address. Normal command allows data traffic filtration based on the IP address. With the “port-security” option, the data traffic will be filtered based on the IP and MAC addresses.

Default

Format

Mode the source ID is the IP address ip verify source {port-security}

Interface Config no ip verify source

Use this command to disable the IPSG configuration in the hardware. You cannot disable portsecurity alone if it is configured.

Format

Mode no ip verify source

Interface Config show ip dhcp snooping

Use this command to display the DHCP Snooping global configurations and per port configurations.

Format

Mode show ip dhcp snooping

• Privileged EXEC

• User EXEC



Term Definition

Interface

Trusted

The interface for which data is displayed.

If it is enabled, DHCP snooping considers the port as trusted. The factory default is disabled.

Log Invalid Pkts If it is enabled, DHCP snooping application logs invalid packets on the specified interface.

Example: The following shows example CLI display output for the command.

(switch) #show ip dhcp snooping

DHCP snooping is Disabled

DHCP snooping source MAC verification is enabled

DHCP snooping is enabled on the following VLANs:

11 - 30, 40

Interface Trusted Log Invalid Pkts

--------- -------- ----------------

0/1 Yes No

0/2 No Yes

0/3 No Yes

0/4 No No

0/6 No No show ip dhcp snooping binding

Use this command to display the DHCP Snooping binding entries. To restrict the output, use the following options:

• Dynamic: Restrict the output based on DCHP snooping.

• Interface: Restrict the output based on a specific interface.

• Static: Restrict the output based on static entries.

• VLAN: Restrict the output based on VLAN.

Format

Mode show ip dhcp snooping binding [{static/dynamic}] [interface unit/ slot/port ] [ vlan id ]

• Privileged EXEC

• User EXEC



Term Definition

MAC Address Displays the MAC address for the binding that was added. The MAC address is the key to the binding database.

IP Address

VLAN

Displays the valid IP address for the binding rule.

The VLAN for the binding rule.

Interface

Type

Lease (sec)

The interface to add a binding into the DHCP snooping interface.

Binding type; statically configured from the CLI or dynamically learned.

The remaining lease time for the entry.


(switch) #show ip dhcp snooping binding

Total number of bindings: 2

MAC Address IP Address VLAN Interface Type Lease (Secs)

------------------ ------------ ---- --------- ---- -------------

00:02:B3:06:60:80 210.1.1.3 10 0/1 86400

00:0F:FE:00:13:04 210.1.1.4 10 0/1 86400 show ip dhcp snooping database

Use this command to display the DHCP Snooping configuration related to the database persistency.

Format

Mode show ip dhcp snooping database

• Privileged EXEC

• User EXEC

Term

Agent URL

Write Delay

Definition

Bindings database agent URL.

The maximum write time to wrte the database into local or remote.


(switch) #show ip dhcp snooping database


3-127


agent url: /10.131.13.79:/sai1.txt

write-delay: 5000 show ip dhcp snooping statistics

Use this command to list statistics for DHCP Snooping security violations on untrusted ports.

Format

Mode show ip dhcp snooping statistics

• Privileged EXEC

• User EXEC

Term

Interface

MAC Verify

Failures

Client Ifc

Mismatch

DHCP Server

Msgs Rec’d

Definition

The IP address of the interface in unit/slot/port format.

Represents the number of DHCP messages that were filtered on an untrusted interface because of source MAC address and client HW address mismatch.

Represents the number of DHCP release and Deny messages received on the different ports than learned previously.

Represents the number of DHCP server messages received on Untrusted ports.


(switch) #show ip dhcp snooping statistics

Interface MAC Verify Client Ifc DHCP Server

Failures Mismatch Msgs Rec'd

----------- ---------- ---------- -----------

1/0/2 0 0 0

1/0/3 0 0 0

1/0/4 0 0 0

1/0/5 0 0 0

1/0/6 0 0 0

1/0/7 0 0 0

1/0/8 0 0 0

1/0/9 0 0 0

1/0/10 0 0 0

1/0/11 0 0 0

1/0/12 0 0 0

1/0/13 0 0 0


3-128


1/0/14 0 0 0

1/0/15 0 0 0

1/0/16 0 0 0

1/0/17 0 0 0

1/0/18 0 0 0

1/0/19 0 0 0

1/0/20 0 0 0 clear ip dhcp snooping binding

Use this command to clear all DHCP Snooping bindings on all interfaces or on a specific interface.

Format

Mode clear ip dhcp snooping binding [interface < unit/slot/port >]

• Privileged EXEC

• User EXEC clear ip dhcp snooping statistics

Use this command to clear all DHCP Snooping statistics.

Format

Mode clear ip dhcp snooping statistics

• Privileged EXEC

• User EXEC show ip verify source

Use this command to display the IPSG configurations on all ports.

Format

Mode show ip verify source

• Privileged EXEC

• User EXEC

Term

Interface

Definition

Interface address in unit/slot/port format.



Term

Filter Type

Definition

Is one of two values:

• ip-mac: User has configured MAC address filtering on this interface.

• ip: Only IP address filtering on this interface.

IP Address IP address of the interface

MAC Address If MAC address filtering is not configured on the interface, the MAC Address field is empty. If port security is disabled on the interface, then the MAC Address field displays

“permit-all.”

VLAN The VLAN for the binding rule.


(switch) #show ip verify source

Interface Filter Type IP Address MAC Address Vlan

--------- ----------- --------------- ----------------- -----

0/1 ip-mac 210.1.1.3 00:02:B3:06:60:80 10

0/1 ip-mac 210.1.1.4 00:0F:FE:00:13:04 10 show ip source binding

Use this command to display the IPSG bindings.

Format

Mode show ip source binding [{static/dynamic}] [interface unit/slot/port ]

[ vlan id ]

• Privileged EXEC

• User EXEC

Term Definition

MAC Address The MAC address for the entry that is added.

IP Address The IP address of the entry that is added.

Type

VLAN

Interface

Entry type; statically configured from CLI or dynamically learned from DHCP Snooping.

VLAN for the entry.

IP address of the interface in unit/slot/port format.




(switch) #show ip source binding

MAC Address IP Address Type Vlan Interface

----------------- --------------- ------------- ----- -------------

00:00:00:00:00:08 1.2.3.4 dhcp-snooping 2 1/0/1

00:00:00:00:00:09 1.2.3.4 dhcp-snooping 3 1/0/1

00:00:00:00:00:0A 1.2.3.4 dhcp-snooping 4 1/0/1

Dynamic ARP Inspection Commands

Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. DAI prevents a class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting neighbors. The miscreant sends ARP requests or responses mapping another station’s IP address to its own MAC address.

DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges and builds a binding database of valid {MAC address, IP address, VLAN, and interface} tuples.

When DAI is enabled, the switch drops ARP packets whose sender MAC address and sender IP address do not match an entry in the DHCP snooping bindings database. You can optionally configure additional ARP packet validation.

ip arp inspection vlan

Use this command to enable Dynamic ARP Inspection on a list of comma-separated VLAN ranges.

Default

Format

Mode disabled ip arp inspection vlan vlan-list

Global Config no ip arp inspection vlan

Use this command to disable Dynamic ARP Inspection on a list of comma-separated VLAN ranges.



Format

Mode no ip arp inspection vlan vlan-list

Global Config ip arp inspection validate

Use this command to enable additional validation checks like source-mac validation, destinationmac validation, and ip address validation on the received ARP packets. Each command overrides the configuration of the previous command. For example, if a command enables src-mac and dstmac validations, and a second command enables IP validation only, the src-mac and dst-mac validations are disabled as a result of the second command.

Default

Format

Mode disabled ip arp inspection validate {[src-mac ] [ dst-mac] [ip]}

Global Config no ip arp inspection validate

Use this command to disable the additional validation checks on the received ARP packets.

Format

Mode no ip arp inspection validate {[src-mac ] [ dst-mac] [ip]}

Global Config ip arp inspection vlan logging

Use this command to enable logging of invalid ARP packets on a list of comma-separated VLAN ranges.

Default

Format

Mode enabled ip arp inspection vlan vlan-list logging

Global Config


Format

Mode


no ip arp inspection vlan logging

Use this command to disable logging of invalid ARP packets on a list of comma-separated VLAN ranges.

no ip arp inspection vlan vlan-list logging

Global Config ip arp inspection trust

Use this command to configure an interface as trusted for Dynamic ARP Inspection.

Default

Format

Mode enabled ip arp inspection trust

Interface Config no ip arp inspection trust

Use this command to configure an interface as untrusted for Dynamic ARP Inspection.

Format

Mode no ip arp inspection trust

Interface Config ip arp inspection limit

Use this command to configure the rate limit and burst interval values for an interface.

Configuring none for the limit means the interface is not rate limited for Dynamic ARP

Inspections.

Note: The user interface will accept a rate limit for a trusted interface, but the limit will not be enforced unless the interface is configured to be untrusted.



Default

Format

Mode

15 pps for rate and 1 second for burst-interval ip arp inspection limit {rate pps [burst interval seconds ] | none}

Interface Config no ip arp inspection limit

Use this command to set the rate limit and burst interval values for an interface to the default values of 15 pps and 1 second, respectively.

Format

Mode no ip arp inspection limit

Interface Config ip arp inspection filter

Use this command to configure the ARP ACL used to filter invalid ARP packets on a list of comma-separated VLAN ranges. If the static keyword is given, packets that do not match a permit statement are dropped without consulting the DHCP snooping bindings.

Default

Format

Mode

No ARP ACL is configured on a VLAN ip arp inspection filter acl-name vlan vlan-list [static]

Global Config no ip arp inspection filter

Use this command to unconfigure the ARP ACL used to filter invalid ARP packets on a list of comma-separated VLAN ranges.

Format

Mode no ip arp inspection filter acl-name vlan vlan-list [static]

Global Config



arp access-list

Use this command to create an ARP ACL.

Format

Mode arp access-list acl-name

Global Config no arp access-list

Use this command to delete a configured ARP ACL.

Format

Mode no arp access-list acl-name

Global Config permit ip host mac host

Use this command to configure a rule for a valid IP address and MAC address combination used in

ARP packet validation.

Format

Mode permit ip host sender-ip mac host sender-mac

ARP Access-list Config no permit ip host mac host

Use this command to delete a rule for a valid IP and MAC combination.

Format

Mode no permit ip host sender-ip mac host sender-mac

ARP Access-list Config


3-135

Format

Mode


show ip arp inspection

Use this command to display the Dynamic ARP Inspection global configuration and configuration on all the VLANs. With the vlan-list argument (i.e. comma separated VLAN ranges), the command displays the global configuration and configuration on all the VLANs in the given

VLAN list. The global configuration includes the source mac validation , destination mac validation and invalid IP validation information.

show ip arp inspection [vlan < vlan-list> ]

• Privileged EXEC

• User EXEC

Term Definition

Source MAC

Validation

Displays whether Source MAC Validation of ARP frame is enabled or disabled.

Destination

MAC Validation

IP Address

Validation

Displays whether Destination MAC Validation is enabled or disabled.

Displays whether IP Address Validation is enabled or disabled.

VLAN The VLAN ID for each displayed row.

Configuration Displays whether DAI is enabled or disabled on the VLAN.

Log Invalid

ACL Name

Static Flag

Displays whether logging of invalid ARP packets is enabled on the VLAN.

The ARP ACL Name, if configured on the VLAN.

If the ARP ACL is configured static on the VLAN.


(Switch) #show ip arp inspection vlan 10-12

Source Mac Validation : Disabled

Destination Mac Validation : Disabled

IP Address Validation : Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- --------- ----------

10 Enabled Enabled H2 Enabled

11 Disabled Enabled

12 Enabled Disabled


Format

Mode


show ip arp inspection statistics

Use this command to display the statitstics of the ARP packets processed by Dynamic ARP

Inspection. Give the vlan-list argument and the command displays the statistics on all DAI-enabled

VLANs in that list. Give the single vlan argument and the command displays the statistics on that

VLAN. If no argument is included, the command lists a summary of the forwarded and dropped

ARP packets.

show ip arp inspection statistics [vlan vlan-list ]

• Privileged EXEC

• User EXEC

Term Definition

VLAN

Forwarded

Dropped

DHCP Drops

The VLAN ID for each displayed row.

The total number of valid ARP packets forwarded in this VLAN.

The total number of not valid ARP packets dropped in this VLAN.

The number of packets dropped due to DHCP snooping binding database match failure.

ACL Drops The number of packets dropped due to ARP ACL rule match failure.

DHCP Permits The number of packets permitted due to DHCP snooping binding database match.

ACL Permits

Bad Src MAC

The number of packets permitted due to ARP ACL rule match.

The number of packets dropped due to Source MAC validation failure.

Bad Dest MAC The number of packets dropped due to Destination MAC validation failure.

Invalid IP The number of packets dropped due to invalid IP checks.

Example: The following shows example CLI display output for the command show ip arp inspection statistics which lists the summary of forwarded and dropped ARP packets on all DAI-enabled VLANs.

VLAN Forwarded Dropped

---- --------- -------

10 90 14

20 10 3

Example: The following shows example CLI display output for the command show ip arp inspection statistics vlan <vlan-list> .

VLAN DHCP ACL DHCP ACL Bad Src Bad Dest Invalid

Drops Drops Permits Permits MAC MAC IP

----- -------- --------- ----------- --------- ---------- ----------- ---------


10

20

11

1

1

0

65 25

8 2


1

0

1 0

1 1 clear ip arp inspection statistics

Use this command to reset the statistics for Dynamic ARP Inspection on all VLANs.

Default

Format

Mode none clear ip arp inspection statistics

Privileged EXEC show ip arp inspection interfaces

Use this command to display the Dynamic ARP Inspection configuration on all the DAI-enabled interfaces. An interface is said to be enabled for DAI if at least one VLAN, that the interface is a member of, is enabled for DAI. Given a unit/slot/port interface argument, the command displays the values for that interface whether the interface is enabled for DAI or not.

Format

Mode show ip arp inspection interfaces [unit/slot/port]

• Privileged EXEC

• User EXEC

Term Definition

Interface

Trust State

The interface ID for each displayed row.

Whether the interface is trusted or untrusted for DAI.

Rate Limit The configured rate limit value in packets per second.

Burst Interval The configured burst interval value in seconds.


(Switch) #show ip arp inspection interfaces

(pps) (seconds)

--------------- ----------- ---------- ---------------

0/1 Untrusted 15 1


3-138


0/2 Untrusted 10 10 show arp access-list

Use this command to display the configured ARP ACLs with the rules. Giving an ARP ACL name as the argument will display on ly the rules in that ARP ACL.

Format

Mode show arp access-list [ acl-name ]

• Privileged EXEC

• User EXEC


(Switch) #show arp access-list

ARP access list H2

permit ip host 1.1.1.1 mac host 00:01:02:03:04:05


ARP access list H3

ARP access list H4


IGMP Snooping Configuration Commands

This section describes the commands you use to configure IGMP snooping. The software supports

IGMP Versions 1, 2, and 3. The IGMP snooping feature can help conserve bandwidth because it allows the switch to forward IP multicast traffic only to connected hosts that request multicast traffic. IGMPv3 adds source filtering capabilities to IGMP versions 1 and 2.

set igmp

This command enables IGMP Snooping on the system (Global Config Mode) or an interface

(Interface Config Mode). This command also enables IGMP snooping on a particular VLAN

(VLAN Config Mode) and can enable IGMP snooping on all interfaces participating in a VLAN.



If an interface has IGMP Snooping enabled and you enable this interface for routing or enlist it as a member of a port-channel (LAG), IGMP Snooping functionality is disabled on that interface.

IGMP Snooping functionality is re-enabled if you disable routing or remove port-channel (LAG) membership from an interface that has IGMP Snooping enabled.

The IGMP application supports the following activities:

• Validation of the IP header checksum (as well as the IGMP header checksum) and discarding of the frame upon checksum error.

• Maintenance of the forwarding table entries based on the MAC address versus the IP address.

• Flooding of unregistered multicast data packets to all ports in the VLAN.

Default

Format

Mode

Format

Mode disabled set igmp

• Global Config

• Interface Config set igmp <vlanid>

VLAN Config no set igmp

This command disables IGMP Snooping on the system, an interface or a VLAN.

Format

Mode no set igmp

• Global Config


Format

Mode no set igmp <vlanid>

VLAN Config


3-140


set igmp interfacemode

This command enables IGMP Snooping on all interfaces. If an interface has IGMP Snooping enabled and you enable this interface for routing or enlist it as a member of a port-channel (LAG),

IGMP Snooping functionality is disabled on that interface. IGMP Snooping functionality is reenabled if you disable routing or remove port-channel (LAG) membership from an interface that has IGMP Snooping enabled.

Default

Format

Mode disabled set igmp interfacemode

Global Config no set igmp interfacemode

This command disables IGMP Snooping on all interfaces.

Format

Mode no set igmp interfacemode

Global Config set igmp fast-leave

This command enables or disables IGMP Snooping fast-leave admin mode on a selected interface or VLAN. Enabling fast-leave allows the switch to immediately remove the layer 2 LAN interface from its forwarding table entry upon receiving an IGMP leave message for that multicast group without first sending out MAC-based general queries to the interface.

You should enable fast-leave admin mode only on VLANs where only one host is connected to each layer 2 LAN port. This prevents the inadvertent dropping of the other hosts that were connected to the same layer 2 LAN port but were still interested in receiving multicast traffic directed to that group. Also, fast-leave processing is supported only with IGMP version 2 hosts.

Default

Format

Mode disabled set igmp fast-leave

Interface Config

Format

Mode set igmp fast-leave <vlan_id>

VLAN Config



no set igmp fast-leave

This command disables IGMP Snooping fast-leave admin mode on a selected interface.

Format

Mode no set igmp fast-leave

Interface Config

Format

Mode no set igmp fast-leave <vlan_id>

VLAN Config set igmp groupmembership-interval

This command sets the IGMP Group Membership Interval time on a VLAN, one interface or all interfaces. The Group Membership Interval time is the amount of time in seconds that a switch waits for a report from a particular group on a particular interface before deleting the interface from the entry. This value must be greater than the IGMPv3 Maximum Response time value. The range is 2 to 3600 seconds.

Default

Format

Mode

260 seconds set igmp groupmembership-interval <2-3600>


• Global Config

Format

Mode set igmp groupmembership-interval <vlan_id> <2-3600>

VLAN Config no set igmp groupmembership-interval

This command sets the IGMPv3 Group Membership Interval time to the default value.

Format

Mode no set igmp groupmembership-interval


• Global Config

Format

Mode no set igmp groupmembership-interval <vlan_id>

VLAN Config



set igmp maxresponse

This command sets the IGMP Maximum Response time for the system, or on a particular interface or VLAN. The Maximum Response time is the amount of time in seconds that a switch will wait after sending a query on an interface because it did not receive a report for a particular group in that interface. This value must be less than the IGMP Query Interval time value. The range is 1 to

25 seconds.

Default

Format

Mode

10 seconds set igmp maxresponse <1-25>

• Global Config


Format

Mode set igmp maxresponse <vlan_id> <1-25>

VLAN Config no set igmp maxresponse

This command sets the max response time (on the interface or VLAN) to the default value.

Format

Mode no set igmp maxresponse

• Global Config


Format

Mode no set igmp maxresponse <vlan_id>

VLAN Config set igmp mcrtrexpiretime

This command sets the Multicast Router Present Expiration time. The time is set for the system, on a particular interface or VLAN. This is the amount of time in seconds that a switch waits for a query to be received on an interface before the interface is removed from the list of interfaces with multicast routers attached. The range is 0 to 3600 seconds. A value of 0 indicates an infinite timeout, i.e. no expiration.

Default 0


Format

Mode


set igmp mcrtrexpiretime <0-3600>

• Global Config

• Interface Config set igmp mcrtrexpiretime <vlan_id> <0-3600>

VLAN Config

Format

Mode no set igmp mcrtrexpiretime

This command sets the Multicast Router Present Expiration time to 0. The time is set for the system, on a particular interface or a VLAN.

Format

Mode no set igmp mcrtrexpiretime

• Global Config


Format

Mode no set igmp mcrtrexpiretime <vlan_id>

VLAN Config set igmp mrouter

This command configures the VLAN ID ( < vlanId > ) that has the multicast router mode enabled.

Format

Mode set igmp mrouter < vlan_id >

Interface Config no set igmp mrouter

This command disables multicast router mode for a particular VLAN ID ( < vlan_id > ).

Format

Mode no set igmp mrouter < vlan_id >

Interface Config



set igmp mrouter interface

This command configures the interface as a multicast router interface. When configured as a multicast router interface, the interface is treated as a multicast router interface in all VLANs.

Default

Format

Mode disabled set igmp mrouter interface

Interface Config no set igmp mrouter interface

This command disables the status of the interface as a statically configured multicast router interface.

Format

Mode no set igmp mrouter interface

Interface Config ip igmpsnooping unknown-multicast

This command enables the filtering of unknown multicast packets to the VLAN. Packets with an unknown mulicast address in the destination field will be dropped. This command is mainly used when IGMP snooping is enabled, to prevent flooding of unwanted multicast packets to every port.

Format

Mode ip igmpsnooping unknown-multicast

Global Config no ip igmpsnooping unknown-multicast

This command disables the filtering of unknown multicast packets. Unknown multicast packets will be flooded to all ports in the same VLAN.

Format

Mode no ip igmpsnooping unknown-multicast

Global Config



show igmpsnooping

This command displays IGMP Snooping information. Configured information is displayed whether or not IGMP Snooping is enabled.

Format

Mode show igmpsnooping [<unit/slot/port> | <vlan_id>]

Privileged EXEC

When the optional arguments <unit/slot/port> or <vlan_id> are not used, the command displays the following information:

Term Definition

Admin Mode

Multicast

Control Frame

Count

Indicates whether or not IGMP Snooping is active on the switch.

The number of multicast control frames that are processed by the CPU.

Interface

Enabled for

IGMP Snooping

The list of interfaces on which IGMP Snooping is enabled.

VLANS Enabled for IGMP

Snooping

The list of VLANS on which IGMP Snooping is enabled.

When you specify the <unit/slot/port > values, the following information appears:

Term Definition

IGMP Snooping

Admin Mode

Indicates whether IGMP Snooping is active on the interface.

Indicates whether IGMP Snooping Fast-leave is active on the interface.

Fast Leave

Mode

Group

Membership

Interval

Maximum

Response Time

The amount of time in seconds that a switch will wait for a report from a particular group on a particular interface before deleting the interface from the entry.This value may be configured.

The amount of time the switch waits after it sends a query on an interface because it did not receive a report for a particular group on that interface. This value may be configured.

Multicast

Router Expiry

Time

The amount of time to wait before removing an interface from the list of interfaces with multicast routers attached. The interface is removed if a query is not received. This value may be configured.



When you specify a value for <vlan_id> , the following information appears:

Term Definition

VLAN ID

Fast Leave

Mode

The VLAN ID.

IGMP Snooping

Admin Mode

Indicates whether IGMP Snooping is active on the VLAN.

Indicates whether IGMP Snooping Fast-leave is active on the VLAN.

Group

Membership

Interval

Maximum

Response Time

Multicast

Router Expiry

Time

The amount of time in seconds that a switch will wait for a report from a particular group on a particular interface, which is participating in the VLAN, before deleting the interface from the entry.This value may be configured.

The amount of time the switch waits after it sends a query on an interface, participating in the VLAN, because it did not receive a report for a particular group on that interface. This value may be configured.

The amount of time to wait before removing an interface that is participating in the VLAN from the list of interfaces with multicast routers attached. The interface is removed if a query is not received. This value may be configured.

show igmpsnooping mrouter interface

This command displays information about statically configured ports.

Format

Mode

Term

Interface

Multicast

Router

Attached

VLAN ID show igmpsnooping mrouter interface <unit/slot/port>

Privileged EXEC

Definition

The port on which multicast router information is being displayed.

Indicates whether multicast router is statically enabled on the interface.

The list of VLANs of which the interface is a member.

show igmpsnooping mrouter vlan

This command displays information about statically configured ports.



Format

Mode

Term

Interface

VLAN ID show igmpsnooping mrouter vlan <unit/slot/port>

Privileged EXEC

Definition

The port on which multicast router information is being displayed.

The list of VLANs of which the interface is a member.

show mac-address-table igmpsnooping

This command displays the IGMP Snooping entries in the MFDB table.

Format

Mode show mac-address-table igmpsnooping

Privileged EXEC

Term Definition

MAC Address A multicast MAC address for which the switch has forwarding or filtering information. The format is two-digit hexadecimal numbers that are separated by colons, for example

01:23:45:67:89:AB. In an IVL system the MAC address is displayed as a MAC address and VLAN ID combination of 8 bytes.

Type The type of the entry, which is either static (added by the user) or dynamic (added to the table as a result of a learning process or protocol).

Description

Interfaces



IGMP Snooping Querier Commands

IGMP Snooping requires that one central switch or router periodically query all end-devices on the network to announce their multicast memberships. This central device is the “IGMP Querier”. The

IGMP query responses, known as IGMP reports, keep the switch updated with the current multicast group membership on a port-by-port basis. If the switch does not receive updated membership information in a timely fashion, it will stop forwarding multicasts to the port where the end device is located.



This section describes commands used to configure and display information on IGMP Snooping

Queriers on the network and, separately, on VLANs. set igmp querier

Use this command to enable IGMP Snooping Querier on the system, using Global Config mode, or on a VLAN. Using this command, you can specify the IP Address that the Snooping Querier switch should use as the source address while generating periodic queries.

If a VLAN has IGMP Snooping Querier enabled and IGMP Snooping is operationally disabled on it, IGMP Snooping Querier functionality is disabled on that VLAN. IGMP Snooping functionality is re-enabled if IGMP Snooping is operational on the VLAN.

Note: The Querier IP Address assigned for a VLAN takes preference over global configuration.

The IGMP Snooping Querier application supports sending periodic general queries on the VLAN to solicit membership reports.

Default

Format

Mode disabled set igmp querier [< vlan-id >] [address ipv4_address ]

• Global Config

• VLAN Mode no set igmp querier

Use this command to disable IGMP Snooping Querier on the system. Use the optional address parameter to reset the querier address to 0.0.0.0.

Format

Mode no set igmp querier [< vlan-id >] [address]

• Global Config

• VLAN Mode



set igmp querier query-interval

Use this command to set the IGMP Querier Query Interval time. It is the amount of time in seconds that the switch waits before sending another general query.

Default

Format

Mode disabled set igmp querier query-interval < 1-18000 >

Global Config no set igmp querier query-interval

Use this command to set the IGMP Querier Query Interval time to its default value.

Format

Mode no set igmp querier query-interval

Global Config set igmp querier timer expiry

Use this command to set the IGMP Querier timer expiration period. It is the time period that the switch remains in Non-Querier mode once it has discovered that there is a Multicast Querier in the network.

Default

Format

Mode

60 seconds set igmp querier timer expiry <60-300>

Global Config no set igmp querier timer expiry

Use this command to set the IGMP Querier timer expiration period to its default value.

Format

Mode no set igmp querier timer expiry

Global Config



set igmp querier version

Use this command to set the IGMP version of the query that the snooping switch is going to send periodically.

Default

Format

Mode

1 set igmp querier version <1-2>

Global Config no set igmp querier version

Use this command to set the IGMP Querier version to its default value.

Format

Mode no set igmp querier version

Global Config set igmp querier election participate

Use this command to enable the Snooping Querier to participate in the Querier Election process when it discovers the presence of another Querier in the VLAN. When this mode is enabled, if the

Snooping Querier finds that the other Querier’s source address is better (less) than the Snooping

Querier’s address, it stops sending periodic queries. If the Snooping Querier wins the election, then it will continue sending periodic queries.

Default

Format

Mode disabled set igmp querier election participate

VLAN Config no set igmp querier election participate

Use this command to set the Snooping Querier not to participate in querier election but go into non-querier mode as soon as it discovers the presence of another querier in the same VLAN.

Format

Mode no set igmp querier election participate

VLAN Config



show igmpsnooping querier

Use this command to display IGMP Snooping Querier information. Configured information is displayed whether or not IGMP Snooping Querier is enabled.

Format

Mode show igmpsnooping querier [{detail | vlan < vlanid >}]

Privileged EXEC

When the optional argument < vlanid > is not used, the command displays the following information.

Field Description

Admin Mode Indicates whether or not IGMP Snooping Querier is active on the switch.

Admin Version The version of IGMP that will be used while sending out the queries.

Querier

Address

The IP Address which will be used in the IPv4 header while sending out IGMP queries. It can be configured using the appropriate command.

Query Interval The amount of time in seconds that a Snooping Querier waits before sending out the periodic general query.

Querier Timeout The amount of time to wait in the Non-Querier operational state before moving to a

Querier state.

When you specify a value for < vlanid >, the following additional information appears.


VLAN Admin

Mode

Indicates whether iGMP Snooping Querier is active on the VLAN.

VLAN

Operational

State

VLAN

Operational

Max Response

Time

Indicates whether IGMP Snooping Querier is in “Querier” or “Non-Querier” state. When the switch is in Querier state, it will send out periodic general queries. When in Non-

Querier state, it will wait for moving to Querier state and does not send out any queries.

Indicates the time to wait before removing a Leave from a host upon receiving a Leave request. This value is calculated dynamically from the Queries received from the network. If the Snooping Switch is in Querier state, then it is equal to the configured value.

Querier Election

Participation

Indicates whether the IGMP Snooping Querier participates in querier election if it discovers the presence of a querier in the VLAN.

Querier VLAN

Address

The IP address will be used in the IPv4 header while sending out IGMP queries on this

VLAN. It can be configured using the appropriate command.

Operational

Version

The version of IPv4 will be used while sending out IGMP queries on this VLAN.



Field

Last Querier

Address

Last Querier

Version

Description

Indicates the IP address of the most recent Querier from which a Query was received.

Indicates the IGMP version of the most recent Querier from which a Query was received on this VLAN.

When the optional argument detail is used, the command shows the global information and the information for all Querier-enabled VLANs.

MLD Snooping Commands

This section describes commands used for MLD Snooping. In IPv4, Layer 2 switches can use

IGMP Snooping to limit the flooding of multicast traffic by dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded only to those interfaces associated with IP multicast addresses. In IPv6, MLD Snooping performs a similar function. With MLD Snooping, IPv6 multicast data is selectively forwarded to a list of ports that want to receive the data, instead of being flooded to all ports in a VLAN. This list is constructed by snooping IPv6 multicast control packets.

set mld

This command enables MLD Snooping on the system (Global Config Mode) or an Interface

(Interface Config Mode). This command also enables MLD Snooping on a particular VLAN and enables MLD Snooping on all interfaces participating in a VLAN.

If an interface has MLD Snooping enabled and you enable this interface for routing or enlist it as a member of a port-channel (LAG), MLD Snooping functionality is disabled on that interface. MLD

Snooping functionality is re-enabled if you disable routing or remove port channel (LAG) membership from an interface that has MLD Snooping enabled.

MLD Snooping supports the following activities:

• Validation of address version, payload length consistencies and discarding of the frame upon error.

• Maintenance of the forwarding table entries based on the MAC address versus the IPv6 address.

• Flooding of unregistered multicast data packets to all ports in the VLAN.



Default

Format

Mode

Default

Format

Mode disabled set mld

Global Config

Interface Config disabled set mld <vlanid>

VLAN Mode no set mld

Use this command to disable MLD Snooping on the system.

Format

Mode

Format

Mode no set mld

Global Config

Interface Config no set mld <vlanid>

VLAN Mode set mld interfacemode

Use this command to enable MLD Snooping on all interfaces. If an interface has MLD Snooping enabled and you enable this interface for routing or enlist it as a member of a port-channel (LAG),

MLD Snooping functionality is disabled on that interface. MLD Snooping functionality is reenabled if you disable routing or remove port-channel (LAG) membership from an interface that has MLD Snooping enabled.

Default

Format

Mode disabled set mld interfacemode

Global Config


no set mld interfacemode

Global Config


no set mld interfacemode

Use this command to disable MLD Snooping on all interfaces.

Format

Mode set mld fast-leave

Use this command to enable MLD Snooping fast-leave admin mode on a selected interface or

VLAN. Enabling fast-leave allows the switch to immediately remove the Layer 2 LAN interface from its forwarding table entry upon receiving and MLD done message for that multicast group without first sending out MAC-based general queries to the interface.

Note: You should enable fast-leave admin mode only on VLANs where only one host is connected to each Layer 2 LAN port. This prevents the inadvertent dropping of the other hosts that were connected to the same layer 2 LAN port but were still interested in receiving multicast traffic directed to that group.

Note: Fast-leave processing is supported only with MLD version 1 hosts.

Default

Format

Mode

Default

Format

Mode disabled set mld fast-leave <vlanid>

• VLAN Mode disabled set mld fast-leave




no set mld fast-leave

Use this command to disable MLD Snooping fast-leave admin mode on a selected interface.

Format

Mode

Format

Mode no set mld fast-leave <vlanid>

• VLAN Mode no set mld fast-leave <vlanid>

• Interface Config set mld groupmembership-interval

Use this command to set the MLD Group Membership Interval time on a VLAN, one interface or all interfaces. The Group Membership Interval time is the amount of time in seconds that a switch waits for a report from a particular group on a particular interface before deleting the interface from the entry. This value must be greater than the MLDv2 Maximum Response time value. The range is 2 to 3600 seconds.

Default

Format

Mode

Default

Format

Mode

260 seconds set mld groupmembership-interval <vlanid> <2-3600>

• VLAN Mode

260 seconds set mld groupmembership-interval <2-3600>


• Global Config no set groupmembership-interval

Use this command to set the MLDv2 Group Membership Interval time to the default value.

Format

Mode no set mld groupmembership-interval <vlanid>

• VLAN Mode



Format

Mode no set mld groupmembership-interval


• Global Config set mld maxresponse

Use this command to set the MLD Maximum Response time for the system, on a particular interface or VLAN. The Maximum Response time is the amount of time in seconds that a switch will wait after sending a query on an interface because it did not receive a report for a particular group in that interface. This value must be less than the MLD Query Interval time value. The range is 1 to 65 seconds.

Default

Format

Mode

Default

Format

Mode

10 seconds set mld maxresponse <1-65>

• Global Config


10 seconds set mld maxresponse <vlanid> <1-65>

• VLAN Mode no set mld maxresponse

Use this command to set the max response time (on the interface or VLAN) to the default value.

Format

Mode

Format

Mode no set mld maxresponse

• Global Config

• Interface Config no set mld maxresponse <vlanid>

• VLAN Mode


Default

Format

Mode


set mld mcrtexpiretime

Use this command to set the Multicast Router Present Expiration time. The time is set for the system, on a particular interface or VLAN. This is the amount of time in seconds that a switch waits for a query to be received on an interface before the interface is removed from the list of interfaces with multicast routers attached. The range is 0 to 3600 seconds. A value of 0 indicates an infinite timeout, i.e. no expiration.

Default

Format

Mode

0 set mld mcrtexpiretime <0-3600>

• Global Config


0 set mld mcrtexpiretime <vlanid> <0-3600>

• VLAN Config no set mld mcrtexpiretime

Use this command to set the Multicast Router Present Expiration time to 0. The time is set for the system, on a particular interface or a VLAN.

Format

Mode

Format

Mode no set mld mcrtexpiretime

• Global Config

• Interface Config no set mld mcrtexpiretime <vlanid>

• VLAN Mode set mld mrouter

Use this command to configure the VLAN ID for the VLAN that has the multicast router attached mode enabled.

Format

Mode set mld mrouter <vlanid>

Interface Config


3-158

no set mld mrouter <vlanid>

Interface Config


no set mld mrouter

Use this command to disable multicast router attached mode for a VLAN with a particular VLAN

ID.

Format

Mode set mld mrouter interface

Use this command to configure the interface as a multicast router-attached interface. When configured as a multicast router interface, the interface is treated as a multicast router-attached interface in all VLANs.

Default

Format

Mode disabled set mld mrouter interface

Interface Config no set mld mrouter interface

Use this command to disable the status of the interface as a statically configured multicast routerattached interface.

Format

Mode no set mld mrouter interface

Interface Config show mldsnooping

Use this command to display MLD Snooping information. Configured information is displayed whether or not MLD Snooping is enabled.

Format

Mode show mldsnooping [<unit/slot/port> | <vlanid>]

Privileged EXEC



When the optional arguments <unit/slot/port> or <vlanid> are not used, the command displays the following information.

Term Definition

Admin Mode

Interfaces

Enabled for

MLD Snooping

MLD Control

Frame Count

Indicates whether or not MLD Snooping is active on the switch.

Interfaces on which MLD Snooping is enabled.

Displays the number of MLD Control frames that are processed by the CPU.

VLANs Enabled for MLD

Snooping

VLANs on which MLD Snooping is enabled.

When you specify the <unit/slot/port> values, the following information displays.

Term Definition

MLD Snooping

Admin Mode

Fast Leave

Mode

Group

Membership

Interval

Max Response

Time

Multicast

Router Expiry

Time

Indicates whether MLD Snooping is active on the interface.

Indicates whether MLD Snooping Fast Leave is active on the VLAN.

Shows the amount of time in seconds that a switch will wait for a report from a particular group on a particular interface, which is participating in the VLAN, before deleting the interface from the entry. This value may be configured.

Displays the amount of time the switch waits after it sends a query on an interface, participating in the VLAN, because it did not receive a report for a particular group on that interface. This value may be configured.

Displays the amount of time to wait before removing an interface that is participating in the VLAN from the list of interfaces with multicast routers attached. The interface is removed if a query is not received. This value may be configured.

When you specify a value for <vlanid> , the following information appears.

Term

VLAN Admin

Mode

Definition

Indicates whether MLD Snooping is active on the VLAN.



show mldsnooping mrouter

Use this command to display information about statically configured multicast router attached interfaces.

Format

Mode

Term

Interface

Multicast

Router

Attached

VLAN ID show mldsnooping mrouter <unit/slot/port>

Privileged EXEC

Definition

Shows the interface on which multicast router information is being displayed.

Indicates whether multicast router is statically enabled on the interface.

Displays the list of VLANs of which the interface is a member.

show mldsnooping mrouter vlan

Use this command to display information about statically configured multicast router-attached interfaces.

Format

Mode

Term

Interface

VLAN ID show mldsnooping mrouter vlan <unit/slot/port>

Privileged EXEC

Definition

Shows the interface on which multicast router information is being displayed.

Displays the list of VLANs of which the interface is a member.

show mac-address-table mldsnooping

Use this command to display the MLD Snooping entries in the Multicast Forwarding Database

(MFDB) table.

Format

Mode show mac-address-table mldsnooping

Privileged EXEC



Term Definition

MAC Address A multicast MAC address for which the switch has forwarding or filtering information. The format is two-digit hexadecimal numbers that are separated by colons, for example

33:33:45:67:89:AB. In an IVL system, the MAC address is displayed as a MAC address and a VLAN ID combination of 8 bytes.

Type

Description

The type of entry, which is either static (added by the user) or dynamic (added to the table as a result of a learning process or protocol.)


Interfaces The list of interfaces that are designated for forwarding (Fwd:) and filtering (Flt:).

MLD Snooping Querier Commands

In an IPv6 environment, MLD Snooping requires that one central switch or router periodically query all end-devices on the network to announce their multicast memberships. This central device is the MLD Querier. The MLD query responses, known as MLD reports, keep the switch updated with the current multicast group membership on a port-by-port basis. If the switch does not receive updated membership information in a timely fashion, it will stop forwarding multicasts to the port where the end device is located.

This section describes the commands you use to configure and display information on MLD

Snooping queries on the network and, separately, on VLANs.

set mld querier

Use this command to enable MLD Snooping Querier on the system (Global Config Mode) or on a

VLAN. Using this command, you can specify the IP address that the snooping querier switch should use as a source address while generating periodic queries.

If a VLAN has MLD Snooping Querier enabled and MLD Snooping is operationally disabled on it, MLD Snooping Querier functionality is disabled on that VLAN. MLD Snooping functionality is re-enabled if MLD Snooping is operational on the VLAN.

The MLD Snooping Querier sends periodic general queries on the VLAN to solicit membership reports.

Default disabled


Format

Mode

Default

Format

Mode


set mld querier <address ipv6_address >

• Global Config disabled set mld querier [< vlan-id >] [address ipv6_address ]

• VLAN Mode no set mld querier

Use this command to disable MLD Snooping Querier on the system. Use the optional parameter address to reset the querier address.

Format

Mode

Format

Mode no set mld querier address

• Global Config no set mld querier < vlan-id > address <ipv6_address>

• VLAN Mode set mld querier query_interval

Use this command to set the MLD Querier Query Interval time. It is the amount of time in seconds that the switch waits before sending another general query.

Default

Format

Mode disabled set mld querier query_interval <1-18000>

Global Config no set mld querier query_interval

Use this command to set the MLD Querier Query Interval time to its default value.

Format

Mode no set mld querier query_interval

Global Config



set mld querier timer expiry

Use this command to set the MLD Querier timer expiration period. It is the time period that the switch remains in Non-Querier mode once it has discovered that there is a Multicast Querier in the network.

Default

Format

Mode

60 seconds set mld querier timer expiry <60-300>

Global Config no set mld querier timer expiry

Use this command to set the MLD Querier timer expiration period to its default value.

Format

Mode no set mld querier timer expiry

Global Config set mld querier election participate

Use this command to enable the Snooping Querier to participate in the Querier Election process when it discovers the presence of another Querier in the VLAN. When this mode is enabled, if the

Snooping Querier finds that the other Querier’s source address is better (less) than the Snooping

Querier’s address, it stops sending periodic queries. If the Snooping Querier wins the election, then it will continue sending periodic queries.

Default

Format

Mode disabled set mld querier election participate <vlanid>

VLAN Config no set mld querier election participate

Use this command to set the snooping querier not to participate in querier election but go into a non-querier mode as soon as it discovers the presence of another querier in the same VLAN.



Format

Mode no set mld querier election participate <vlanid>

VLAN Config show mldsnooping querier

Use this command to display MLD Snooping Querier information. Configured information is displayed whether or not MLD Snooping Querier is enabled.

Format

Mode show mldsnooping querier [{detail | vlan < vlanid >}]

Privileged EXEC

When the optional arguments < vlandid > are not used, the command displays the following information.


Admin Mode

Querier

Address

Indicates whether or not MLD Snooping Querier is active on the switch.

Admin Version Indicates the version of MLD that will be used while sending out the queries. This is defaulted to MLD v1 and it cannot be changed.

Shows the IP address which will be used in the IPv6 header while sending out MLD queries. It can be configured using the appropriate command.

Query Interval Shows the amount of time in seconds that a Snooping Querier waits before sending out the periodic general query.

Querier Timeout Displays the amount of time to wait in the Non-Querier operational state before moving to a Querier state.

When you specify a value for < vlanid >, the following information appears.

Field

VLAN Admin

Mode

VLAN

Operational

State

Description

Indicates whether MLD Snooping Querier is active on the VLAN.

Indicates whether MLD Snooping Querier is in “ Querier ” or “ Non-Querier ” state.

When the switch is in Querier state, it will send out periodic general queries. When in

Non-Querier state, it will wait for moving to Querier state and does not send out any queries.




VLAN

Operational

Max Response

Time

Indicates the time to wait before removing a Leave from a host upon receiving a Leave request. This value is calculated dynamically from the Queries received from the network. If the Snooping Switch is in Querier state, then it is equal to the configured value.

Querier Election

Participate

Indicates whether the MLD Snooping Querier participates in querier election if it discovers the presence of a querier in the VLAN.

Querier VLAN

Address

The IP address will be used in the IPv6 header while sending out MLD queries on this

VLAN. It can be configured using the appropriate command.

This version of IPv6 will be used while sending out MLD queriers on this VLAN.

Operational

Version

Last Querier

Address

Indicates the IP address of the most recent Querier from which a Query was received.

Last Querier

Version

Indicates the MLD version of the most recent Querier from which a Query was received on this VLAN.

When the optional argument detail is used, the command shows the global information and the information for all Querier-enabled VLANs.

Port Security Commands

This section describes the command you use to configure Port Security on the switch. Port security, which is also known as port MAC locking, allows you to secure the network by locking allowable MAC addresses on a port. Packets with a matching source MAC address are forwarded normally, and all other packets are discarded.

Note: To enable the SNMP trap specific to port security, see “snmp-server enable traps violation” on page 10-44 .


3-166


port-security

This command enables port locking at the system level (Global Config) or port level (Interface

Config)

.

Default

Format

Mode disabled port-security

• Global Config

• Interface Config no port-security

This command disables port locking for one (Interface Config) or all (Global Config) ports.

Format

Mode no port-security

• Global Config

• Interface Config port-security max-dynamic

This command sets the maximum number of dynamically locked MAC addresses allowed on a specific port.

Default

Format

Mode

600 port-security max-dynamic <maxvalue>

Interface Config no port-security max-dynamic

This command resets the maximum number of dynamically locked MAC addresses allowed on a specific port to its default value.

Format

Mode no port-security max-dynamic

Interface Config



port-security max-static

This command sets the maximum number of statically locked MAC addresses allowed on a port.

Default

Format

Mode

20 port-security max-static <maxvalue>

Interface Config no port-security max-static

This command sets maximum number of statically locked MAC addresses to the default value.

Format

Mode no port-security max-static

Interface Config port-security mac-address

This command adds a MAC address to the list of statically locked MAC addresses. The <vid> is the VLAN ID.

Format

Mode port-security mac-address <mac-address> <vid>

Interface Config no port-security mac-address

This command removes a MAC address from the list of statically locked MAC addresses.

Format

Mode no port-security mac-address <mac-address> <vid>

Interface Config


3-168


port-security mac-address move

This command converts dynamically locked MAC addresses to statically locked addresses.

Format

Mode port-security mac-address move

Interface Config show port-security

This command displays the port-security settings. If you do not use a parameter, the command displays the settings for the entire system. Use the optional parameters to display the settings on a specific interface or on all interfaces.

Format

Mode show port-security [{<unit/slot/port> | all}]

Privileged EXEC

Term

Admin Mode

Definition

Port Locking mode for the entire system. This field displays if you do not supply any parameters.

For each interface, or for the interface you specify, the following information appears:

Term Definition

Admin Mode Port Locking mode for the Interface.

Dynamic Limit Maximum dynamically allocated MAC Addresses.

Static Limit

Violation Trap

Mode

Maximum statically allocated MAC Addresses.

Whether violation traps are enabled.

show port-security dynamic

This command displays the dynamically locked MAC addresses for the port.

Format

Mode show port-security dynamic <unit/slot/port>

Privileged EXEC



Term Definition

MAC Address MAC Address of dynamically locked MAC.

show port-security static

This command displays the statically locked MAC addresses for port.

Format

Mode show port-security static <unit/slot/port>

Privileged EXEC

Term Definition

MAC Address MAC Address of statically locked MAC.

show port-security violation

This command displays the source MAC address of the last packet discarded on a locked port.

Format

Mode show port-security violation <unit/slot/port>

Privileged EXEC

Term Definition

MAC Address MAC Address of discarded packet on locked port.

LLDP (802.1AB) Commands

This section describes the command you use to configure Link Layer Discovery Protocol (LLDP), which is defined in the IEEE 802.1AB specification. LLDP allows stations on an 802 LAN to advertise major capabilities and physical descriptions. The advertisements allow a network management system (NMS) to access and display this information.



lldp transmit

Use this command to enable the LLDP advertise capability.

Default

Format

Mode enabled lldp transmit

Interface Config no lldp transmit

Use this command to return the local data transmission capability to the default.

Format

Mode no lldp transmit

Interface Config lldp receive

Use this command to enable the LLDP receive capability.

Default

Format

Mode enabled lldp receive

Interface Config no lldp receive

Use this command to return the reception of LLDPDUs to the default value.

Format

Mode no lldp receive

Interface Config lldp timers

Use this command to set the timing parameters for local data transmission on ports enabled for

LLDP. The <interval-seconds> determines the number of seconds to wait between transmitting local data LLDPDUs. The range is 1-32768 seconds. The <hold-value> is the



multiplier on the transmit interval that sets the TTL in local data LLDPDUs. The multiplier range is 2-10. The <reinit-seconds> is the delay before re-initialization, and the range is 1-0 seconds.

Default

Format

Mode

• interval—30 seconds

• hold—4

• reinit—2 seconds lldp timers [interval <interval-seconds>] [hold <hold-value>] [reinit

<reinit-seconds>

]

Global Config no lldp timers

Use this command to return any or all timing parameters for local data transmission on ports enabled for LLDP to the default values.

Format

Mode no lldp timers [interval] [hold] [reinit]

Global Config lldp transmit-tlv

Use this command to specify which optional type length values (TLVs) in the 802.1AB basic management set are transmitted in the LLDPDUs. Use sys-name to transmit the system name

TLV. To configure the system name, see “snmp-server” on page 10-41 . Use sys-desc to transmit the system description TLV. Use sys-cap to transmit the system capabilities TLV. Use portdesc to transmit the port description TLV. To configure the port description, see See

“description” on page 5.

Default

Format

Mode all optional TLVs are included lldp transmit-tlv [sys-desc] [sys-name] [sys-cap] [port-desc]

Interface Config


3-172


no lldp transmit-tlv

Use this command to remove an optional TLV from the LLDPDUs. Use the command without parameters to remove all optional TLVs from the LLDPDU.

Format

Mode no lldp transmit-tlv [sys-desc] [sys-name] [sys-cap] [port-desc]

Interface Config lldp transmit-mgmt

Use this command to include transmission of the local system management address information in the LLDPDUs.

Format

Mode lldp transmit-mgmt

Interface Config no lldp transmit-mgmt

Use this command to include transmission of the local system management address information in the LLDPDUs. Use this command to cancel inclusion of the management information in

LLDPDUs.

Format

Mode no lldp transmit-mgmt

Interface Config lldp notification

Use this command to enable remote data change notifications.

Default

Format

Mode disabled lldp notification

Interface Config



no lldp notification

Use this command to disable notifications.

Default

Format

Mode disabled no lldp notification

Interface Config lldp notification-interval

Use this command to configure how frequently the system sends remote data change notifications.

The <interval> parameter is the number of seconds to wait between sending notifications. The valid interval range is 5-3600 seconds.

Default

Format

Mode

5 lldp notification-interval <interval>

Global Config no lldp notification-interval

Use this command to return the notification interval to the default value.

Format

Mode no lldp notification-interval

Global Config clear lldp statistics

Use this command to reset all LLDP statistics, including MED-related information.

Format

Mode clear lldp statistics

Privileged Exec



clear lldp remote-data

Use this command to delete all information from the LLDP remote data table, including MEDrelated information.

Format

Mode clear lldp remote-data

Global Config show lldp

Use this command to display a summary of the current LLDP configuration.

Format

Mode show lldp

Privileged Exec

Term Definition

Transmit

Interval

Transmit Hold

Multiplier

How frequently the system transmits local data LLDPDUs, in seconds.

The multiplier on the transmit interval that sets the TTL in local data LLDPDUs.

Re-initialization

Delay

The delay before re-initialization, in seconds.

Notification

Interval

How frequently the system sends remote data change notifications, in seconds.

show lldp interface

Use this command to display a summary of the current LLDP configuration for a specific interface or for all interfaces.

Format

Mode show lldp interface {<unit/slot/port> | all}

Privileged Exec

Term

Interface

Link

Definition

The interface in a unit/slot/port format.




Term

Transmit

Receive

Notify

TLVs

Mgmt

Definition

Shows whether the interface transmits LLDPDUs.

Shows whether the interface receives LLDPDUs.

Shows whether the interface sends remote data change notifications.

Shows whether the interface sends optional TLVs in the LLDPDUs. The TLV codes can be 0 (Port Description), 1 (System Name), 2 (System Description), or 3 (System

Capability).

Shows whether the interface transmits system management address information in the

LLDPDUs.

show lldp statistics

Use this command to display the current LLDP traffic and remote table statistics for a specific interface or for all interfaces.

Format

Mode show lldp statistics {<unit/slot/port> | all}

Privileged Exec

Term Definition

Last Update

Total Inserts

Total Deletes

The amount of time since the last update to the remote table in days, hours, minutes, and seconds.

Total number of inserts to the remote data table.

Total number of deletes from the remote data table.

Total Drops Total number of times the complete remote data received was not inserted due to insufficient resources.

Total Ageouts Total number of times a complete remote data entry was deleted because the Time to

Live interval expired.

The table contains the following column headings:

Term Definition

Interface The interface in unit/slot/port format.

Transmit Total Total number of LLDP packets transmitted on the port.

Receive Total Total number of LLDP packets received on the port.

Discards Total number of LLDP frames discarded on the port for any reason.



Term Definition

Errors

Ageouts

The number of invalid LLDP frames received on the port.

Total number of times a complete remote data entry was deleted for the port because the

Time to Live interval expired.

TLV Discards The number of TLVs discarded.

TLV Unknowns Total number of LLDP TLVs received on the port where the type value is in the reserved range, and not recognized.

TLV MED Total number of LLDP MED TLVs received on the local ports.

TVL802.1

TVL802.3

Total number of 802.1 LLDP TLVs received on the local ports.

Total number of 802.3 LLDP TLVs received on the local ports.

show lldp remote-device

Use this command to display summary information about remote devices that transmit current

LLDP data to the system. You can show information about LLDP remote data received on all ports or on a specific port.

Format

Mode show lldp remote-device {<unit/slot/port> | all}

Privileged EXEC

Term Definition

Local Interface The interface that received the LLDPDU from the remote device.

RemID An internal identifier to the switch to mark each remote device to the system.

Chassis ID The ID that is sent by a remote device as part of the LLDP message, it is usually a MAC address of the device.

Port ID The port number that transmitted the LLDPDU.

System Name The system name of the remote device.



3-177


(switch) #show lldp remote-device all

LLDP Remote Device Summary

Local

Interface RemID Chassis ID Port ID System Name

------- ------- -------------------- ------------------ ------------------

0/1

0/2

0/3

0/4

0/5

0/6

0/7 2 00:FC:E3:90:01:0F 00:FC:E3:90:01:11

0/7 3 00:FC:E3:90:01:0F 00:FC:E3:90:01:12

0/7 4 00:FC:E3:90:01:0F 00:FC:E3:90:01:13

0/7 5 00:FC:E3:90:01:0F 00:FC:E3:90:01:14

0/7 1 00:FC:E3:90:01:0F 00:FC:E3:90:03:11

0/7 6 00:FC:E3:90:01:0F 00:FC:E3:90:04:11

0/8

0/9

0/10

0/11

0/12

--More-- or (q)uit show lldp remote-device detail

Use this command to display detailed information about remote devices that transmit current

LLDP data to an interface on the system.

Format

Mode show lldp remote-device detail <unit/slot/port>

Privileged EXEC

Term Definition

Local Interface The interface that received the LLDPDU from the remote device.

Remote

Identifier

An internal identifier to the switch to mark each remote device to the system.

Chassis ID

Subtype

The type of identification used in the Chassis ID field.

Chassis ID The chassis of the remote device.

Port ID Subtype The type of port on the remote device.


3-178


Term Definition


System Name The system name of the remote device.

System

Description

Describes the remote system by identifying the system name and versions of hardware, operating system, and networking software supported in the device.

Describes the port in an alpha-numeric format. The port description is configurable.

Port

Description

System

Capabilities

Supported

Indicates the primary function(s) of the device.

System

Capabilities

Enabled

Management

Address

Time To Live

Shows which of the supported system capabilities are enabled.

For each interface on the remote device with an LLDP agent, lists the type of address the remote LLDP agent uses and specifies the address used to obtain information related to the device.

The amount of time (in seconds) the remote device's information received in the

LLDPDU should be treated as valid information.


(Switch) #show lldp remote-device detail 0/7

LLDP Remote Device Detail

Local Interface: 0/7

Remote Identifier: 2

Chassis ID Subtype: MAC Address

Chassis ID: 00:FC:E3:90:01:0F

Port ID Subtype: MAC Address

Port ID: 00:FC:E3:90:01:11

System Name:

System Description:

Port Description:

System Capabilities Supported:

System Capabilities Enabled:

Time to Live: 24 seconds



show lldp local-device

Use this command to display summary information about the advertised LLDP local data. This command can display summary information or detail for each interface.

Format

Mode show lldp local-device {<unit/slot/port> | all}

Privileged EXEC

Term

Interface

Port ID

Port

Description

Definition


The port ID associated with this interface.

The port description associated with the interface.

show lldp local-device detail

Use this command to display detailed information about the LLDP data a specific interface transmits.

Format

Mode show lldp local-device detail <unit/slot/port>

Privileged EXEC

Term Definition

Interface

Chassis ID

Subtype

The interface that sends the LLDPDU.

The type of identification used in the Chassis ID field.

Chassis ID The chassis of the local device.

Port ID Subtype The type of port on the local device.


System Name The system name of the local device.

System

Description

Describes the local system by identifying the system name and versions of hardware, operating system, and networking software supported in the device.

Port

Description

System

Capabilities

Supported

Describes the port in an alpha-numeric format.

Indicates the primary function(s) of the device.



Term

System

Capabilities

Enabled

Management

Address

Definition

Shows which of the supported system capabilities are enabled.

The type of address and the specific address the local LLDP agent uses to send and receive information.

LLDP-MED Commands

Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED) (ANSI-TIA-1057) provides an extension to the LLDP standard. Specifically, LLDP-MED provides extensions for network configuration and policy, device location, Power over Ethernet (PoE) management and inventory management.

lldp med

Use this command to enable MED. By enabling MED, you will be effectively enabling the transmit and receive function of LLDP.

Default

Format

Mode enabled lldp med

Interface Config no lldp med

Use this command to disable MED.

Format

Mode no lldp med

Interface Config


3-181


lldp med confignotification

Use this command to configure all the ports to send the topology change notification.

Default

Format

Mode enabled lldp med confignotification

Interface Config no ldp med confignotification

Use this command to disable notifications.

Format

Mode no lldp med confignotification

Interface Config lldp med transmit-tlv

Use this command to specify which optional Type Length Values (TLVs) in the LLDP MED set will be transmitted in the Link Layer Discovery Protocol Data Units (LLDPDUs).

Default

Format

Mode

By default, the capabilities and network policy TLVs are included.

lldp med transmit-tlv [capabilities] [ex-pd] [ex-pse] [inventory]

[location] [network-policy]

Interface Config

Term Definition capabilities ex-pd ex-pse

Transmit the LLDP capabilities TLV.

Transmit the LLDP extended PD TLV.

Transmit the LLDP extended PSE TLV.

inventory location

Transmit the LLDP inventory TLV.

Transmit the LLDP location TLV.

network-policy Transmit the LLDP network policy TLV.



no lldp med transmit-tlv

Use this command to remove a TLV.

Format

Mode no lldp med transmit-tlv [capabilities] [network-policy] [ex-pse]

[ex-pd] [location] [inventory]

Interface Config lldp med all

Use this command to configure LLDP-MED on all the ports

Format

Mode lldp med all

Global Config no lldp med all

Use this command to remove LLDP-MD on all ports.

Format

Mode no lldp med all

Global Config lldp med confignotification all

Use this command to configure all the ports to send the topology change notification.

Format

Mode lldp med confignotification all

Global Config no lldp med confignotification all

Use this command to disable all the ports to send the topology change notification.

Format

Mode no lldp med confignotification all

Global Config


3-183


lldp med faststartrepeatcount

Use this command to set the value of the fast start repeat count. [count] is the number of LLDP

PDUs that will be transmitted when the product is enabled. The range is 1 to 10.

Default

Format

Mode

3 lldp med faststartrepeatcount [count]

Global Config no lldp med faststartrepeatcount

Use this command to return to the factory default value.

Format

Mode no lldp med faststartrepeatcount

Global Config lldp med transmit-tlv all

Use this command to specify which optional Type Length Values (TLVs) in the LLDP MED set will be transmitted in the Link Layer Discovery Protocol Data Units (LLDPDUs).

Default

Format

Mode

By default, the capabilities and network policy TLVs are included.

lldp med transmit-tlv all [capabilities] [ex-pd] [ex-pse] [inventory]

[location] [network-policy]

Global Config

Term Definition capabilities ex-pd ex-pse

Transmit the LLDP capabilities TLV.

Transmit the LLDP extended PD TLV.

Transmit the LLDP extended PSE TLV.

inventory location

Transmit the LLDP inventory TLV.

Transmit the LLDP location TLV.

network-policy Transmit the LLDP network policy TLV.



no lldp med transmit-tlv

Use this command to remove a TLV.

Format

Mode no lldp med transmit-tlv all [capabilities] [network-policy] [ex-pse]

[ex-pd] [location] [inventory]

Global Config show lldp med

Use this command to display a summary of the current LLDP MED configuration.

Format

Mode show lldp med

Privileged Exec

Term

Fast Start

Repeat Count

Device Class

Definition

The number of LLDP PDUs that will be transmitted when the protocl is enabled.

The local device’s MED Classification. There are four different kinds of devices, three of them represent the actual end points (classified as Class I Generic[IP Communication

Controller etc.], Class II Media Conference Bridge etc.], Class III Communication [IP

Telephone etc.]. Class IV Network Connectivity Device, which is typically a LAN Switch,

Router, IEEE 802.11 Wireless Access Point, etc.


(switch) #show lldp med

LLDP MED Global Configuration

Fast Start Repeat Count: 3

Device Class: Network Connectivity

(switch) #



show lldp med interface

Use this command to display a summary of the current LLDP MED configuration for a specific interface.

<unit/slot/port> indicates a specific physical interface. all indicates all valid

LLDP interfaces.

Format

Mode show lldp med interface {<unit/slot/port> | all}

Privileged Exec

Term

Interface

Link

ConfigMED

OperMED

ConfigNotify

TLVsTx

Definition



Shows if the LLPD-MED mode is enabled or disabled on this interface

Shows if the LLPD-MED TLVs are transmitted or not on this interface.

Shows if the LLPD-MED topology notification mode of this interface.

Shows whether the interface sends optional TLVs in the LLDPDUs. The TLV codes can be 0 (Capabilities), 1 (Network Policy), 2 (Location), 3 (Extended PSE), 4

(Extended Pd), or 5 (Inventory).


(Switch) #show lldp med interface all

Interface Link configMED operMED ConfigNotify TLVsTx

--------- ------ --------- -------- ------------ -----------

1/0/1 Down Disabled Disabled Disabled 0,1

1/0/2 Up Disabled Disabled Disabled 0,1















TLV Codes: 0- Capabilities, 1- Network Policy

2- Location, 3- Extended PSE

4- Extended Pd, 5- Inventory

--More-- or (q)uit

(Switch) #show lldp med interface 1/0/2

Interface Link configMED operMED ConfigNotify TLVsTx

--------- ------ --------- -------- ------------ -----------

1/0/2 Up Disabled Disabled Disabled 0,1

TLV Codes: 0- Capabilities, 1- Network Policy

2- Location, 3- Extended PSE

4- Extended Pd, 5- Inventory

(Routing) # show lldp med local-device detail

This command displays detailed information about the LLDP data a specific interface transmits.

Format

Mode show lldp med local-device detail <unit/slot/port>

Privileged EXEC

Term

Media Application

Type

Vlan ID

Priority

DSCP

Unknown

Tagged

Hardware Rev

Firmware Rev

Software Rev

Serial Num

Mfg Name

Model Name

Definition

Shows the application type. Types are unknown, voice, voicesignaling, guestvoice, guestvoicesignaling, sfotphonevoice, videoconferencing, streamingvideo, videosignaling.

Shows the VLAN id associated with a particular policy type

Shows the priority associated with a particular policy type.

Shows the DSCP associated with a particular policy type.

Indicates if the policy type is unknown. In this case, the VLAN ID, Priority and DSCP are ignored.

Indicates if the policy type is using tagged or untagged VLAN.

Shows the local hardware version.

Shows the local firmware version.

Shows the local software version.

Shows the local serial number.

Shows the manufacture name.

Shows the model name.




(Switch) #show lldp med local-device detail 1/0/8

LLDP MED Local Device Detail

Interface: 1/0/8

Network Policies

Media Policy Application Type : voice

Vlan ID: 10

Priority: 5

DSCP: 1

Unknown: False

Tagged: True

Media Policy Application Type : streamingvideo

Vlan ID: 20

Priority: 1

DSCP: 2

Unknown: False

Tagged: True

Inventory

Hardware Rev: xxx xxx xxx

Firmware Rev: xxx xxx xxx

Software Rev: xxx xxx xxx

Serial Num: xxx xxx xxx

Mfg Name: xxx xxx xxx

Model Name: xxx xxx xxx

Asset ID: xxx xxx xxx

Location

Subtype: elin

Info: xxx xxx xxx

Extended POE

Device Type: pseDevice

Extended POE PSE

Available: 0.3 Watts

Source: primary

Priority: critical

Extended POE PD

Required: 0.2 Watts



Source: local

Priority: low show lldp med remote-device

This command displays summary information about remote devices that transmit current LLDP

MED data to the system. You can show information about LLDP remote data received on all ports or on a specific port.

Format

Mode show lldp med remote-device {<unit/slot/port> | all}

Privileged EXEC

Term

Interface

Device Class

Definition


The Remote device’s MED Classification. There are four different kinds of devices, three of them represent the actual end points (classified as Class I Generic [IP Communication

Controller etc.], Class II Media [Conference Bridge etc.], Class III Communication [IP

Telephone etc]). The fourth device is Network Connectivity Device, which is typically a

LAN Switch/Router, IEEE 802.1 Bridge, IEEE 802.11 Wireless Access Point etc.


(Switch) #show lldp med remote-device all

LLDP MED Remote Device Summary

Local

Interface Remote ID Device Class

--------- --------- ------------

1/0/8

1/0/9

1

2

1/0/10 3

Class I

Not Defined

1/0/11 4

1/0/12 5 Network Con



show lldp med remote-device detail

Use this command to display detailed information about remote devices that transmit current

LLDP MED data to an interface on the system.

Format

Mode show lldp med remote-device detail <unit/slot/port>

Privileged EXEC

Term Definition

Supported

Capabilities

DSCP

Unknown

Tagged

Hardware

Revision

Shows the suppoted capabilities that were received in MED TLV on this port.

Enabled capabilities

Device Class

Network Policy

Information

Media

Application

Type

VLAN Id

Priority

Shows the enabled capabilities that were enabled in MED TLV on this port.

Shows the device class as advertized by the device remotely connected to the port.

Shows if network policy TLV is received in the LLDP frames on this port.

Shows the application type. Types of applications are unknown, voice, voicesignaling, guestvoice, guestvoicesignaling, sfotphonevoice, videoconferencing, streamingvideo, videosignaling.

Shows the VLAN id associated with a particular policy type.

Shows the priority associated with a particular policy type.

Shows the DSCP associated with a particular policy type.

Indicates if the policy type is unknown. In this case, the VLAN id, Priority and DSCP are ignored.

Indicates if the policy type is using tagged or untagged VLAN.

Shows the hardware version of the remote device.

Firmware

Revision

Software

Revision

Shows the firmware version of the remote device.

Shows the software version of the remote device.

Serial Number Shows the serial number of the remote device.

Manufacturer

Name

Shows the manufacture name of the remote device.

Model Name

Asset ID

Shows the model name of the remote device.

Shows the asset id of the remote device.



Term

Sub Type

Location

Information

Device Type

Available

Source

Priority

Required

Source

Priority

Definition

Shows the type of location information.

Shows the location information as a string for a given type of location id

Shows the remote device’s PoE device type connected to this port.

Shows the romote port’s PSE power value in tenths of a watt.

Shows the remote port’s PSE power source.

Shows the remote port’s PSE priority.

Shows the remote port’s PD power requirement.

Shows the remote port’s PD power source.

Shows the remote port’s PD power priority.


(Switch) #show lldp med remote-device detail 1/0/8

LLDP MED Remote Device Detail

Local Interface: 1/0/8

Remote Identifier: 18

Capabilities

MED Capabilities Supported: capabilities, networkpolicy, location, extendedpse

MED Capabilities Enabled: capabilities, networkpolicy

Device Class: Endpoint Class I

Network Policies

Media Policy Application Type : voice

Vlan ID: 10

Priority: 5

DSCP: 1

Unknown: False

Tagged: True

Media Policy Application Type : streamingvideo

Vlan ID: 20

Priority: 1

DSCP: 2

Unknown: False

Tagged: True

Inventory

Hardware Rev: xxx xxx xxx

Firmware Rev: xxx xxx xxx



Software Rev: xxx xxx xxx

Serial Num: xxx xxx xxx

Mfg Name: xxx xxx xxx

Model Name: xxx xxx xxx

Asset ID: xxx xxx xxx

Location

Subtype: elin

Info: xxx xxx xxx

Extended POE

Device Type: pseDevice

Extended POE PSE

Available: 0.3 Watts

Source: primary

Priority: critical

Extended POE PD

Required: 0.2 Watts

Source: local

Priority: low

Denial of Service Commands

This section describes the commands you use to configure Denial of Service (DoS) Control. The software provides support for classifying and blocking specific types of Denial of Service attacks.

You can configure your system to monitor and block these types of attacks:

• SIP=DIP: Source IP address = Destination IP address.

• First Fragment: TCP Header size smaller then configured value.

• TCP Fragment: IP Fragment Offset = 1.

• TCP Flag: TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0 and TCP

Sequence Number = 0 or TCP Flags FIN, URG, and PSH set and TCP Sequence Number = 0 or TCP Flags SYN and FIN set.

• L4 Port: Source TCP/UDP Port = Destination TCP/UDP Port.

• ICMP: Limiting the size of ICMP Ping packets.



dos-control all

This command enables Denial of Service protection checks globally.

Default

Format

Mode disabled dos-control all

Global Config no dos-control all

This command disables Denial of Service prevention checks globally.

Format

Mode no dos-control all

Global Config dos-control sipdip

This command enables Source IP address = Destination IP address (SIP=DIP) Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress with SIP=DIP, the packets will be dropped if the mode is enabled.

Default

Format

Mode disabled dos-control sipdip

Global Config no dos-control sipdip

This command disables Source IP address = Destination IP address (SIP=DIP) Denial of Service prevention.

Format

Mode no dos-control sipdip

Global Config



dos-control firstfrag

This command enables Minimum TCP Header Size Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress having a

TCP Header Size smaller then the configured value, the packets will be dropped if the mode is enabled.The default is disabled.

If you enable dos-control firstfrag, but do not provide a

Minimum TCP Header Size, the system sets that value to 20 .

Default

Format

Mode disabled <20> dos-control firstfrag

[<0-255>]

Global Config no dos-control firstfrag

This command sets Minimum TCP Header Size Denial of Service protection to the default value of disabled .

Format

Mode no dos-control firstfrag

Global Config dos-control tcpfrag

This command enables TCP Fragment Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress having IP Fragment Offset equal to one (1), the packets will be dropped if the mode is enabled.

Default

Format

Mode disabled dos-control tcpfrag

Global Config no dos-control tcpfrag

This command disabled TCP Fragment Denial of Service protection.

Format

Mode no dos-control tcpfrag

Global Config


3-194


dos-control tcpflag

This command enables TCP Flag Denial of Service protections. If the mode is enabled, Denial of

Service prevention is active for this type of attacks. If packets ingress having TCP Flag SYN set and a source port less than 1024 or having TCP Control Flags set to 0 and TCP Sequence Number set to 0 or having TCP Flags FIN, URG, and PSH set and TCP Sequence Number set to 0 or having TCP Flags SYN and FIN both set, the packets will be dropped if the mode is enabled.

Default

Format

Mode disabled dos-control tcpflag

Global Config no dos-control tcpflag

This command sets disables TCP Flag Denial of Service protections.

Format

Mode no dos-control tcpflag

Global Config dos-control l4port

This command enables L4 Port Denial of Service protections. If the mode is enabled, Denial of

Service prevention is active for this type of attack. If packets ingress having Source TCP/UDP Port

Number equal to Destination TCP/UDP Port Number, the packets will be dropped if the mode is enabled.

Default

Format

Mode

Note: Some applications mirror source and destination L4 ports - RIP for example uses

520 for both. If you enable dos-control l4port, applications such as RIP may experience packet loss which would render the application inoperable.

disabled dos-control l4port

Global Config



no dos-control l4port

This command disables L4 Port Denial of Service protections.

Format

Mode no dos-control l4port

Global Config dos-control icmp

This command enables Maximum ICMP Packet Size Denial of Service protections. If the mode is enabled, Denial of Service prevention is active for this type of attack. If ICMP Echo Request

(PING) packets ingress having a size greater than the configured value, the packets will be dropped if the mode is enabled.

Default

Format

Mode disabled <512> dos-control icmp [ <0-1023>]

Global Config no dos-control icmp

This command disables Maximum ICMP Packet Size Denial of Service protections.

Format

Mode no dos-control icmp

Global Config dos-control smacdmac

This command enables Source MAC address = Destination MAC address (SMAC=DMAC)

Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress with SMAC=DMAC, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control smacdmac

Global Config


3-196

no dos-control smacdmac

Global Config


no dos-control smacdmac

This command disables Source MAC address = Destination MAC address (SMAC=DMAC)

Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode dos-control tcpport

This command enables TCP L4 source = destination port number (Source TCP Port =Destination

TCP Port) Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress with Source TCP Port =Destination TCP Port, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control tcpport

Global Config no dos-control tcpport

This command disables TCP L4 source = destination port number (Source TCP Port =Destination

TCP Port) Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control smacdmac

Global Config dos-control udpport

This command enables UDP L4 source = destination port number (Source UDP Port =Destination

UDP Port) Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress with Source UDP Port =Destination UDP Port, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.



Default

Format

Mode disabled dos-control udppport

Global Config no dos-control udpport

This command disables UDP L4 source = destination port number (Source UDP Port =Destination

UDP Port) Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control udppport

Global Config dos-control tcpflagseq

This command enables TCP Flag and Sequence Denial of Service protections. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress having

TCP Flag SYN set and a source port less than 1024 or having TCP Control Flags set to 0 and TCP

Sequence Number set to 0 or having TCP Flags FIN, URG, and PSH set and TCP Sequence

Number set to 0 or having TCP Flags SYN and FIN both set, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control tcpflagseq

Global Config no dos-control tcpflagseq

This command sets disables TCP Flag and Sequence Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control tcpflagseq

Global Config


3-198


dos-control tcpoffset

This command enables TCP Offset Denial of Service protection. If the mode is enabled, Denial of

Service prevention is active for this type of attack. If packets ingress having TCP Header Offset equal to one (1), the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control tcpoffset

Global Config no dos-control tcpoffset

This command disabled TCP Offset Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control tcpoffset

Global Config dos-control tcpsyn

This command enables TCP SYN and L4 source = 0-1023 Denial of Service protection. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress having TCP flag SYN set and an L4 source port from 0 to 1023, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control tcpsyn

Global Config no dos-control tcpsyn

This command sets disables TCP SYN and L4 source = 0-1023 Denial of Service protection. This command is only available on FSM72xxRS switches.



Format

Mode no dos-control tcpsyn

Global Config dos-control tcpsynfin

This command enables TCP SYN and FIN Denial of Service protection. If the mode is enabled,

Denial of Service prevention is active for this type of attack. If packets ingress having TCP flags

SYN and FIN set, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control tcpsynfin

Global Config no dos-control tcpsynfin

This command sets disables TCP SYN & FIN Denial of Service protection. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control tcpsynfin

Global Config dos-control tcpfinurgpsh

This command enables TCP FIN and URG and PSH and SEQ=0 checking Denial of Service protections. If the mode is enabled, Denial of Service prevention is active for this type of attack. If packets ingress having TCP FIN, URG, and PSH all set and TCP Sequence Number set to 0, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default disabled



Format

Mode dos-control tcpfinurgpsh

Global Config no dos-control tcpfinurgpsh

This command sets disables TCP FIN and URG and PSH and SEQ=0 checking Denial of Service protections. This command is only available on FSM72xxRS switches.

dos-control icmpv4

Format

Mode no dos-control tcpfinurgpsh

Global Config dos-control icmpv4

This command enables Maximum ICMPv4 Packet Size Denial of Service protections. If the mode is enabled, Denial of Service prevention is active for this type of attack. If ICMPv4 Echo Request

(PING) packets ingress having a size greater than the configured value, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled <512> dos-control icmpv4 <0-16384>

Global Config no dos-control icmpv4

This command disables Maximum ICMP Packet Size Denial of Service protections. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control icmpv4

Global Config



dos-control icmpv6

This command enables Maximum ICMPv6 Packet Size Denial of Service protections. If the mode is enabled, Denial of Service prevention is active for this type of attack. If ICMPv6 Echo Request

(PING) packets ingress having a size greater than the configured value, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled <512> dos-control icmpv6 <0-16384>

Global Config no dos-control icmpv6

This command disables Maximum ICMP Packet Size Denial of Service protections. This command is only available on FSM72xxRS switches.

Format

Mode no dos-control icmpv6

Global Config dos-control icmpfrag

This command enables ICMP Fragment Denial of Service protection. If the mode is enabled,

Denial of Service prevention is active for this type of attack. If packets ingress having fragmented

ICMP packets, the packets will be dropped if the mode is enabled. This command is only available on FSM72xxRS switches.

Default

Format

Mode disabled dos-control icmpfrag

Global Config no dos-control icmpfrag

This command disabled ICMP Fragment Denial of Service protection. This command is only available on FSM72xxRS switches.



Format

Mode no dos-control icmpfrag

Global Config show dos-control

This command displays Denial of Service configuration information.

Format

Mode show dos-control

Privileged EXEC

Note: Not all messages below are available in all 7000series managed switches.

Term Definition

First Fragment

Mode

Min TCP Hdr

Size <0-255>

ICMP Mode

May be enabled or disabled. The factory default is disabled.

The factory default is 20.


Max ICMPv4 Pkt

Size

The range is 0-1023. The factory default is 512.

Max ICMPv6 Pkt

Size

The range is 0-16384. The factory default is 512.

ICMP Fragment

Mode


L4 Port Mode May be enabled or disabled. The factory default is disabled.

TCP Port Mode May be enabled or disabled. The factory default is disabled.

UDP Port Mode May be enabled or disabled. The factory default is disabled.

SIPDIP Mode May be enabled or disabled. The factory default is disabled.

SMACDMAC

Mode


TCP Flag Mode May be enabled or disabled. The factory default is disabled.


3-203


Term Definition

TCP FIN&URG&

PSH Mode


TCP Flag &

Sequence Mode


TCP SYN Mode May be enabled or disabled. The factory default is disabled.

TCP SYN & FIN

Mode



TCP Fragment

Mode

TCP Offset

Mode


MAC Database Commands

This section describes the commands you use to configure and view information about the MAC databases.

bridge aging-time

This command configures the forwarding database address aging timeout in seconds. The

<seconds> parameter must be within the range of 10 to 1,000,000 seconds.

Default

Format

Mode

300 bridge aging-time <10-1,000,000>

Global Config no bridge aging-time

This command sets the forwarding database address aging timeout to the default value.

Format

Mode no bridge aging-time

Global Config



show forwardingdb agetime

This command displays the timeout for address aging.

Default

Format

Mode all show forwardingdb agetime

Privileged EXEC

Term Definition

Address Aging

Timeout

• This parameter displays the address aging timeout for the associated forwarding database.

show mac-address-table multicast

This command displays the Multicast Forwarding Database (MFDB) information. If you enter the command with no parameter, the entire table is displayed. You can display the table entry for one

MAC Address by specifying the MAC address as an optional parameter.

Format

Mode show mac-address-table multicast <macaddr>

Privileged EXEC

Term Definition

MAC Address A multicast MAC address for which the switch has forwarding and or filtering information.

The format is two-digit hexadecimal numbers separated by colons, for example

01:23:45:67:89:AB. In an IVL system the MAC address will be displayed as a MAC address and VLAN ID combination of 8 bytes.

Type

Component



The component that is responsible for this entry in the Multicast Forwarding Database.

Possible values are IGMP Snooping, GMRP, and Static Filtering.

Description

Interfaces

Forwarding

Interfaces



The resultant forwarding list is derived from combining all the component’s forwarding interfaces and removing the interfaces that are listed as the static filtering interfaces.



show mac-address-table stats

This command displays the Multicast Forwarding Database (MFDB) statistics.

Format

Mode show mac-address-table stats

Privileged EXEC

Term Definition

Max MFDB

Table Entries

The total number of entries that can possibly be in the Multicast Forwarding Database table.

Most MFDB

Entries Since

Last Reset

The largest number of entries that have been present in the Multicast Forwarding

Database table. This value is also known as the MFDB high-water mark.

Current Entries The current number of entries in the MFDB.

ISDP Commands

This section describes the commands you use to configure the industry standard Discovery

Protocol (ISDP).

isdp run

This command enables ISDP on the switch.

Default

Format

Mode

Enabled isdp run

Global Config no isdp run

This command disables ISDP on the switch.

Format

Mode no isdp run

Global Config



isdp holdtime

This command configures the hold time for ISDP packets that the switch transmits. The hold time specifies how long a receiving device should store information sent in the ISDP packet before discarding it. The range is given in seconds.

Default

Format

Mode

180 seconds isdp holdtime <10-255>

Global Config isdp timer

This command sets the period of time between sending new ISDP packets. The range is given in seconds.

Default

Format

Mode

30 seconds isdp timer <5-254>

Global Config isdp advertise-v2

This command enables the sending of ISDP version 2 packets from the device.

Default

Format

Mode

Enabled isdp advertise-v2

Global Config no isdp advertise-v2

This command disables the sending of ISDP version 2 packets from the device.

Format

Mode no isdp advertise-v2

Global Config



isdp enable

This command enables ISDP on the interface.

Default

Format

Mode

Enabled isdp enable

Interface Config no isdp enable

This command disables ISDP on the interface.

Format

Mode no isdp enable

Interface Config clear isdp counters

This command clears ISDP counters.

Format

Mode clear isdp counters

Privileged EXEC clear isdp table

This command clears entries in the ISDP table.

Format

Mode clear isdp table

Privileged EXEC show isdp

This command displays global ISDP settings.

Format

Mode show isdp

Privileged EXEC


3-208


Term Definition

Timer

Hold Time

The frequency with which this device sends ISDP packets. This value is given in seconds.

The length of time the receiving device should save information sent by this device. This value is given in seconds.

Version 2

Advertisements

Device ID

The setting for sending ISDPv2 packets. If disabled, version 1 packets are transmitted.

The Device ID advertised by this device. The format of this Device ID is characterized by the value of the Device ID Format object.

Device ID

Format

Capability

Device ID

Format

Indicates the Device ID format capability of the device.

• serialNumber indicates that the device uses a serial number as the format for its

Device ID.

• macAddress indicates that the device uses a Layer 2 MAC address as the format for its Device ID.

• other indicates that the device uses its platform-specific format as the format for its

Device ID.

Indicates the Device ID format of the device.

• serialNumber indicates that the value is in the form of an ASCII string containing the device serial number.

• macAddress indicates that the value is in the form of a Layer 2 MAC address.

• other indicates that the value is in the form of a platform specific ASCII string containing info that identifies the device. For example, ASCII string contains serialNumber appended/prepended with system name.

show isdp interface

This command displays ISDP settings for the specified interface.

Format

Mode show isdp interface {all | <unit/slot/port>}

Privileged EXEC

Term

Mode

Definition

ISDP mode enabled/disabled status for the interface(s).



show isdp entry

This command displays ISDP entries. If the device id is specified, then only entries for that device are shown.

Format

Mode show isdp entry {all | deviceid}

Privileged EXEC

Term

Device ID

IP Addresses

Platform

Interface

Port ID

Hold Time

Version

Advertisement

Version

Capability

Definition

The device ID associated with the neighbor which advertised the information.

The IP address(es) associated with the neighbor.

The hardware platform advertised by the neighbor.

The interface (slot/port) on which the neighbor's advertisement was received.

The port ID of the interface from which the neighbor sent the advertisement.

The hold time advertised by the neighbor.

The software version that the neighbor is running.

The version of the advertisement packet received from the neighbor.

ISDP Functional Capabilities advertised by the neighbor.

show isdp neighbors

This command displays the list of neighboring devices.

Format

Mode show isdp neighbors [ {<unit/slot/port> | detail} ]

Privileged EXEC

Term

Device ID

IP Addresses

Capability

Platform

Interface

Definition

The device ID associated with the neighbor which advertised the information.

The IP addresses associated with the neighbor.

ISDP functional capabilities advertised by the neighbor.

The hardware platform advertised by the neighbor.

The interface (unit/slot/port) on which the neighbor's advertisement was received.



Term

Port ID

Hold Time

Advertisement

Version

Entry Last

Changed Time

Version

Definition

The port ID of the interface from which the neighbor sent the advertisement.

The hold time advertised by the neighbor.

The version of the advertisement packet received from the neighbor.

Displays when the entry was last modified.

The software version that the neighbor is running.


(Switch) #show isdp neighbors detail

Device ID

Address(es):

IP Address:

Capability

0001f45f1bc0

10.27.7.57

Router Trans Bridge Switch IGMP

Interface 0/48

Port ID ge.3.14

Holdtime 131

Advertisement Version

Entry last changed time

Version :

2

0 days 00:01:59

05.00.56

show isdp traffic

This command displays ISDP statistics.

Format

Mode show isdp traffic

Privileged EXEC

Term Definition

ISDP Packets Received Total number of ISDP packets received

ISDP Packets Transmitted Total number of ISDP packets transmitted

ISDPv1 Packets Received Total number of ISDPv1 packets received

ISDPv1 Packets

Transmitted

Total number of ISDPv1 packets transmtted

ISDPv2 Packets Received Total number of ISDPv2 packets received


3-211


Term Definition

ISDPv2 Packets

Transmitted

ISDP Bad Header

ISDP Checksum Error

Total number of ISDPv2 packets transmitted

Number of packets received with a bad header

Number of packets received with a checksum error

ISDP Transmission Failure Number of packets which failed to transmit

ISDP Invalid Format Number of invalid packets received

ISDP Table Full Number of times a neighbor entry was not added to the table due to a full database

ISDP IP Address Table Full Displays the number of times a neighbor entry was added to the table without an IP address.

debug isdp packet

This command enables tracing of ISDP packets processed by the switch. ISDP must be enabled on both the device and the interface in order to monitor packets for a particular interface.

Format

Mode debug isdp packet [{receive | transmit}]

Privileged EXEC no debug isdp packet

This command disables tracing of ISDP packets on the receive or the transmit sides or on both sides.

Format

Mode no debug isdp packet [{receive | transmit}]

Privileged EXEC


3-212

Chapter 4

Routing Commands

This chapter describes the routing commands available in the 7000 series CLI.

The Routing Commands chapter contains the following sections:

• “Address Resolution Protocol (ARP) Commands” on page 4-1

• “IP Routing Commands” on page 4-8

• “Router Discovery Protocol Commands” on page 4-20

• “Virtual LAN Routing Commands” on page 4-24

• “Virtual Router Redundancy Protocol Commands” on page 4-25

• “DHCP and BOOTP Relay Commands” on page 4-34

• “IP Helper Commands” on page 4-37

• “Open Shortest Path First (OSPF) Commands” on page 4-39

• “Routing Information Protocol (RIP) Commands” on page 4-82

• “ICMP Throttling Commands” on page 4-91

Warning: The commands in this chapter are in one of three functional groups:




Address Resolution Protocol (ARP) Commands

This section describes the commands you use to configure ARP and to view ARP information on the switch. ARP associates IP addresses with MAC addresses and stores the information as ARP entries in the ARP cache.

4-1 v1.0, July 2009


arp

This command creates an ARP entry. The value for <ipaddress> is the IP address of a device on a subnet attached to an existing routing interface. <macaddr> is a unicast MAC address for that device.

The format of the MAC address is 6 two-digit hexadecimal numbers that are separated by colons, for example 00:06:29:32:81:40.

Format

Mode

arp <ipaddress> <macaddr>

Global Config no arp

This command deletes an ARP entry. The value for <arpentry> is the IP address of the interface. The value for <ipaddress> is the IP address of a device on a subnet attached to an existing routing interface. <macaddr> is a unicast MAC address for that device.

Format

Mode

no arp <ipaddress> <macaddr>

Global Config ip proxy-arp

This command enables proxy ARP on a router interface. Without proxy ARP, a device only responds to an ARP request if the target IP address is an address configured on the interface where the ARP request arrived. With proxy ARP, the device may also respond if the target IP address is reachable. The device only responds if all next hops in its route to the destination are through interfaces other than the interface that received the ARP request.

Default

Format

Mode enabled ip proxy-arp

Interface Config

Routing Commands v1.0, July 2009

4-2


no ip proxy-arp

This command disables proxy ARP on a router interface.

Format

Mode no ip proxy-arp

Interface Config arp cachesize

This command configures the ARP cache size. The ARP cache size value is a platform specific integer value. The default size also varies depending on the platform.

Format

Mode

arp cachesize <platform specific integer value>

Global Config no arp cachesize

This command configures the default ARP cache size.

Format

Mode no arp cachesize

Global Config arp dynamicrenew

This command enables the ARP component to automatically renew dynamic ARP entries when they age out.

Default

Format

Mode enabled arp dynamicrenew

Privileged EXEC no arp dynamicrenew

This command prevents dynamic ARP entries from renewing when they age out.

Format

Mode no arp dynamicrenew

Privileged EXEC


4-3


arp purge

This command causes the specified IP address to be removed from the ARP cache. Only entries of type dynamic or gateway are affected by this command.

Format

Mode

arp purge <ipaddr>

Privileged EXEC arp resptime

This command configures the ARP request response timeout.

The value for <seconds> is a valid positive integer, which represents the IP ARP entry response timeout time in seconds. The range for <seconds> is between 1-10 seconds.

Default

Format

Mode

1

arp resptime <1-10>

Global Config no arp resptime

This command configures the default ARP request response timeout.

Format

Mode no arp resptime

Global Config arp retries

This command configures the ARP count of maximum request for retries.

The value for <retries> is an integer, which represents the maximum number of request for retries. The range for <retries> is an integer between 0-10 retries.

Default

Format

Mode

4

arp retries <0-10>

Global Config

Routing Commands 4-4 v1.0, July 2009


no arp retries

This command configures the default ARP count of maximum request for retries.

Format

Mode no arp retries

Global Config arp timeout

This command configures the ARP entry ageout time.

The value for <seconds> is a valid positive integer, which represents the IP ARP entry ageout time in seconds. The range for <seconds> is between 15-21600 seconds.

Default

Format

Mode

1200

arp timeout <15-21600>

Global Config no arp timeout

This command configures the default ARP entry ageout time.

Format

Mode no arp timeout

Global Config clear arp-cache

This command causes all ARP entries of type dynamic to be removed from the ARP cache. If the gateway keyword is specified, the dynamic entries of type gateway are purged as well.

Format

Mode

clear arp-cache [gateway]

Privileged EXEC


4-5


clear arp-switch

Use this command to clear the contents of the switch’s Address Resolution Protocol (ARP) table that contains entries learned through the Management port. To observe whether this command is successful, ping from the remote system to the DUT. Issue the show arp switch command to see the ARP entries. Then issue the clear arp-switch command and check the show arp switch entries. There will be no more arp entries.

Format

Mode clear arp-switch

Privileged EXEC show arp

This command displays the Address Resolution Protocol (ARP) cache. The displayed results are not the total ARP entries. To view the total ARP entries, the operator should view the show arp results in conjunction with the show arp switch results.

Format

Mode show arp

Privileged EXEC

Term Definition

Age Time

(seconds)

Response Time

(seconds)

Retries

Cache Size

The time it takes for an ARP entry to age out. This is configurable. Age time is measured in seconds.

The time it takes for an ARP request timeout. This value is configurable. Response time is measured in seconds.

The maximum number of times an ARP request is retried. This value is configurable.

The maximum number of entries in the ARP table. This value is configurable.

Dynamic Renew

Mode

Displays whether the ARP component automatically attempts to renew dynamic ARP entries when they age out.

Total Entry Count

Current / Peak

The total entries in the ARP table and the peak entry count in the ARP table.

Static Entry Count The static entry count in the ARP table, the active entry count in the ARP table, the

Configured/Active active entry count in the ARP table, and maximum static entry count in the ARP table.

/ Max

The following are displayed for each ARP entry:

Term

IP Address

Definition

The IP address of a device on a subnet attached to an existing routing interface.



Term Definition

MAC Address The hardware MAC address of that device.

Interface

Type

Age

The routing unit/slot/port associated with the device ARP entry.

The type that is configurable. The possible values are Local, Gateway, Dynamic and

Static.

The current age of the ARP entry since last refresh (in hh:mm:ss format ) show arp brief

This command displays the brief Address Resolution Protocol (ARP) table information.

Format

Mode show arp brief

Privileged EXEC

Term Definition

Age Time

(seconds)

The time it takes for an ARP entry to age out. This value is configurable. Age time is measured in seconds.

Response Time

(seconds)

The time it takes for an ARP request timeout. This value is configurable. Response time is measured in seconds.

Retries The maximum number of times an ARP request is retried. This value is configurable.

Cache Size The maximum number of entries in the ARP table. This value is configurable.

Dynamic Renew

Mode

Displays whether the ARP component automatically attempts to renew dynamic ARP entries when they age out.

Total Entry

Count Current /

Peak

The total entries in the ARP table and the peak entry count in the ARP table.

Static Entry

Count Current /

Max

The static entry count in the ARP table and maximum static entry count in the ARP table. show arp switch

This command displays the contents of the switch’s Address Resolution Protocol (ARP) table.

Format

Mode show arp switch

Privileged EXEC



Term Definition

IP Address The IP address of a device on a subnet attached to the switch.

MAC Address The hardware MAC address of that device.

Interface The routing unit/slot/port associated with the device’s ARP entry.

IP Routing Commands

This section describes the commands you use to enable and configure IP routing on the switch. routing

This command enables IPv4 and IPv6 routing for an interface. You can view the current value for this function with the show ip brief command. The value is labeled as “Routing Mode.”

Default

Format

Mode disabled routing

Interface Config no routing

This command disables routing for an interface.

You can view the current value for this function with the show ip brief command. The value is labeled as “Routing Mode.”

Format

Mode no routing

Interface Config ip routing

This command enables the IP Router Admin Mode for the master switch.

Format

Mode ip routing

Global Config



no ip routing

This command disables the IP Router Admin Mode for the master switch.

Format

Mode no ip routing

Global Config ip address

This command configures an IP address on an interface. You can also use this command to configure one or more secondary IP addresses on the interface.The value for <ipaddr> is the IP address of the interface. The value for <subnetmask> is a 4-digit dotted-decimal number which represents the subnet mask of the interface. The subnet mask must have contiguous ones and be no longer than 30 bits, for example 255.255.255.0. This command adds the label IP address in show ip interface .

Format

Mode

ip address <ipaddr> <subnetmask> [secondary]

Interface Config no ip address

This command deletes an IP address from an interface. The value for <ipaddr> is the IP address of the interface in a.b.c.d format where the range for a, b, c, and d is 1-255. The value for

<subnetmask> is a 4-digit dotted-decimal number which represents the Subnet Mask of the interface. To remove all of the IP addresses (primary and secondary) configured on the interface, enter the command no ip address .

Format

Mode

no ip address [{<ipaddr> <subnetmask> [secondary]}]

Interface Config ip route

This command configures a static route. The <ipaddr> parameter is a valid IP address, and

<subnetmask> is a valid subnet mask. The <nexthopip> parameter is a valid IP address of the next hop router. Specifying Null0 as nexthop parameter adds a static reject route. The optional <preference> parameter is an integer (value from 1 to 255) that allows you to specify the preference value (sometimes called “administrative distance”) of an individual static route.

Among routes to the same destination, the route with the lowest preference value is the route



entered into the forwarding database. By specifying the preference of a static route, you control whether a static route is more or less preferred than routes from dynamic routing protocols. The preference also controls whether a static route is more or less preferred than other static routes to the same destination. A route with a preference of 255 cannot be used to forward traffic.

For the static routes to be visible, you must perform the following steps:

• Enable ip routing globally.

• Enable ip routing for the interface.

• Confirm that the associated link is also up.

Default

Format

Mode preference—1

ip route <ipaddr> <subnetmask> [<nexthopip> | Null0 ] [<preference>]

Global Config no ip route

This command deletes a single next hop to a destination static route. If you use the

<nexthopip> parameter, the next hop is deleted. If you use the <preference> value, the preference value of the static route is reset to its default.

Format

Mode

no ip route <ipaddr> <subnetmask> [{<nexthopip> [<preference>] |

Null0 }]

Global Config ip route default

This command configures the default route. The value for <nexthopip> is a valid IP address of the next hop router. The <preference> is an integer value from 1 to 255. A route with a preference of 255 cannot be used to forward traffic.

Default

Format

Mode preference—1

ip route default <nexthopip> [<preference>]

Global Config



no ip route default

This command deletes all configured default routes. If the optional <nexthopip> parameter is designated, the specific next hop is deleted from the configured default route and if the optional preference value is designated, the preference of the configured default route is reset to its default.

Format

Mode

no ip route default [{<nexthopip> | <preference>}]

Global Config ip route distance

This command sets the default distance (preference) for static routes. Lower route distance values are preferred when determining the best route. The ip route and ip route default commands allow you to optionally set the distance (preference) of an individual static route. The default distance is used when no distance is specified in these commands. Changing the default distance does not update the distance of existing static routes, even if they were assigned the original default distance. The new default distance will only be applied to static routes created after invoking the ip route distance command.

Default

Format

Mode

1

ip route distance <1-255>

Global Config no ip route distance

This command sets the default static route preference value in the router. Lower route preference values are preferred when determining the best route.

Format

Mode no ip route distance

Global Config ip netdirbcast

This command enables the forwarding of network-directed broadcasts. When enabled, network directed broadcasts are forwarded. When disabled they are dropped.

Default disabled



Format

Mode ip netdirbcast

Interface Config no ip netdirbcast

This command disables the forwarding of network-directed broadcasts. When disabled, network directed broadcasts are dropped.

Format

Mode no ip netdirbcast

Interface Config ip mtu

This command sets the IP Maximum Transmission Unit (MTU) on a routing interface. The IP

MTU is the size of the largest IP packet that can be transmitted on the interface without fragmentation. The software currently does not fragment IP packets.

• Packets forwarded in hardware ignore the IP MTU.

• Packets forwarded in software are dropped if they exceed the IP MTU of the outgoing interface.

Packets originated on the router, such as OSPF packets, may be fragmented by the IP stack. The IP stack uses its default IP MTU and ignores the value set using the ip mtu command.

OSPF advertises the IP MTU in the Database Description packets it sends to its neighbors during database exchange. If two OSPF neighbors advertise different IP MTUs, they will not form an adjacency. (unless OSPF has been instructed to ignore differences in IP MTU with the ip ospf mtu-ignore command.)

Note: The IP MTU size refers to the maximum size of the IP packet (IP Header + IP payload). It does not include any extra bytes that may be required for Layer-2 headers. To receive and process packets, the Ethernet MTU (see “mtu” on page 3-

5 ) must take into account the size of the Ethernet header.

Default

Format

Mode

1500 bytes

ip mtu <68-1500>

Interface Config



no ip mtu

This command resets the ip mtu to the default value.

Format

Mode

no ip mtu <mtu>

Interface Config encapsulation

This command configures the link layer encapsulation type for the packet. The encapsulation type can be ethernet or snap .

Default

Format

Mode ethernet

encapsulation {ethernet | snap}

Interface Config

Note: Routed frames are always ethernet encapsulated when a frame is routed to a

VLAN.

clear ip route all

This command removes all the route entries learned over the network.

Format clear ip route all

Mode

Protocol

Privileged EXEC

Tells which protocol added the specified route. The possibilities are: local, static, OSPF, or

RIP.

Total Number of Routes

The total number of routes.

show ip brief

This command displays all the summary information of the IP, including the ICMP rate limit configuration and the global ICMP Redirect configuration.



Format

Modes show ip brief

• Privileged EXEC

• User EXEC

Term Definition

Default Time to Live The computed TTL (Time to Live) of forwarding a packet from the local router to the final destination.

Routing Mode Shows whether the routing mode is enabled or disabled.

Maximum Next Hops The maximum number of next hops the packet can travel.

Maximum Routes

ICMP Rate Limit

Interval

The maximum number of routes the packet can travel.

Shows how often the token bucket is initialized with burst-size tokens. Burst-interval is from 0 to 2147483647 milliseconds. The default burst-interval is 1000 msec.

ICMP Rate Limit Burst

Size

Shows the number of ICMPv4 error messages that can be sent during one burstinterval . The range is from 1 to 200 messages. The default value is 100 messages.

ICMP Echo Replies Shows whether ICMP Echo Replies are enabled or disabled.

ICMP Redirects Shows whether ICMP Redirects are enabled or disabled.

The following shows example CLI display output for the command.

(Switch) #show ip brief

Default Time to Live........................... 64

Routing Mode................................... Disabled

Maximum Next Hops.............................. 4

Maximum Routes................................. 6000

ICMP Rate Limit Interval....................... 1000 msec

ICMP Rate Limit Burst Size..................... 100 messages

ICMP Echo Replies.............................. Enabled

ICMP Redirects................................. Enabled show ip interface

This command displays all pertinent information about the IP interface.

Format

Modes

show ip interface {<unit/slot/port> | vlan <1-4093> | loopback <0-7>}

• Privileged EXEC

• User EXEC



Term Definition

Routing

Interface Status

Primary IP

Address

Secondary IP

Address

Determine the operational status of IPv4 routing Interface. The possible values are Up or

Down.

The primary IP address and subnet masks for the interface. This value appears only if you configure it.

One or more secondary IP addresses and subnet masks for the interface. This value appears only if you configure it.

The helper IP addresses configured by the “ip helper-address (Global Config) command.

Helper IP

Address

Routing Mode The administrative mode of router interface participation. The possible values are enable or disable. This value is configurable.

Administrative

Mode

The administrative mode of the specified interface. The possible values of this field are enable or disable. This value is configurable.

Forward Net

Directed

Broadcasts

Proxy ARP

Displays whether forwarding of network-directed broadcasts is enabled or disabled. This value is configurable.

Displays whether Proxy ARP is enabled or disabled on the system.

Local Proxy ARP Displays whether Local Proxy ARP is enabled or disabled on the interface.

Active State Displays whether the interface is active or inactive. An interface is considered active if its link is up and it is in forwarding state.

Link Speed Data

Rate

An integer representing the physical link data rate of the specified interface. This is measured in Megabits per second (Mbps).

MAC Address The burned in physical address of the specified interface. The format is 6 two-digit hexadecimal numbers that are separated by colons.

Encapsulation

Type

The encapsulation type for the specified interface. The types are: Ethernet or SNAP.

IP MTU

Bandwidth

The maximum transmission unit (MTU) size of a frame, in bytes.

Shows the bandwidth of the interface.

Destination

Unreachables

Displays whether ICMP Destination Unreachables may be sent (enabled or disabled).

ICMP Redirects Displays whether ICMP Redirects may be sent (enabled or disabled).


(switch)#show ip interface 1/0/2

Routing Interface Status....................... Down

Primary IP Address............................. 1.2.3.4/255.255.255.0

Secondary IP Address(es)....................... 21.2.3.4/255.255.255.0

............................................... 22.2.3.4/255.255.255.0

Helper IP Address.............................. 1.2.3.4

............................................... 1.2.3.5



Routing Mode................................... Disable

Administrative Mode............................ Enable

Forward Net Directed Broadcasts................ Disable

Proxy ARP...................................... Enable

Local Proxy ARP................................ Disable

Active State................................... Inactive

Link Speed Data Rate........................... Inactive

MAC Address.................................... 00:10:18:82:0C:68

Encapsulation Type............................. Ethernet

IP MTU......................................... 1500

Bandwidth...................................... 100000 kbps

Destination Unreachables....................... Enabled

ICMP Redirects................................. Enabled show ip interface brief

This command displays summary information about IP configuration settings for all ports in the router.

Format

Modes show ip interface brief

• Privileged EXEC

• User EXEC

Term Definition

Interface

State

IP Address


Routing operational state of the interface.

The IP address of the routing interface in 32-bit dotted decimal format.

IP Mask

Netdir Bcast

The IP mask of the routing interface in 32-bit dotted decimal format.

Indicates if IP forwards net-directed broadcasts on this interface. Possible values are

Enable or Disable.

MultiCast Fwd The multicast forwarding administrative mode on the interface. Possible values are

Enable or Disable. show ip route

This command displays the routing table. The <ip-address> specifies the network for which the route is to be displayed and displays the best matching best-route for the address. The <mask> specifies the subnet mask for the given <ip-address> . When you use the longer-



prefixes keyword, the <ip-address> and <mask> pair becomes the prefix, and the command displays the routes to the addresses that match that prefix. Use the <protocol> parameter to specify the protocol that installed the routes. The value for <protocol> can be connected , ospf , rip , or static . Use the all parameter to display all routes including best and non-best routes. If you do not use the all parameter, the command only displays the best route.

Note: If you use the connected keyword for <protocol> , the all option is not available because there are no best or non-best connected routes.

Format

Modes show ip route [{<ip-address> [<protocol>] | {<ip-address> <mask>

[longer-prefixes] [<protocol>] | <protocol>} [all] | all}]

• Privileged EXEC

• User EXEC

Term

Route Codes

Definition

The key for the routing protocol codes that might appear in the routing table output.

The show ip route command displays the routing tables in the following format:

Code IP-Address/Mask [Preference/Metric] via Next-Hop, Route-Timestamp,

Interface

The columns for the routing table display the following information:

Term Definition

Code The codes for the routing protocols that created the routes.

IP-Address/Mask The IP-Address and mask of the destination network corresponding to this route.

Preference The administrative distance associated with this route. Routes with low values are preferred over routes with higher values.

Metric via Next-Hop

The cost associated with this route.

The outgoing router IP address to use when forwarding traffic to the next router (if any) in the path toward the destination.

Route-Timestamp The last updated time for dynamic routes. The format of Route-Timestamp will be

• Days:Hours:Minutes if days > = 1

• Hours:Minutes:Seconds if days < 1

Interface The outgoing router interface to use when forwarding traffic to the next destination. For reject routes, the next hop interface would be Null0 interface.



To administratively control the traffic destined to a particular network and prevent it from being forwarded through the router, you can configure a static reject route on the router. Such traffic would be discarded and the ICMP destination unreachable message is sent back to the source. This is typically used for preventing routing loops. The reject route added in the RTO is of the type

OSPF Inter-Area . Reject routes (routes of REJECT type installed by any protocol) are not redistributed by OSPF/RIP. Reject routes are supported in both OSPFv2 and OSPFv3.


(Switch) #show ip route

Route Codes: R - RIP Derived, O - OSPF Derived, C - Connected, S - Static

B - BGP Derived, IA - OSPF Inter Area

E1 - OSPF External Type 1, E2 - OSPF External Type 2

N1 - OSPF NSSA External Type 1, N2 - OSPF NSSA External Type 2

C 1.1.1.0/24 [0/1] directly connected, 0/11



S 7.0.0.0/8 [1/0] directly connected, Null0

OIA 10.10.10.0/24 [110/6] via 5.5.5.2, 00h:00m:01s, 0/5


S 12.0.0.0/8 [5/0] directly connected, Null0

S 23.0.0.0/8 [3/0] directly connected, Null0 show ip route summary

Use this command to display the routing table summary. Use the optional all parameter to show the number of all routes, including best and non-best routes. To include only the number of best routes, do not use the optional parameter.

Format

Modes

show ip route summary [all]

• Privileged EXEC

• User EXEC

Term

Connected

Routes

Static Routes

RIP Routes

OSPF Routes

Definition

The total number of connected routes in the routing table.

Total number of static routes in the routing table.

Total number of routes installed by RIP protocol.

Total number of routes installed by OSPF protocol.


4-18


Term Definition

Reject Routes Total number of reject routes installed by all protocols.

Total Routes Total number of routes in the routing table.


(Switch) #show ip route summary

Connected Routes..............................1

Static Routes.................................7

RIP Routes....................................0

BGP Routes....................................0

OSPF Routes...................................0

Intra Area Routes...........................0

Inter Area Routes...........................0

External Type-1 Routes......................0


Reject Routes.................................2

Total routes..................................8

show ip route preferences

This command displays detailed information about the route preferences. Route preferences are used in determining the best route. Lower router preference values are preferred over higher router preference values. A route with a preference of 255 cannot be used to forward traffic.

Format

Modes show ip route preferences

• Privileged EXEC

• User EXEC

Term Definition

Local

Static

OSPF Intra

The local route preference value.

The static route preference value.

The OSPF Intra route preference value.

OSPF Inter The OSPF Inter route preference value.

OSPF External The OSPF External route preference value.

RIP The RIP route preference value.



show ip stats

This command displays IP statistical information. Refer to RFC 1213 for more information about the fields that are displayed.

Format

Modes show ip stats

• Privileged EXEC

• User EXEC

Router Discovery Protocol Commands

This section describes the commands you use to view and configure Router Discovery Protocol settings on the switch. The Router Discovery Protocol enables a host to discover the IP address of routers on the subnet.

ip irdp

This command enables Router Discovery on an interface.

Default

Format

Mode disabled ip irdp

Interface Config no ip irdp

This command disables Router Discovery on an interface.

Format

Mode no ip irdp

Interface Config


4-20


ip irdp address

This command configures the address that the interface uses to send the router discovery advertisements. The valid values for <ipaddr> are 224.0.0.1, which is the all-hosts IP multicast address, and 255.255.255.255, which is the limited broadcast address.

Default

Format

Mode

224.0.0.1

ip irdp address <ipaddr>

Interface Config no ip irdp address

This command configures the default address used to advertise the router for the interface.

Format

Mode no ip irdp address

Interface Config ip irdp holdtime

This command configures the value, in seconds, of the holdtime field of the router advertisement sent from this interface. The holdtime range is the value of <maxadvertinterval> to 9000 seconds.

Default

Format

Mode

3 * maxinterval

ip irdp holdtime <maxadvertinterval-9000>

Interface Config no ip irdp holdtime

This command configures the default value, in seconds, of the holdtime field of the router advertisement sent from this interface.

Format

Mode no ip irdp holdtime

Interface Config



ip irdp maxadvertinterval

This command configures the maximum time, in seconds, allowed between sending router advertisements from the interface. The range for maxadvertinterval is 4 to 1800 seconds.

Default

Format

Mode

600

ip irdp maxadvertinterval <4-1800>

Interface Config no ip irdp maxadvertinterval

This command configures the default maximum time, in seconds.

Format

Mode no ip irdp maxadvertinterval

Interface Config ip irdp minadvertinterval

This command configures the minimum time, in seconds, allowed between sending router advertisements from the interface. The range for minadvertinterval is three to the value of maxadvertinterval.

Default

Format

Mode

0.75 * maxadvertinterval

ip irdp minadvertinterval <3-maxadvertinterval>

Interface Config no ip irdp minadvertinterval

This command sets the default minimum time to the default.

Format

Mode no ip irdp minadvertinterval

Interface Config



ip irdp preference

This command configures the preferability of the address as a default router address, relative to other router addresses on the same subnet.

Default

Format

Mode

0

ip irdp preference <-2147483648 to 2147483647>

Interface Config no ip irdp preference

This command configures the default preferability of the address as a default router address, relative to other router addresses on the same subnet.

Format

Mode no ip irdp preference

Interface Config show ip irdp

This command displays the router discovery information for all interfaces, or a specified interface.

Format

Modes

show ip irdp {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Interface

Ad Mode

Advertise

Address

Max Int

Min Int

Hold Time

Definition

The < unit/slot/port> that matches the rest of the information in the row.

The advertise mode, which indicates whether router discovery is enabled or disabled on this interface.

The IP address to which the interface sends the advertisement.

The maximum advertise interval, which is the maximum time, in seconds, allowed between sending router advertisements from the interface.

The minimum advertise interval, which is the minimum time, in seconds, allowed between sending router advertisements from the interface.

The amount of time, in seconds, that a system should keep the router advertisement before discarding it.



Term

Preference

Definition

The preference of the address as a default router address, relative to other router addresses on the same subnet.

Virtual LAN Routing Commands

This section describes the commands you use to view and configure VLAN routing and to view

VLAN routing status information.

vlan routing

This command creates routing on a VLAN. The <vlanid> value has a range from 1 to 4093.

Format

Mode

vlan routing <vlanid>

VLAN Config no vlan routing

This command deletes routing on a VLAN. The <vlanid> value has a range from 1 to 4093.

Format

Mode

no vlan routing <vlanid>

VLAN Config show ip vlan

This command displays the VLAN routing information for all VLANs with routing enabled.

Format

Modes show ip vlan

• Privileged EXEC

• User EXEC

Term Definition

MAC Address used by Routing

VLANs

The MAC Address associated with the internal bridge-router interface (IBRI). The same

MAC Address is used by all VLAN routing interfaces. It will be displayed above the per-

VLAN information.



Term Definition

VLAN ID The identifier of the VLAN.

Logical Interface The logical unit/slot/port associated with the VLAN routing interface.

IP Address The IP address associated with this VLAN.

Subnet Mask The subnet mask that is associated with this VLAN.

Virtual Router Redundancy Protocol Commands

This section describes the commands you use to view and configure Virtual Router Redundancy

Protocol (VRRP) and to view VRRP status information. VRRP helps provide failover and load balancing when you configure two devices as a VRRP pair.

ip vrrp (Global Config)

Use this command in Global Config mode to enable the administrative mode of VRRP on the router.

Default

Format

Mode none ip vrrp

Global Config no ip vrrp

Use this command in Global Config mode to disable the default administrative mode of VRRP on the router.

Format

Mode no ip vrrp

Global Config


4-25


ip vrrp (Interface Config)

Use this command in Interface Config mode to create a virtual router associated with the interface.

The parameter <vrid> is the virtual router ID, which has an integer value range from 1 to 255.

Format

Mode

ip vrrp <vrid>

Interface Config no ip vrrp

Use this command in Interface Config mode to delete the virtual router associated with the interface. The virtual Router ID, <vrid> , is an integer value that ranges from 1 to 255.

Format

Mode

no ip vrrp <vrid>

Interface Config ip vrrp mode

This command enables the virtual router configured on the specified interface. Enabling the status field starts a virtual router. The parameter <vrid> is the virtual router ID which has an integer value ranging from 1 to 255.

Default

Format

Mode disabled

ip vrrp <vrid> mode

Interface Config no ip vrrp mode

This command disables the virtual router configured on the specified interface. Disabling the status field stops a virtual router.

Format

Mode

no ip vrrp <vrid> mode

Interface Config



ip vrrp ip

This command sets the virtual router IP address value for an interface. The value for <ipaddr> is the IP address which is to be configured on that interface for VRRP. The parameter <vrid> is the virtual router ID which has an integer value range from 1 to 255. You can use the optional

[secondary] parameter to designate the IP address as a secondary IP address.

Default

Format

Mode none

ip vrrp <vrid> ip <ipaddr> [secondary]

Interface Config no ip vrrp ip

Use this command in Interface Config mode to delete a secondary IP address value from the interface. To delete the primary IP address, you must delete the virtual router on the interface.

Format

Mode

no ip vrrp <vrid> <ipaddress> secondary

Interface Config ip vrrp authentication

This command sets the authorization details value for the virtual router configured on a specified interface. The parameter {none | simple} specifies the authorization type for virtual router configured on the specified interface. The parameter [key] is optional, it is only required when authorization type is simple text password. The parameter <vrid> is the virtual router ID which has an integer value ranges from 1 to 255.

Default

Format

Mode no authorization

ip vrrp <vrid> authentication {none | simple <key>}

Interface Config no ip vrrp authentication

This command sets the default authorization details value for the virtual router configured on a specified interface.

Format

Mode

no ip vrrp <vrid> authentication

Interface Config



ip vrrp preempt

This command sets the preemption mode value for the virtual router configured on a specified interface. The parameter <vrid> is the virtual router ID, which is an integer from 1 to 255.

Default

Format

Mode enabled

ip vrrp <vrid> preempt

Interface Config no ip vrrp preempt

This command sets the default preemption mode value for the virtual router configured on a specified interface.

Format

Mode

no ip vrrp <vrid> preempt

Interface Config ip vrrp priority

This command sets the priority of a router within a VRRP group. Higher values equal higher priority. The range is from 1 to 254. The parameter <vrid> is the virtual router ID, whose range is from 1 to 255.

The router with the highest priority is elected master. If a router is configured with the address used as the address of the virtual router, the router is called the “address owner.” The priority of the address owner is always 255 so that the address owner is always master. If the master has a priority less than 255 (it is not the address owner) and you configure the priority of another router in the group higher than the master’s priority, the router will take over as master only if preempt mode is enabled.

Default

Format

Mode

100 unless the router is the address owner, in which case its priority is automatically set to

255.

ip vrrp <vrid> priority <1-254>

Interface Config



no ip vrrp priority

This command sets the default priority value for the virtual router configured on a specified interface.

Format

Mode

no ip vrrp <vrid> priority

Interface Config ip vrrp timers advertise

This command sets the frequency, in seconds, that an interface on the specified virtual router sends a virtual router advertisement.

Default

Format

Mode

1

ip vrrp <vrid> timers advertise <1-255>

Interface Config no ip vrrp timers advertise

This command sets the default virtual router advertisement value for an interface.

Format

Mode

no ip vrrp <vrid> timers advertise

Interface Config ip vrrp track interface

Use this command to alter the priority of the VRRP router based on the availability of its interfaces. This command is useful for tracking interfaces that are not configured for VRRP. Only

IP interfaces are tracked. A tracked interface is up if the IP on that interface is up. Otherwise, the tracked interface is down.

When the tracked interface is down or the interface has been removed from the router, the priority of the VRRP router will be decremented by the value specified in the < priority > argument. When the interface is up for IP protocol, the priority will be incremented by the < priority > value.

A VRRP configured interface can track more than one interface. When a tracked interface goes down, then the priority of the router will be decreased by 10 (the default priority decrement) for each downed interface. The default priority decrement is changed using the < priority > argument.



The default priority of the virtual router is 100, and the default decrement priority is 10. By default, no interfaces are tracked. If you specify just the interface to be tracked, without giving the optional priority, then the default priority will be set. The default priority decrement is 10.

Default

Format

Mode priority: 10

ip vrrp <vrid> track interface <unit/slot/port> [decrement < priority >]

Interface Config no ip vrrp track interface

Use this command to remove the interface from the tracked list or to restore the priority decrement to its default.

Format

Mode

no ip vrrp <vrid> track interface <unit/slot/port> [decrement]

Interface Config ip vrrp track ip route

Use this command to track the route reachability. When the tracked route is deleted, the priority of the VRRP router will be decremented by the value specified in the < priority > argument. When the tracked route is added, the priority will be incremented by the same.

A VRRP configured interface can track more than one route. When a tracked route goes down, then the priority of the router will be decreased by 10 (the default priority decrement) for each downed route. By default no routes are tracked. If you specify just the route to be tracked, without giving the optional priority, then the default priority will be set. The default priority decrement is

10. The default priority decrement is changed using the < priority > argument.

Default

Format

Mode priority: 10

ip vrrp <vrid> track ip route <ip-address/prefix-length> [decrement

< priority >]

Interface Config



no ip vrrp track ip route

Use this command to remove the route from the tracked list or to restore the priority decrement to its default. When removing a tracked IP route from the tracked list, the priority should be incremented by the decrement value if the route is not reachable.

Format

Mode

no ip vrrp <vrid> track ip route <ip-address/prefix-length >

[decrement]

Interface Config show ip vrrp interface stats

This command displays the statistical information about each virtual router configured on the switch.

Format

Modes

show ip vrrp interface stats <unit/slot/port> <vrid>

• Privileged EXEC

• User EXEC

Term Definition

Uptime

Protocol

State

Transitioned to

Master

Advertisement

Received

Advertisement

Interval Errors

Authentication

Failure

IP TTL errors

The time that the virtual router has been up, in days, hours, minutes and seconds.

The protocol configured on the interface.

The total number of times virtual router state has changed to MASTER.

The total number of VRRP advertisements received by this virtual router.

The total number of VRRP advertisements received for which advertisement interval is different than the configured value for this virtual router.

The total number of VRRP packets received that don't pass the authentication check.

The total number of VRRP packets received by the virtual router with IP TTL (time to live) not equal to 255.

The total number of VRRP packets received by virtual router with a priority of '0'.

Zero Priority

Packets

Received

Zero Priority

Packets Sent

The total number of VRRP packets sent by the virtual router with a priority of '0'.



Term

Invalid Type

Packets

Received

Address List

Errors

Invalid

Authentication

Type

Authentication

Type Mismatch

Packet Length

Errors

Definition

The total number of VRRP packets received by the virtual router with invalid 'type' field.

The total number of VRRP packets received for which address list does not match the locally configured list for the virtual router.

The total number of VRRP packets received with unknown authentication type.

The total number of VRRP advertisements received for which 'auth type' not equal to locally configured one for this virtual router.

The total number of VRRP packets received with packet length less than length of VRRP header.

show ip vrrp

This command displays whether VRRP functionality is enabled or disabled on the switch. It also displays some global parameters which are required for monitoring. This command takes no options.

Format

Modes show ip vrrp

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode

Router

Checksum

Errors

Router Version

Errors

Router VRID

Errors

The administrative mode for VRRP functionality on the switch.

The total number of VRRP packets received with an invalid VRRP checksum value.

The total number of VRRP packets received with Unknown or unsupported version number.

The total number of VRRP packets received with invalid VRID for this virtual router.



show ip vrrp interface

This command displays all configuration information and VRRP router statistics of a virtual router configured on a specific interface. Use the output of the command to verify the track interface and track IP route configurations.

Format

Modes

show ip vrrp interface {<unit/slot/port> <vrid> | vlan <1-4093>}

• Privileged EXEC

• User EXEC

Term Definition

Primary IP

Address

The configured IP address for the Virtual router.

VMAC address The VMAC address of the specified router.

Authentication type

The authentication type for the specific virtual router.

Priority

Configured

Priority

The priority value for the specific virtual router, taking into account any priority decrements for tracked interfaces or routes.

The priority configured through the ip vrrp <vrid> priority <1-254> command.

Advertisement interval

The advertisement interval in seconds for the specific virtual router.

Pre-Empt Mode The preemption mode configured on the specified virtual router.

The status (Enable or Disable) of the specific router.

Administrative

Mode

State The state (Master/backup) of the virtual router.


show ip vrrp interface <u/s/p> <vrid>

Primary IP Address............................. 1.1.1.5

VMAC Address................................... 00:00:5e:00:01:01

Authentication Type............................ None

Priority....................................... 80

Configured priority.......................... 100

Advertisement Interval (secs).................. 1

Pre-empt Mode.................................. Enable

Administrative Mode............................ Enable

State.......................................... Initialized

Track Interface State DecrementPriority

--------------- ------ ------------------



<1/0/1> down 10

TrackRoute (pfx/len) State DecrementPriority

------------------------ ------ ------------------

10.10.10.1/255.255.255.0 down 10 show ip vrrp interface brief

This command displays information about each virtual router configured on the switch. This command takes no options. It displays information about each virtual router.

Format

Modes show ip vrrp interface brief

• Privileged EXEC

• User EXEC

Term

Interface

VRID

IP Address

Mode

State

Definition


The router ID of the virtual router.

The virtual router IP address.

Indicates whether the virtual router is enabled or disabled.

The state (Master/backup) of the virtual router.

DHCP and BOOTP Relay Commands

This section describes the commands you use to configure BootP/DHCP Relay on the switch. A

DHCP relay agent operates at Layer 3 and forwards DHCP requests and replies between clients and servers when they are not on the same physical subnet. bootpdhcprelay cidoptmode

This command enables the circuit ID option mode for BootP/DHCP Relay on the system.

Default

Format

Mode disabled bootpdhcprelay cidoptmode

Global Config


4-34


no bootpdhcprelay cidoptmode

This command disables the circuit ID option mode for BootP/DHCP Relay on the system.

Format

Mode no bootpdhcprelay cidoptmode

Global Config bootpdhcprelay maxhopcount

This command configures the maximum allowable relay agent hops for BootP/DHCP Relay on the system. The <hops> parameter has a range of 1 to 16.

Default

Format

Mode

4

bootpdhcprelay maxhopcount <1-16>

Global Config no bootpdhcprelay maxhopcount

This command configures the default maximum allowable relay agent hops for BootP/DHCP

Relay on the system.

Format

Mode no bootpdhcprelay maxhopcount

Global Config bootpdhcprelay minwaittime

This command configures the minimum wait time in seconds for BootP/DHCP Relay on the system. When the BOOTP relay agent receives a BOOTREQUEST message, it MAY use the seconds-since-client-began-booting field of the request as a factor in deciding whether to relay the request or not. The parameter has a range of 0 to 100 seconds.

Default

Format

Mode

0

bootpdhcprelay minwaittime <0-100>

Global Config



no bootpdhcprelay minwaittime

This command configures the default minimum wait time in seconds for BootP/DHCP Relay on the system.

Format

Mode no bootpdhcprelay minwaittime

Global Config show bootpdhcprelay

This command displays the BootP/DHCP Relay information.

Format

Modes show bootpdhcprelay

• Privileged EXEC

• User EXEC

Term Definition

Maximum Hop

Count

Minimum Wait

Time (Seconds)

Admin Mode

The maximum allowable relay agent hops.

The minimum wait time.

Indicates whether relaying of requests is enabled or disabled.

Server IP

Address

The IP address for the BootP/DHCP Relay server.

Circuit Id Option

Mode

The DHCP circuit Id option which may be enabled or disabled.

The number or requests received.

Requests

Received

Requests

Relayed

Packets

Discarded

The number of requests relayed.

The number of packets discarded.



IP Helper Commands

This section describes the commands to configure a DHCP relay agent with multiple DHCP server addresses per routing interface, and to use different server addresses for client packets arriving on different interfaces on the relay agent.

ip helper-address (Global Config)

Use the Global Configuration ip helper-address command to have the switch forward User

Datagram Protocol (UDP) broadcasts received on an interface. To disable the forwarding of broadcast packets to specific addresses, use the no form of this command.

The ip helper-address command forwards specific UDP broadcast from one interface to another.

You can define many helper addresses but the total number of address-port pairs is limited to 128 for the whole device. The setting of a helper address for a specific interface has precedence over a setting of a helper address for all interfaces. You cannot enable forwarding of BOOTP/DHCP packets (ports 67,68) with this command. If you want to relay BOOTP/DHCP packets, use the

DHCP relay commands.

Ip-address: Destination broadcast or host address to be used when forwarding UDP broadcasts.

You can specify 0.0.0.0 to indicate not to forward the UDP packet to any host and use

"255.255.255.255" to broadcast the UDP packets to all hosts on the target subnet.

udp-port-list: The broadcast packet destination UDP port number to forward. If not specified, packets for the default services are forwarded to the helper address. Valid range, 0-65535.

Default

Format

Mode

Disabled ip helper-address <ip-address>

{<1-65535>|dhcp|domain|isakmp|mobile-ip|nameserver| netbios-dgm|netbios-ns|ntp|pim-auto-rip|rip|tacacs|tftp|time}

Global Config no ip helper-address (Global Config)

Use this command to remove the IP address from the previously configured list. The no command without an < ip-address > argument removes the entire list of helper addresses on that interface.



Format

Mode no ip helper-address {<ip-address>}


GlobalConfig ip helper-address

Use this command to add a unicast helper address to the list of helper addresses on an interface.

This is the address of a DHCP server. This command can be applied multiple times on the routing interface to form the helper addresses list until the list reaches the maximum supported helper addresses.

Format

Mode ip helper-address <ip-address>


Interface Config no ip helper-address

Use this command to remove the IP address from the previously configured list. The no command without an < ip-address > argument removes the entire list of helper addresses on that interface.

Format

Mode no ip helper-address {< ip-address >}


Interface Config ip helper-address discard

Use this command to drop matching packets.

Format

Mode ip helper-address discard


Interface Config



no ip helper-address discard

Use this command to permit the matching packets.

Format

Mode no ip helper-address discard


Interface Config show ip helper-address

Use this command to display the configured helper addresses on the given interface.

Format

Mode show ip helper-address < interface >

• Privileged EXEC

• User EXEC


(switch) #show ip helper-address 1/0/1

Helper IP Address.............................. 1.2.3.4

............................................... 1.2.3.5

Open Shortest Path First (OSPF) Commands

This section describes the commands you use to view and configure OSPF, which is a link-state routing protocol that you use to route traffic within a network. router ospf

Use this command to enter Router OSPF mode.

Format

Mode router ospf

Global Config



enable (OSPF)

This command resets the default administrative mode of OSPF in the router (active).

Default

Format

Mode enabled enable

Router OSPF Config no enable (OSPF)

This command sets the administrative mode of OSPF in the router to inactive.

Format

Mode no enable

Router OSPF Config network area (OSPF)

Use this command to enable OSPFv2 on an interface and set its area ID if the IP address of an interface is covered by this network command.

Default

Format

Mode disabled network <ip-address> <wildcard-mask> area <area-id>

Router OSPF Config no network area (OSPF)

Use this command to disable the OSPFv2 on a interface if the IP address of an interface was earlier covered by this network command.

Format

Mode no network <ip-address> <wildcard-mask> area <area-id>

Router OSPF Config


4-40


ip ospf area

Use this command to enable OSPFv2 and set the area ID of an interface. The < area-id > is an IP address formatted as a 4-digit dotted-decimal number or a decimal value in the range of <0-

4294967295>. This command supersedes the effects of the network area command. It can also be used to configure the advertiseability of the secondary addresses on this interface into the

OSPFv2 domain.

Default

Format

Mode disabled ip ospf area < area-id > [secondaries none]

Interface Config no ip ospf area

Use this command to disable OSPF on an interface.

Format

Mode no ip ospf area [secondaries none]

Interface Config

1583compatibility

This command enables OSPF 1583 compatibility.

Note: 1583 compatibility mode is enabled by default. If all OSPF routers in the routing domain are capable of operating according to RFC 2328, OSPF 1583 compatibility mode should be disabled.

Default

Format

Mode enabled

1583compatibility

Router OSPF Config no 1583compatibility

This command disables OSPF 1583 compatibility.

Format

Mode no 1583compatibility

Router OSPF Config


4-41


area default-cost (OSPF)

This command configures the default cost for the stub area. You must specify the area ID and an integer value between 1-16777215.

Format

Mode

area <areaid> default-cost <1-16777215>

Router OSPF Config area nssa (OSPF)

This command configures the specified areaid to function as an NSSA.

Format

Mode

area <areaid> nssa

Router OSPF Config no area nssa

This command disables nssa from the specified area id.

Format

Mode

no area <areaid> nssa

Router OSPF Config area nssa default-info-originate (OSPF)

This command configures the metric value and type for the default route advertised into the

NSSA. The optional metric parameter specifies the metric of the default route and is to be in a range of 1-16777214. If no metric is specified, the default value is 10. The metric type can be comparable (nssa-external 1) or non-comparable (nssa-external 2).

Format

Mode

area <areaid> nssa default-info-originate [<metric>] [{comparable | non-comparable}]

Router OSPF Config


4-42


no area nssa default-info-originate (OSPF)

This command disables the default route advertised into the NSSA.

Format

Mode

no area <areaid> nssa default-info-originate [<metric>] [{comparable

| non-comparable}]

Router OSPF Config area nssa no-redistribute (OSPF)

This command configures the NSSA Area Border router (ABR) so that learned external routes will not be redistributed to the NSSA.

Format

Mode

area <areaid> nssa no-redistribute

Router OSPF Config no area nssa no-redistribute (OSPF)

This command disables the NSSA ABR so that learned external routes are redistributed to the

NSSA.

Format

Mode

no area <areaid> nssa no-redistribute

Router OSPF Config area nssa no-summary (OSPF)

This command configures the NSSA so that summary LSAs are not advertised into the NSSA.

Format

Mode

area <areaid> nssa no-summary

Router OSPF Config no area nssa no-summary (OSPF)

This command disables nssa from the summary LSAs.

Format

Mode

no area <areaid> nssa no-summary

Router OSPF Config


4-43


area nssa translator-role (OSPF)

This command configures the translator role of the NSSA. A value of always causes the router to assume the role of the translator the instant it becomes a border router and a value of candidate causes the router to participate in the translator election process when it attains border router status.

Format

Mode

area <areaid> nssa translator-role {always | candidate}

Router OSPF Config no area nssa translator-role (OSPF)

This command disables the nssa translator role from the specified area id.

Format

Mode

no area <areaid> nssa translator-role {always | candidate}

Router OSPF Config area nssa translator-stab-intv (OSPF)

This command configures the translator <stabilityinterval> of the NSSA. The

<stabilityinterval> is the period of time that an elected translator continues to perform its duties after it determines that its translator status has been deposed by another router.

Format

Mode

area <areaid> nssa translator-stab-intv <stabilityinterval>

Router OSPF Config no area nssa translator-stab-intv (OSPF)

This command disables the nssa translator’s <stabilityinterval> from the specified area id.

Format

Mode

no area <areaid> nssa translator-stab-intv <stabilityinterval>

Router OSPF Config



area range (OSPF)

This command creates a specified area range for a specified NSSA. The <ipaddr> is a valid IP address. The <subnetmask> is a valid subnet mask. The LSDB type must be specified by either summarylink or nssaexternallink , and the advertising of the area range can be allowed or suppressed.

Format

Mode

area <areaid> range <ipaddr> <subnetmask> {summarylink | nssaexternallink} [advertise | not-advertise]

Router OSPF Config no area range

This command deletes a specified area range. The <ipaddr> is a valid IP address. The

<subnetmask> is a valid subnet mask.

Format

Mode

no area <areaid> range <ipaddr> <subnetmask>

Router OSPF Config area stub (OSPF)

This command creates a stub area for the specified area ID. A stub area is characterized by the fact that AS External LSAs are not propagated into the area. Removing AS External LSAs and

Summary LSAs can significantly reduce the link state database of routers within the stub area.

Format

Mode

area <areaid> stub

Router OSPF Config no area stub

This command deletes a stub area for the specified area ID.

Format

Mode

no area <areaid> stub

Router OSPF Config



area stub no-summary (OSPF)

This command configures the Summary LSA mode for the stub area identified by <areaid> .

Use this command to prevent LSA Summaries from being sent.

Default

Format

Mode disabled

area <areaid> stub no-summary

Router OSPF Config no area stub no-summary

This command configures the default Summary LSA mode for the stub area identified by

<areaid> .

Format

Mode

no area <areaid> stub no-summary

Router OSPF Config area virtual-link (OSPF)

This command creates the OSPF virtual interface for the specified <areaid> and

<neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

area <areaid> virtual-link <neighbor>

Router OSPF Config no area virtual-link

This command deletes the OSPF virtual interface from the given interface, identified by

<areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor>

Router OSPF Config



area virtual-link authentication

This command configures the authentication type and key for the OSPF virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor. The value for <type> is either none, simple, or encrypt. The [key] is composed of standard displayable, non-control keystrokes from a Standard 101/102-key keyboard. The authentication key must be 8 bytes or less if the authentication type is simple. If the type is encrypt, the key may be up to 16 bytes. Unauthenticated interfaces do not need an authentication key. If the type is encrypt, a key id in the range of 0 and 255 must be specified.The default value for authentication type is none. Neither the default password key nor the default key id are configured.

Default

Format

Mode none

area <areaid> virtual-link <neighbor> authentication {none | {simple

<key>} | {encrypt <key> <keyid>}}

Router OSPF Config no area virtual-link authentication

This command configures the default authentication type for the OSPF virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor> authentication

Router OSPF Config area virtual-link dead-interval (OSPF)

This command configures the dead interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor>.

The <neighbor> parameter is the Router ID of the neighbor. The range for seconds is 1 to 65535.

Default

Format

Mode

40

area <areaid> virtual-link <neighbor> dead-interval <seconds>

Router OSPF Config



no area virtual-link dead-interval

This command configures the default dead interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the

Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor> dead-interval

Router OSPF Config area virtual-link hello-interval (OSPF)

This command configures the hello interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor. The range for <seconds> is 1 to 65535.

Default

Format

Mode

10

area <areaid> virtual-link <neighbor> hello-interval <1-65535>

Router OSPF Config no area virtual-link hello-interval

This command configures the default hello interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the


Format

Mode

no area <areaid> virtual-link <neighbor> hello-interval

Router OSPF Config area virtual-link retransmit-interval (OSPF)

This command configures the retransmit interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the

Router ID of the neighbor. The range for seconds is 0 to 3600.

Default

Format

Mode

5

area <areaid> virtual-link <neighbor> retransmit-interval <seconds>

Router OSPF Config



no area virtual-link retransmit-interval

This command configures the default retransmit interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor> retransmit-interval

Router OSPF Config area virtual-link transmit-delay (OSPF)

This command configures the transmit delay for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor. The range for seconds is 0 to 3600 (1 hour).

Default

Format

Mode

1

area <areaid> virtual-link <neighbor> transmit-delay <seconds>

Router OSPF Config no area virtual-link transmit-delay

This command resets the default transmit delay for the OSPF virtual interface to the default value.

Format

Mode

no area <areaid> virtual-link <neighbor> transmit-delay

Router OSPF Config auto-cost (OSPF)

By default, OSPF computes the link cost of each interface from the interface bandwidth. Faster links have lower metrics, making them more attractive in route selection. The configuration parameters in the auto-cost reference bandwidth and bandwidth commands give you control over the default link cost. You can configure for OSPF an interface bandwidth that is independent of the actual link speed. A second configuration parameter allows you to control the ratio of interface bandwidth to link cost. The link cost is computed as the ratio of a reference bandwidth to the interface bandwidth (ref_bw / interface bandwidth), where interface bandwidth is defined by the bandwidth command. Because the default reference bandwidth is 100 Mbps,

OSPF uses the same default link cost for all interfaces whose bandwidth is 100 Mbps or greater.



Use the auto-cost command to change the reference bandwidth, specifying the reference bandwidth in megabits per second (Mbps). The reference bandwidth range is 1-4294967 Mbps.

The different reference bandwidth can be independently configured for OSPFv2 and OSPFv3.

Default

Format

Mode

100Mbps auto-cost reference-bandwidth < 1 to 4294967 >

Router OSPF Config no auto-cost reference-bandwidth (OSPF)

Use this command to set the reference bandwidth to the default value.

Format

Mode no auto-cost reference-bandwidth

Router OSPF Config bandwidth

By default, OSPF computes the link cost of an interface as the ratio of the reference bandwidth to the interface bandwidth. Reference bandwidth is specified with the auto-cost command. For the purpose of the OSPF link cost calculation, use the bandwidth command to specify the interface bandwidth. The bandwidth is specified in kilobits per second. If no bandwidth is configured, the bandwidth defaults to the actual interface bandwidth for port-based routing interfaces and to 10

Mbps for VLAN routing interfaces. This command does not affect the actual speed of an interface.

Default

Format

Mode actual interface bandwidth bandwidth < 1-10000000 >

Interface Config no bandwidth

Use this command to set the interface bandwidth to its default value.

Format

Mode no bandwidth

Interface Config



capability opaque

Use this command to enable Opaque Capability on the Router. The information contained in

Opaque LSAs may be used directly by OSPF or indirectly by an application wishing to distribute information throughout the OSPF domain. The 7000 series supports the storing and flooding of

Opaque LSAs of different scopes.

Default

Format

Mode disabled capability opaque

Router OSPF Config no capability opaque

Use this command to disable opaque capability on the router.

Format

Mode no capability opaque

Router OSPF Config clear ip ospf

Use this command to disable and re-enable OSPF.

Format

Mode clear ip ospf

Privileged EXEC clear ip ospf configuration

Use this command to reset the OSPF configuration to factory defaults.

Format

Mode clear ip ospf configuration

Privileged EXEC clear ip ospf counters

Use this command to reset global and interface statistics.


4-51


Format

Mode clear ip ospf counters

Privileged EXEC clear ip ospf neighbor

Use this command to drop the adjacency with all OSPF neighbors. On each neighbor’s interface, send a one-way hello. Adjacencies may then be re-established. To drop all adjacencies with a specific router ID, specify the neighbor’s Router ID using the optional parameter [ neighbor-id ].

Format

Mode clear ip ospf neighbor [ neighbor-id ]

Privileged EXEC clear ip ospf neighbor interface

To drop adjacency with all neighbors on a specific interface, use the optional parameter [ unit/slot/ port ]. To drop adjacency with a specific router ID on a specific interface, use the optional parameter [ neighbor-id ].

Format

Mode clear ip ospf neighbor interface [ unit/slot/port ] [ neighbor-id ]

Privileged EXEC clear ip ospf redistribution

Use this command to flush all self-originated external LSAs. Reapply the redistribution configuration and re-originate prefixes as necessary.

Format

Mode clear ip ospf redistribution

Privileged EXEC


4-52


default-information originate (OSPF)

This command is used to control the advertisement of default routes.

Default

Format

Mode

• metric—unspecified

• type—2

default-information originate [always] [metric <0-16777214>] [metric- type {1 | 2}]

Router OSPF Config no default-information originate (OSPF)


Format

Mode

no default-information originate [metric] [metric-type]

Router OSPF Config default-metric (OSPF)

This command is used to set a default for the metric of distributed routes.

Format

Mode

default-metric <1-16777214>

Router OSPF Config no default-metric (OSPF)


Format

Mode no default-metric

Router OSPF Config


4-53


distance ospf (OSPF)

This command sets the route preference value of OSPF in the router. Lower route preference values are preferred when determining the best route. The type of OSPF route can be intra, inter , or external . All the external type routes are given the same preference value. The range of < preference > value is 1 to 255.

Default

Format

Mode

110

distance ospf {intra-area <1-255> | inter-area <1-255> | external <1-

255>}

Router OSPF Config no distance ospf

This command sets the default route preference value of OSPF routes in the router. The type of

OSPF can be intra, inter, or external. All the external type routes are given the same preference value.

Format

Mode

no distance ospf {intra-area | inter-area | external}

Router OSPF Config distribute-list out (OSPF)

Use this command to specify the access list to filter routes received from the source protocol.

Format

Mode

distribute-list <1-199> out {rip | static | connected}

Router OSPF Config no distribute-list out

Use this command to specify the access list to filter routes received from the source protocol.

Format

Mode

no distribute-list <1-199> out {rip | static | connected}

Router OSPF Config



exit-overflow-interval (OSPF)

This command configures the exit overflow interval for OSPF. It describes the number of seconds after entering overflow state that a router will wait before attempting to leave the overflow state.

This allows the router to again originate non-default AS-external-LSAs. When set to 0, the router will not leave overflow state until restarted. The range for seconds is 0 to 2147483647 seconds.

Default

Format

Mode

0

exit-overflow-interval <seconds>

Router OSPF Config no exit-overflow-interval

This command configures the default exit overflow interval for OSPF.

Format

Mode no exit-overflow-interval

Router OSPF Config external-lsdb-limit (OSPF)

This command configures the external LSDB limit for OSPF. If the value is -1, then there is no limit. When the number of non-default AS-external-LSAs in a router's link-state database reaches the external LSDB limit, the router enters overflow state. The router never holds more than the external LSDB limit non-default AS-external-LSAs in it database. The external LSDB limit

MUST be set identically in all routers attached to the OSPF backbone and/or any regular OSPF area. The range for limit is -1 to 2147483647.

Default

Format

Mode

-1

external-lsdb-limit <limit>

Router OSPF Config no external-lsdb-limit

This command configures the default external LSDB limit for OSPF.

Format

Mode no external-lsdb-limit

Router OSPF Config



ip ospf authentication

This command sets the OSPF Authentication Type and Key for the specified interface. The value of < type > is either none, simple or encrypt. The < key > is composed of standard displayable, non-control keystrokes from a Standard 101/102-key keyboard. The authentication key must be 8 bytes or less if the authentication type is simple. If the type is encrypt, the key may be up to 16 bytes. If the type is encrypt a < keyid > in the range of 0 and 255 must be specified.

Unauthenticated interfaces do not need an authentication key or authentication key ID. There is no default value for this command.

Format

Mode

ip ospf authentication {none | {simple <key>} | {encrypt <key>

<keyid>}}

Interface Config no ip ospf authentication

This command sets the default OSPF Authentication Type for the specified interface.

Format

Mode no ip ospf authentication

Interface Config ip ospf cost

This command configures the cost on an OSPF interface. The < cost > parameter has a range of 1 to 65535.

Default

Format

Mode

10

ip ospf cost <1-65535>

Interface Config no ip ospf cost

This command configures the default cost on an OSPF interface.

Format

Mode no ip ospf cost

Interface Config



ip ospf dead-interval

This command sets the OSPF dead interval for the specified interface. The value for < seconds > is a valid positive integer, which represents the length of time in seconds that a router's Hello packets have not been seen before its neighbor routers declare that the router is down. The value for the length of time must be the same for all routers attached to a common network. This value should be some multiple of the Hello Interval (i.e. 4). Valid values range in seconds from 1 to

2147483647.

Default

Format

Mode

40

ip ospf dead-interval <seconds>

Interface Config no ip ospf dead-interval

This command sets the default OSPF dead interval for the specified interface.

Format

Mode no ip ospf dead-interval

Interface Config ip ospf hello-interval

This command sets the OSPF hello interval for the specified interface. The value for seconds is a valid positive integer, which represents the length of time in seconds. The value for the length of time must be the same for all routers attached to a network. Valid values range from 1 to 65535.

Default

Format

Mode

10

ip ospf hello-interval <seconds>

Interface Config no ip ospf hello-interval

This command sets the default OSPF hello interval for the specified interface.

Format

Mode no ip ospf hello-interval

Interface Config



ip ospf network

Use this command to configure OSPF to treat an interface as a point-to-point rather than broadcast interface. The broadcast option sets the OSPF network type to broadcast. The point-topoint option sets the OSPF network type to point-to-point. OSPF treats interfaces as broadcast interfaces by default. (Loopback interfaces have a special loopback network type, which cannot be changed.) When there are only two routers on the network, OSPF can operate more efficiently by treating the network as a point-to-point network. For point-to-point networks, OSPF does not elect a designated router or generate a network link state advertisement (LSA). Both endpoints of the link must be configured to operate in point-to-point mode.

Default

Format

Mode broadcast ip ospf network {broadcast|point-to-point}

Interface Config no ip ospf network

Use this command to return the OSPF network type to the default.

Format

Mode no ip ospf network

Interface Config ip ospf priority

This command sets the OSPF priority for the specified router interface. The priority of the interface is a priority integer from 0 to 255. A value of 0 indicates that the router is not eligible to become the designated router on this network.

Default

Format

Mode

1, which is the highest router priority

ip ospf priority <0-255>

Interface Config


4-58


no ip ospf priority

This command sets the default OSPF priority for the specified router interface.

Format

Mode no ip ospf priority

Interface Config ip ospf retransmit-interval

This command sets the OSPF retransmit Interval for the specified interface. The retransmit interval is specified in seconds. The value for < seconds > is the number of seconds between link-state advertisement retransmissions for adjacencies belonging to this router interface. This value is also used when retransmitting database description and link-state request packets. Valid values range from 0 to 3600 (1 hour).

Default

Format

Mode

5

ip ospf retransmit-interval <0-3600>

Interface Config no ip ospf retransmit-interval

This command sets the default OSPF retransmit Interval for the specified interface.

Format

Mode no ip ospf retransmit-interval

Interface Config ip ospf transmit-delay

This command sets the OSPF Transit Delay for the specified interface. The transmit delay is specified in seconds. In addition, it sets the estimated number of seconds it takes to transmit a link state update packet over this interface. Valid values for <seconds> range from 1 to 3600 (1 hour).

Default

Format

Mode

1

ip ospf transmit-delay <1-3600>

Interface Config



no ip ospf transmit-delay

This command sets the default OSPF Transit Delay for the specified interface.

Format

Mode no ip ospf transmit-delay

Interface Config ip ospf mtu-ignore

This command disables OSPF maximum transmission unit (MTU) mismatch detection. OSPF

Database Description packets specify the size of the largest IP packet that can be sent without fragmentation on the interface. When a router receives a Database Description packet, it examines the MTU advertised by the neighbor. By default, if the MTU is larger than the router can accept, the Database Description packet is rejected and the OSPF adjacency is not established.

Default

Format

Mode enabled ip ospf mtu-ignore

Interface Config no ip ospf mtu-ignore

This command enables the OSPF MTU mismatch detection.

Format

Mode no ip ospf mtu-ignore

Interface Config router-id (OSPF)

This command sets a 4-digit dotted-decimal number uniquely identifying the router ospf id. The

< ipaddress > is a configured value.

Format

Mode

router-id <ipaddress>

Router OSPF Config



redistribute (OSPF)

This command configures OSPF protocol to allow redistribution of routes from the specified source protocol/routers.

Default

Format

Mode


• type—2

• tag—0

redistribute {rip | static | connected} [metric <0-16777214>] [metric- type {1 | 2}] [tag <0-4294967295>] [subnets]

Router OSPF Config no redistribute

This command configures OSPF protocol to prohibit redistribution of routes from the specified source protocol/routers.

Format

Mode

no redistribute {rip | static | connected} [metric] [metric-type]

[tag] [subnets]

Router OSPF Config maximum-paths (OSPF)

This command sets the number of paths that OSPF can report for a given destination where maxpaths is platform dependent.

Default

Format

Mode

4

maximum-paths <maxpaths>

Router OSPF Config no maximum-paths

This command resets the number of paths that OSPF can report for a given destination back to its default value.

Format

Mode no maximum-paths

Router OSPF Config



passive-interface default (OSPF)

Use this command to enable global passive mode by default for all interfaces. It overrides any interface level passive mode. OSPF will not form adjacencies over a passive interface.

Default

Format

Mode disabled passive-interface default

Router OSPF Config no passive-interface default

Use this command to disable the global passive mode by default for all interfaces. Any interface previously configured to be passive reverts to non-passive mode.

Format

Mode no passive-interface default

Router OSPF Config passive-interface (OSPF)

Use this command to set the interface or tunnel as passive. It overrides the global passive mode that is currently effective on the interface or tunnel.

Default

Format

Mode disabled passive-interface {< unit/slot/port >}

Router OSPF Config no passive-interface

Use this command to set the interface or tunnel as non-passive. It overrides the global passive mode that is currently effective on the interface or tunnel.

Format

Mode no passive-interface {< unit/slot/port >}

Router OSPF Config



timers spf

Use this command to configure the SPF delay time and hold time. The valid range for both parameters is 0-65535 seconds.

Default

Format

Mode

• delay-time—5

• hold-time—10

timers spf <delay-time> <hold-time>

Router OSPF Config trapflags (OSPF)

Use this command to enable individual OSPF traps, enable a group of trap flags at a time, or enable all the trap flags at a time. The different groups of trapflags, and each group’s specific trapflags to enable or disable, are listed in <Cross-Ref>Table 1.

Table 1: Trapflags Groups

Group errors if-rx lsa overflow retransmit rtb state-change

Flags

• authentication-failure

• bad-packet

• config-error

• virt-authentication-failure

• virt-bad-packet

• virt-config-error ir-rx-packet

• lsa-maxage

• lsa-originate

• lsdb-overflow

• lsdb-approaching-overflow

• packets

• virt-packets

• rtb-entry-info

• if-state-change

• neighbor-state-change

• virtif-state-change

• virtneighbor-state-change

• To enable the individual flag, enter the group name followed by that particular flag.

• To enable all the flags in that group, give the group name followed by all .



• To enable all the flags, give the command as trapflags all .

Default

Format disabled trapflags { all | errors {all | authentication-failure | bad-packet | config-error | virtauthentication-failure | virt-bad-packet | virt-config-error} | if-rx {all | if-rx-packet} | lsa {all | lsa-maxage | lsa-originate} | overflow {all | lsdb-overflow | lsdb-approaching-overflow} | retransmit {all | packets | virt-packets} | rtb {all, rtb-entry-info} | state-change {all | if-state-change | neighbor-state-change | virtifstatechange | virtneighbor-state-change}

}

Mode Router OSPF Config no trapflags

Use this command to revert to the default reference bandwidth.

• To disable the individual flag, enter the group name followed by that particular flag.

• To disable all the flags in that group, give the group name followed by all .

• To disable all the flags, give the command as trapflags all .


4-64


Format no trapflags { all | errors {all | authentication-failure | bad-packet | config-error | virtauthentication-failure | virt-bad-packet | virt-config-error} | if-rx {all | if-rx-packet} | lsa {all | lsa-maxage | lsa-originate} | overflow {all | lsdb-overflow | lsdb-approaching-overflow} | retransmit {all | packets | virt-packets} | rtb {all, rtb-entry-info} | state-change {all | if-state-change | neighbor-state-change | virtifstatechange | virtneighbor-state-change}

}

Router OSPF Config Mode show ip ospf

This command displays information relevant to the OSPF router.

Format

Mode show ip ospf

Privileged EXEC

Note: Some of the information below displays only if you enable OSPF and configure certain features.

Term

Router ID

OSPF Admin

Mode

ASBR Mode

RFC 1583

Compatibility

Definition

A 32-bit integer in dotted decimal format identifying the router, about which information is displayed. This is a configured value.

Shows whether the administrative mode of OSPF in the router is enabled or disabled.

This is a configured value.

Indicates whether the ASBR mode is enabled or disabled. Enable implies that the router is an autonomous system border router. Router automatically becomes an ASBR when it is configured to redistribute routes learnt from other protocol. The possible values for the

ASBR status is enabled (if the router is configured to re-distribute routes learned by other protocols) or disabled (if the router is not configured for the same).

Indicates whether 1583 compatibility is enabled or disabled. This is a configured value.



Term Definition

External LSDB

Limit

Exit Overflow

Interval

The maximum number of non-default AS-external-LSA (link state advertisement) entries that can be stored in the link-state database.

The number of seconds that, after entering overflow state, a router will attempt to leave overflow state.

Spf Delay Time The number of seconds between two subsequent changes of LSAs, during which time the routing table calculation is delayed.

Spf Hold Time The number of seconds between two consecutive spf calculations.

Opaque

Capability

Shows whether the router is capable of sending Opaque LSAs. This is a configured value.

Autocost Ref BW Shows the value of auto-cost reference bandwidth configured on the router.

ABR Status

ASBR Status

Stub Router

Shows whether the router is an OSPF Area Border Router.

Reflects whether the ASBR mode is enabled or disabled. Enable implies that the router is an autonomous system border router. The router automatically becomes an ASBR when it is configured to redistribute routes learnt from other protocols. The possible values for the

ASBR status is enabled (if the router is configured to redistribute routes learned by other protocols) or disabled (if the router is not configured for the same).

When OSPF runs out of resources to store the entire link state database, or any other state information, OSPF goes into stub router mode. As a stub router, OSPF re-originates its own router LSAs, setting the cost of all non-stub interfaces to infinity. To restore OSPF to normal operation, disable and re-enable OSPF.

Exit Overflow

Interval


External LSDB

Overflow

When the number of non-default external LSAs exceeds the configured limit, External

LSDB Limit, OSPF goes into LSDB overflow state. In this state, OSPF withdraws all of its self-originated non-default external LSAs. After the Exit Overflow Interval, OSPF leaves the overflow state, if the number of external LSAs has been reduced.

The number of external (LS type 5) link-state advertisements in the link-state database.

External LSA

Count

External LSA

Checksum

The sum of the LS checksums of external link-state advertisements contained in the linkstate database.

Shows the number of AS Opaque LSAs in the link-state database.

AS_OPAQUE

LSA Count

AS_OPAQUE

LSA Checksum

Shows the sum of the LS Checksums of AS Opaque LSAs contained in the link-state database.

New LSAs

Originated

The number of new link-state advertisements that have been originated.

LSAs Received The number of link-state advertisements received determined to be new instantiations.

LSA Count The total number of link state advertisements currently in the link state database.



Term Definition

Maximum

Number of LSAs

The maximum number of LSAs that OSPF can store.

LSA High Water

Mark

The maximum size of the link state database since the system started.

Retransmit List

Entries

The total number of LSAs waiting to be acknowledged by all neighbors. An LSA may be pending acknowledgment from more than one neighbor.

The maximum number of LSAs that can be waiting for acknowledgment at any given time.

Maximum

Number of

Retransmit

Entries

Retransmit

Entries High

Water Mark

The highest number of LSAs that have been waiting for acknowledgment.

External LSDB

Limit

The maximum number of non-default AS-external-LSAs entries that can be stored in the link-state database.

Default Metric Default value for redistributed routes.

Default Passive

Setting

Shows whether the interfaces are passive by default.

Default Route

Advertise

Always

Metric

Metric Type

Number of

Active Areas

Indicates whether the default routes received from other source protocols are advertised or not.

Shows whether default routes are always advertised.

The metric of the routes being redistributed. If the metric is not configured, this field is blank.

Shows whether the routes are External Type 1 or External Type 2.

The number of active OSPF areas. An “active” OSPF area is an area with at least one interface up.

AutoCost Ref

BW

Shows the value of auto-cost reference bandwidth configured on the router.

Maximum Paths The maximum number of paths that OSPF can report for a given destination.

Redistributing This field is a heading and appears only if you configure the system to take routes learned from a non-OSPF source and advertise them to its peers.

Source The source protocol/routes that are being redistributed. Possible values are static, connected, or RIP.

Tag

Subnets

The decimal value attached to each external route.

For redistributing routes into OSPF, the scope of redistribution for the specified protocol.

Distribute-List The access list used to filter redistributed routes.




(Switch) #show ip ospf

Router ID.....................................2.2.2.2

OSPF Admin Mode...............................Disable

RFC 1583 Compatibility........................Enable

External LSDB Limit...........................No Limit

Exit Overflow Interval........................0

Spf Delay Time................................5

Spf Hold Time.................................10

Opaque Capability.............................Disable

AutoCost Ref BW...............................100 Mbps

Default Passive Setting.......................Disabled

Maximum Paths.................................4

Default Metric................................Not configured

Default Route Advertise.......................Disabled

Always........................................FALSE

Metric........................................Not configured

Metric Type...................................External Type 2

Number of Active Areas......................... 3 (3 normal, 0 stub, 0 nssa)

ABR Status....................................Disable

ASBR Status...................................Disable

Stub Router...................................FALSE

External LSDB Overflow........................FALSE

External LSA Count............................0

External LSA Checksum.........................0

AS_OPAQUE LSA Count...........................0

AS_OPAQUE LSA Checksum........................0

LSAs Originated...............................0

LSAs Received.................................0

LSA Count.....................................0

Maximum Number of LSAs........................18200

LSA High Water Mark...........................0

Retransmit List Entries........................ 9078

Maximum Number of Retransmit Entries........... 72800

Retransmit Entries High Water Mark............. 72849


4-68


show ip ospf abr

This command displays the internal OSPF routing table entries to Area Border Routers (ABR).

This command takes no options.

Format

Mode show ip ospf abr

• Privileged EXEC

• User EXEC

Term

Type

Router ID

Cost

Area ID

Next Hop

Next Hop Intf

Definition

The type of the route to the destination. It can be either:

• intra — Intra-area route

• inter — Inter-area route

Router ID of the destination.

Cost of using this route.

The area ID of the area from which this route is learned.

Next hop toward the destination.

The outgoing router interface to use when forwarding traffic to the next hop.

show ip ospf area

This command displays information about the area. The < areaid > identifies the OSPF area that is being displayed.

Format

Modes

show ip ospf area <areaid>

• Privileged EXEC

• User EXEC

Term Definition

AreaID The area id of the requested OSPF area.

External Routing A number representing the external routing capabilities for this area.

Spf Runs The number of times that the intra-area route table has been calculated using this area's link-state database.

Area Border

Router Count

The total number of area border routers reachable within this area.

Area LSA Count Total number of link-state advertisements in this area's link-state database, excluding AS

External LSA's.



Term Definition

Area LSA

Checksum

A number representing the Area LSA Checksum for the specified AreaID excluding the external (LS type 5) link-state advertisements.

Import Summary

LSAs

Shows whether to import summary LSAs.

OSPF Stub

Metric Value

The metric value of the stub area. This field displays only if the area is a configured as a stub area.

The following OSPF NSSA specific information displays only if the area is configured as an

NSSA:

Term Definition

Import Summary

LSAs

Shows whether to import summary LSAs into the NSSA.

Redistribute into

NSSA

Shows whether to redistribute information into the NSSA.

Shows whether to advertise a default route into the NSSA.

Default

Information

Originate

Default Metric The metric value for the default route advertised into the NSSA.

Default Metric

Type

The metric type for the default route advertised into the NSSA.

Translator Role The NSSA translator role of the ABR, which is always or candidate.

Translator

Stability Interval

The amount of time that an elected translator continues to perform its duties after it determines that its translator status has been deposed by another router.

Translator State Shows whether the ABR translator state is disabled, always, or elected.

show ip ospf asbr

This command displays the internal OSPF routing table entries to Autonomous System Boundary

Routers (ASBR). This command takes no options.

Format

Mode show ip ospf asbr

• Privileged EXEC

• User EXEC



Term

Type

Router ID

Cost

Area ID

Next Hop

Next Hop Intf

Definition

The type of the route to the destination. It can be one of the following values: intra — Intra-area route inter — Inter-area route






show ip ospf database

This command displays information about the link state database when OSPF is enabled. If you do not enter any parameters, the command displays the LSA headers for all areas. Use the optional

<areaid> parameter to display database information about a specific area. Use the optional parameters to specify the type of link state advertisements to display.

Parameter Description asbr-summary Use asbr-summary to show the autonomous system boundary router (ASBR) summary

LSAs.

external Use external to display the external LSAs. network Use network to display the network LSAs. nssa-external Use nssa-external to display NSSA external LSAs. opaque-area opaque-as opaque-link router summary adv-router self-originate

Use opaque-area to display area opaque LSAs.

Use opaque-as to display AS opaque LSAs.

Use opaque-link to display link opaque LSAs.

Use

Use

Use router to display router LSAs. summary to show the LSA database summary information.

adv-router to show the LSAs that are restricted by the advertising router.

Use self-originate to display the LSAs in that are self originated. The information below is only displayed if OSPF is enabled



The information below is only displayed if OSPF is enabled.

Format

Mode

show ip ospf [<areaid>] database [{database-summary | [{asbr-summary

| external | network | nssa-external | opaque-area | opaque-as | opaque-link | router | summary}] [{adv-router [<ipaddr>] | selforiginate}]}]

• Privileged EXEC

• User EXEC

For each link-type and area, the following information is displayed:

Term

Adv Router

Age

Sequence

Checksum

Options

Rtr Opt

Definition

The Advertising Router. Is a 32 bit dotted decimal number representing the LSDB interface.

A number representing the age of the link state advertisement in seconds.

A number that represents which LSA is more recent.

The total number LSA checksum.

This is an integer. It indicates that the LSA receives special handling during routing calculations.

Router Options are valid for router links only.

show ip ospf database database-summary

Use this command to display the number of each type of LSA in the database for each area and for the router. The command also displays the total number of LSAs in the database.

Format

Modes show ip ospf database database-summary

• Privileged EXEC

• User EXEC

Term Definition

Router Total number of router LSAs in the OSPF link state database.

Network Total number of network LSAs in the OSPF link state database.

Summary Net Total number of summary network LSAs in the database.

Summary ASBR Number of summary ASBR LSAs in the database.

Type-7 Ext Total number of Type-7 external LSAs in the database.

Self-Originated

Type-7

Total number of self originated AS external LSAs in the OSPFv3 link state database.



Term

Opaque Link

Opaque Area

Subtotal

Opaque AS

Total

Definition

Number of opaque link LSAs in the database.

Number of opaque area LSAs in the database.

Number of entries for the identified area.

Number of opaque AS LSAs in the database.

Number of entries for all areas.

show ip ospf interface

This command displays the information for the IFO object or virtual interface tables.

Format

Mode

show ip ospf interface {<unit/slot/port> | loopback <loopback-id> | vlan <1-4093>}

• Privileged EXEC

• User EXEC

Term Definition

IP Address

Subnet Mask

Secondary IP

Address(es)

OSPF Admin

Mode

The IP address for the specified interface.

A mask of the network and host portion of the IP address for the OSPF interface.

The secondary IP addresses if any are configured on the interface.

States whether OSPF is enabled or disabled on a router interface.

OSPF Area ID The OSPF Area ID for the specified interface.

OSPF Network

Type

The type of network on this interface that the OSPF is running on.

Router Priority A number representing the OSPF Priority for the specified interface.

Retransmit

Interval

A number representing the OSPF Retransmit Interval for the specified interface.

Hello Interval A number representing the OSPF Hello Interval for the specified interface.

Dead Interval

Transit Delay

Interval

A number representing the OSPF Dead Interval for the specified interface.

LSA Ack Interval A number representing the OSPF LSA Acknowledgment Interval for the specified interface.

A number representing the OSPF Transit Delay for the specified interface.

Authentication

Type

The OSPF Authentication Type for the specified interface are: none, simple, and encrypt.



Term Definition

Metric Cost The cost of the OSPF interface.

Passive Status Shows whether the interface is passive or not.

OSPF MTUignore

Indicates whether to ignore MTU mismatches in database descriptor packets sent from neighboring routers.

The information below will only be displayed if OSPF is enabled.

Term Definition

OSPF Interface

Type

State

Broadcast LANs, such as Ethernet and IEEE 802.5, take the value broadcast . The

OSPF Interface Type will be 'broadcast'.

The OSPF Interface States are: down, loopback, waiting, point-to-point, designated router, and backup designated router.

The router ID representing the designated router.

Designated

Router

Backup

Designated

Router

The router ID representing the backup designated router.

Number of Link

Events

The number of link events.

Local Link LSAs The number of Link Local Opaque LSAs in the link-state database.

Local Link LSA

Checksum

The sum of LS Checksums of Link Local Opaque LSAs in the link-state database.

show ip ospf interface brief

This command displays brief information for the IFO object or virtual interface tables.

Format

Mode show ip ospf interface brief

• Privileged EXEC

• User EXEC

Term Definition

Interface

OSPF Admin

Mode



OSPF Area ID The OSPF Area Id for the specified interface.

Router Priority A number representing the OSPF Priority for the specified interface.


4-74


Term Definition

Hello Interval A number representing the OSPF Hello Interval for the specified interface.

Dead Interval A number representing the OSPF Dead Interval for the specified interface.

Retransmit

Interval

A number representing the OSPF Retransmit Interval for the specified interface.

Retransmit Delay

Interval

A number representing the OSPF Transit Delay for the specified interface.

LSA Ack Interval A number representing the OSPF LSA Acknowledgment Interval for the specified interface. show ip ospf interface stats

This command displays the statistics for a specific interface. The information below will only be displayed if OSPF is enabled.

Format

Modes

show ip ospf interface stats <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

OSPF Area ID The area id of this OSPF interface.

Area Border

Router Count

The total number of area border routers reachable within this area. This is initially zero, and is calculated in each SPF pass.

AS Border

Router Count

The total number of Autonomous System border routers reachable within this area.

Area LSA Count The total number of link-state advertisements in this area's link-state database, excluding

AS External LSAs.

IP Address The IP address associated with this OSPF interface.

OSPF Interface

Events

The number of times the specified OSPF interface has changed its state, or an error has occurred.

Virtual Events The number of state changes or errors that occurred on this virtual link.

Neighbor Events The number of times this neighbor relationship has changed state, or an error has occurred.


External LSA

Count

Sent Packets The number of OSPF packets transmitted on the interface.

Received

Packets

The number of valid OSPF packets received on the interface.



Term

Discards

Bad Version

Source Not On

Local Subnet

Definition

The number of received OSPF packets discarded because of an error in the packet or an error in processing the packet.

The number of received OSPF packets whose version field in the OSPF header does not match the version of the OSPF process handling the packet.

The number of received packets discarded because the source IP address is not within a subnet configured on a local interface.

Note: This field only applies to OSPFv2.

Virtual Link Not

Found

The number of received OSPF packets discarded where the ingress interface is in a nonbackbone area and the OSPF header identifies the packet as belonging to the backbone, but OSPF does not have a virtual link to the packet’s sender.

Area Mismatch The number of OSPF packets discarded because the area ID in the OSPF header is not the area ID configured on the ingress interface.

Invalid

Destination

Address

The number of OSPF packets discarded because the packet’s destination IP address is not the address of the ingress interface and is not the AllDrRouters or AllSpfRouters multicast addresses.

Wrong

Authentication

Type

The number of packets discarded because the authentication type specified in the OSPF header does not match the authentication type configured on the ingress interface.


Authentication

Failure

The number of OSPF packets dropped because the sender is not an existing neighbor or the sender’s IP address does not match the previously recorded IP address for that neighbor.


No Neighbor at

Source Address

The number of OSPF packets dropped because the sender is not an existing neighbor or the sender’s IP address does not match the previously recorded IP address for that neighbor.

Note: Does not apply to Hellos.

Invalid OSPF

Packet Type

The number of OSPF packets discarded because the packet type field in the OSPF header is not a known type.

Hellos Ignored The number of received Hello packets that were ignored by this router from the new neighbors after the limit has been reached for the number of neighbors on an interface or on the system as a whole.

The command lists the number of OSPF packets of each type sent and received on the interface.

Packet Type

Hello

Database Description

Sent

6960

3

Received

6960

3


Packet Type

LS Request

LS Update

LS Acknowledgment

Sent

1

141

40


Received

1

42

135 show ip ospf neighbor

This command displays information about OSPF neighbors. If you do not specify a neighbor IP address, the output displays summary information in a table. If you specify an interface or tunnel, only the information for that interface or tunnel displays. The <ip-address> is the IP address of the neighbor, and when you specify this, detailed information about the neighbor displays. The information below only displays if OSPF is enabled and the interface has a neighbor.

Format

Modes

show ip ospf neighbor [interface <unit/slot/port>] [<ip-address>]

• Privileged EXEC

• User EXEC

If you do not specify an IP address, a table with the following columns displays for all neighbors or the neighbor associated with the interface that you specify:

Term

Router ID

Priority

IP Address

Neighbor

Interface

Definition

The 4-digit dotted-decimal number of the neighbor router.

The OSPF priority for the specified interface. The priority of an interface is a priority integer from 0 to 255. A value of '0' indicates that the router is not eligible to become the designated router on this network.

The IP address of the neighbor.

The interface of the local router in unit/slot/port format.


4-77


Term

State

Dead Time

Definition

The state of the neighboring routers. Possible values are:

• Down - initial state of the neighbor conversation - no recent information has been received from the neighbor.

• Attempt - no recent information has been received from the neighbor but a more concerted effort should be made to contact the neighbor.

• Init - an Hello packet has recently been seen from the neighbor, but bidirectional communication has not yet been established.

• 2 way - communication between the two routers is bidirectional.

• Exchange start - the first step in creating an adjacency between the two neighboring routers, the goal is to decide which router is the master and to decide upon the initial DD sequence number.

• Exchange - the router is describing its entire link state database by sending Database

Description packets to the neighbor.

• Loading - Link State Request packets are sent to the neighbor asking for the more recent LSAs that have been discovered (but not yet received) in the Exchange state.

• Full - the neighboring routers are fully adjacent and they will now appear in router-LSAs and network-LSAs.

The amount of time, in seconds, to wait before the router assumes the neighbor is unreachable.

If you specify an IP address for the neighbor router, the following fields display:

Term Definition

Interface

Neighbor IP

Address


The IP address of the neighbor router.

Interface Index The interface ID of the neighbor router.

Area ID The area ID of the OSPF area associated with the interface.

Options An integer value that indicates the optional OSPF capabilities supported by the neighbor.

The neighbor's optional OSPF capabilities are also listed in its Hello packets. This enables received Hello Packets to be rejected (i.e., neighbor relationships will not even start to form) if there is a mismatch in certain crucial OSPF capabilities.

Router Priority The OSPF priority for the specified interface. The priority of an interface is a priority integer from 0 to 255. A value of '0' indicates that the router is not eligible to become the designated router on this network.

Dead Timer Due The amount of time, in seconds, to wait before the router assumes the neighbor is unreachable.

Up Time

State

Events

Neighbor uptime; how long since the adjacency last reached the Full state.

The state of the neighboring routers.

The number of times this neighbor relationship has changed state, or an error has occurred.



Term Definition

Retransmission

Queue Length

An integer representing the current length of the retransmission queue of the specified neighbor router Id of the specified interface.


(Switch) #show ip ospf neighbor 170.1.1.50

Interface.....................................0/17

Neighbor IP Address...........................170.1.1.50

Interface Index...............................17

Area Id.......................................0.0.0.2

Options.......................................0x2

Router Priority...............................1

Dead timer due in (secs)......................15

Up Time.......................................0 days 2 hrs 8 mins 46 secs

State.........................................Full/BACKUP-DR

Events........................................4

Retransmission Queue Length...................0

show ip ospf range

This command displays information about the area ranges for the specified < areaid > . The

< areaid > identifies the OSPF area whose ranges are being displayed.

Format

Modes

show ip ospf range <areaid>

• Privileged EXEC

• User EXEC

Term Definition

Area ID

IP Address

Subnet Mask

Lsdb Type

The area id of the requested OSPF area.

An IP address which represents this area range.

A valid subnet mask for this area range.

The type of link advertisement associated with this area range.

Advertisement The status of the advertisement. Advertisement has two possible settings: enabled or disabled.



show ip ospf statistics

This command displays information about recent Shortest Path First (SPF) calculations. The SPF is the OSPF routing table calculation. The output lists the number of times the SPF has run for each OSPF area. A table follows this information. For each of the 15 most recent SPF runs, the table lists how long ago the SPF ran, how long the SPF took, and the reasons why the SPF was scheduled.

Format

Modes show ip ospf statistics

• Privileged EXEC

• User EXEC

Term

Delta T

SPF Duration

Reason

Definition

How long ago the SPF ran. The time is in the format hh:mm:ss, giving the hours, minutes, and seconds since the SPF run.

How long the SPF took in milliseconds.

The reason the SPF was scheduled. Reason codes are as follows:

• R - a router LSA has changed

• N - a network LSA has changed

• SN - a type 3 network summary LSA has changed

• SA - a type 4 ASBR summary LSA has changed

• X - a type 5 or type 7 external LSA has changed show ip ospf stub table

This command displays the OSPF stub table. The information below will only be displayed if

OSPF is initialized on the switch.

Format

Modes show ip ospf stub table

• Privileged EXEC

• User EXEC

Term Definition

Area ID A 32-bit identifier for the created stub area.

Type of Service The type of service associated with the stub metric. Switch CLI only supports Normal

TOS.



Term Definition

Metric Val The metric value is applied based on the TOS. It defaults to the least metric of the type of service among the interfaces to other areas. The OSPF cost for a route is a function of the metric value.

Import Summary

LSA

Controls the import of summary LSAs into stub areas.

show ip ospf virtual-link

This command displays the OSPF Virtual Interface information for a specific area and neighbor.

The < areaid > parameter identifies the area and the < neighbor > parameter identifies the neighbor's Router ID.

Format

Modes

show ip ospf virtual-link <areaid> <neighbor>

• Privileged EXEC

• User EXEC

Term Definition

Area ID The area id of the requested OSPF area.

Neighbor Router

ID

The input neighbor Router ID.

Hello Interval The configured hello interval for the OSPF virtual interface.

Dead Interval

Iftransit Delay

Interval

The configured dead interval for the OSPF virtual interface.

The configured transit delay for the OSPF virtual interface.

Retransmit

Interval

Authentication

Type

State

The configured retransmit interval for the OSPF virtual interface.

The configured authentication type of the OSPF virtual interface.

The OSPF Interface States are: down, loopback, waiting, point-to-point, designated router, and backup designated router. This is the state of the OSPF interface.

Neighbor State The neighbor state.


4-81


show ip ospf virtual-link brief

This command displays the OSPF Virtual Interface information for all areas in the system.

Format

Modes show ip ospf virtual-link brief

• Privileged EXEC

• User EXEC

Term Definition

Area ID

Neighbor

Hello Interval

The neighbor interface of the OSPF virtual interface.

The configured hello interval for the OSPF virtual interface.

Dead Interval The configured dead interval for the OSPF virtual interface.

Retransmit

Interval

Transit Delay




Routing Information Protocol (RIP) Commands

This section describes the commands you use to view and configure RIP, which is a distancevector routing protocol that you use to route traffic within a small network. router rip

Use this command to enter Router RIP mode.

Format

Mode router rip

Global Config enable (RIP)

This command resets the default administrative mode of RIP in the router (active).

Default

Format

Mode enabled enable

Router RIP Config


4-82


no enable (RIP)

This command sets the administrative mode of RIP in the router to inactive.

Format

Mode no enable

Router RIP Config ip rip

This command enables RIP on a router interface.

Default

Format

Mode disabled ip rip

Interface Config no ip rip

This command disables RIP on a router interface.

Format

Mode no ip rip

Interface Config auto-summary

This command enables the RIP auto-summarization mode.

Default

Format

Mode disabled auto-summary

Router RIP Config no auto-summary

This command disables the RIP auto-summarization mode.

Format

Mode no auto-summary

Router RIP Config



default-information originate (RIP)


Format

Mode default-information originate

Router RIP Config no default-information originate (RIP)


Format

Mode no default-information originate

Router RIP Config default-metric (RIP)


Format

Mode

default-metric <0-15>

Router RIP Config no default-metric (RIP)

This command is used to reset the default metric of distributed routes to its default value.

Format


Router RIP Config distance rip

This command sets the route preference value of RIP in the router. Lower route preference values are preferred when determining the best route. A route with a preference of 255 cannot be used to forward traffic.

Default

Format

Mode

15

distance rip <1-255>

Router RIP Config



no distance rip

This command sets the default route preference value of RIP in the router.

Format

Mode no distance rip

Router RIP Config distribute-list out (RIP)

This command is used to specify the access list to filter routes received from the source protocol.

Default

Format

Mode

0

distribute-list <1-199> out {ospf | static | connected}

Router RIP Config no distribute-list out

This command is used to specify the access list to filter routes received from the source protocol.

Format

Mode

no distribute-list <1-199> out {ospf | static | connected}

Router RIP Config ip rip authentication

This command sets the RIP Version 2 Authentication Type and Key for the specified interface.

The value of < type > is either none , simple , or encrypt . The value for authentication key

[ key ] must be 16 bytes or less. The [ key ] is composed of standard displayable, non-control keystrokes from a Standard 101/102-key keyboard. If the value of < type > is encrypt , a keyid in the range of 0 and 255 must be specified. Unauthenticated interfaces do not need an authentication key or authentication key ID.

Default

Format

Mode none

ip rip authentication {none | {simple <key>} | {encrypt <key>

<keyid>}}

Interface Config



no ip rip authentication

This command sets the default RIP Version 2 Authentication Type for an interface.

Format

Mode no ip rip authentication

Interface Config ip rip receive version

This command configures the interface to allow RIP control packets of the specified version(s) to be received.

The value for < mode > is one of: rip1 to receive only RIP version 1 formatted packets, rip2 for RIP version 2, both to receive packets from either format, or none to not allow any RIP control packets to be received.

Default

Format

Mode both

ip rip receive version {rip1 | rip2 | both | none}

Interface Config no ip rip receive version

This command configures the interface to allow RIP control packets of the default version(s) to be received.

Format

Mode no ip rip receive version

Interface Config ip rip send version

This command configures the interface to allow RIP control packets of the specified version to be sent. The value for < mode > is one of: rip1 to broadcast RIP version 1 formatted packets, rip1c (RIP version 1 compatibility mode) which sends RIP version 2 formatted packets via broadcast, rip2 for sending RIP version 2 using multicast, or none to not allow any RIP control packets to be sent.

Default ripi2


Format

Mode


ip rip send version {rip1 | rip1c | rip2 | none}

Interface Config no ip rip send version

This command configures the interface to allow RIP control packets of the default version to be sent.

Format

Mode no ip rip send version

Interface Config hostroutesaccept

This command enables the RIP hostroutesaccept mode.

Default

Format

Mode enabled hostroutesaccept

Router RIP Config no hostroutesaccept

This command disables the RIP hostroutesaccept mode.

Format

Mode no hostroutesaccept

Router RIP Config split-horizon

This command sets the RIP split horizon mode. Split horizon is a technique for avoiding problems caused by including routes in updates sent to the router from which the route was originally learned. The options are: None - no special processing for this case. Simple - a route will not be included in updates sent to the router from which it was learned. Poisoned reverse - a route will be included in updates sent to the router from which it was learned, but the metric will be set to infinity.

Default simple


Format

Mode


split-horizon {none | simple | poison}

Router RIP Config no split-horizon

This command sets the default RIP split horizon mode.

Format

Mode no split-horizon

Router RIP Config redistribute (RIP)

This command configures RIP protocol to redistribute routes from the specified source protocol/ routers. There are five possible match options. When you submit the command redistribute ospf match < match-type > the match-type or types specified are added to any match types presently being redistributed. Internal routes are redistributed by default.

Default • metric—not-configured

• match—internal

Format for

OSPF as source protocol

redistribute ospf [metric <0-15>] [match [internal] [external 1]

[external 2] [nssa-external 1] [nssa-external-2]]

Format for other source protocol

redistribute {static | connected} [metric <0-15>]

Mode Router RIP Config no redistribute

This command de-configures RIP protocol to redistribute routes from the specified source protocol/routers.

Format

Mode

no redistribute {ospf | static | connected} [metric] [match [internal]

[external 1] [external 2] [nssa-external 1] [nssa-external-2]]

Router RIP Config



show ip rip

This command displays information relevant to the RIP router.

Format

Modes show ip rip

• Privileged EXEC

• User EXEC

Term Definition

RIP Admin Mode Enable or disable.

Split Horizon

Mode

Auto Summary

Mode

None, simple or poison reverse.

Enable or disable. If enabled, groups of adjacent routes are summarized into single entries, in order to reduce the total number of entries The default is enable.

Enable or disable. If enabled the router accepts host routes. The default is enable.

Host Routes

Accept Mode

Global Route

Changes

The number of route changes made to the IP Route Database by RIP. This does not include the refresh of a route's age.

Global queries The number of responses sent to RIP queries from other systems.

Default Metric The default metric of redistributed routes if one has already been set, or blank if not configured earlier. The valid values are 1 to 15.

Default Route

Advertise

The default route.

show ip rip interface brief

This command displays general information for each RIP interface. For this command to display successful results routing must be enabled per interface (i.e., ip rip).

Format

Modes show ip rip interface brief

• Privileged EXEC

• User EXEC

Term

Interface

IP Address

Send Version

Definition


The IP source address used by the specified RIP interface.

The RIP version(s) used when sending updates on the specified interface. The types are none, RIP-1, RIP-1c, RIP-2



Term Definition

Receive Version The RIP version(s) allowed when receiving updates from the specified interface. The types are none, RIP-1, RIP-2, Both

RIP Mode The administrative mode of router RIP operation (enabled or disabled).

Link State The mode of the interface (up or down).

show ip rip interface

This command displays information related to a particular RIP interface.

Format

Modes show ip rip interface { <unit/slot/port> | vlan <1-4093>}

• Privileged EXEC

• User EXEC

Term Definition

Interface Valid unit, slot, and port number separated by forward slashes. This is a configured value.

IP Address

Send Version

The IP source address used by the specified RIP interface. This is a configured value.

The RIP version(s) used when sending updates on the specified interface. The types are none, RIP-1, RIP-1c, RIP-2. This is a configured value.

Receive Version The RIP version(s) allowed when receiving updates from the specified interface. The types are none, RIP-1, RIP-2, Both. This is a configured value.

RIP Admin Mode RIP administrative mode of router RIP operation; enable activates, disable de-activates it.


Link State Indicates whether the RIP interface is up or down. This is a configured value.

Authentication

Type

The RIP Authentication Type for the specified interface. The types are none, simple, and encrypt. This is a configured value.

Default Metric A number which represents the metric used for default routes in RIP updates originated on the specified interface. This is a configured value.

The following information will be invalid if the link state is down.

Term

Bad Packets

Received

Bad Routes

Received

Updates Sent

Definition

The number of RIP response packets received by the RIP process which were subsequently discarded for any reason.

The number of routes contained in valid RIP packets that were ignored for any reason.

The number of triggered RIP updates actually sent on this interface.



ICMP Throttling Commands

This section describes the commands you use to configure options for the transmission of various types of ICMP messages. ip unreachables

Use this command to enable the generation of ICMP Destination Unreachable messages. By default, the generation of ICMP Destination Unreachable messages is enabled.

Default

Format

Mode enable ip unreachables

Interface Config no ip unreachables

Use this command to prevent the generation of ICMP Destination Unreachable messages.

Format

Mode no ip unreachables

Interface Config ip redirects

Use this command to enable the generation of ICMP Redirect messages by the router. By default, the generation of ICMP Redirect messages is enabled.

Default

Format

Mode enable ip redirects

• Global Config

• Interface Config no ip redirects

Use this command to prevent the generation of ICMP Redirect messages by the router.


4-91


Format

Mode no ip redirects

• Global Config

• Interface Config ip icmp echo-reply

Use this command to enable the generation of ICMP Echo Reply messages by the router. By default, the generation of ICMP Echo Reply messages is enabled.

Default

Format

Mode enable ip icmp echo-reply

Global Config no ip icmp echo-reply

Use this command to prevent the generation of ICMP Echo Reply messages by the router.

Format

Mode no ip icmp echo-reply

Global Config ip icmp error-interval

Use this command to limit the rate at which IPv4 ICMP error messages are sent. The rate limit is configured as a token bucket, with two configurable parameters, burst-size and burst-interval .

The burst-interval specifies how often the token bucket is initialized with burst-size tokens. burstinterval is from 0 to 2147483647 milliseconds (msec).

The burst-size is the number of ICMP error messages that can be sent during one burst-interval .

The range is from 1 to 200 messages.

To disable ICMP rate limiting, set burst-interval to zero (0).

Default

Format

Mode

• burst-interval of 1000 msec.

• burst-size of 100 messages ip icmp error-interval < burst-interval> [<burst-size>]

Global Config



no ip icmp error-interval

Use the no form of the command to return burst-interval and burst-size to their default values.

Format

Mode no ip icmp error-interval

Global Config


4-93

Chapter 5

IP Multicast Commands

This chapter describes the IP Multicast commands available in the managed switch CLI.

The IP Multicast Commands chapter contains the following sections:

• “Multicast Commands” on page 5-1

• “DVMRP Commands” on page 5-7

• “PIM-DM Commands” on page 5-12

• “PIM-SM Commands” on page 5-16

• “Internet Group Message Protocol (IGMP) Commands” on page 5-26

• “IGMP Proxy Commands” on page 5-35

Warning: The commands in this chapter are in one of two functional groups:



Multicast Commands

This section describes the commands you use to configure IP Multicast and to view IP Multicast settings and statistics.

5-1 v1.0, July 2009


ip mcast boundary

This command adds an administrative scope multicast boundary specified by < groupipaddr > and < mask > for which this multicast administrative boundary is applicable. < groupipaddr > is a group IP address and < mask > is a group IP mask.

Format

Mode

ip mcast boundary <groupipaddr> <mask>

Interface Config no ip mcast boundary

This command deletes an administrative scope multicast boundary specified by

< groupipaddr > and < mask > for which this multicast administrative boundary is applicable.

< groupipaddr > is a group IP address and < mask > is a group IP mask.

Format

Mode

no ip mcast boundary <groupipaddr> <mask>

Interface Config ip multicast

This command sets the administrative mode of the IP multicast forwarder in the router to active.

Default

Format

Mode disabled ip multicast

Global Config no ip multicast

This command sets the administrative mode of the IP multicast forwarder in the router to inactive.

Format

Mode no ip multicast

Global Config

IP Multicast Commands v1.0, July 2009

5-2


ip multicast ttl-threshold

This command is specific to IPv4. Use this command to apply the given Time-to-Live threshold value < ttlthreshold> to a routing interface. The < ttlthreshold> is the TTL threshold which is to be applied to the multicast Data packets which are to be forwarded from the interface.

This command sets the Time-to-Live threshold value such that any data packets forwarded over the interface having TTL value below the configured value are dropped . The value for

< ttlthreshold> ranges from 0 to 255.

Default

Format

Mode

1

ip multicast ttl-threshold <ttlvalue>

Interface Config no ip multicast ttl-threshold

This command applies the default < ttlthreshold> to a routing interface. The

< ttlthreshold> is the TTL threshold which is to be applied to the multicast Data packets which are to be forwarded from the interface .

Format

Mode no ip multicast ttl-threshold

Interface Config show ip mcast

This command displays the system-wide multicast information.

Format

Modes show ip mcast

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode The administrative status of multicast. Possible values are enabled or disabled.

Protocol State The current state of the multicast protocol. Possible values are Operational or Non-

Operational.

Table Max Size The maximum number of entries allowed in the multicast table.

Protocol The multicast protocol running on the router. Possible values are PIMDM, PIMSM, or

DVMRP.

IP Multicast Commands 5-3 v1.0, July 2009


Term

Multicast

Forwarding

Cache Entry

Count

Definition

The number of entries in the multicast forwarding cache.

show ip mcast boundary

This command displays all the configured administrative scoped multicast boundaries.

Format

Modes

show ip mcast boundary {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Interface

Group Ip

Mask

Definition


The group IP address.

The group IP mask.

show ip mcast interface

This command displays the multicast information for the specified interface.

Format

Modes

show ip mcast interface <unit/slot/port>

• Privileged EXEC

• User EXEC

Term

Interface

TTL

Definition


The time-to-live value for this interface.


5-4


show ip mcast mroute

This command displays a summary or all the details of the multicast table.

Format

Modes

show ip mcast mroute {detail | summary}

• Privileged EXEC

• User EXEC

If you use the detail parameter, the command displays the following fields:

Term Definition

Source IP

Group IP

Expiry Time

Up Time

The IP address of the multicast data source.

The IP address of the destination of the multicast packet.

The time of expiry of this entry in seconds.

The time elapsed since the entry was created in seconds.

RPF Neighbor The IP address of the RPF neighbor.

Flags The flags associated with this entry.

If you use the summary parameter, the command displays the following fields:

Term

Source IP

Group IP

Protocol

Incoming

Interface

Outgoing

Interface List

Definition



The multicast routing protocol by which the entry was created.

The interface on which the packet for the source/group arrives.

The list of outgoing interfaces on which the packet is forwarded.

show ip mcast mroute group

This command displays the multicast configuration settings such as flags, timer settings, incoming and outgoing interfaces, RPF neighboring routers, and expiration times of all the entries in the multicast mroute table containing the given < groupipaddr> .

Format

Modes

show ip mcast mroute group <groupipaddr> {detail |summary}

• Privileged EXEC

• User EXEC



Term

Source IP

Group IP

Protocol

Incoming

Interface

Outgoing

Interface List

Definition



The multicast routing protocol by which this entry was created.

The interface on which the packet for this group arrives.

The list of outgoing interfaces on which this packet is forwarded.

show ip mcast mroute source

This command displays the multicast configuration settings such as flags, timer settings, incoming and outgoing interfaces, RPF neighboring routers, and expiration times of all the entries in the multicast mroute table containing the given source IP address or source IP address and group IP address pair.

Format

Modes

show ip mcast mroute source <sourceipaddr> {summary | detail}

• Privileged EXEC

• User EXEC

If you use the detail parameter, the command displays the following column headings in the output table:

Term Definition

Source IP

Group IP

Expiry Time




Up Time The time elapsed since the entry was created in seconds.



If you use the summary parameter, the command displays the following column headings in the output table:

Term

Source IP

Group IP

Definition





Term

Protocol

Incoming

Interface

Outgoing

Interface List

Definition


The interface on which the packet for this source arrives.


DVMRP Commands

This section provides a detailed explanation of the Distance Vector Multicast Routing Protocol

(DVMRP) commands. ip dvmrp(Global Config)

This command sets administrative mode of DVMRP in the router to active.

Default

Format

Mode disabled ip dvmrp

Global Config no ip dvmrp(Global Config)

This command sets administrative mode of DVMRP in the router to inactive.

Format

Mode no ip dvmrp

Global Config ip dvmrp metric

This command configures the metric for an interface. This value is used in the DVMRP messages as the cost to reach this network. This field has a range of 1 to 31.

Default

Format

Mode

1 ip dvmrp metric < metric >

Interface Config



no ip dvmrp metric

This command resets the metric for an interface to the default value. This value is used in the

DVMRP messages as the cost to reach this network.

Format

Mode no ip dvmrp metric

Interface Config ip dvmrp trapflags

This command enables the DVMRP trap mode.

Default

Format

Mode disabled ip dvmrp trapflags

Global Config no ip dvmrp trapflags

This command disables the DVMRP trap mode.

Format

Mode no ip dvmrp trapflags

Global Config ip dvmrp

This command sets the administrative mode of DVMRP on an interface to active.

Default

Format

Mode disabled ip dvmrp

Interface Config no ip dvmrp

This command sets the administrative mode of DVMRP on an interface to inactive.

Format

Mode no ip dvmrp

Interface Config


5-8


show ip dvmrp

This command displays the system-wide information for DVMRP.

Format

Modes show ip dvmrp

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode Indicates whether DVMRP is enabled or disabled.

Version

Reachable

Routes

The version of DVMRP being used.

Total Number of

Routes

The number of routes in the DVMRP routing table.

The number of entries in the routing table with non-infinite metrics.

The following fields are displayed for each interface.

Term Definition


Interface-Mode The mode of this interface. Possible values are Enabled and Disabled.

Operationalstatus

The current state of DVMRP on this interface. Possible values are Operational or Non-

Operational.

show ip dvmrp interface

This command displays the interface information for DVMRP on the specified interface.

Format

Modes

show ip dvmrp interface <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

Interface Mode Indicates whether DVMRP is enabled or disabled on the specified interface.

Metric The metric of this interface. This is a configured value.

Local Address The IP address of the interface.



The following field is displayed only when DVMRP is operational on the interface.

Term Definition

Generation ID The Generation ID value for the interface. This is used by the neighboring routers to detect that the DVMRP table should be resent.

The following fields are displayed only if DVMRP is enabled on this interface.

Term

Received Bad

Packets

Received Bad

Routes

Sent Routes

Definition

The number of invalid packets received.

The number of invalid routes received.

The number of routes that have been sent on this interface.

show ip dvmrp neighbor

This command displays the neighbor information for DVMRP.

Format

Modes show ip dvmrp neighbor

• Privileged EXEC

• User EXEC

Term Definition

IfIndex

Nbr IP Addr

State

The value of the interface used to reach the neighbor.

The IP address of the DVMRP neighbor for which this entry contains information.

The state of the neighboring router. The possible value for this field are ACTIVE or

DOWN.

Up Time

Expiry Time

The time since this neighboring router was learned.

The time remaining for the neighbor to age out. This field is not applicable if the State is

DOWN.

Generation ID The Generation ID value for the neighbor.

Major Version The major version of DVMRP protocol of neighbor.

Minor Version The minor version of DVMRP protocol of neighbor.

Capabilities The capabilities of neighbor.

Received Routes The number of routes received from the neighbor.

Rcvd Bad Pkts The number of invalid packets received from this neighbor.


Term

Rcvd Bad

Routes


Definition

The number of correct packets received with invalid routes.

show ip dvmrp nexthop

This command displays the next hop information on outgoing interfaces for routing multicast datagrams.

Format

Modes show ip dvmrp nexthop

• Privileged EXEC

• User EXEC

Term

Source IP

Source Mask

Next Hop

Interface

Type

Definition

The sources for which this entry specifies a next hop on an outgoing interface.

The IP Mask for the sources for which this entry specifies a next hop on an outgoing interface.

The interface in unit/slot/port format for the outgoing interface for this next hop.

The network is a LEAF or a BRANCH.

show ip dvmrp prune

This command displays the table listing the router’s upstream prune information.

Format

Modes show ip dvmrp prune

• Privileged EXEC

• User EXEC

Term

Group IP

Source IP

Source Mask

Expiry Time

(secs)

Definition

The multicast Address that is pruned.

The IP address of the source that has pruned.

The network Mask for the prune source. It should be all 1s or both the prune source and prune mask must match.

The expiry time in seconds. This is the time remaining for this prune to age out.



show ip dvmrp route

This command displays the multicast routing information for DVMRP.

Format

Modes show ip dvmrp route

• Privileged EXEC

• User EXEC

Term Definition

Source Address The multicast address of the source group.

Source Mask

Upstream

Neighbor

Interface

Metric

The IP Mask for the source group.

The IP address of the neighbor which is the source for the packets for a specified multicast address.

The interface used to receive the packets sent by the sources.

The distance in hops to the source subnet. This field has a different meaning than the

Interface Metric field.

Expiry Time

(secs)

The expiry time in seconds, which is the time left for this route to age out.

Up Time (secs) The time when a specified route was learnt, in seconds.

PIM-DM Commands

This section describes the commands you use to configure Protocol Independent Multicast -Dense

Mode (PIM-DM). PIM-DM is a multicast routing protocol that provides scalable inter-domain multicast routing across the Internet, independent of the mechanisms provided by any particular unicast routing protocol. ip pimdm (Global Config)

This command enables the administrative mode of PIM-DM in the router.

Default

Format

Mode disabled ip pimdm

Global Config



no ip pimdm (Global Config)

This command disables the administrative mode of PIM-DM in the router.

Format

Mode no ip pimdm

Global Config ip pimdm (Interface Config)

This command sets administrative mode of PIM-DM on an interface to enabled.

Default

Format

Mode disabled ip pimdm

Interface Config no ip pimdm (Interface Config)

This command sets administrative mode of PIM-DM on an interface to disabled.

Format

Mode no ip pimdm

Interface Config ip pimdm hello-interval

This command configures the transmission frequency of hello messages between PIM enabled neighbors. This field has a range of 10 to 3600 seconds.

Default

Format

Mode

30

ip pimdm hello-interval <seconds>

Interface Config


5-13


no ip pimdm hello-interval

This command resets the transmission frequency of hello messages between PIM enabled neighbors to the default value.

Format

Mode no ip pimdm hello-interval

Interface Config show ip pimdm

This command displays the system-wide information for PIM-DM.

Format

Modes show ip pimdm

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode Indicates whether PIM-DM is enabled or disabled.


Interface-Mode Indicates whether PIM-DM is enabled or disabled on this interface.

Operationalstatus

The current state of PIM-DM on this interface. Possible values are Operational or Non-

Operational.

show ip pimdm interface

This command displays the interface information for PIM-DM on the specified interface.

Format

Modes

show ip pimdm interface <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

Interface Mode Indicates whether PIM-DM is enabled or disabled on the specified interface.

Hello Interval The frequency at which PIM hello messages are transmitted on this interface. By default, the value is 30 seconds.



show ip pimdm interface stats

This command displays the statistical information for PIM-DM on the specified interface.

Format

Modes

show ip pimdm interface stats {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Interface

IP Address

Nbr Count

Hello Interval

Designated

Router

Definition


The IP address that represents the PIM-DM interface.

The neighbor count for the PIM-DM interface.

The time interval between two hello messages sent from the router on the given interface.

The IP address of the Designated Router for this interface.

show ip pimdm neighbor

This command displays the neighbor information for PIM-DM on the specified interface.

Format

Modes

show ip pimdm neighbor {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Neighbor

Address

Interface

Up Time

Expiry Time

Definition

The IP address of the neighbor on an interface.


The time since this neighbor has become active on this interface.

The expiry time of the neighbor on this interface.


5-15


PIM-SM Commands

This section describes the commands you use to configure Protocol Independent Multicast -

Sparse Mode (PIM-SM). PIM-SM is a multicast routing protocol that provides scalable interdomain multicast routing across the Internet, independent of the mechanisms provided by any particular unicast routing protocol. ip pimsm(Global Config)

This command is used to administratively enable PIM-SM multicast routing mode on the router.

Default

Format

Mode disabled ip pimsm

Global Config no ip pimsm(Global Config)

This command is used to administratively disable PIM-SM multicast routing mode on the router.

Format

Mode no ip pimsm

Global Config ip pimsm(Interface Config)

This command is used to administratively enable PIM-SM multicast routing mode on a particular router interface.

Default

Format

Mode disabled ip pimsm

Interface Config


5-16


no ip pimsm(Interface Config)

This command is used to administratively disable PIM-SM multicast routing mode on a particular router interface.

Format

Mode no ip pimsm

Interface Config ip pimsm bsr-border

Use this command to prevent bootstrap router (BSR) messages from being sent or received through an interface.

Default

Format

Mode disabled ip pimsm bsr-border

Interface Config no ip pimsm bsr-border

Use this command to disable the interface from being the BSR border.

Format

Mode no ip pimsm bsr-border

Interface Config ip pimsm bsr-candidate

This command is used to configure the router to announce its candidacy as a bootstrap router

(BSR).

Default

Format

Mode

None

ip pimsm bsr-candidate interface <unit/slot/port> [hash-mask-length]

[priority]

Global Config



Parameters hash-masklength priority

Description

Length of a mask (32 bits maximum) that is to be ANDed with the group address before the hash function is called. All groups with the same seed hash correspond to the same

RP. For example, if this value was 24, only the first 24 bits of the group addresses matter.

This allows you to get one RP for multiple groups.

Priority of the candidate BSR. The range is an integer from 0 to 255. The BSR with the larger priority is preferred. If the priority values are the same, the router with the larger IP address is the BSR. The default value is 0.

no ip pimsm bsr-candidate

This command is used to disable the router to announce its candidacy as a bootstrap router (BSR).

Format

Mode

no ip pimsm bsr-candidate interface <unit/slot/port> [hash-mask- length] [priority]

Global Config ip pimsm dr-priority

Use this command to set the priority value for which a router is elected as the designated router

(DR).

Default

Format

Mode

1 ip pimsm dr-priority <0-2147483647>

Interface Config no ip pimsm dr-priority


Format

Mode no ip pimsm dr-priority

Interface Config


5-18


ip pimsm hello-interval

This command is used to configure the PIM-SM hello interval for the specified interface. The hello interval is specified in seconds.

Default

Format

Mode

30

ip pimsm hello-interval <0-18000>

Interface Config no ip pimsm hello-interval

This command is used to set the hello interval to the default value.

Format

Mode no ip pimsm hello-interval

Interface Config ip pimsm join-prune-interval

This command is used to configure the interface join/prune interval for the PIM-SM router. The join/prune interval is specified in seconds. This parameter can be configured to a value from 0 to

18000.

Default

Format

Mode

60

ip pimsm join-prune-interval <0-18000>

Interface Config no ip pimsm join-prune-interval

Use this command to set the join/prune interval to the default value.

Format

Mode no ip pimsm join-prune-interval

Interface Config


5-19


ip pimsm register-threshold

This command configures the Register Threshold rate for the Rendezvous Point router to switch to a source-specific shortest path. The valid values are from (0 to 2000 kilobits/sec).

Default

Format

Mode

0

ip pimsm register-threshold <0-2000>

Global Config no ip pimsm register-threshold

This command resets the register threshold rate for the Rendezvous Pointer router to the default value.

Format

Mode no ip pimsm register-threshold

Global Config ip pimsm rp-address

This command is used to statically configure the RP address for one or more multicast groups. The parameter < rp-address > is the IP address of the RP. The parameter < groupaddress > is the group address supported by the RP. The parameter < groupmask > is the group mask for the group address. The optional keyword override indicates that if there is a conflict, the RP configured with this command prevails over the RP learned by BSR.

Default

Format

Mode none

ip pimsm rp-address <rp-address> <group-address> <group-mask>

[override]

Global Config no ip pimsm rp-address

This command is used to statically remove the RP address for one or more multicast groups.

Format

Mode

no ip pimsm rp-address <rp-address> <group-address> <group-mask>

Global Config



ip pimsm rp-candidate

This command is used to configure the router to advertise itself as a PIM candidate rendezvous point (RP) to the bootstrap router (BSR).

Default

Format

Mode

None ip pimsm rp-candidate interface <unit/slot/port> <group-address>

<group-mask>

Global Config no ip pimsm rp-candidate

This command is used to disable the router to advertise itself as a PIM candidate rendezvous point

(RP) to the bootstrap router (BSR).

Format

Mode no ip pimsm rp-candidate interface <unit/slot/port> <group-address>

<group-mask>

Global Config ip pimsm spt-threshold

This command is used to configure the Data Threshold rate for the last-hop router to switch to the shortest path. The rate is specified in Kilobits per second. The possible values are 0 to 2000.

Default

Format

Mode

0

ip pimsm spt-threshold <0-2000>

Global Config no ip pimsm spt-threshold

This command is used to set the Data Threshold rate for the RP router to the default value.

Format

Mode no ip pimsm spt-threshold

Global Config



ip pimsm ssm

Use this command to define the Source Specific Multicast (SSM) range of IP multicast addresses.

Default

Format

Mode disabled ip pimsm ssm {default | <group-address> <group-mask>}

Global Config

Parameter default-range

Description

Defines the SSM range access list to 232/8.

no ip pimsm ssm

This command is used to disable the Source Specific Multicast (SSM) range.

Format

Mode no ip pimsm ssm

Global Config ip pim-trapflags

This command enables the PIM trap mode for both Sparse Mode (SM) and Dense Mode. (DM).

Default

Format

Mode disabled ip pim-trapflags

Global Config no ip pim-trapflags

This command sets the PIM trap mode to the default.

Format

Mode no ip pim-trapflags

Global Config



show ip pimsm

This command displays the system-wide information for PIM-SM.

Format

Modes show ip pimsm

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode

Data Threshold

Rate (Kbps)

Register

Threshold Rate

(Kbps)

Interface

Indicates whether PIM-SM is enabled or disabled.

The data threshold rate for the PIM-SM router.

The threshold rate for the RP router to switch to the shortest path.


Interface-Mode Indicates whether PIM-SM is enabled or disabled on the interface.

Operational-

Status

The current state of the PIM-SM protocol on the interface. Possible values are

Operational or Non-Operational.

show ip pimsm bsr

This command displays the bootstrap router (BSR) information. The output includes elected BSR information and information about the locally configured candidate rendezvous point (RP) advertisement.

Format

Mode show ip pimsm bsr

• Privileged EXEC

• User EXEC

Term

BSR Address

Uptime

BSR Priority

Hash Mask

Length

Definition

IP address of the BSR.

Length of time that this router has been up (in hours, minutes, and seconds).

Priority as configured in the ip pimsm bsr-candidate command.

Length of a mask (maximum 32 bits) that is to be ANDed with the group address before the hash function is called. This value is configured in the ip pimsm bsr-candidate command.



Term Definition

Next Bootstrap

Message In

Time (in hours, minutes, and seconds) in which the next bootstrap message is due from this BSR.

Next Candidate

RP advertisement in

Time (in hours, minutes, and seconds) in which the next candidate RP advertisement will be sent.

show ip pimsm interface

This command displays interface configuration parameters for PIM-SM on the specified interface.

If no interface is specified, all interfaces are displayed.

Format

Modes show ip pimsm interface [ <unit/slot/port> ]

• Privileged EXEC

• User EXEC

Term Definition

Interface

IP Address

Subnet Mask

Hello Interval

(secs)


The IP address of the specified interface.

The Subnet Mask for the IP address of the PIM interface.

The frequency at which PIM hello messages are transmitted on this interface. By default, the value is 30 seconds.

The join/prune interval for the PIM-SM router. The interval is in seconds.

Join Prune

Interval (secs)

Neighbor Count The neighbor count for the PIM-SM interface.

Designated

Router


DR Priority The priority of the Designated Router.

BSR Border The bootstrap router border interface. Possible values are enabled or disabled .


(Switch) #show ip pimsm interface 1/0/3

Slot/Port...................................... 1/0/3

IP Address..................................... 41.1.1.2

Subnet Mask.................................... 255.255.255.0

Hello Interval (secs).......................... 30

Join Prune Interval (secs)..................... 60

Neighbor Count ................................ 0



Designated Router.............................. 41.1.1.2

DR Priority.................................... 1

BSR Border..................................... Disabled show ip pimsm neighbor

This command displays the neighbor information for PIM-SM on the specified interface.

Format

Modes

show ip pimsm neighbor {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Interface

IP Address

Up Time

Expiry Time

Definition





show ip pimsm rphash

This command displays which rendezvous point (RP) is being used for a specified group.

Format

Modes

show ip pimsm rphash <group-address>

• Privileged EXEC

• User EXEC

Term

RP

Origin

Definition

The IP address of the RP for the group specified.

Indicates the mechanism (BSR or static) by which the RP was selected.


5-25


show ip pimsm rp mapping

Use this command to display all group-to-RP mappings of which the router is a aware (either configured or learned from the bootstrap router (BSR)). If no RP is specified, all active RPs are displayed.

Format

Modes show ip pimsm rp mapping [rp address]

• Privileged EXEC

• User EXEC

Internet Group Message Protocol (IGMP) Commands

This section describes the commands you use to view and configure IGMP settings.

ip igmp

This command sets the administrative mode of IGMP in the system to active.

Default

Format

Modes disabled ip igmp

• Global Config

• Interface Config no ip igmp

This command sets the administrative mode of IGMP in the system to inactive.

Format

Modes no ip igmp

• Global Config



5-26


ip igmp version

This command configures the version of IGMP for an interface. The value for <version> is either 1, 2 or 3.

Default

Format

Modes

3

ip igmp version <version>

Interface Config no ip igmp version

This command resets the version of IGMP to the default value .

Format

Modes no ip igmp version

Interface Config ip igmp last-member-query-count

This command sets the number of Group-Specific Queries sent before the router assumes that there are no local members on the interface. The range for < count> is 1 to 20.

Format

Modes

ip igmp last-member-query-count <count>

Interface Config no ip igmp last-member-query-count

This command resets the number of Group-Specific Queries to the default value.

Format

Modes no ip igmp last-member-query-count

Interface Config


5-27


ip igmp last-member-query-interval

This command configures the Maximum Response Time inserted in Group-Specific Queries which are sent in response to Leave Group messages. The range for < seconds> is 0 to 255 tenths of a second.

Default

Format

Modes

10 tenths of a second (1 second)

ip igmp last-member-query-interval <seconds>

Interface Config no ip igmp last-member-query-interval

This command resets the Maximum Response Time to the default value.

Format

Modes no ip igmp last-member-query-interval

Interface Config ip igmp query-interval

This command configures the query interval for the specified interface. The query interval determines how fast IGMP Host-Query packets are transmitted on this interface. The range for

< queryinterval> is 1 to 3600 seconds.

Default

Format

Modes

125 seconds

ip igmp query-interval <seconds>

Interface Config no ip igmp query-interval

This command resets the query interval for the specified interface to the default value. This is the frequency at which IGMP Host-Query packets are transmitted on this interface.

Format

Modes no ip igmp query-interval

Interface Config



ip igmp query-max-response-time

This command configures the maximum response time interval for the specified interface, which is the maximum query response time advertised in IGMPv2 queries on this interface.The time interval is specified in tenths of a second. The range for < maxresptime> is 0 to 255 tenths of a second.

Default

Format

Mode

100

ip igmp query-max-response-time <seconds>

Interface Config no ip igmp query-max-response-time

This command resets the maximum response time interval for the specified interface, which is the maximum query response time advertised in IGMPv2 queries on this interface to the default value.

The maximum response time interval is reset to the default time.

Format

Mode no ip igmp query-max-response-time

Interface Config ip igmp robustness

This command configures the robustness that allows tuning of the interface. The robustness is the tuning for the expected packet loss on a subnet. If a subnet is expected to have a lot of loss, the

Robustness variable may be increased for the interface. The range for < robustness> is 1 to

255.

Default

Format

Mode

2

ip igmp robustness <robustness>

Interface Config no ip igmp robustness

This command sets the robustness value to default.

Format

Mode no ip igmp robustness

Interface Config



ip igmp startup-query-count

This command sets the number of Queries sent out on startup, separated by the Startup Query

Interval on the interface. The range for < count> is 1 to 20.

Default

Format

Mode

2

ip igmp startup-query-count <count>

Interface Config no ip igmp startup-query-count

This command resets the number of Queries sent out on startup, separated by the Startup Query

Interval on the interface to the default value.

Format

Mode no ip igmp startup-query-count

Interface Config ip igmp startup-query-interval

This command sets the interval between General Queries sent on startup on the interface. The time interval value is in seconds. The range for < interval> is 1 to 300 seconds.

Default

Format

Mode

31

ip igmp startup-query-interval <interval>

Interface Config no ip igmp startup-query-interval

This command resets the interval between General Queries sent on startup on the interface to the default value.

Format

Mode no ip igmp startup-query-interval

Interface Config



show ip igmp

This command displays the system-wide IGMP information.

Format

Modes show ip igmp

• Privileged EXEC

• User EXEC

Term Definition

IGMP Admin

Mode

The administrative status of IGMP. This is a configured value.

Interface

Opeational-

Status


Interface-Mode Indicates whether IGMP is enabled or disabled on the interface. This is a configured value.

The current state of IGMP on this interface. Possible values are Operational or Non-

Operational.

show ip igmp groups

This command displays the registered multicast groups on the interface. If [detail] is specified this command displays the registered multicast groups on the interface in detail.

Format

Mode

show ip igmp groups <unit/slot/port> [detail]

Privileged EXEC

If you do not use the detail keyword, the following fields appear:

Term Definition

IP Address

Subnet Mask

The IP address of the interface participating in the multicast group.

The subnet mask of the interface participating in the multicast group.

Interface Mode This displays whether IGMP is enabled or disabled on this interface.

The following fields are not displayed if the interface is not enabled:

Term Definition

Querier Status This displays whether the interface has IGMP in Querier mode or Non-Querier mode.

Groups The list of multicast groups that are registered on this interface.



If you use the detail keyword, the following fields appear:

Term Definition

Multicast IP

Address

Up Time

The IP address of the registered multicast group on this interface.

Last Reporter The IP address of the source of the last membership report received for the specified multicast group address on this interface.

The time elapsed since the entry was created for the specified multicast group address on this interface.

Expiry Time The amount of time remaining to remove this entry before it is aged out.

Version1 Host

Timer

Version2 Host

Timer

The time remaining until the local router assumes that there are no longer any IGMP version 1 multicast members on the IP subnet attached to this interface. This could be an integer value or “-----” if there is no Version 1 host present.

The time remaining until the local router assumes that there are no longer any IGMP version 2 multicast members on the IP subnet attached to this interface. This could be an integer value or “-----” if there is no Version 2 host present.

The group compatibility mode (v1, v2 or v3) for this group on the specified interface.

Group

Compatibility

Mode show ip igmp interface

This command displays the IGMP information for the interface.

Format

Modes

show ip igmp interface <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

Interface

IGMP Admin

Mode


The administrative status of IGMP.

Interface Mode Indicates whether IGMP is enabled or disabled on the interface.

IGMP Version The version of IGMP running on the interface. This value can be configured to create a router capable of running either IGMP version 1 or 2.

Query Interval The frequency at which IGMP Host-Query packets are transmitted on this interface.

Query Max

Response Time

The maximum query response time advertised in IGMPv2 queries on this interface.



Term

Robustness

Definition

The tuning for the expected packet loss on a subnet. If a subnet is expected to be have a lot of loss, the Robustness variable may be increased for that interface.

The interval between General Queries sent by a Querier on startup. Startup Query

Interval

Startup Query

Count

Last Member

Query Interval

Last Member

Query Count

The number of Queries sent out on startup, separated by the Startup Query Interval.

The Maximum Response Time inserted into Group-Specific Queries sent in response to

Leave Group messages.

The number of Group-Specific Queries sent before the router assumes that there are no local members.

show ip igmp interface membership

This command displays the list of interfaces that have registered in the multicast group.

Format

Mode

show ip igmp interface membership <multiipaddr> [detail]

Privileged EXEC

Term

Interface

Interface IP

State

Group

Compatibility

Mode

Source Filter

Mode

Definition

Valid unit, slot and port number separated by forward slashes.

The IP address of the interface participating in the multicast group.

The interface that has IGMP in Querier mode or Non-Querier mode.

The group compatibility mode (v1, v2 or v3) for the specified group on this interface.

The source filter mode (Include/Exclude) for the specified group on this interface. This is “-

----” for IGMPv1 and IGMPv2 Membership Reports.

If you use the detail keyword, the following fields appear:

Term

Interface

Group

Compatibility

Mode

Source Filter

Mode

Definition

Valid unit, slot and port number separated by forward slashes.

The group compatibility mode (v1, v2 or v3) for the specified group on this interface.

The source filter mode (Include/Exclude) for the specified group on this interface. This is “-

----” for IGMPv1 and IGMPv2 Membership Reports.



Term Definition

Source Hosts The list of unicast source IP addresses in the group record of the IGMPv3 Membership

Report with the specified multicast group IP address. This is “-----” for IGMPv1 and

IGMPv2 Membership Reports.

Expiry Time The amount of time remaining to remove this entry before it is aged out. This is “-----” for

IGMPv1 and IGMPv2 Membership Reports.

show ip igmp interface stats

This command displays the IGMP statistical information for the interface. The statistics are only displayed when the interface is enabled for IGMP.

Format

Modes

show ip igmp interface stats <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

Querier Status The status of the IGMP router, whether it is running in Querier mode or Non-Querier mode.

Querier IP

Address

The IP address of the IGMP Querier on the IP subnet to which this interface is attached.

Querier Up Time The time since the interface Querier was last changed.

Querier Expiry

Time

The amount of time remaining before the Other Querier Present Timer expires. If the local system is the querier, the value of this object is zero.

Wrong Version

Queries

The number of queries received whose IGMP version does not match the IGMP version of the interface.

Number of Joins The number of times a group membership has been added on this interface.

Number of

Groups

The current number of membership entries for this interface.


5-34


IGMP Proxy Commands

The IGMP Proxy is used by IGMP Router (IPv4 system) to enable the system to issue IGMP host messages on behalf of hosts that the system discovered through standard IGMP router interfaces.

With IGMP Proxy enabled, the system acts as proxy to all the hosts residing on its router interfaces.

ip igmp-proxy

This command enables the IGMP Proxy on the router. To enable the IGMP Proxy on the router, you must enable multicast forwarding. Also, make sure that there are no multicast routing protocols enabled on the router.

Format

Mode ip igmp-proxy

Interface Config no ip igmp-proxy

This command disables the IGMP Proxy on the router.

Format

Mode no ip igmp-proxy

Interface Config ip igmp-proxy unsolicit-rprt-interval

This command sets the unsolicited report interval for the IGMP Proxy router. This command is valid only when you enable IGMP Proxy on the interface. The value of <interval> can be 1-

260 seconds.

Default

Format

Mode

1

ip igmp-proxy unsolicit-rprt-interval <interval>

Interface Config



no ip igmp-proxy unsolicit-rprt-interval

This command resets the unsolicited report interval of the IGMP Proxy router to the default value.

Format

Mode no ip igmp-proxy unsolicit-rprt-interval

Interface Config ip igmp-proxy reset-status

This command resets the host interface status parameters of the IGMP Proxy router. This command is valid only when you enable IGMP Proxy on the interface.

Format

Mode ip igmp-proxy reset-status

Interface Config show ip igmp-proxy

This command displays a summary of the host interface status parameters. It displays the following parameters only when you enable IGMP Proxy.

Format

Modes show ip igmp-proxy

• Privileged EXEC

• User EXEC

Term Definition

Interface index The interface number of the IGMP Proxy.

Admin Mode States whether the IGMP Proxy is enabled or not. This is a configured value.

Operational

Mode

States whether the IGMP Proxy is operationally enabled or not. This is a status parameter.

Version The present IGMP host version that is operational on the proxy interface.

Number of

Multicast Groups

The number of multicast groups that are associated with the IGMP Proxy interface.

Unsolicited

Report Interval

Querier IP

Address on

Proxy Interface

The time interval at which the IGMP Proxy interface sends unsolicited group membership report.

The IP address of the Querier, if any, in the network attached to the upstream interface

(IGMP-Proxy interface).



Term Definition

Older Version 1

Querier Timeout

The interval used to timeout the older version 1 queriers.

Older Version 2

Querier Timeout


Proxy Start

Frequency

The number of times the IGMP Proxy has been stopped and started.


(Switch) #show ip igmp-proxy

Interface Index............................................. 1/0/1

Admin Mode................................................ Enable

Operational Mode......................................... Enable

Version......................................................... 3

Num of Multicast Groups............................. 0

Unsolicited Report Interval.......................... 1

Querier IP Address on Proxy Interface........ 5.5.5.50

Older Version 1 Querier Timeout................ 0

Older Version 2 Querier Timeout................ 00::00:00

Proxy Start Frequency................................. 1 show ip igmp-proxy interface

This command displays a detailed list of the host interface status parameters. It displays the following parameters only when you enable IGMP Proxy.

Format

Modes show ip igmp-proxy interface

• Privileged EXEC

• User EXEC

Term Definition

Interface Index The unit/slot/port of the IGMP proxy.

The column headings of the table associated with the interface are as follows:

Term

Ver

Query Rcvd

Definition

The IGMP version.

Number of IGMP queries received.



Term

Report Rcvd

Report Sent

Leaves Rcvd

Leaves Sent

Definition

Number of IGMP reports received.

Number of IGMP reports sent.

Number of IGMP leaves received. Valid for version 2 only.

Number of IGMP leaves sent on the Proxy interface. Valid for version 2 only.


(Switch) #show ip igmp-proxy interface

Interface Index................................ 1/0/1

Ver Query Rcvd Report Rcvd Report Sent Leave Rcvd Leave Sent

------------------------------------------------------------------

0 show ip igmp-proxy groups

This command displays information about the subscribed multicast groups that IGMP Proxy reported. It displays a table of entries with the following as the fields of each column.

Format

Modes show ip igmp-proxy groups

• Privileged EXEC

• User EXEC

Term Definition

Interface The interface number of the IGMP Proxy.

Group Address The IP address of the multicast group.

Last Reporter The IP address of host that last sent a membership report for the current group on the network attached to the IGMP Proxy interface (upstream interface).

Up Time (in secs) The time elapsed since last created.

Member State The status of the entry. Possible values are IDLE_MEMBER or DELAY_MEMBER.

• IDLE_MEMBER - interface has responded to the latest group membership query for this group.

• DELAY_MEMBER - interface is going to send a group membership report to respond to a group membership query for this group.

Filter Mode Possible values are Include or Exclude .



Term

Sources

Definition

The number of sources attached to the multicast group.


(Switch) #show ip igmp-proxy groups

Interface Index................................ 1/0/1

Group Address Last Reporter Up Time Member State Filter Mode Sources

------------- -------------- ---------- ------------- ------------- -------

225.4.4.4 5.5.5.48 00:02:21 DELAY_MEMBER Include 3

226.4.4.4

227.4.4.4

228.4.4.4

5.5.5.48

5.5.5.48

5.5.5.48

00:02:21 DELAY_MEMBER



Include

Exclude

Include

3

0

3 show ip igmp-proxy groups detail

This command displays complete information about multicast groups that IGMP Proxy reported. It displays a table of entries with the following as the fields of each column.

Format

Modes show ip igmp-proxy groups detail

• Privileged EXEC

• User EXEC

Term Definition

Interface The interface number of the IGMP Proxy.

Group Address The IP address of the multicast group.

Last Reporter The IP address of host that last sent a membership report for the current group, on the network attached to the IGMP-Proxy interface (upstream interface).

Up Time (in secs) The time elapsed since last created.

Member State The status of the entry. Possible values are IDLE_MEMBER or DELAY_MEMBER.

• IDLE_MEMBER - interface has responded to the latest group membership query for this group.

• DELAY_MEMBER - interface is going to send a group membership report to respond to a group membership query for this group.



Term

Filter Mode

Sources

Group Source

List

Expiry Time

Definition

Possible values are Include or Exclude .


The list of IP addresses of the sources attached to the multicast group.

Time left before a source is deleted.


(Switch) #show ip igmp-proxy groups

Interface Index................................ 1/0/1

Group Address Last Reporter Up Time Member State Filter Mode Sources

-------------------------- ----------- ------------ ------------ ---------


Group Source List Expiry Time

---------------------------------

5.1.2.3 00:02:21

6.1.2.3 00:02:21

7.1.2.3 00:02:21



----------------- ---------------

2.1.2.3 00:02:21

6.1.2.3 00:01:44

8.1.2.3 00:01:44

227.4.4.4 5.5.5.48 00:02:21 DELAY_MEMBER Exclude 0



----------------- ---------------

9.1.2.3 00:03:21

6.1.2.3 00:03:21

7.1.2.3 00:03:21


Chapter 6

IPv6 Multicast Commands

The IPv6 Multicast commands described in this chapter are standard on the GSM7328Sv2 and

GSM7352Sv2, but are optional on the GSM7328Sv1 and GSM7352Sv1. In order to use these commands with the GS7328Sv1 or GSM7352Sv1 you must purchase a separate software license.

Note: The commands in this chapter require an optional software license for use on the

GSM7328Sv1 and GSM7352Sv1.

Note: There is no specific IP multicast enable for IPv6. Enabling of multicast at global config is common for both IPv4 and IPv6.

This chapter contains the following sections:

• “IPv6 Multicast Forwarder” on page 6-2

• “IPv6 PIM-DM Commands” on page 6-4

• “IPv6 PIM-SM Commands” on page 6-8

• “IPv6 MLD Commands” on page 6-16

• “IPv6 MLD-Proxy Commands” on page 6-23

Note: The commands in this chapter are in one of three functional groups:




6-1 v1.0, July 2009


IPv6 Multicast Forwarder

show ipv6 mroute

Note: There is no specific IP multicast enable for IPv6. Enabling of multicast at global config is common for both IPv4 and IPv6.

Use this command to show the mroute entries specific for IPv6. (This command is the IPv6 equivalent of the IPv4 show ip mcaste mroute command.)

Format

Modes

show ipv6 mroute {detail | summary}

• Privileged EXEC

• User EXEC

If you use the detail parameter, the command displays the following Multicast Route Table fields:

Term Definition

Source IP

Group IP

Expiry Time




Up Time The time elapsed since the entry was created in seconds.



If you use the summary parameter, the command displays the following fields:

Term

Source IP

Group IP

Protocol

Incoming

Interface

Definition



The multicast routing protocol by which the entry was created.

The interface on which the packet for the source/group arrives.

IPv6 Multicast Commands 6-2 v1.0, July 2009


Term

Outgoing

Interface List

Definition

The list of outgoing interfaces on which the packet is forwarded.

show ipv6 mroute group

This command displays the multicast configuration settings specific to IPv6 such as flags, timer settings, incoming and outgoing interfaces, RPF neighboring routers, and expiration times of all the entries in the multicast mroute table containing the given group IPv6 address < groupaddress> .

Format

Modes

show ipv6 mroute group <group-address> {detail | summary}

• Privileged EXEC

• User EXEC

Term

Source IP

Group IP

Protocol

Incoming

Interface

Outgoing

Interface List

Definition




The interface on which the packet for this group arrives.


show ipv6 mroute source

This command displays the multicast configuration settings specific to IPv6 such as flags, timer settings, incoming and outgoing interfaces, RPF neighboring routers, and expiration times of all the entries in the multicast mroute table containing the given source IP address or source IP address and group IP address pair.

Format

Modes

show ipv6 mroute source <source-address> {detail | summary}

• Privileged EXEC

• User EXEC



If you use the detail parameter, the command displays the following column headings in the output table:

Term Definition

Source IP

Group IP



Expiry Time

Up Time


The time elapsed since the entry was created in seconds.



If you use the summary parameter, the command displays the following column headings in the output table:

Term

Source IP

Group IP

Protocol

Incoming

Interface

Outgoing

Interface List

Definition




The interface on which the packet for this source arrives.


IPv6 PIM-DM Commands

This section describes the Protocol Independent Multicast -Dense Mode (PIM-DM) commands to support the PIM version of IPv6.

ipv6 pimdm

Use this command to administratively enable PIM-DM Multicast Routing Mode either across the router (Global Config) or on a particular router (Interface Config).



no ipv6 pimdm

Default

Format

Mode disabled ipv6 pimdm

• Global Config


Use this command to administratively disable PIM-DM Multicast Routing Mode either across the router (Global Config) or on a particular router (Interface Config).

Format

Mode no ipv6 pimdm

• Global Config

• Interface Config ipv6 pimdm hello-interval

Use this command to configure the PIM-DM hello interval for the specified router interface. The hello-interval is specified in seconds and is in the range 10–3600.

Default

Format

Mode

30 ipv6 pimdm hello-interval <10-3600>

Interface Config no ipv6 pimdm hello-interval

Use this command to set the PIM-DM hello interval to the default value.

Format

Mode no ipv6 pimdm hello-interval

Interface Config show ipv6 pimdm

Use this command to display PIM-DM Global Configuration parameters and PIM-DM interface status.



Format

Mode show ipv6 pimdm

• Privileged EXEC

• User EXEC

Term Definition

Admin Mode Indicates whether PIM-DM is enabled or disabled.


Interface-Mode Indicates whether PIM-DM is enabled or disabled on this interface.

Operational-

Status

The current state of PIM-DM on this interface. Possible values are Operational or Non-

Operational.


(Switch) #show ipv6 pimdm

Admin Mode..................................... Enable

PIM-DM INTERFACE STATUS

Interface Interface Mode Protocol State

--------- -------------- ----------------

0/1 Enable Non-Operational

0/2 Enable Non-Operational show ipv6 pimdm neighbor

Use this command to display the PIM-DM neighbor information for all interfaces or for the specified interface.

Format

Modes

show ipv6 pimdm neighbor [<unit/slot/port>|all]

• Privileged EXEC

• User EXEC

Term

Interface

Neighbor

Address

Definition



IPv6 Multicast Commands v1.0, July 2009

6-6


Term

Up Time

Expiry Time

Definition




(Switch) #show ipv6 pimdm neighbor 0/1

Interface Neighbor Up Time Expiry Time

Address (hh:mm:ss) (hh:mm:ss) show ipv6 pimdm interface

Use this command to display PIM-DM configuration information for all interfaces or for the specified interface. If no interface is specified, configuration of all interfaces is displayed.


Format

Modes

show ipv6 pimdm interface [<unit/slot/port>|all]

• Privileged EXEC

• User EXEC

Term Definition

Interface Mode Indicates whether PIM-DM is enabled or disabled on the specified interface.

PIM-DM Interface

Hello Interval


(Switch) #show ipv6 pimdm interface 0/1

Slot/Port...................................... 0/1

IP Address..................................... 1.1.1.1

Subnet Mask.................................... 255.255.255.0

Hello Interval (secs).......................... 30 secs

Neighbor count................................. 3

Designated Router.............................. Not Supported

(Switch) #show ipv6 pimdm interface

Address Interface Neighbor Hello

Count Interval

--------- ------- -------- -------

192.168.37.6 0/1 2

192.168.36.129 0/2 2

30

30



10.1.37.2 0/24 1 30

--------- ------- --------- -------

IPv6 PIM-SM Commands

This section describes the PIM-SM commands you use to configure Protocol Independent

Multicast - Sparse Mode (PIM-SM) in IPv6.

ipv6 pimsm bsr-border

Use this command to prevent bootstrap router (BSR) messages from being sent or received through an interface.

Default

Format

Mode disabled ipv6 pimsm bsr-border

Interface Config no ipv6 pimsm bsr-border


Format

Mode no ipv6 pimsm bsr-border

Interface Config ipv6 pimsm bsr-candidate

This command is used to configure the router to announce its candidacy as a bootstrap router

(BSR).

Default

Format

Mode

None

ipv6 pimsm bsr-candidate interface <unit/slot/port> [hash-mask- length] [priority]

Global Config



Parameters hash-masklength priority

Description

Length of a mask (32 bits maximum) that is to be ANDed with the group address before the hash function is called. All groups with the same seed hash correspond to the same RP.

For example, if this value was 24, only the first 24 bits of the group addresses matter. This allows you to get one RP for multiple groups.

Priority of the candidate BSR. The range is an integer from 0 to 255. The BSR with the larger priority is preferred. If the priority values are the same, the router with the larger IP address is the BSR. The default value is 0.

no ipv6 pimsm bsr-candidate

This command is used to disable the router to announce its candidacy as a bootstrap router (BSR).

Format

Mode

no ipv6 pimsm bsr-candidate interface <unit/slot/port> [hash-mask- length] [priority]

Global Config ipv6 pimsm dr-priority

Use this command to set the priority value for which a router is elected as the designated router

(DR).

Default

Format

Mode

1 ipv6 pimsm dr-priority <0-2147483647>

Interface Config no ipv6 pimsm dr-priority


Format

Mode no ipv6 pimsm dr-priority

Interface Config ipv6 pimsm hello-interval

This command is used to configure the PIM-SM hello interval for the specified interface. The hello interval range is 0-18000 is specified in seconds.



Default

Format

Mode

30

ipv6 pimsm hello-interval <0-18000>

Interface Config no ipv6 pimsm hello-interval

This command is used to set the hello interval to the default value.

Format

Mode no ipv6 pimsm hello-interval

Interface Config ipv6 pimsm join-prune-interval

This command is used to configure the interface join/prune interval for the PIM-SM router. The join/prune interval is specified in seconds. This parameter can be configured to a value from 0 to

18000.

Default

Format

Mode

60

ipv6 pimsm join-prune-interval <0-18000>

Interface Config no ipv6 pimsm join-prune-interval

Use this command to set the join/prune interval to the default value.

Format

Mode no ipv6 pimsm join-prune-interval

Interface Config ipv6 pimsm register-threshold

This command configures the Register Threshold rate for the Rendezvous Point router to switch to a source-specific shortest path. The valid values are from (0 to 2000 kilobits/sec).



Default

Format

Mode

0

ipv6 pimsm register-threshold <0-2000>

Global Config no ipv6 pimsm register-threshold

This command resets the register threshold rate for the Rendezvous Pointer router to the default value.

Format

Mode no ipv6 pimsm register-threshold

Global Config ipv6 pimsm rp-address

This command is used to statically configure the RP address for one or more multicast groups. The parameter < rp-address > is the IP address of the RP. The parameter < groupaddress > is the group address supported by the RP. The parameter < groupmask > is the group mask for the group address. The optional keyword override indicates that if there is a conflict, the RP configured with this command prevails over the RP learned by BSR.

Default

Format

Mode

0

ipv6 pimsm rp-address <rp-address> <group-address> <group-mask>

[override]

Global Config no ipv6 pimsm rp-address

This command is used to statically remove the RP address for one or more multicast groups.

Format

Mode

no ipv6 pimsm rp-address <rp-address> <group-address> <group-mask>

Global Config


6-11


ipv6 pimsm rp-candidate

This command is used to configure the router to advertise itself as a PIM candidate rendezvous point (RP) to the bootstrap router (BSR).

Default

Format

Mode

None ipv6 pimsm rp-candidate interface <unit/slot/port> <group-address>

<group-mask>

Global Config no ipv6 pimsm rp-candidate

This command is used to disable the router to advertise itself as a PIM candidate rendezvous point

(RP) to the bootstrap router (BSR).

Format

Mode no ipv6 pimsm rp-candidate interface <unit/slot/port> <group-address>

<group-mask>

Global Config ipv6 pimsm spt-threshold

This command is used to configure the Data Threshold rate for the last-hop router to switch to the shortest path. The rate is specified in Kilobits per second. The possible values are 0 to 2000.

Default

Format

Mode

0

ipv6 pimsm spt-threshold <1-2000>

Global Config no ipv6 pimsm spt-threshold

This command is used to set the Data Threshold rate for the RP router to the default value.

Format

Mode no ipv6 pimsm spt-threshold

Global Config



ipv6 pimsm ssm

Use this command to define the Source Specific Multicast (SSM) range of IP multicast addresses.

Default

Format

Mode disabled ipv6 pimsm ssm {default | <group-address/prefixlength> <group-mask>}

Global Config

Parameter default

Description

Defines the SSM range access list to 232/8.

no ipv6 pimsm ssm

This command is used to disable the Source Specific Multicast (SSM) range.

Format

Mode no ipv6 pimsm ssm

Global Config show ipv6 pimsm

This command displays the system-wide information for PIM-SM.

Format

Modes show ipv6 pimsm

• Privileged EXEC

• User EXEC

Term Definition

PIM-SM Admin

Mode

Data Threshold

Rate (Kbps)

Indicates whether PIM-SM is enabled or disabled.

The data threshold rate for the PIM-SM router.

Register

Threshold Rate

(Kbps)

SSM Range Table

The threshold rate for the RP router to switch to the shortest path.

Group Address/

Prefix Length

The Group IPv6 address and prefix length.


6-13


Term Definition

PIM-SM Interface Status


Interface-Mode Indicates whether PIM-SM is enabled or disabled on the interface.

Operational-

Status

The current state of the PIM-SM protocol on the interface. Possible values are Operational or Non-Operational.

show ipv6 pimsm bsr

This command displays the bootstrap router (BSR) information. The output includes elected BSR information and information about the locally configured candidate rendezvous point (RP) advertisement.

Format

Mode show ipv6 pimsm bsr

• Privileged EXEC

• User EXEC

Term Definition

BSR Address

Uptime

BSR Priority

Hash Mask

Length

IP address of the BSR.

Length of time that this router has been up (in hours, minutes, and seconds).

Priority as configured in the ip pimsm bsr-candidate command.

Length of a mask (maximum 32 bits) that is to be ANDed with the group address before the hash function is called. This value is configured in the ip pimsm bsr-candidate command.

Next Bootstrap

Message In

Time (in hours, minutes, and seconds) in which the next bootstrap message is due from this BSR.

Next Candidate

RP advertisement in

Time (in hours, minutes, and seconds) in which the next candidate RP advertisement will be sent.


6-14


show ipv6 pimsm interface

This command displays interface configuration parameters for PIM-SM on the specified interface.

If no interface is specified, all interfaces are displayed.

Format

Modes show ipv6 pimsm interface [ <unit/slot/port> ]

• Privileged EXEC

• User EXEC

Term Definition

Interface

IP Address

Hello Interval

(secs)

Join Prune

Interval (secs)


The IPv6 address of the specified interface.


The join/prune interval for the PIM-SM router. The interval is in seconds.

Neighbor Count The neighbor count for the PIM-SM interface.

Designated

Router


DR Priority

BSR Border

The priority of the Designated Router.

The bootstrap router border interface. Possible values are enabled or disabled .

show ipv6 pimsm neighbor

This command displays the neighbor information for PIM-SM on the specified interface.

Format

Modes

show ipv6 pimsm neighbor {<unit/slot/port> | all}

• Privileged EXEC

• User EXEC

Term

Interface

IP Address

Up Time

Expiry Time

Definition


The IPv6 address of the neighbor on an interface.





show ipv6 pimsm rphash

This command displays which rendezvous point (RP) is being used for a specified group.

Format

Modes

show ipv6 pimsm rphash <group-address>

• Privileged EXEC

• User EXEC

Term

RP

Origin

Definition

The IP address of the RP for the group specified.

Indicates the mechanism (BSR or static) by which the RP was selected.

show ipv6 pimsm rp mapping

Use this command to display all group-to-RP mappings of which the router is a aware (either configured or learned from the bootstrap router (BSR)). If no RP is specified, all active RPs are displayed.

Format

Modes show ipv6 pimsm rp mapping [rp address]

• Privileged EXEC

• User EXEC

IPv6 MLD Commands

IGMP/MLD Snooping is Layer 2 functionality but IGMP/MLD are Layer 3 multicast protocols. It requires that in a network setup there should be a multicast router (which can act as a querier) to be present to solicit the multicast group registrations. However some network setup does not need a multicast router as multicast traffic is destined to hosts within the same network. In this situation, the 7000 series has an IGMP/MLD Snooping Querier running on one of the switches and

Snooping enabled on all the switches. For more information, see “IGMP Snooping Configuration

Commands” on page 3-139 and “MLD Snooping Commands” on page 3-153 .

ipv6 mld router

Use this command, in the administrative mode of the router, to enable MLD in the router.



Default

Format

Mode

Disabled ipv6 mld router

Global Config

Interface Config no ipv6 mld router

Use this command, in the administrative mode of the router, to disable MLD in the router.

Default

Format

Mode

Disabled no ipv6 mld router

Global Config

Interface Config ipv6 mld query-interval

Use this command to set the MLD router’s query interval for the interface. The query-interval is the amount of time between the general queries sent when the router is the querier on that interface. The range for < query-interval > is 1 to 3600 seconds.

Default

Format

Mode

125 ipv6 mld query-interval <query-interval>

Interface Config no ipv6 mld query-interval

Use this command to reset the MLD query interval to the default value for that interface.

Format

Mode no ipv6 mld query-interval

Interface Config


6-17


ipv6 mld query-max-response-time

Use this command to set the MLD querier’s maximum response time for the interface and this value is used in assigning the maximum response time in the query messages that are sent on that interface. The range for <query-max-response-time> is 0 to 65535 milliseconds.

Default

Format

Mode

10000 milliseconds ipv6 mld query-max-response-time <query-max-response-time>

Interface Config no ipv6 mld query-max-response-time

This command resets the MLD query max response time for the interface to the default value.

Format

Mode no ipv6 mld query-max-response-time

Interface Config ipv6 mld last-member-query-interval

Use this command to set the last member query interval for the MLD interface, which is the value of the maximum response time parameter in the group specific queries sent out of this interface.

The range for <last-member-query-interval> is 1 to 65535 milliseconds.

Default

Format

Mode

1000 milliseconds ipv6 mld last-member-query-interval <last-member-query-interval>

Interface Config no ipv6 mld last-member-query-interval

Use this command to reset the <last-member-query-interval> parameter of the interface to the default value.

Format

Mode no ipv6 mld last-member-query-interval

Interface Config



ipv6 mld last-member-query-count

Use this command to set the number of listener-specific queries sent before the router assumes that there are no local members on the interface. The range for <last-member-query-count> is

1 to 20.

Default

Format

Mode

2 ipv6 mld last-member-query-count <last-member-query-count>

Interface Config no ipv6 mld last-member-query-count

Use this command to reset the <last-member-query-count> parameter of the interface to the default value.

Format

Mode no ipv6 mld last-member-query-count

Interface Config show ipv6 mld groups

Use this command to display information about multicast groups that MLD reported. The information is displayed only when MLD is enabled on at least one interface. If MLD was not enabled on even one interface, there is no group information to be displayed.

Format

Mode show ipv6 mld groups { <unit/slot/port> | <group-address>}

• Privileged EXEC

• User EXEC

The following fields are displayed as a table when < unit/slot/port> is specified.


Group Address The address of the multicast group.

Interface Interface through which the multicast group is reachable.

Up Time

Expiry Time

Time elapsed in hours, minutes, and seconds since the multicast group has been known.

Time left in hours, minutes, and seconds before the entry is removed from the MLD membership table.



When <group-address > is specified, the following fields are displayed for each multicast group and each interface.


Interface Interface through which the multicast group is reachable.

Group Address The address of the multicast group.

Last Reporter The IP Address of the source of the last membership report received for this multicast group address on that interface.

Filter Mode The filter mode of the multicast group on this interface. The values it can take are and exclude .

include

Version 1 Host

Timer

The time remaining until the router assumes there are no longer any MLD version-1 Hosts on the specified interface.

Group Compat

Mode

The compatibility mode of the multicast group on this interface. The values it can take are

MLDv1 and MLDv2 .

The following table is displayed to indicate all the sources associated with this group.


Source Address The IP address of the source.

Uptime Time elapsed in hours, minutes, and seconds since the source has been known.

Expiry Time Time left in hours, minutes, and seconds before the entry is removed.

Example: The following shows examples of CLI display output for the commands.

(Switch) #show ipv6 mld groups ?

<group-address> Enter Group Address Info.

<unit/slot/port> Enter interface in unit/slot/port format.

(Switch) #show ipv6 mld groups 1/0/1

Group Address.................................. FF43::3

Interface...................................... 1/0/1

Up Time (hh:mm:ss)............................. 00:03:04

Expiry Time (hh:mm:ss)......................... ------

(Switch) #show ipv6 mld groups ff43::3

Interface...................................... 1/0/1

Group Address.................................. FF43::3

Last Reporter.................................. FE80::200:FF:FE00:3


6-20


Up Time (hh:mm:ss)............................. 00:02:53

Expiry Time (hh:mm:ss)......................... ------

Filter Mode.................................... Include

Version1 Host Timer............................ ------

Group compat mode.............................. v2

Source Address ExpiryTime

----------------- -----------

2003::10 00:04:17

2003::20 00:04:17 show ipv6 mld interface

Use this command to display MLD-related information for the interface.

Format

Mode

show ipv6 mld interface [<unit/slot/port>]

• Privileged EXEC

• User EXEC

The following information is displayed for each of the interfaces or for only the specified interface.


Interface

MLD Global

Mode

The interface number in unit/slot/port format.

Displays the configured administrative status of MLD.

MLD Operational

Mode

The operational status of MLD on the interface.

MLD Version Indicates the version of MLD configured on the interface.

Query Interval Indicates the configured query interval for the interface.

Query Max

Response Time

Robustness

Startup Query interval

Indicates the configured maximum query response time (in seconds) advertised in MLD queries on this interface.

Displays the configured value for the tuning for the expected packet loss on a subnet attached to the interface.

This valued indicates the configured interval between General Queries sent by a Querier on startup.

Startup Query

Count

Last Member

Query Interval

This value indicates the configured number of Queries sent out on startup, separated by the Startup Query Interval.

This value indicates the configured Maximum Response Time inserted into Group-Specific

Queries sent in response to Leave Group messages.



Field

Last Member

Query Count

Description

This value indicates the configured number of Group-Specific Queries sent before the router assumes that there are no local members.

The following information is displayed if the operational mode of the MLD interface is enabled.


Querier Status This value indicates whether the interface is an MLD querier or non-querier on the subnet it is associated with.

Querier Address The IP address of the MLD querier on the subnet the interface is associated with.

Querier Up Time Time elapsed in seconds since the querier state has been updated.

Querier Expiry

Time

Time left in seconds before the Querier loses its title as querier.

Wrong Version

Queries

Indicates the number of queries received whose MLD version does not match the MLD version of the interface.

Number of Joins The number of times a group membership has been added on this interface.

The number of times a group membership has been removed on this interface.

Number of

Leaves

Number of

Groups

The current number of membership entries for this interface.

show ipv6 mld traffic

Use this command to display MLD statistical information for the router.

Format

Mode show ipv6 mld traffic

• Privileged EXEC

• User EXEC


Valid MLD Packets Received The number of valid MLD packets received by the router.

Valid MLD Packets Sent The number of valid MLD packets sent by the router.

Queries Received

Queries Sent

IPv6 Multicast Commands

The number of valid MLD queries received by the router.

The number of valid MLD queries sent by the router.

v1.0, July 2009

6-22



Reports Received

Reports Sent

Leaves Received

The number of valid MLD reports received by the router.

The number of valid MLD reports sent by the router.

The number of valid MLD leaves received by the router.

Leaves Sent The number of valid MLD leaves sent by the router.

Bad Checksum MLD Packets The number of bad checksum MLD packets received by the router.

Malformed MLD Packets The number of malformed MLD packets received by the router.

IPv6 MLD-Proxy Commands

MLD-Proxy is the IPv6 equivalent of IGMP-Proxy. MLD-Proxy commands allow you to configure the network device as well as to view device settings and statistics using either serial interface or telnet session. The operation of MLD-Proxy commands is the same as for IGMP-

Proxy: MLD is for IPv6 and IGMP is for IPv4.MGMD is a term used to refer to both IGMP and

MLD.

ipv6 mld-proxy

Use this command to enable MLD-Proxy on the router. To enable MLD-Proxy on the router, you must enable multicast forwarding. Also, make sure that there are no other multicast routing protocols enabled n the router.

Format

Mode ipv6 mld-proxy

Interface Config no ipv6 mld-proxy

Use this command to disable MLD-Proxy on the router.

Format

Mode no ipv6 mld-proxy

Interface Config



ipv6 mld-proxy unsolicit-rprt-interval

Use this command to set the unsolicited report interval for the MLD-Proxy router. This command is only valid when you enable MLD-Proxy on the interface. The value of < interval > is 1-260 seconds.

Default

Format

Mode

1 ipv6 mld-proxy unsolicit-rprt-interval < interval >

Interface Config no ipv6 mld-proxy unsolicited-report-interval

Use this command to reset the MLD-Proxy router’s unsolicited report interval to the default value.

Format

Mode no ipv6 mld-proxy unsolicit-rprt-interval

Interface Config ipv6 mld-proxy reset-status

Use this command to reset the host interface status parameters of the MLD-Proxy router. This command is only valid when you enable MLD-Proxy on the interface.

Format

Mode ipv6 mld-proxy reset-status

Interface Config show ipv6 mld-proxy

Use this command to display a summary of the host interface status parameters.

Format

Mode show ipv6 mld-proxy

• Privileged EXEC

• User EXEC

The command displays the following parameters only when you enable MLD-Proxy.




Interface Index

Admin Mode

Operational Mode

The interface number of the MLD-Proxy.

Indicates whether MLD-Proxy is enabled or disabled. This is a configured value.

Indicates whether MLD-Proxy is operationally enabled or disabled. This is a status parameter.

Version The present MLD host version that is operational on the proxy interface.

Number of Multicast Groups The number of multicast groups that are associated with the MLD-Proxy interface.

Unsolicited Report Interval

Querier IP Address on Proxy

Interface

Older Version 1 Querier

Timeout

The time interval at which the MLD-Proxy interface sends unsolicited group membership report.

The IP address of the Querier, if any, in the network attached to the upstream interface (MLD-Proxy interface).


Proxy Start Frequency The number of times the MLD-Proxy has been stopped and started.


(Switch) #show ipv6 mld-proxy

Interface Index............................................. 1/0/3

Admin Mode................................................ Enable

Operational Mode......................................... Enable

Version......................................................... 3

Num of Multicast Groups............................. 0

Unsolicited Report Interval.......................... 1

Querier IP Address on Proxy Interface........ fe80::1:2:5

Older Version 1 Querier Timeout................ 00:00:00

Proxy Start Frequency.................................

show ipv6 mld-proxy interface

This command displays a detailed list of the host interface status parameters. It displays the following parameters only when you enable MLD-Proxy.

Format

Modes show ipv6 mld-proxy interface

• Privileged EXEC

• User EXEC



Term Definition

Interface Index The unit/slot/port of the MLD-proxy.

The column headings of the table associated with the interface are as follows:

Term

Ver

Query Rcvd

Report Rcvd

Report Sent

Leaves Rcvd

Leaves Sent

Definition

The MLD version.

Number of MLD queries received.

Number of MLD reports received.

Number of MLD reports sent.

Number of MLD leaves received. Valid for version 2 only.

Number of MLD leaves sent on the Proxy interface. Valid for version 2 only.


(Switch) #show ipv6 mld-proxy interface

Interface Index................................ 1/0/1

Ver Query Rcvd Report Rcvd Report Sent Leave Rcvd Leave Sent

------------------------------------------------------------------

1 2 0 0 0 2

----show ipv6 mld-proxy groups

Use this command to display information about multicast groups that the MLD-Proxy reported.

Format

Mode show ipv6 mld-proxy groups

• Privileged EXEC

• User EXEC

Field

Interface

Group Address

Description


The IP address of the multicast group.



Field

Last Reporter

Up Time (in secs)

Member State

Filter Mode

Sources

Description

The IP address of the host that last sent a membership report for the current group, on the network attached to the MLD-Proxy interface (upstream interface).

The time elapsed in seconds since last created.

Possible values are:

• Idle_Member . The interface has responded to the latest group membership query for this group.

• Delay_Member . The interface is going to send a group membership report to respond to a group membership query for this group.

Possible values are Include or Exclude.



(Switch) #show ipv6 mld-proxy groups

Interface Index................................ 1/0/3

Group Address Last Reporter Up Time Member State Filter Mode

Sources

------------- -------------- ---------- ----------------- -------------- ----

---

FF1E::1 FE80::100:2.3 00:01:40 DELAY_MEMBER Exclude 2

FF1E::2

FF1E::3

FE80::100:2.3 00:02:40 DELAY_MEMBER Include

FE80::100:2.3 00:01:40 DELAY_MEMBER Exclude

1

0

FF1E::4 FE80::100:2.3 00:02:44 DELAY_MEMBER Include 4 show ipv6 mld-proxy groups detail

Use this command to display information about multicast groups that MLD-Proxy reported.

Format

Mode show ipv6 mld-proxy groups detail

• Privileged EXEC

• User EXEC


6-27


Field

Interface

Group Address

Last Reporter

Up Time (in secs)

Member State

Filter Mode

Sources

Group Source List

Expiry Time

Description


The IP address of the multicast group.

The IP address of the host that last sent a membership report for the current group, on the network attached to the MLD-Proxy interface (upstream interface).

The time elapsed in seconds since last created.

Possible values are:

• Idle_Member . The interface has responded to the latest group membership query for this group.

• Delay_Member . The interface is going to send a group membership report to respond to a group membership query for this group.

Possible values are Include or Exclude.


The list of IP addresses of the sources attached to the multicast group.

The time left for a source to get deleted.


(Switch) #show ipv6 igmp-proxy groups

Interface Index................................ 1/0/3

Group Address Last Reporter Up Time Member State Filter Mode

Sources

------------- ---------------- ----------- ----------------- ------------- ----

---

FF1E::1 FE80::100:2.3 244 DELAY_MEMBER Exclude 2


----------------- ---------------

2001::1 00:02:40

2001::2 --------

FF1E::2 FE80::100:2.3 243 DELAY_MEMBER Include 1


----------------- ---------------

3001::1 00:03:32

3002::2 00:03:32



FF1E::3

FF1E::4

FE80::100:2.3 328 DELAY_MEMBER Exclude 0

FE80::100:2.3 255 DELAY_MEMBER Include 4


----------------- ---------------

4001::1 00:03:40

5002::2 00:03:40

4001::2 00:03:40

5002::2 00:03:40


6-29

Chapter 7

IPv6 Commands

The IPv6 commands described in this chapter are standard on the GSM7328Sv2 and

GSM7352Sv2, but are optional on the GSM7328Sv1 and GSM7352Sv1. In order to use these commands with the GS7328Sv1 or GSM7352Sv1 you must purchase a separate software license.

Note: The commands in this chapter require an optional software license for use on the

GSM7328Sv1 and GSM7352Sv1.


This chapter contains the following sections:

• “IPv6 Management Commands” on page 7-2

• “Tunnel Interface Commands” on page 7-6

• “Loopback Interface Commands” on page 7-8

• “IPv6 Routing Commands” on page 7-10

• “OSPFv3 Commands” on page 7-33

• “DHCPv6 Commands” on page 7-68





7-1 v1.0, July 2009


IPv6 Management Commands

IPv6 Management commands allow a device to be managed via an IPv6 address in a switch or

IPv4 routing (i.e., independent from the IPv6 Routing package). For Routing/IPv6 builds of

Switch CLI dual IPv4/IPv6 operation over the service port is enabled. Switch CLI has capabilities such as:

• Static assignment of IPv6 addresses and gateways for the network ports.

• The ability to ping an IPv6 link-local address over the network port.

• Using IPv6 Management commands, you can send SNMP traps and queries via the network port.

• The user can manage a device via the network port (in addition to a Routing Interface). network ipv6 enable

Use this command to enable IPv6 operation on the network port.

Default

Format

Mode enabled network ipv6 enable

Privileged EXEC no network ipv6 enable

Use this command to disable IPv6 operation on the network port.

Format

Mode no network ipv6 enable

Privileged EXEC network ipv6 address

Use this command to configure IPv6 global addressing (i.e. default routers) information for the network port.

Format

Mode

network ipv6 address <address>/<prefix-length> [eui64]

Privileged EXEC

IPv6 Commands 7-2 v1.0, July 2009


Parameter address prefix-length eui64

Description

IPv6 prefix in IPv6 global address format.

IPv6 prefix length value

Formulate IPv6 address in eui64 format no network ipv6 address

Use this command to remove IPv6 prefixes on the network port interface. The command no network ipv6 address removes all IPv6 prefixes.

Format

Mode

no network ipv6 address <address>/<prefix-length> [eui64]

Privileged EXEC network ipv6 gateway

Use this command to configure IPv6 gateway (i.e. default routers) information for the network port.

Format

Mode

network ipv6 gateway <gateway-address>

Privileged EXEC

Parameter gatewayaddress

Description

Gateway address in IPv6 global or link-local address format.

no network ipv6 gateway

Use this command to remove IPv6 gateways on the network port interface.

Format

Mode no network ipv6 gateway

Privileged EXEC



show network ndp

This command displays NDP cache information for the network port.

Default

Format

Mode enabled show network ndp

• Privileged EXEC

• User EXEC


IPv6 Address The IPv6 address of the interface.

MAC Address The MAC Address used.

isRtr Specifies the router flag.

Neighbor State The state of the neighbor cache entry. Possible values are: Reachable, Delay.

Age Updated The time in seconds that has elapsed since an entry was added to the cache.


(Switch) #show network ndp

IPv6 Address MAC Address isRtr

Neighbor Age

State Updated

-------------------------- ----------------- ----- -------- -------

3017::204:76FF:FE73:423A 00:04:76:73:42:3a Reachable 447535

FE80::204:76FF:FE73:423A 00:04:76:73:42:3a Delay 447540 ping ipv6

Use this command to determine whether another computer is on the network. Ping provides a synchronous response when initiated from the CLI and Web interfaces. To use the command, configure the switch for network (in-band) connection. The source and target devices must have the ping utility enabled and running on top of TCP/IP. The switch can be pinged from any IP workstation with which the switch is connected through the default VLAN (VLAN 1), as long as there is a physical path between the switch and the workstation. The terminal interface sends three pings to the target station. Use the < ipv6-address|hostname> parameter to ping an interface by using the global IPv6 address of the interface. Use the optional size keyword to specify the size of the ping packet.



You can utilize the ping or traceroute facilities over the service/network ports when using an IPv6 global address <ipv6-global-address|hostname> . Any IPv6 global address or gateway assignments to these interfaces will cause IPv6 routes to be installed within the IP stack such that the ping or traceroute request is routed out the service/network port properly. When referencing an

IPv6 link-local address, you must also specify the service or network port interface by using the serviceport or network parameter.

Default

Format

Mode

• The default count is 1.

• The default interval is 3 seconds.

• The default size is 0 bytes.

ping ipv6 {ipv6-global-address|hostname} [size <datagram-size>]}

• Privileged EXEC

• User Exec ping ipv6 interface

Use this command to determine whether another computer is on the network. To use the command, configure the switch for network (in-band) connection. The source and target devices must have the ping utility enabled and running on top of TCP/IP. The switch can be pinged from any IP workstation with which the switch is connected through the default VLAN (VLAN 1), as long as there is a physical path between the switch and the workstation. The terminal interface sends three pings to the target station. Use the interface keyword to ping an interface by using the link-local address or the global IPv6 address of the interface. You can use a loopback, network port, serviceport, tunnel, or physical interface as the source. Use the optional size keyword to specify the size of the ping packet. The <ipv6-address> is the link local IPv6 address of the device you want to query.

Format

Modes

ping ipv6 interface {<unit/slot/port> | loopback <loopback-id>

|network |tunnel <tunnel-id>} <link-local-address>} [size <datagramsize>]

• Privileged EXEC

• User Exec



traceroute ipv6

Use this command to discover the routes that packets actually take when traveling to their destination through the network on a hop-by-hop basis. The <ipv6-address> parameter must be a valid IPv6 address. The optional <port> parameter is the UDP port used as the destination of packets sent as part of the traceroute. This port should be an unused port on the destination system. The range for <port> is 0 (zero) to 65535.The default value is 33434.

Format

Mode traceroute ipv6 <ipv6-address> [<port>]

Privileged EXEC

Tunnel Interface Commands

The commands in this section describe how to create, delete, and manage tunnel interfaces.Several different types of tunnels provide functionality to facilitate the transition of IPv4 networks to IPv6 networks. These tunnels are divided into two classes: configured and automatic. The distinction is that configured tunnels are explicitly configured with a destination or endpoint of the tunnel.

Automatic tunnels, in contrast, infer the endpoint of the tunnel from the destination address of packets routed into the tunnel. To assign an IP address to the tunnel interface, see “ip address” on page 4-9 . To assign an IPv6 address to the tunnel interface, see “ipv6 address” on page 7-12 .

interface tunnel

Use this command to enter the Interface Config mode for a tunnel interface. The <tunnel-id> range is 0 to 7.

Format

Mode

interface tunnel <tunnel-id>

Global Config no interface tunnel

This command removes the tunnel interface and associated configuration parameters for the specified tunnel interface.

Format

Mode

no interface tunnel <tunnel-id>

Global Config

IPv6 Commands v1.0, July 2009

7-6


tunnel source

This command specifies the source transport address of the tunnel, either explicitly or by reference to an interface.

Format

Mode

tunnel source {<ipv4-address> | ethernet <unit/slot/port>}

Interface Config tunnel destination

This command specifies the destination transport address of the tunnel.

Format

Mode

tunnel destination {<ipv4-address>}

Interface Config tunnel mode ipv6ip

This command specifies the mode of the tunnel. With the optional 6to4 argument, the tunnel mode is set to 6to4 automatic. Without the optional 6to4 argument, the tunnel mode is configured.

Format

Mode tunnel mode ipv6ip [6to4]

Interface Config show interface tunnel

This command displays the parameters related to tunnel such as tunnel mode, tunnel source address and tunnel destination address.

Format

Mode

show interface tunnel [<tunnel-id>]

Privileged EXEC

If you do not specify a tunnel ID, the command shows the following information for each configured tunnel:



Term Definition

Tunnel ID

Interface

The tunnel identification number.

The name of the tunnel interface.

Tunnel Mode The tunnel mode.

Source Address The source transport address of the tunnel.

Destination

Address

The destination transport address of the tunnel.

If you specify a tunnel ID, the command shows the following information for the tunnel:

Term

Interface Link

Status

MTU Size

IPv6 Prefix is

Definition


The maximum transmission unit for packets on the interface.

If you enable IPv6 on the interface and assign an address, the IPv6 address and prefix display.

Loopback Interface Commands

The commands in this section describe how to create, delete, and manage loopback interfaces. A loopback interface is always expected to be up. This interface can provide the source address for sent packets and can receive both local and remote packets. The loopback interface is typically used by routing protocols.

To assign an IP address to the loopback interface, see “ip address” on page 4-9 . To assign an IPv6 address to the loopback interface, see “ipv6 address” on page 7-12 .

interface loopback

Use this command to enter the Interface Config mode for a loopback interface. The range of the loopback ID is 0 to 7.

Format

Mode

interface loopback <loopback-id>

Global Config



no interface loopback

This command removes the loopback interface and associated configuration parameters for the specified loopback interface.

Format

Mode

no interface loopback <loopback-id>

Global Config show interface loopback

This command displays information about configured loopback interfaces.

Format

Mode

show interface loopback [<loopback-id>]

Privileged EXEC

If you do not specify a loopback ID, the following information appears for each loopback interface on the system:

Term

Loopback ID

Interface

IP Address

Received

Packets

Sent Packets

IPv6 Address

Definition

The loopback ID associated with the rest of the information in the row.

The interface name.

The IPv4 address of the interface.

The number of packets received on this interface.

The number of packets transmitted from this interface.

The IPv6 address of this interface.

If you specify a loopback ID, the following information appears:

Term Definition

Interface Link

Status


IP Address

IPv6 is enabled

(disabled)


Shows whether IPv6 is enabled on the interface.


7-9


Term

IPv6 Prefix is

MTU size

Definition


The maximum transmission size for packets on this interface, in bytes.

IPv6 Routing Commands

This section describes the IPv6 commands you use to configure IPv6 on the system and on the interfaces. This section also describes IPv6 management commands and show commands.

ipv6 forwarding

This command enables IPv6 forwarding on the router.

Default

Format

Mode enabled ipv6 forwarding

Global Config no ipv6 forwarding

This command disables IPv6 forwarding on the router

Format

Mode no ipv6 forwarding

Global Config ipv6 hop-limit

This command defines the unicast hop count used in ipv6 packets originated by the node. The value is also included in router advertisements. Valid values for <hops> are 1-255 inclusive. The default “not configured” means that a value of zero is sent in router advertisements and a value of

64 is sent in packets originated by the node. Note that this is not the same as configuring a value of

64.

Default not configured



Format

Mode

ipv6 hop-limit <hops>

Global Config no ipv6 hop-limit

This command returns the unicast hop count to the default.

Format

Mode no ipv6 hop-limit

Global Config ipv6 unicast-routing

Use this command to enable the forwarding of IPv6 unicast datagrams.

Default

Format

Mode disabled ipv6 unicast-routing

Global Config no ipv6 unicast-routing

Use this command to disable the forwarding of IPv6 unicast datagrams.

Format

Mode no ipv6 unicast-routing

Global Config ipv6 enable

Use this command to enable IPv6 routing on an interface, including tunnel and loopback interfaces, that has not been configured with an explicit IPv6 address. When you use this command, the interface is automatically configured with a link-local address. You do not need to use this command if you configured an IPv6 global address on the interface.

Default

Format

Mode disabled ipv6 enable

Interface Config



no ipv6 enable

Use this command to disable IPv6 routing on an interface.

Format

Mode no ipv6 enable

Interface Config ipv6 address

Use this command to configure an IPv6 address on an interface, including tunnel and loopback interfaces, and to enable IPv6 processing on this interface. You can assign multiple globally reachable addresses to an interface by using this command. You do not need to assign a link-local address by using this command since one is automatically created. The <prefix> field consists of the bits of the address to be configured. The <prefix_length> designates how many of the high-order contiguous bits of the address make up the prefix.

You can express IPv6 addresses in eight blocks. Also of note is that instead of a period, a colon now separates each block. For simplification, leading zeros of each 16 bit block can be omitted.

One sequence of 16 bit blocks containing only zeros can be replaced with a double colon “::”, but not more than one at a time (otherwise it is no longer a unique representation).

• Dropping zeros: 3ffe:ffff:100:f101:0:0:0:1 becomes 3ffe:ffff:100:f101::1

• Local host: 0000:0000:0000:0000:0000:0000:0000:0001 becomes ::1

• Any host: 0000:0000:0000:0000:0000:0000:0000:0000 becomes ::

The hexadecimal letters in the IPv6 addresses are not case-sensitive. An example of an IPv6 prefix and prefix length is 3ffe:1::1234/64 .

The optional [eui-64] field designates that IPv6 processing on the interfaces was enabled using an

EUI-64 interface ID in the low order 64 bits of the address. If you use this option, the value of

<prefix_length> must be 64 bits.

Format

Mode ipv6 address <prefix>/<prefix_length> [eui64]

Interface Config



no ipv6 address

Use this command to remove all IPv6 addresses on an interface or specified IPv6 address. The

<prefix> parameter consists of the bits of the address to be configured. The

<prefix_length> designates how many of the high-order contiguous bits of the address comprise the prefix.The optional [eui-64] field designates that IPv6 processing on the interfaces was enabled using an EUI-64 interface ID in the low order 64 bits of the address.

If you do not supply any parameters, the command deletes all the IPv6 addresses on an interface.

Format

Mode no ipv6 address

[

<prefix>/<prefix_length>] [eui64]

Interface Config ipv6 route

Use this command to configure an IPv6 static route. The <ipv6-prefix> is the IPv6 network that is the destination of the static route. The <prefix_length> is the length of the IPv6 prefix

— a decimal value (usually 0-64) that shows how many of the high-order contiguous bits of the address comprise the prefix (the network portion of the address). A slash mark must precede the

<prefix_length> . The <next-hop-address> is the IPv6 address of the next hop that can be used to reach the specified network. Specifying Null0 as nexthop parameter adds a static reject route. The <preference> parameter is a value the router uses to compare this route with routes from other route sources that have the same destination. The range for <preference> is

1 - 255, and the default value is 1. You can specify a <unit/slot/port> or tunnel

<tunnel_id> interface to identify direct static routes from point-to-point and broadcast interfaces. The interface must be specified when using a link-local address as the next hop. A route with a preference of 255 cannot be used to forward traffic.

Default

Format

Mode disabled

ipv6 route <ipv6-prefix>/<prefix_length> {<next-hop-address> | Null0

| interface {<unit/slot/port> | tunnel <tunnel_id>} <next-hopaddress>} [<preference>]

Global Config no ipv6 route

Use this command to delete an IPv6 static route. Use the command without the optional parameters to delete all static routes to the specified destination. Use the <preference> parameter to revert the preference of a route to the default preference.


7-13


Format

Mode

no ipv6 route <ipv6-prefix>/<prefix_length> [{<next-hop-address> |

Null0 | interface {<unit/slot/port> | tunnel <tunnel_id>} <next-hopaddress> | <preference>}]

Global Config ipv6 route distance

This command sets the default distance (preference) for IPv6 static routes. Lower route distance values are preferred when determining the best route. The ipv6 route command allows you to optionally set the distance (preference) of an individual static route. The default distance is used when no distance is specified in this command.

Changing the default distance does not update the distance of existing static routes, even if they were assigned the original default distance. The new default distance will only be applied to static routes created after invoking the ipv6 route distance command.

Default

Format

Mode

1

ipv6 route distance <1-255>

Global Config no ipv6 route distance

This command resets the default static route preference value in the router to the original default preference. Lower route preference values are preferred when determining the best route.

Format

Mode no ipv6 route distance

Global Config ipv6 mtu

This command sets the maximum transmission unit (MTU) size, in bytes, of IPv6 packets on an interface. This command replaces the default or link MTU with a new MTU value.

Note: The default MTU value for a tunnel interface is 1480. You cannot change this value.



Default

Format

Mode

0 or link speed (MTU value (1500))

ipv6 mtu <1280-1500>

Interface Config no ipv6 mtu

This command resets maximum transmission unit value to default value.

Format

Mode no ipv6 mtu

Interface Config ipv6 nd dad attempts

This command sets the number of duplicate address detection probes transmitted. Duplicate address detection verifies that an IPv6 address on an interface is unique.

Default

Format

Mode

1

ipv6 nd dad attempts <0 - 600>

Interface Config no ipv6 nd dad attempts

This command resets to number of duplicate address detection value to default value.

Format

Mode no ipv6 nd dad attempts

Interface Config ipv6 nd managed-config-flag

This command sets the “managed address configuration” flag in router advertisements. When the value is true, end nodes use DHCPv6. When the value is false, end nodes automatically configure addresses.



Default

Format

Mode false ipv6 nd managed-config-flag

Interface Config no ipv6 nd managed-config-flag

This command resets the “managed address configuration” flag in router advertisements to the default value.

Format

Mode no ipv6 nd managed-config-flag

Interface Config ipv6 nd ns-interval

This command sets the interval between router advertisements for advertised neighbor solicitations, in milliseconds. An advertised value of 0 means the interval is unspecified.

Default

Format

Mode

0

ipv6 nd ns-interval {<1000-4294967295> | 0}

Interface Config no ipv6 nd ns-interval

This command resets the neighbor solicit retransmission interval of the specified interface to the default value.

Format

Mode no ipv6 nd ns-interval

Interface Config ipv6 nd other-config-flag

This command sets the “other stateful configuration” flag in router advertisements sent from the interface.



Default

Format

Mode false ipv6 nd other-config-flag

Interface Config no ipv6 nd other-config-flag

This command resets the “other stateful configuration” flag back to its default value in router advertisements sent from the interface.

Format

Mode no ipv6 nd other-config-flag

Interface Config ipv6 nd ra-interval

This command sets the transmission interval between router advertisements.

Default

Format

Mode

600

ipv6 nd ra-interval-max <4- 1800>

Interface Config no ipv6 nd ra-interval

This command sets router advertisement interval to the default.

Format

Mode no ipv6 nd ra-interval-max

Interface Config ipv6 nd ra-lifetime

This command sets the value, in seconds, that is placed in the Router Lifetime field of the router advertisements sent from the interface. The <lifetime> value must be zero, or it must be an integer between the value of the router advertisement transmission interval and 9000. A value of zero means this router is not to be used as the default router.



Default

Format

Mode

1800

ipv6 nd ra-lifetime <lifetime>

Interface Config no ipv6 nd ra-lifetime

This command resets router lifetime to the default value.

Format

Mode no ipv6 nd ra-lifetime

Interface Config ipv6 nd reachable-time

This command sets the router advertisement time to consider a neighbor reachable after neighbor discovery confirmation. Reachable time is specified in milliseconds. A value of zero means the time is unspecified by the router.

Default

Format

Mode

0

ipv6 nd reachable-time <0–3600000>

Interface Config no ipv6 nd reachable-time

This command means reachable time is unspecified for the router.

Format

Mode no ipv6 nd reachable-time

Interface Config ipv6 nd suppress-ra

This command suppresses router advertisement transmission on an interface.

Default disabled



Format

Mode ipv6 nd suppress-ra

Interface Config no ipv6 nd suppress-ra

This command enables router transmission on an interface

.

Format

Mode no ipv6 nd suppress-ra

Interface Config ipv6 unreachables

Use this command to enable the generation of ICMPv6 Destination Unreachable messages. By default, the generation of ICMPv6 Destination Unreachable messages is enabled.

Default

Format

Mode enable ipv6 unreachables

Interface Config no ipv6 unreachables

Use this command to prevent the generation of ICMPv6 Destination Unreachable messages.

Format

Mode no ipv6 unreachables

Interface Config ipv6 icmp error-interval

Use this command to limit the rate at which ICMPv6 error messages are sent. The rate limit is configured as a token bucket, with two configurable parameters, burst-size and burst-interval .

The burst-interval specifies how often the token bucket is initialized with burst-size tokens. burstinterval is from 0 to 2147483647 milliseconds (msec).

The burst-size is the number of ICMPv6 error messages that can be sent during one burst-interval .

The range is from 1 to 200 messages.



To disable ICMP rate limiting, set burst-interval to zero (0).

Default

Format

Mode

• burst-interval of 1000 msec.

• burst-size of 100 messages ipv6 icmp error-interval < burst-interval> [<burst-size>]

Global Config no ipv6 icmp error-interval

Use the no form of the command to return burst-interval and burst-size to their default values.

Format

Mode no ipv6 icmp error-interval

Global Config show ipv6 brief

Use this command to display the IPv6 status of forwarding mode and IPv6 unicast routing mode.

Format

Mode show ipv6 brief

Privileged EXEC

Term Definition

IPv6

Forwarding

Mode

IPv6 Unicast

Routing Mode

Shows whether the IPv6 forwarding mode is enabled.

Shows whether the IPv6 unicast routing mode is enabled.

IPv6 Hop Limit Shows the unicast hop count used in IPv6 packets originated by the node. For more information, see “ipv6 hop-limit” on page 7-10 .

ICMPv6 Rate

Limit Error

Interval

Shows how often the token bucket is initialized with burst-size tokens. For more information, see “ipv6 icmp error-interval” on page 7-19 .

ICMPv6 Rate

Limit Burst Size

Shows the number of ICMPv6 error messages that can be sent during one burst-interval.

For more information, see “ipv6 icmp error-interval” on page 7-19 .

Maximum

Routes

Shows the maximum IPv6 route table size.




(Switch) #show ipv6 brief

IPv6 Forwarding Mode........................... Enable

IPv6 Unicast Routing Mode...................... Enable

IPv6 Hop Limit................................. 0

ICMPv6 Rate Limit Error Interval............... 1000 msec

ICMPv6 Rate Limit Burst Size................... 100 messages

Maximum Routes................................. 3000 show ipv6 interface

Use this command to show the usability status of IPv6 interfaces and whether ICMPv6 Destination

Unreachable messages may be sent.

Format

Mode

show ipv6 interface {brief | <unit/slot/port> |tunnel <0-7> | loopback

<0-7>}

Privileged EXEC

If you use the brief parameter, the following information displays for all configured IPv6 interfaces:

Term

Interface

IPv6 Routing

Operational

Mode

IPv6 Address/

Length

Definition

The interface in unit/slot/port format.

Shows whether the mode is enabled or disabled.

Shows the IPv6 address and length on interfaces with IPv6 enabled.

If you specify an interface, the following information also appears.

Term Definition

IPv6 is enabled Appears if IPv6 is enabled on the interface.

Routing Mode Shows whether IPv6 routing is enabled or disabled.



Term Definition

Administrative

Mode

Bandwidth

Interface

Maximum

Transmission

Unit

Router

Duplicate

Address

Detection

Transmits

Shows whether the interface administrative mode is enabled or disabled.

Shows bandwidth of the interface.

The MTU size, in bytes.

The number of consecutive duplicate address detection probes to transmit.

Router

Advertisement

NS Interval

Router

Advertisement

Lifetime

The interval, in milliseconds, between router advertisements for advertised neighbor solicitations.

Shows the router lifetime value of the interface in router advertisements.

Router

Advertisement

Reachable Time

The amount of time, in milliseconds, to consider a neighbor reachable after neighbor discovery confirmation.

The frequency, in seconds, that router advertisements are sent.

Router

Advertisement

Interval

Router

Advertisement

Managed

Config Flag

Shows whether the managed configuration flag is set (enabled) for router advertisements on this interface.

Shows whether the other configuration flag is set (enabled) for router advertisements on this interface.

Router

Advertisement

Other Config

Flag

Router

Advertisement

Suppress Flag

IPv6

Destination

Unreachables

Shows whether router advertisements are suppressed (enabled) or sent (disabled).

Shows whether ICMPv6 Destination Unreachable messages may be sent (enabled) or not (disabled). For more information, see “ipv6 unreachables” on page 7-19 .


(Switch) #show ipv6 interface 1/0/1



Routing Mode................................... Disabled

Administrative Mode............................ Enabled

IPv6 Routing Operational Mode.................. Disabled

Bandwidth...................................... 100000 kbps

Interface Maximum Transmit Unit................ 1500

Router Duplicate Address Detection Transmits... 1

Router Advertisement NS Interval............... 0

Router Advertisement Lifetime.................. 1800

Router Advertisement Reachable Time............ 0

Router Advertisement Interval.................. 600

Router Advertisement Managed Config Flag....... Disabled

Router Advertisement Other Config Flag......... Disabled

Router Advertisement Suppress Flag............. Disabled

IPv6 Destination Unreachables.................. Enabled

No IPv6 prefixes configured.

If an IPv6 prefix is configured on the interface, the following information also appears.

Term Definition

IFPv6 Prefix is The IPv6 prefix for the specified interface.

Preferred

Lifetime

The amount of time the advertised prefix is a preferred prefix.

Valid Lifetime The amount of time the advertised prefix is valid.

Onlink Flag

Autonomous

Flag

Shows whether the onlink flag is set (enabled) in the prefix.

Shows whether the autonomous address-configuration flag (autoconfig) is set (enabled) in the prefix.

show ipv6 neighbor

Use this command to display information about the IPv6 neighbors.

Format

Mode show ipv6 neighbor

Privileged EXEC

Term

Interface

IPv6 Commands

Definition

The interface in unit/slot/port format.

v1.0, July 2009

7-23


Term Definition

IPv6 Address IPV6 address of neighbor or interface.

MAC Address Link-layer Address.

IsRtr Shows whether the neighbor is a router. If the value is TRUE, the neighbor is known to be a router, and FALSE otherwise. A value of FALSE might not mean Note that routers are not always known to be routers.

Neighbor State State of neighbor cache entry. Possible values are Incomplete, Reachable, Stale, Delay,

Probe, and Unknown.

Last Updated The time in seconds that has elapsed since an entry was added to the cache.

clear ipv6 neighbors

Use this command to clear all entries IPv6 neighbor table or an entry on a specific interface. Use the <unit/slot/port> parameter to specify the interface.

Format

Mode

clear ipv6 neighbors [<unit/slot/port>]

Privileged EXEC show ipv6 route

This command displays the IPv6 routing table The <ipv6-address> specifies a specific IPv6 address for which the best-matching route would be displayed. The <ipv6-prefix/ipv6prefix-length> specifies a specific IPv6 network for which the matching route would be displayed. The <interface> specifies that the routes with next-hops on the <interface> be displayed. The <protocol> specifies the protocol that installed the routes. The <protocol> is one of the following keywords: connected , ospf , static . The all specifies that all routes including best and non-best routes are displayed. Otherwise, only the best routes are displayed.

Note: If you use the connected keyword for <protocol> , the all option is not available because there are no best or non-best connected routes.



Format

Modes

show ipv6 route [{<ipv6-address> [<protocol>] | {{<ipv6-prefix/ipv6- prefix-length> | <unit/slot/port>} [<protocol>] | <protocol> | summary} [all] | all}]

• Privileged EXEC

• User EXEC

Term

Route Codes

Definition

The key for the routing protocol codes that might appear in the routing table output.

The show ipv6 route command displays the routing tables in the following format:

Codes: C - connected, S - static

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF Ext 1, OE2 - OSPF Ext 2

ON1 - OSPF NSSA Ext Type 1, ON2 - OSPF NSSA Ext Type 2

The columns for the routing table display the following information:

Term

Code

IPv6-Prefix/

IPv6-Prefix-

Length

Preference/

Metric

Tag

Next-Hop

Route-

Timestamp

Interface

Definition

The code for the routing protocol that created this routing entry.

The IPv6-Prefix and prefix-length of the destination IPv6 network corresponding to this route.

The administrative distance (preference) and cost (metric) associated with this route. An example of this output is [1/0], where 1 is the preference and 0 is the metric.

The decimal value of the tag associated with a redistributed route, if it is not 0.

The outgoing router IPv6 address to use when forwarding traffic to the next router (if any) in the path toward the destination.

The last updated time for dynamic routes. The format of Route-Timestamp will be

• Days:Hours:Minutes if days > = 1

• Hours:Minutes:Seconds if days < 1

The outgoing router interface to use when forwarding traffic to the next destination. For reject routes, the next hop interface would be Null0 interface.

To administratively control the traffic destined to a particular network and prevent it from being forwarded through the router, you can configure a static reject route on the router. Such traffic would be discarded and the ICMP destination unreachable message is sent back to the source. This is typically used for preventing routing loops. The reject route added in the RTO is of the type

OSPF Inter-Area . Reject routes (routes of REJECT type installed by any protocol) are not redistributed by OSPF/RIP. Reject routes are supported in both OSPFv2 and OSPFv3.




(Switch) #show ipv6 route

IPv6 Routing Table - 3 entries

Codes: C - connected, S - static

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF Ext 1, OE2 - OSPF Ext 2

ON1 - OSPF NSSA Ext Type 1, ON2 - OSPF NSSA Ext Type 2

S 2001::/64 [10/0] directly connected, Null0

C 2003::/64 [0/0]

via ::, 0/11

S 2005::/64 [1/0]

via 2003::2, 0/11

C 5001::/64 [0/0]

via ::, 0/5

OE1 6001::/64 [110/1]

via fe80::200:42ff:fe7d:2f19, 00h:00m:23s, 0/5

OI 7000::/64 [110/6]

via fe80::200:4fff:fe35:c8bb, 00h:01m:47s, 0/11 show ipv6 route preferences

Use this command to show the preference value associated with the type of route. Lower numbers have a greater preference. A route with a preference of 255 cannot be used to forward traffic.

Format

Mode show ipv6 route preferences

Privileged EXEC

Term Definition

Local

Static

OSPF Intra

OSPF Inter

Preference of directly-connected routes.

Preference of static routes.

Preference of routes within the OSPF area.

Preference of routes to other OSPF routes that are outside of the area.

OSPF External Preference of OSPF external routes.



show ipv6 route summary

This command displays the summary of the routing table. Use all to display the count summary for all routes, including best and non-best routes. Use the command without parameters to display the count summary for only the best routes.

Format

Modes

show ipv6 route summary [all]

• Privileged EXEC

• User EXEC

Term Definition

Connected

Routes

Total number of connected routes in the routing table.

Static Routes

OSPF Routes

Total number of static routes in the routing table.

Total number of routes installed by OSPFv3 protocol.

Reject Routes Total number of reject routes installed by all protocols.

Number of

Prefixes

Summarizes the number of routes with prefixes of different lengths.

Total Routes The total number of routes in the routing table.


(Switch) #show ipv6 route summary

IPv6 Routing Table Summary - 3 entries

Connected Routes..............................1

Static Routes.................................2

OSPF Routes...................................0

Intra Area Routes...........................0

Inter Area Routes...........................0



Reject Routes.................................1

Total routes..................................3

Number of Prefixes:

/64: 3



show ipv6 vlan

This command displays IPv6 VLAN routing interface addresses.

Format

Modes show ipv6 vlan

• Privileged EXEC

• User EXEC

Term Definition

MAC Address used by

Routing VLANs

Shows the MAC address.

The rest of the output for this command is displayed in a table with the following column headings:

Column

Headings

VLAN ID

Logical

Interface

IPv6 Address/

Prefix Length

Definition

The VLAN ID of a configured VLAN.

The interface in unit/slot/port format that is associated with the VLAN ID.

The IPv6 prefix and prefix length associated with the VLAN ID.

show ipv6 traffic

Use this command to show traffic and statistics for IPv6 and ICMPv6. Specify a logical, loopback, or tunnel interface to view information about traffic on a specific interface. If you do not specify an interface, the command displays information about traffic on all interfaces.

Format

Mode

show ipv6 traffic [{<unit/slot/port> | loopback <loopback-id> | tunnel

<tunnel-id>}]

Privileged EXEC



Term Definition

Total Datagrams

Received

Received Datagrams

Locally Delivered


Discarded Due To

Header Errors


Discarded Due To MTU

Total number of input datagrams received by the interface, including those received in error.

Total number of datagrams successfully delivered to IPv6 user-protocols

(including ICMP). This counter increments at the interface to which these datagrams were addressed, which might not necessarily be the input interface for some of the datagrams.

Number of input datagrams discarded due to errors in their IPv6 headers, including version number mismatch, other format errors, hop count exceeded, errors discovered in processing their IPv6 options, etc.

Number of input datagrams that could not be forwarded because their size exceeded the link MTU of outgoing interface.

Number of input datagrams discarded because no route could be found to transmit them to their destination.


Discarded Due To No

Route


With Unknown Protocol

Number of locally-addressed datagrams received successfully but discarded because of an unknown or unsupported protocol. This counter increments at the interface to which these datagrams were addressed, which might not be necessarily the input interface for some of the datagrams.


Discarded Due To Invalid

Address

Number of input datagrams discarded because the IPv6 address in their IPv6 header's destination field was not a valid address to be received at this entity.

This count includes invalid addresses (for example, ::0 ) and unsupported addresses (for example, addresses with unallocated prefixes). Forentities which are not IPv6 routers and therefore do not forward datagrams, this counter includes datagrams discarded because the destination address was not a local address.


Discarded Due To

Truncated Data


Discarded Other


Reassembly Required

Number of input datagrams discarded because datagram frame didn't carry enough data.

Number of input IPv6 datagrams for which no problems were encountered to prevent their continue processing, but which were discarded (e.g., for lack of buffer space). Note that this counter does not include datagrams discarded while awaiting re-assembly.

Number of IPv6 fragments received which needed to be reassembled at this interface. Note that this counter increments at the interface to which these fragments were addressed, which might not be necessarily the input interface for some of the fragments.

Datagrams Successfully

Reassembled

Number of IPv6 datagrams successfully reassembled. Note that this counter increments at the interface to which these datagrams were addressed, which might not be necessarily the input interface for some of the fragments.



Term Definition

Datagrams Failed To

Reassemble

Number of failures detected by the IPv6 reassembly algorithm (for whatever reason: timed out, errors, etc.). Note that this is not necessarily a count of discarded IPv6 fragments since some algorithms (notably the algorithm in by combining them as they are received. This counter increments at the interface to which these fragments were addressed, which might not be necessarily the input interface for some of the fragments.

Datagrams Forwarded Number of output datagrams which this entity received and forwarded to their final destinations. In entities which do not act as IPv6 routers, this counter will include only those packets which were Source-Routed via this entity, and the

Source-Route processing was successful. Note that for a successfully forwarded datagram the counter of the outgoing interface increments.

Datagrams Locally

Transmitted

Total number of IPv6 datagrams which local IPv6 user-protocols (including

ICMP) supplied to IPv6 in requests for transmission. Note that this counter does not include any datagrams counted in ipv6IfStatsOutForwDatagrams.

Datagrams Transmit

Failed

Fragments Created

Number of output IPv6 datagrams for which no problem was encountered to prevent their transmission to their destination, but which were discarded (e.g., for lack of buffer space). Note that this counter would include datagrams counted in ipv6IfStatsOutForwDatagrams if any such packets met this

(discretionary) discard criterion.

Number of output datagram fragments that have been generated as a result of fragmentation at this output interface.

Datagrams Successfully

Fragmented

Number of IPv6 datagrams that have been successfully fragmented at this output interface.

Datagrams Failed To

Fragment

Number of IPv6 datagrams that have been discarded because they needed to be fragmented at this output interface but could not be.

Number of multicast packets received by the interface.

Multicast Datagrams

Received

Multicast Datagrams

Transmitted

Number of multicast packets transmitted by the interface.

Total ICMPv6 messages received

Total number of ICMP messages received by the interface which includes all those counted by ipv6IfIcmpInErrors. Note that this interface is the interface to which the ICMP messages were addressed which may not be necessarily the input interface for the messages.

ICMPv6 Messages with errors

Number of ICMP messages which the interface received but determined as having ICMP-specific errors (bad ICMP checksums, bad length, etc.).

Number of ICMP Destination Unreachable messages received by the interface.

ICMPv6 Destination

Unreachable Messages

ICMPv6 Messages

Prohibited

Administratively

Number of ICMP destination unreachable/communication administratively prohibited messages received by the interface.



Term Definition

ICMPv6 Time Exceeded

Messages

ICMPv6 Parameter

Problem Messages

ICMPv6 messages with too big packets

ICMPv6 Echo Request

Messages Received

Number of ICMP Time Exceeded messages received by the interface.

Number of ICMP Parameter Problem messages received by the interface.

Number of ICMP Packet Too Big messages received by the interface.

Number of ICMP Echo (request) messages received by the interface.

ICMPv6 Echo Reply


ICMPv6 Router Solicit


Number of ICMP Echo Reply messages received by the interface.

Number of ICMP Router Solicit messages received by the interface.

ICMPv6 Router

Advertisement


Number of ICMP Router Advertisement messages received by the interface.

ICMPv6 Neighbor Solicit


Number of ICMP Neighbor Solicit messages received by the interface.

ICMPv6 Neighbor

Advertisement


Number of ICMP Neighbor Advertisement messages received by the interface.

ICMPv6 Redirect


Transmitted

Number of Redirect messages received by the interface.

Number of ICMPv6 Group Membership Query messages received by the interface.

Total ICMPv6 Messages

Transmitted

Total number of ICMP messages which this interface attempted to send. Note that this counter includes all those counted by icmpOutErrors.

ICMPv6 Messages Not

Transmitted Due To

Error

Number of ICMP messages which this interface did not send due to problems discovered within ICMP such as a lack of buffers. This value should not include errors discovered outside the ICMP layer such as the inability of IPv6 to route the resultant datagram. In some implementations there may be no types of error which contribute to this counter's value.

Number of ICMP Destination Unreachable messages sent by the interface.

ICMPv6 Destination

Unreachable Messages

Transmitted

ICMPv6 Messages

Prohibited

Administratively

Transmitted

ICMPv6 Time Exceeded

Messages Transmitted

Number of ICMP destination unreachable/communication administratively prohibited messages sent.

Number of ICMP Time Exceeded messages sent by the interface.



Term Definition

ICMPv6 Parameter

Problem Messages

Transmitted

ICMPv6 Packet Too Big


ICMPv6 Echo Request


Number of ICMP Parameter Problem messages sent by the interface.

Number of ICMP Packet Too Big messages sent by the interface.

Number of ICMP Echo (request) messages sent by the interface.ICMP echo messages sent.

Number of ICMP Echo Reply messages sent by the interface.

ICMPv6 Echo Reply


ICMPv6 Router Solicit


ICMPv6 Router

Advertisement


Number of ICMP Router Solicitation messages sent by the interface.

Number of ICMP Router Advertisement messages sent by the interface.

ICMPv6 Neighbor Solicit


Number of ICMP Neighbor Solicitation messages sent by the interface.

Number of ICMP Neighbor Advertisement messages sent by the interface.

ICMPv6 Neighbor

Advertisement


ICMPv6 Redirect


Number of Redirect messages sent. For a host, this object will always be zero, since hosts do not send redirects.

Number of ICMPv6 Group Membership Query messages sent.

ICMPv6 Group

Membership Query


ICMPv6 Group

Membership Response


Number of ICMPv6 Group Membership Response messages sent.

ICMPv6 Group

Membership Reduction


ICMPv6 Duplicate

Address Detects

Number of ICMPv6 Group Membership Reduction messages sent.

Number of duplicate addresses detected by the interface.

clear ipv6 statistics

Use this command to clear IPv6 statistics for all interfaces or for a specific interface, including loopback and tunnel interfaces. IPv6 statistics display in the output of the show ipv6 traffic command. If you do not specify an interface, the counters for all IPv6 traffic statistics reset to zero.



Format

Mode

clear ipv6 statistics [{<unit/slot/port> | loopback <loopback-id> | tunnel <tunnel-id>}]

Privileged EXEC

OSPFv3 Commands

This section describes the commands you use to configure OSPFv3, which is a link-state routing protocol that you use to route traffic within a network. ipv6 ospf

This command enables OSPF on a router interface or loopback interface.

Default

Format

Mode disabled ipv6 ospf

Interface Config no ipv6 ospf

This command disables OSPF on a router interface or loopback interface.

Format

Mode no ipv6 ospf

Interface Config ipv6 ospf areaid

This command sets the OSPF area to which the specified router interface belongs. The <areaid> is an IPv6 address, formatted as a 4-digit dotted-decimal number or a decimal value in the range of

<0-4294967295>. The <areaid> uniquely identifies the area to which the interface connects.

Assigning an area id, which does not exist on an interface, causes the area to be created with default values.

Format

Mode

ipv6 ospf areaid <areaid>

Interface Config



ipv6 ospf cost

This command configures the cost on an OSPF interface. The < cost > parameter has a range of 1 to 65535.

Default

Format

Mode

10

ipv6 ospf cost <1-65535>

Interface Config no ipv6 ospf cost

This command configures the default cost on an OSPF interface.

Format

Mode no ipv6 ospf cost

Interface Config ipv6 ospf dead-interval

This command sets the OSPF dead interval for the specified interface. The value for < seconds > is a valid positive integer, which represents the length of time in seconds that a router's Hello packets have not been seen before its neighbor routers declare that the router is down. The value for the length of time must be the same for all routers attached to a common network. This value should be some multiple of the Hello Interval (i.e., 4). Valid values range for < seconds > is from

1 to 2147483647.

Default

Format

Mode

40

ipv6 ospf dead-interval <seconds>

Interface Config no ipv6 ospf dead-interval

This command sets the default OSPF dead interval for the specified interface.

Format

Mode no ipv6 ospf dead-interval

Interface Config



ipv6 ospf hello-interval

This command sets the OSPF hello interval for the specified interface. The value for < seconds > is a valid positive integer, which represents the length of time in seconds. The value for the length of time must be the same for all routers attached to a network. Valid values for < seconds > range from 1 to 65535.

Default

Format

Mode

10

ipv6 ospf hello-interval <seconds>

Interface Config no ipv6 ospf hello-interval

This command sets the default OSPF hello interval for the specified interface.

Format

Mode no ipv6 ospf hello-interval

Interface Config ipv6 ospf mtu-ignore

This command disables OSPF maximum transmission unit (MTU) mismatch detection. OSPF

Database Description packets specify the size of the largest IP packet that can be sent without fragmentation on the interface. When a router receives a Database Description packet, it examines the MTU advertised by the neighbor. By default, if the MTU is larger than the router can accept, the Database Description packet is rejected and the OSPF adjacency is not established.

Default

Format

Mode enabled ipv6 ospf mtu-ignore

Interface Config no ipv6 ospf mtu-ignore

This command enables the OSPF MTU mismatch detection.

Format

Mode no ipv6 ospf mtu-ignore

Interface Config


7-35


ipv6 ospf network

This command changes the default OSPF network type for the interface. Normally, the network type is determined from the physical IP network type. By default all Ethernet networks are OSPF type broadcast. Similarly, tunnel interfaces default to point-to-point. When an Ethernet port is used as a single large bandwidth IP network between two routers, the network type can be pointto-point since there are only two routers. Using point-to-point as the network type eliminates the overhead of the OSPF designated router election. It is normally not useful to set a tunnel to OSPF network type broadcast.

Default

Format

Mode broadcast

ipv6 ospf network {broadcast | point-to-point}

Interface Config no ipv6 ospf network

This command sets the interface type to the default value.

Format

Mode

no ipv6 ospf network {broadcast | point-to-point}

Interface Config ipv6 ospf priority

This command sets the OSPF priority for the specified router interface. The priority of the interface is a priority integer from 0 to 255. A value of 0 indicates that the router is not eligible to become the designated router on this network.

Default

Format

Mode

1, which is the highest router priority

ipv6 ospf priority <0-255>

Interface Config no ipv6 ospf priority

This command sets the default OSPF priority for the specified router interface.



Format

Mode no ipv6 ospf priority

Interface Config ipv6 ospf retransmit-interval

This command sets the OSPF retransmit Interval for the specified interface. The retransmit interval is specified in seconds. The value for < seconds > is the number of seconds between link-state advertisement retransmissions for adjacencies belonging to this router interface. This value is also used when retransmitting database description and link-state request packets. Valid values range from 0 to 3600 (1 hour).

Default

Format

Mode

5

ipv6 ospf retransmit-interval

< seconds

>

Interface Config no ipv6 ospf retransmit-interval

This command sets the default OSPF retransmit Interval for the specified interface.

Format

Mode no ipv6 ospf retransmit-interval

Interface Config ipv6 ospf transmit-delay

This command sets the OSPF Transit Delay for the specified interface. The transmit delay is specified in seconds. In addition, it sets the estimated number of seconds it takes to transmit a link state update packet over this interface. Valid values for <seconds> range from 1 to 3600 (1 hour).

Default

Format

Mode

1 ipv6 ospf transmit-delay

< seconds

>

Interface Config



no ipv6 ospf transmit-delay

This command sets the default OSPF Transit Delay for the specified interface.

Format

Mode no ipv6 ospf transmit-delay

Interface Config ipv6 router ospf

Use this command to enter Router OSPFv3 Config mode.

Format

Mode ipv6 router ospf

Global Config area default-cost (OSPFv3)

This command configures the monetary default cost for the stub area. The operator must specify the area id and an integer value between 1–16777215.

Format

Mode

area <areaid> default-cost <1-16777215>

Router OSPFv3 Config area nssa (OSPFv3)

This command configures the specified areaid to function as an NSSA.

Format

Mode

area <areaid> nssa

Router OSPFv3 Config no area nssa (OSPFv3)

This command disables nssa from the specified area id.

Format

Mode

no area <areaid> nssa

Router OSPFv3 Config


7-38


area nssa default-info-originate (OSPFv3)

This command configures the metric value and type for the default route advertised into the

NSSA. The optional metric parameter specifies the metric of the default route and is to be in a range of 1-16777214. If no metric is specified, the default value is 10. The metric type can be comparable (nssa-external 1) or non-comparable (nssa-external 2).

Format

Mode

area <areaid> nssa default-info-originate [<metric>] [{comparable | non-comparable}]

Router OSPFv3 Config no area nssa default-info-originate (OSPFv3)

This command disables the default route advertised into the NSSA.

Format

Mode

no area <areaid> nssa default-info-originate [<metric>] [{comparable

| non-comparable}]

Router OSPF Config area nssa no-redistribute (OSPFv3)

This command configures the NSSA ABR so that learned external routes will not be redistributed to the NSSA.

Format

Mode

area <areaid> nssa no-redistribute

Router OSPFv3 Config no area nssa no-redistribute (OSPFv3)

This command disables the NSSA ABR so that learned external routes are redistributed to the

NSSA.

Format

Mode

no area <areaid> nssa no-redistribute

Router OSPF Config



area nssa no-summary (OSPFv3)

This command configures the NSSA so that summary LSAs are not advertised into the NSSA.

Format

Mode

area <areaid> nssa no-summary

Router OSPFv3 Config no area nssa no-summary (OSPFv3)

This command disables nssa from the summary LSAs.

Format

Mode

no area <areaid> nssa no-summary

Router OSPF Config area nssa translator-role (OSPFv3)

This command configures the translator role of the NSSA. A value of always causes the router to assume the role of the translator the instant it becomes a border router and a value of candidate causes the router to participate in the translator election process when it attains border router status.

Format

Mode

area <areaid> nssa translator-role {always | candidate}

Router OSPFv3 Config no area nssa translator-role (OSPFv3)

This command disables the nssa translator role from the specified area id.

Format

Mode

no area <areaid> nssa translator-role {always | candidate}

Router OSPF Config area nssa translator-stab-intv (OSPFv3)

This command configures the translator <stabilityinterval> of the NSSA. The

<stabilityinterval> is the period of time that an elected translator continues to perform its duties after it determines that its translator status has been deposed by another router.



Format

Mode

area <areaid> nssa translator-stab-intv <stabilityinterval>

Router OSPFv3 Config no area nssa translator-stab-intv (OSPFv3)

This command disables the nssa translator’s <stabilityinterval> from the specified area id.

Format

Mode

no area <areaid> nssa translator-stab-intv <stabilityinterval>

Router OSPF Config area range (OSPFv3)

This command creates a specified area range for a specified NSSA. The <ipaddr> is a valid IP address. The <subnetmask> is a valid subnet mask. The LSDB type must be specified by either summarylink or nssaexternallink , and the advertising of the area range can be allowed or suppressed.

Format

Mode

area <areaid> range <ipv6-prefix> <prefix-length> {summarylink | nssaexternallink} [advertise | not-advertise]

Router OSPFv3 Config no area range (OSPFv3)

This command deletes a specified area range. The <ipaddr> is a valid IP address. The

<subnetmask> is a valid subnet mask.

Format

Mode

no area <areaid> range <ipv6-prefix> <prefix-length>

Router OSPFv3 Config area stub (OSPFv3)

This command creates a stub area for the specified area ID. A stub area is characterized by the fact that AS External LSAs are not propagated into the area. Removing AS External LSAs and

Summary LSAs can significantly reduce the link state database of routers within the stub area.



Format

Mode

area <areaid> stub

Router OSPFv3 Config no area stub (OSPFv3)

This command deletes a stub area for the specified area ID.

Format

Mode

no area <areaid> stub

Router OSPFv3 Config area stub no-summary (OSPFv3)

This command disables the import of Summary LSAs for the stub area identified by <areaid> .

Default

Format

Mode enabled

area <areaid> stub no-summary

Router OSPFv3 Config no area stub no-summary (OSPFv3)

This command sets the Summary LSA import mode to the default for the stub area identified by

<areaid> .

Format

Mode

no area <areaid> stub summarylsa

Router OSPFv3 Config area virtual-link (OSPFv3)

This command creates the OSPF virtual interface for the specified <areaid> and

<neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

area <areaid> virtual-link <neighbor>




no area virtual-link (OSPFv3)

This command deletes the OSPF virtual interface from the given interface, identified by

<areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor>

Router OSPFv3 Config area virtual-link dead-interval (OSPFv3)

This command configures the dead interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor>.

The <neighbor> parameter is the Router ID of the neighbor. The range for <seconds> is 1 to 65535.

Default

Format

Mode

40

area <areaid> virtual-link <neighbor> dead-interval

< seconds

>

Router OSPFv3 Config no area virtual-link dead-interval (OSPFv3)

This command configures the default dead interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the


Format

Mode

no area <areaid> virtual-link <neighbor> dead-interval

Router OSPFv3 Config area virtual-link hello-interval (OSPFv3)

This command configures the hello interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor. The range for <seconds> is 1 to 65535.

Default

Format

Mode

10

area <areaid> virtual-link <neighbor> hello-interval

< seconds

>




no area virtual-link hello-interval (OSPFv3)

This command configures the default hello interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the


Format

Mode

no area <areaid> virtual-link <neighbor> hello-interval

Router OSPFv3 Config area virtual-link retransmit-interval (OSPFv3)

This command configures the retransmit interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the

Router ID of the neighbor. The range for <seconds> is 0 to 3600.

Default

Format

Mode

5

area <areaid> virtual-link <neighbor> retransmit-interval

< seconds

>

Router OSPFv3 Config no area virtual-link retransmit-interval (OSPFv3)

This command configures the default retransmit interval for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor.

Format

Mode

no area <areaid> virtual-link <neighbor> retransmit-interval

Router OSPFv3 Config area virtual-link transmit-delay (OSPFv3)

This command configures the transmit delay for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the Router ID of the neighbor. The range for <seconds> is 0 to 3600 (1 hour).

Default 1


Format

Mode

area <areaid> virtual-link <neighbor> transmit-delay



< seconds

> no area virtual-link transmit-delay (OSPFv3)

This command configures the default transmit delay for the OSPF virtual interface on the virtual interface identified by <areaid> and <neighbor> . The <neighbor> parameter is the


Format

Mode

no area <areaid> virtual-link <neighbor> transmit-delay

Router OSPFv3 Config auto-cost (OSPFv3)

By default, OSPF computes the link cost of each interface from the interface bandwidth. Faster links have lower metrics, making them more attractive in route selection. The configuration parameters in the auto-cost reference bandwidth and bandwidth commands give you control over the default link cost. You can configure for OSPF an interface bandwidth that is independent of the actual link speed. A second configuration parameter allows you to control the ratio of interface bandwidth to link cost. The link cost is computed as the ratio of a reference bandwidth to the interface bandwidth (ref_bw / interface bandwidth), where interface bandwidth is defined by the bandwidth command. Because the default reference bandwidth is 100 Mbps,

OSPF uses the same default link cost for all interfaces whose bandwidth is 100 Mbps or greater.

Use the auto-cost command to change the reference bandwidth, specifying the reference bandwidth in megabits per second (Mbps). The reference bandwidth range is 1–4294967 Mbps.

The different reference bandwidth can be independently configured for OSPFv2 and OSPFv3.

Default

Format

Mode

100Mbps auto-cost reference-bandwidth < 1 to 4294967 >

Router OSPFv3 Config no auto-cost reference-bandwidth (OSPFv3)

Use this command to set the reference bandwidth to the default value.



Format

Mode no auto-cost reference-bandwidth

Router OSPFv3 Config clear ipv6 ospf

Use this command to disable and re-enable OSPF.

Format

Mode clear ipv6 ospf

Privileged EXEC clear ipv6 ospf configuration

Use this command to reset the OSPF configuration to factory defaults.

Format

Mode clear ipv6 ospf configuration

Privileged EXEC clear ipv6 ospf counters

Use this command to reset global and interface statistics.

Format

Mode clear ipv6 ospf counters

Privileged EXEC clear ipv6 ospf neighbor

Use this command to drop the adjacency with all OSPF neighbors. On each neighbor’s interface, send a one-way hello. Adjacencies may then be re-established. To drop all adjacencies with a specific router ID, specify the neighbor’s Router ID using the optional parameter [ neighbor-id ].

Format

Mode clear ipv6 ospf neighbor [ neighbor-id ]

Privileged EXEC



clear ipv6 ospf neighbor interface

To drop adjacency with all neighbors on a specific interface, use the optional parameter [ unit/slot/ port ]. To drop adjacency with a specific router ID on a specific interface, use the optional parameter [ neighbor-id ].

Format

Mode clear ipv6 ospf neighbor interface [ unit/slot/port ] [ neighbor-id ]

Privileged EXEC clear ipv6 ospf redistribution

Use this command to flush all self-originated external LSAs. Reapply the redistribution configuration and re-originate prefixes as necessary.

Format

Mode clear ipv6 ospf redistribution

Privileged EXEC default-information originate (OSPFv3)


Default

Format

Mode


• type—2

default-information originate [always] [metric <1-16777214>] [metric- type {1 | 2}]

Router OSPFv3 Config no default-information originate (OSPFv3)


Format

Mode

no default-information originate [metric] [metric-type]




default-metric (OSPFv3)


Format

Mode

default-metric <1-16777214>

Router OSPFv3 Config no default-metric (OSPFv3)


Format


Router OSPFv3 Config distance ospf (OSPFv3)

This command sets the route preference value of OSPF route types in the router. Lower route preference values are preferred when determining the best route. The type of OSPF route can be intra, inter, or external. All the external type routes are given the same preference value. The range of < preference > value is 1 to 255.

Default

Format

Mode

110

distance ospf {intra-area <1-255> | inter-area <1-255> | external <1-

255>}

Router OSPFv3 Config no distance ospf (OSPFv3)

This command sets the default route preference value of OSPF routes in the router. The type of

OSPF route can be intra, inter, or external. All the external type routes are given the same preference value.

Format

Mode

no distance ospf {intra-area | inter-area | external}




enable (OSPFv3)

This command resets the default administrative mode of OSPF in the router (active).

Default

Format

Mode enabled enable

Router OSPFv3 Config no enable (OSPFv3)

This command sets the administrative mode of OSPF in the router to inactive.

Format

Mode no enable

Router OSPFv3 Config exit-overflow-interval (OSPFv3)

This command configures the exit overflow interval for OSPF. It describes the number of seconds after entering Overflow state that a router will wait before attempting to leave the overflow state.

This allows the router to again originate non-default AS-external-LSAs. When set to 0, the router will not leave overflow state until restarted. The range for <seconds> is 0 to 2147483647 seconds.

Default

Format

Mode

0 exit-overflow-interval

< seconds

>

Router OSPFv3 Config no exit-overflow-interval (OSPFv3)

This command configures the default exit overflow interval for OSPF.

Format

Mode no exit-overflow-interval




external-lsdb-limit (OSPFv3)

This command configures the external LSDB limit for OSPF. If the value is –1, then there is no limit. When the number of non-default AS-external-LSAs in a router’s link-state database reaches the external LSDB limit, the router enters overflow state. The router never holds more than the external LSDB limit non-default AS-external-LSAs in it database. The external LSDB limit

MUST be set identically in all routers attached to the OSPF backbone and/or any regular OSPF area. The range for < limit > is –1 to 2147483647.

Default

Format

Mode

-1 external-lsdb-limit

< limit

>

Router OSPFv3 Config no external-lsdb-limit

This command configures the default external LSDB limit for OSPF.

Format

Mode no external-lsdb-limit

Router OSPFv3 Config maximum-paths (OSPFv3)

This command sets the number of paths that OSPF can report for a given destination where maxpaths is platform dependent.

Default

Format

Mode

4

maximum-paths <maxpaths>

Router OSPFv3 Config no maximum-paths

This command resets the number of paths that OSPF can report for a given destination back to its default value.

Format

Mode no maximum-paths




passive-interface default (OSPFv3)

Use this command to enable global passive mode by default for all interfaces. It overrides any interface level passive mode. OSPF shall not form adjacencies over a passive interface.

Default

Format

Mode disabled passive-interface default

Router OSPFv3 Config no passive-interface default (OSPFv3)

Use this command to disable the global passive mode by default for all interfaces. Any interface previously configured to be passive reverts to non-passive mode.

Format

Mode no passive-interface default

Router OSPFv3 Config passive-interface (OSPFv3)

Use this command to set the interface or tunnel as passive. It overrides the global passive mode that is currently effective on the interface or tunnel.

Default

Format

Mode disabled passive-interface {< unit/slot/port > | tunnel < tunnel-id >}

Router OSPFv3 Config no passive-interface (OSPFv3)

Use this command to set the interface or tunnel as non-passive. It overrides the global passive mode that is currently effective on the interface or tunnel.

Format

Mode no passive-interface {< unit/slot/port > | tunnel < tunnel-id >}




redistribute (OSPFv3)

This command configures the OSPFv3 protocol to allow redistribution of routes from the specified source protocol/routers.

Default

Format

Mode


• type—2

• tag—0

redistribute {static | connected} [metric <0-16777214>] [metric-type

{1 | 2}] [tag <0-4294967295>]

Router OSPFv3 Config no redistribute (OSPFv3)

This command configures OSPF protocol to prohibit redistribution of routes from the specified source protocol/routers.

Format

Mode

no redistribute {static | connected} [metric] [metric-type] [tag]

Router OSPFv3 Config router-id (OSPFv3)

This command sets a 4-digit dotted-decimal number uniquely identifying the router ospf id. The

< ipaddress > is a configured value.

Format

Mode router-id <ipaddress>

Router OSPFv3 Config trapflags (OSPFv3)

Use this command to enable individual OSPF traps, enable a group of trap flags at a time, or enable all the trap flags at a time. The different groups of trapflags, and each group’s specific trapflags to enable or disable, are listed in <Cross-Ref>Table 2.



Group errors if-rx lsa overflow retransmit rtb state-change

Table 2: Trapflag Groups (OSPFv3)

Flags

• authentication-failure

• bad-packet

• config-error

• virt-authentication-failure

• virt-bad-packet

• virt-config-error ir-rx-packet

• lsa-maxage

• lsa-originate

• lsdb-overflow

• lsdb-approaching-overflow

• packets

• virt-packets

• rtb-entry-info

• if-state-change

• neighbor-state-change

• virtif-state-change

• virtneighbor-state-change

• To enable the individual flag, enter the group name followed by that particular flag.

• To enable all the flags in that group, give the group name followed by all .

• To enable all the flags, give the command as trapflags all .


7-53


Default

Format

Mode disabled trapflags { all | errors {all | authentication-failure | bad-packet | config-error | virtauthentication-failure | virt-bad-packet | virt-config-error} | if-rx {all | if-rx-packet} | lsa {all | lsa-maxage | lsa-originate} | overflow {all | lsdb-overflow | lsdb-approaching-overflow} | retransmit {all | packets | virt-packets} | rtb {all, rtb-entry-info} | state-change {all | if-state-change | neighbor-state-change | virtifstatechange | virtneighbor-state-change}

}

Router OSPFv3 Config no trapflags (OSPFv3)

Use this command to revert to the default reference bandwidth.

• To disable the individual flag, enter the group name followed by that particular flag.

• To disable all the flags in that group, give the group name followed by all .

• To disable all the flags, give the command as trapflags all .

Format no trapflags { all | errors {all | authentication-failure | bad-packet | config-error | virtauthentication-failure | virt-bad-packet | virt-config-error} | if-rx {all | if-rx-packet} | lsa {all | lsa-maxage | lsa-originate} | overflow {all | lsdb-overflow | lsdb-approaching-overflow} | retransmit {all | packets | virt-packets} | rtb {all, rtb-entry-info} | state-change {all | if-state-change | neighbor-state-change | virtifstatechange | virtneighbor-state-change}

}

Mode Router OSPFv3 Config



show ipv6 ospf

This command displays information relevant to the OSPF router.

Format

Mode show ipv6 ospf

Privileged EXEC

Note: Some of the information below displays only if you enable OSPF and configure certain features.

Term

Router ID

OSPF Admin

Mode

ABR Status

ASBR Status

Stub Router

Exit Overflow

Interval

External LSDB

Overflow

External LSA

Count

External LSA

Checksum

Definition

A 32 bit integer in dotted decimal format identifying the router, about which information is displayed. This is a configured value.

Shows whether the administrative mode of OSPF in the router is enabled or disabled.


Shows whether the router is an OSPF Area Border Router.

Reflects whether the ASBR mode is enabled or disabled. Enable implies that the router is an autonomous system border router. Router automatically becomes an ASBR when it is configured to redistribute routes learnt from other protocol. The possible values for the

ASBR status is enabled (if the router is configured to re-distribute routes learned by other protocols) or disabled (if the router is not configured for the same).

When OSPF runs out of resources to store the entire link state database, or any other state information, OSPF goes into stub router mode. As a stub router, OSPF reoriginates its own router LSAs, setting the cost of all non-stub interfaces to infinity. To restore OSPF to normal operation, disable and re-enable OSPF.


When the number of non-default external LSAs exceeds the configured limit, External

LSDB Limit, OSPF goes into LSDB overflow state. In this state, OSPF withdraws all of its self-originated non-default external LSAs. After the Exit Overflow Interval, OSPF leaves the overflow state, if the number of external LSAs has been reduced.


The sum of the LS checksums of external link-state advertisements contained in the linkstate database.



Term Definition

New LSAs

Originated

The number of new link-state advertisements that have been originated.

LSAs Received The number of link-state advertisements received determined to be new instantiations.

LSA Count The total number of link state advertisements currently in the link state database.

Maximum

Number of

LSAs

The maximum number of LSAs that OSPF can store.

LSA High Water

Mark

The maximum size of the link state database since the system started.

Retransmit List

Entries

The total number of LSAs waiting to be acknowledged by all neighbors. An LSA may be pending acknowledgment from more than one neighbor.

Maximum

Number of

Retransmit

Entries

Retransmit

Entries High

Water Mark

External LSDB

Limit

The maximum number of LSAs that can be waiting for acknowledgment at any given time.

The highest number of LSAs that have been waiting for acknowledgment.

The maximum number of non-default AS-external-LSAs entries that can be stored in the link-state database.

Default Metric Default value for redistributed routes.

Default Passive

Setting

Shows whether the interfaces are passive by default.

Default Route

Advertise

Indicates whether the default routes received from other source protocols are advertised or not.

Always

Metric

Metric Type

Shows whether default routes are always advertised.

The metric for the advertised default routes. If the metric is not configured, this field is blank.


Number of

Active Areas

The number of active OSPF areas. An “active” OSPF area is an area with at least one interface up.

AutoCost Ref

BW

Shows the value of the auto-cost reference bandwidth configured on the router.

Maximum Paths The maximum number of paths that OSPF can report for a given destination.

Redistributing This field is a heading and appears only if you configure the system to take routes learned from a non-OSPF source and advertise them to its peers.



Term Definition

Source

Metric

Shows source protocol/routes that are being redistributed. Possible values are static, connected, BGP, or RIP.

The metric of the routes being redistributed.

Metric Type

Tag


The decimal value attached to each external route.

Subnets For redistributing routes into OSPF, the scope of redistribution for the specified protocol.

Distribute-List The access list used to filter redistributed routes.

show ipv6 ospf abr

This command displays the internal OSPFv3 routes to reach Area Border Routers (ABR). This command takes no options.

Format

Modes show ipv6 ospf abr

• Privileged EXEC

• User EXEC

Term

Type

Router ID

Cost

Area ID

Next Hop

Next Hop Intf

Definition









show ipv6 ospf area

This command displays information about the area. The < areaid > identifies the OSPF area that is being displayed.



Format

Modes

show ipv6 ospf area <areaid>

• Privileged EXEC

• User EXEC

Term Definition

AreaID

External

Routing

Spf Runs


A number representing the external routing capabilities for this area.

The number of times that the intra-area route table has been calculated using this area's link-state database.

The total number of area border routers reachable within this area.

Area Border

Router Count

Area LSA Count Total number of link-state advertisements in this area's link-state database, excluding AS

External LSAs.

Area LSA

Checksum

A number representing the Area LSA Checksum for the specified AreaID excluding the external (LS type 5) link-state advertisements.

Stub Mode Represents whether the specified Area is a stub area or not. The possible values are enabled and disabled. This is a configured value.

Shows whether to import summary LSAs (enabled).

Import

Summary LSAs

OSPF Stub

Metric Value

The metric value of the stub area. This field displays only if the area is a configured as a stub area.

The following OSPF NSSA specific information displays only if the area is configured as an

NSSA.

Term Definition

Import

Summary LSAs

Redistribute into NSSA

Shows whether to import summary LSAs into the NSSA.

Shows whether to redistribute information into the NSSA.

Default

Information

Originate

Shows whether to advertise a default route into the NSSA.

Default Metric The metric value for the default route advertised into the NSSA.



Term Definition

Default Metric

Type

The metric type for the default route advertised into the NSSA.

Translator Role The NSSA translator role of the ABR, which is always or candidate.

Translator

Stability Interval

The amount of time that an elected translator continues to perform its duties after it determines that its translator status has been deposed by another router.

Translator State Shows whether the ABR translator state is disabled, always, or elected.

show ipv6 ospf asbr

This command displays the internal OSPFv3 routes to reach Autonomous System Boundary

Routers (ASBR). This command takes no options.

Format

Modes show ipv6 ospf asbr

• Privileged EXEC

• User EXEC

Term

Type

Router ID

Cost

Area ID

Next Hop

Next Hop Intf

Definition








The outgoing router interface to use when forwarding traffic to the next hop. show ipv6 ospf database

This command displays information about the link state database when OSPFv3 is enabled. If you do not enter any parameters, the command displays the LSA headers for all areas. Use the optional

<areaid> parameter to display database information about a specific area. Use the other optional parameters to specify the type of link state advertisements to display. Use external to display the external LSAs. Use inter-area to display the inter-area LSAs. Use link to



display the link LSAs. Use network to display the network LSAs. Use nssa-external to display

NSSA external LSAs. Use prefix to display intra-area Prefix LSAs. Use router to display router LSAs. Use unknown area , unknown as , or unknown link to display unknown area, AS or link-scope LSAs, respectively. Use <lsid> to specify the link state ID (LSID). Use adv-router to show the LSAs that are restricted by the advertising router. Use selforiginate to display the LSAs in that are self originated. The information below is only displayed if OSPF is enabled.

Format

Modes

show ipv6 ospf [<areaid>] database [{external | inter-area {prefix | router} | link | network | nssa-external | prefix | router | unknown

{area | as | link}}] [<lsid>] [{adv-router [<rtrid>] | selforiginate}]

• Privileged EXEC

• User EXEC

For each link-type and area, the following information is displayed.

Term

Link Id

Adv Router

Age

Sequence

Checksum

Options

Rtr Opt

Definition

A number that uniquely identifies an LSA that a router originates from all other self originated LSAs of the same LS type.

The Advertising Router. Is a 32 bit dotted decimal number representing the LSDB interface.

A number representing the age of the link state advertisement in seconds.

A number that represents which LSA is more recent.

The total number LSA checksum.

An integer indicating that the LSA receives special handling during routing calculations.

Router Options are valid for router links only.

show ipv6 ospf database database-summary

Use this command to display the number of each type of LSA in the database and the total number of LSAs in the database.

Format

Modes show ipv6 ospf database database-summary

• Privileged EXEC

• User EXEC



Term Definition

Router

Network

Total number of router LSAs in the OSPFv3 link state database.

Total number of network LSAs in the OSPFv3 link state database.

Inter-area Prefix Total number of inter-area prefix LSAs in the OSPFv3 link state database.

Inter-area

Router

Total number of inter-area router LSAs in the OSPFv3 link state database.

Type-7 Ext

Link

Total number of NSSA external LSAs in the OSPFv3 link state database.

Total number of link LSAs in the OSPFv3 link state database.

Intra-area Prefix Total number of intra-area prefix LSAs in the OSPFv3 link state database.

Link Unknown Total number of link-source unknown LSAs in the OSPFv3 link state database.

Area Unknown Total number of area unknown LSAs in the OSPFv3 link state database.

AS Unknown Total number of as unknown LSAs in the OSPFv3 link state database.

Type-5 Ext

Self-Originated

Type-5

Total

Total number of AS external LSAs in the OSPFv3 link state database.

Total number of self originated AS external LSAs in the OSPFv3 link state database.

Total number of router LSAs in the OSPFv3 link state database. show ipv6 ospf interface

This command displays the information for the IFO object or virtual interface tables.

Format

Modes

show ipv6 ospf interface {<unit/slot/port> | loopback <loopback-id> | tunnel <tunnel-id>}

• Privileged EXEC

• User EXEC

Term Definition

IPv6 Address The IPv6 address of the interface.

ifIndex

OSPF Admin

Mode

The interface index number associated with the interface.

Shows whether the admin mode is enabled or disabled.

OSPF Area ID The area ID associated with this interface.

Router Priority The router priority. The router priority determines which router is the designated router.



Term Definition

Retransmit

Interval

Hello Interval

Dead Interval

LSA Ack

Interval

Iftransit Delay

Interval

The frequency, in seconds, at which the interface sends LSA.

The frequency, in seconds, at which the interface sends Hello packets.

The amount of time, in seconds, the interface waits before assuming a neighbor is down.

The amount of time, in seconds, the interface waits before sending an LSA acknowledgement after receiving an LSA.

The number of seconds the interface adds to the age of LSA packets before transmission.

Authentication

Type

The type of authentication the interface performs on LSAs it receives.

Metric Cost The priority of the path. Low costs have a higher priority than high costs.

Passive Status Shows whether the interface is passive or not.

OSPF MTUignore

Shows whether to ignore MTU mismatches in database descriptor packets sent from neighboring routers.

The following information only displays if OSPF is initialized on the interface:

Term Definition

OSPF Interface

Type

Broadcast LANs, such as Ethernet and IEEE 802.5, take the value broadcast . The OSPF

Interface Type will be 'broadcast'.

State The OSPF Interface States are: down, loopback, waiting, point-to-point, designated router, and backup designated router.

The router ID representing the designated router.

Designated

Router

Backup

Designated

Router

The router ID representing the backup designated router.

Number of Link

Events

The number of link events.

Metric Cost The cost of the OSPF interface.

show ipv6 ospf interface brief

This command displays brief information for the IFO object or virtual interface tables.



Format

Modes show ipv6 ospf interface brief

• Privileged EXEC

• User EXEC

Term Definition

Interface

Admin Mode



Area ID The OSPF Area ID for the specified interface.

Router Priority The router priority. The router priority determines which router is the designated router.

Hello Interval

Dead Interval

Retransmit

Interval

Retransmit

Delay Interval

LSA Ack

Interval

The frequency, in seconds, at which the interface sends Hello packets.

The amount of time, in seconds, the interface waits before assuming a neighbor is down.

The frequency, in seconds, at which the interface sends LSA.

The number of seconds the interface adds to the age of LSA packets before transmission.

The amount of time, in seconds, the interface waits before sending an LSA acknowledgement after receiving an LSA.

show ipv6 ospf interface stats

This command displays the statistics for a specific interface. The command only displays information if OSPF is enabled.

Format

Modes

show ipv6 ospf interface stats <unit/slot/port>

• Privileged EXEC

• User EXEC

Term Definition

OSPFv3 Area ID The area id of this OSPF interface.

IPv6 Address The IP address associated with this OSPF interface.

OSPFv3

Interface Events

The number of times the specified OSPF interface has changed its state, or an error has occurred.



Term Definition

Virtual Events The number of state changes or errors that occurred on this virtual link.

Neighbor

Events

The number of times this neighbor relationship has changed state, or an error has occurred.

Packets

Received

The number of OSPFv3 packets received on the interface.

Packets

Transmitted

LSAs Sent

The number of OSPFv3 packets sent on the interface.

LSA Acks

Received

The total number of LSAs flooded on the interface.

The total number of LSA acknowledged from this interface.

LSA Acks Sent The total number of LSAs acknowledged to this interface.

Sent Packets The number of OSPF packets transmitted on the interface.

The number of valid OSPF packets received on the interface.

Received

Packets

Discards

Bad Version

The number of received OSPF packets discarded because of an error in the packet or an error in processing the packet.

The number of received OSPF packets whose version field in the OSPF header does not match the version of the OSPF process handling the packet.

Virtual Link Not

Found

The number of received OSPF packets discarded where the ingress interface is in a nonbackbone area and the OSPF header identifies the packet as belonging to the backbone, but OSPF does not have a virtual link to the packet’s sender.

Area Mismatch The number of OSPF packets discarded because the area ID in the OSPF header is not the area ID configured on the ingress interface.

Invalid

Destination

Address

The number of OSPF packets discarded because the packet’s destination IP address is not the address of the ingress interface and is not the AllDrRouters or AllSpfRouters multicast addresses.

No Neighbor at

Source Address

The number of OSPF packets dropped because the sender is not an existing neighbor or the sender’s IP address does not match the previously recorded IP address for that neighbor. NOTE: Does not apply to Hellos.

Invalid OSPF

Packet Type

The number of OSPF packets discarded because the packet type field in the OSPF header is not a known type.

Hellos Ignored The number of received Hello packets that were ignored by this router from the new neighbors after the limit has been reached for the number of neighbors on an interface or on the system as a whole.

See “show ip ospf interface stats” on page 4-75 for a sample output of the number of OSPF packets of each type sent and received on the interface.



show ipv6 ospf neighbor

This command displays information about OSPF neighbors. If you do not specify a neighbor IP address, the output displays summary information in a table. If you specify an interface or tunnel, only the information for that interface or tunnel displays. The <ip-address> is the IP address of the neighbor, and when you specify this, detailed information about the neighbor displays. The information below only displays if OSPF is enabled and the interface has a neighbor.

Format

Modes

show ipv6 ospf neighbor [interface {<unit/slot/port> | tunnel

<tunnel_id>}][<ip-address>]

• Privileged EXEC

• User EXEC

If you do not specify an IP address, a table with the following columns displays for all neighbors or the neighbor associated with the interface that you specify:

Term

Router ID

Priority

Intf ID

Interface

State

Dead Time

IPv6 Commands

Definition

The 4-digit dotted-decimal number of the neighbor router.

The OSPF priority for the specified interface. The priority of an interface is a priority integer from 0 to 255. A value of '0' indicates that the router is not eligible to become the designated router on this network.

The interface ID of the neighbor.


The state of the neighboring routers. Possible values are:

• Down- initial state of the neighbor conversation - no recent information has been received from the neighbor.

• Attempt - no recent information has been received from the neighbor but a more concerted effort should be made to contact the neighbor.

• Init - an Hello packet has recently been seen from the neighbor, but bidirectional communication has not yet been established.

• 2 way - communication between the two routers is bidirectional.

• Exchange start - the first step in creating an adjacency between the two neighboring routers, the goal is to decide which router is the master and to decide upon the initial

DD sequence number.

• Exchange - the router is describing its entire link state database by sending Database

Description packets to the neighbor.

• Full - the neighboring routers are fully adjacent and they will now appear in router-LSAs and network-LSAs.

The amount of time, in seconds, to wait before the router assumes the neighbor is unreachable.

7-65 v1.0, July 2009


If you specify an IP address for the neighbor router, the following fields display:

Term Definition

Interface

Area ID


The area ID associated with the interface.

Options An integer value that indicates the optional OSPF capabilities supported by the neighbor.

These are listed in its Hello packets. This enables received Hello Packets to be rejected

(i.e., neighbor relationships will not even start to form) if there is a mismatch in certain crucial OSPF capabilities.

Router Priority The router priority for the specified interface.

Dead Timer Due The amount of time, in seconds, to wait before the router assumes the neighbor is unreachable.

State

Events

The state of the neighboring routers.

Number of times this neighbor relationship has changed state, or an error has occurred.

Retransmission

Queue Length

An integer representing the current length of the retransmission queue of the specified neighbor router Id of the specified interface.

show ipv6 ospf range

This command displays information about the area ranges for the specified < areaid > . The

< areaid > identifies the OSPF area whose ranges are being displayed.

Format

Modes

show ipv6 ospf range <areaid>

• Privileged EXEC

• User EXEC

Term Definition

Area ID The area id of the requested OSPF area.

IP Address

Lsdb Type

An IP address which represents this area range.

The type of link advertisement associated with this area range.

Advertisement The status of the advertisement: enabled or disabled.



show ipv6 ospf stub table

This command displays the OSPF stub table. The information below will only be displayed if

OSPF is initialized on the switch.

Format

Modes show ipv6 ospf stub table

• Privileged EXEC

• User EXEC

Term Definition

Area ID A 32-bit identifier for the created stub area.

Type of Service Type of service associated with the stub metric. For this release, Normal TOS is the only supported type.

Metric Val The metric value is applied based on the TOS. It defaults to the least metric of the type of service among the interfaces to other areas. The OSPF cost for a route is a function of the metric value.

Import

Summary LSA

Controls the import of summary LSAs into stub areas.

show ipv6 ospf virtual-link

This command displays the OSPF Virtual Interface information for a specific area and neighbor.

The < areaid > parameter identifies the area and the < neighbor > parameter identifies the neighbor’s Router ID.

Format

Modes

show ipv6 ospf virtual-link <areaid> <neighbor>

• Privileged EXEC

• User EXEC

Term

Area ID

Neighbor

Router ID

Hello Interval

Definition


The input neighbor Router ID.

The configured hello interval for the OSPF virtual interface.


7-67


Term Definition

Dead Interval

Iftransit Delay

Interval

The configured dead interval for the OSPF virtual interface.


Retransmit

Interval

Authentication

Type

State


The type of authentication the interface performs on LSAs it receives.

The OSPF Interface States are: down, loopback, waiting, point-to-point, designated router, and backup designated router. This is the state of the OSPF interface.

Neighbor State The neighbor state.

show ipv6 ospf virtual-link brief

This command displays the OSPFV3 Virtual Interface information for all areas in the system.

Format

Modes show ipv6 ospf virtual-link brief

• Privileged EXEC

• User EXEC

Term

Area ID

Neighbor

Hello Interval

Dead Interval

Retransmit

Interval

Transit Delay

Definition

The area id of the requested OSPFV3 area.

The neighbor interface of the OSPFV3 virtual interface.

The configured hello interval for the OSPFV3 virtual interface.

The configured dead interval for the OSPFV3 virtual interface.

The configured retransmit interval for the OSPFV3 virtual interface.

The configured transit delay for the OSPFV3 virtual interface.

DHCPv6 Commands

This section describes the command you use to configure the DHCPv6 server on the system and to view DHCPv6 information.



service dhcpv6

This command enables DHCPv6 configuration on the router.

Default

Format

Mode disabled service dhcpv6

Global Config no service dhcpv6

This command disables DHCPv6 configuration on router.

Format

Mode no service dhcpv6

Global Config ipv6 dhcp server

Use this command to configure DHCPv6 server functionality on an interface. The <poolname> is the DHCPv6 pool containing stateless and/or prefix delegation parameters, rapidcommit is an option that allows for an abbreviated exchange between the client and server, and

<pref-value> is a value used by clients to determine preference between multiple DHCPv6 servers. For a particular interface DHCPv6 server and DHCPv6 relay functions are mutually exclusive.

Format

Mode

ipv6 dhcp server <pool-name> [rapid-commit] [preference <pref-value>]

Interface Config ipv6 dhcp relay destination

Use this command to configure an interface for DHCPv6 relay functionality. Use the destination keyword to set the relay server IPv6 address. The <relay-address> parameter is an IPv6 address of a DHCPv6 relay server. Use the interface keyword to set the relay server interface. The <relay-interface> parameter is an interface (unit/slot/port) to reach a relay server. The optional remote-id is the Relay Agent Information Option “remote

ID” sub-option to be added to relayed messages.This can either be the special keyword duidifid , which causes the “remote ID” to be derived from the DHCPv6 server DUID and the relay interface number, or it can be specified as a user-defined string.



Note: If <relay-address> is an IPv6 global address, then <relay-interface> is not required. If <relay-address> is a link-local or multicast address, then <relayinterface> is required. Finally, if you do not specify a value for <relay-address> , then you must specify a value for <relay-interface> and the DHCPV6-ALL-

AGENTS multicast address (i.e. FF02::1:2) is used to relay DHCPv6 messages to the relay server.

Format

Mode

ipv6 dhcp relay {destination [<relay-address>] interface [<relay- interface>]| interface [<relay-interface>]} [remote-id (duid-ifid |

<user-defined-string>)]

Interface Config ipv6 dhcp relay-agent-info-opt

Use this command to configure a number to represent the DHCPv6 Relay Agent Information

Option. The DHCPv6 Relay Agent Information Option allows for various sub-options to be attached to messages that are being relayed by the local router to a relay server. The relay server may in turn use this information in determining an address to assign to a DHCPv6 client.

Default

Format

Mode

32 ipv6 dhcp relay-agent-info-opt <32-65535>

Global Config ipv6 dhcp relay-agent-info-remote-id-subopt

Use this command to configure a number to represent the DHCPv6 the “remote-id” sub-option.

Default

Format

Mode

1

ipv6 dhcp relay-agent-info-remote-id-subopt <1-65535>

Global Config



ipv6 dhcp pool

Use this command from Global Config mode to enter IPv6 DHCP Pool Config mode. Use the exit command to return to Global Config mode. To return to the User EXEC mode, enter

CTRL+Z. The <pool-name> should be less than 31 alpha-numeric characters. DHCPv6 pools are used to specify information for DHCPv6 server to distribute to DHCPv6 clients. These pools are shared between multiple interfaces over which DHCPv6 server capabilities are configured.

Format

Mode

ipv6 dhcp pool <pool-name>

Global Config no ipv6 dhcp pool

This command removes the specified DHCPv6 pool.

Format

Mode

no ipv6 dhcp pool <pool-name>

Global Config domain-name (IPv6)

This command sets the DNS domain name which is provided to DHCPv6 client by DHCPv6 server. DNS domain name is configured for stateless server support. Domain name consist of no more than 31 alpha-numeric characters. DHCPv6 pool can have multiple number of domain names with maximum of 8.

no domain-name

Format

Mode

domain-name <dns-domain-name>

IPv6 DHCP Pool Config

This command will remove dhcpv6 domain name from dhcpv6 pool.

Format

Mode

no domain-name <dns-domain-name>




dns-server (IPv6)

This command sets the ipv6 DNS server address which is provided to dhcpv6 client by dhcpv6 server. DNS server address is configured for stateless server support. DHCPv6 pool can have multiple number of domain names with maximum of 8.

Format

Mode

dns-server <dns-server-address>

IPv6 DHCP Pool Config no dns-server

This command will remove DHCPv6 server address from DHCPv6 server.

Format

Mode

no dns-server <dns-server-address>

IPv6 DHCP Pool Config prefix-delegation (IPv6)

Multiple IPv6 prefixes can be defined within a pool for distributing to specific DHCPv6 Prefix delegation clients. Prefix is the delegated IPv6 prefix. DUID is the client's unique DUID value

(Example: 00:01:00:09:f8:79:4e:00:04:76:73:43:76'). Name is 31 characters textual client’s name which is useful for logging or tracing only. Valid lifetime is the valid lifetime for the delegated prefix in seconds and preferred lifetime is the preferred lifetime for the delegated prefix in seconds.

Default

Format

Mode

• valid-lifetime—2592000

• preferred-lifetime—604800 prefix-delegation <prefix/prefixlength> <DUID> [name <hostname>]

[valid-lifetime <0-4294967295>][preferred-lifetime < 0-4294967295>]

IPv6 DHCP Pool Config no prefix-delegation

This command deletes a specific prefix-delegation client.

Format

Mode no prefix-delegation


IPv6 Commands

<prefix/prefix-delegation> <DUID> v1.0, July 2009

7-72


show ipv6 dhcp

This command displays the DHCPv6 server name and status.

Format

Mode show ipv6 dhcp

Privileged EXEC

Term

DHCPv6 is

Enabled

(Disabled)

Server DUID

Definition

The status of the DHCPv6 server.

If configured, shows the DHCPv6 unique identifier.

show ipv6 dhcp statistics

This command displays the IPv6 DHCP statistics for all interfaces.

Format

Mode show ipv6 dhcp statistics

Privileged EXEC

Term

DHCPv6 Solicit Packets

Received

DHCPv6 Request Packets

Received

DHCPv6 Confirm Packets

Received

DHCPv6 Renew Packets

Received

DHCPv6 Rebind Packets

Received

DHCPv6 Release Packets

Received

DHCPv6 Decline Packets

Received

Definition

Number of solicit received statistics.

Number of request received statistics.

Number of confirm received statistics.

Number of renew received statistics.

Number of rebind received statistics.

Number of release received statistics.

Number of decline received statistics.


7-73


Term Definition

DHCPv6 Inform Packets

Received

DHCPv6 Relay-forward

Packets Received

DHCPv6 Advertisement

Packets Transmitted

DHCPv6 Reply Packets

Transmitted

Number of inform received statistics.

Number of relay forward received statistics.

DHCPv6 Relay-reply Packets

Received

Number of relay-reply received statistics.

DHCPv6 Malformed Packets

Received

Number of malformed packets statistics.

Number of DHCP discarded statistics.

Received DHCPv6 Packets

Discarded

Total DHCPv6 Packets

Received

Total number of DHCPv6 received statistics

Number of advertise sent statistics.

Number of reply sent statistics.

DHCPv6 Reconfig Packets

Transmitted

Number of reconfigure sent statistics.

DHCPv6 Relay-reply Packets

Transmitted

Number of relay-reply sent statistics.

Number of relay-forward sent statistics.

DHCPv6 Relay-forward

Packets Transmitted

Total DHCPv6 Packets

Transmitted

Total number of DHCPv6 sent statistics.

show ipv6 dhcp interface

This command displays DHCPv6 information for all relevant interfaces or the specified interface.

If you specify an interface, you can use the optional statistics parameter to view statistics for the specified interface.

Format

Mode

show ipv6 dhcp interface <unit/slot/port> [statistics]

Privileged EXEC

Term Definition

IPv6 Interface The interface name in <unit/slot/port> format.


7-74


Term

Mode

Definition

Shows whether the interface is a IPv6 DHCP relay or server.

If the interface mode is server, the following information displays.

Term

Pool Name

Server

Preference

Option Flags

Definition

The pool name specifying information for DHCPv6 server distribution to DHCPv6 clients.

The preference of the server.

Shows whether rapid commit is enabled.

If the interface mode is relay, the following information displays.

Term Definition

Relay Address The IPv6 address of the relay server.

Relay Interface

Number

The relay server interface in <unit/slot/port> format.

If configured, shows the name of the relay remote.

Relay Remote

ID

Option Flags Shows whether rapid commit is configured.

If you use the statistics parameter, the command displays the IPv6 DHCP statistics for the specified interface. See “show ipv6 dhcp statistics” on page 7-73 for information about the output.

clear ipv6 dhcp

Use this command to clear DHCPv6 statistics for all interfaces or for a specific interface. Use the

<unit/slot/port> parameter to specify the interface.

Format

Mode

clear ipv6 dhcp {statistics | interface <unit/slot/port> statistics}

Privileged EXEC



show ipv6 dhcp pool

This command displays configured DHCP pool.

Format

Mode show ipv6 dhcp pool <pool-name>

Privileged EXEC

Term Definition

DHCP Pool

Name

Client DUID

Unique pool name configuration.

Client’s DHCP unique identifier. DUID is generated using the combination of the local system burned-in MAC address and a timestamp value.

Host

Prefix/Prefix

Length

Name of the client.

IPv6 address and mask length for delegated prefix.

Preferred

Lifetime

Preferred lifetime in seconds for delegated prefix.

Valid Lifetime Valid lifetime in seconds for delegated prefix.

DNS Server

Address

Address of DNS server address.

Domain Name DNS domain name.

show ipv6 dhcp binding

This command displays configured DHCP pool.

Format

Mode show ipv6 dhcp binding [<ipv6-address>]

Privileged EXEC

Term

DHCP Client

Address

DUID

IAID

Prefix/Prefix

Length

IPv6 Commands

Definition

Address of DHCP Client.

String that represents the Client DUID.

Identity Association ID.

IPv6 address and mask length for delegated prefix.

v1.0, July 2009

7-76


Term Definition

Prefix Type IPV6 Prefix type (IAPD, IANA, or IATA).

Client Address Address of DHCP Client.

Client Interface IPv6 Address of DHCP Client.

Expiration Address of DNS server address.

Valid Lifetime Valid lifetime in seconds for delegated prefix.

Preferred

Lifetime

Preferred lifetime in seconds for delegated prefix.


7-77

Chapter 8

Quality of Service (QoS) Commands

This chapter describes the Quality of Service (QoS) commands available in the managed switch

CLI.

The QoS Commands chapter contains the following sections:

• “Class of Service (CoS) Commands” on page 8-2

• “Differentiated Services (DiffServ) Commands” on page 8-8

• “DiffServ Class Commands” on page 8-10

• “DiffServ Policy Commands” on page 8-19

• “DiffServ Service Commands” on page 8-25

• “DiffServ Show Commands” on page 8-26

• “MAC Access Control List (ACL) Commands” on page 8-32

• “IP Access Control List (ACL) Commands” on page 8-37

• “IPv6 Access Control List (ACL) Commands” on page 8-44

• “Auto-Voice over IP Commands” on page 8-48

Note: The commands in this chapter are in one of two functional groups:



8-1 v1.0, July 2009

Class of Service (CoS) Commands


This section describes the commands you use to configure and view Class of Service (CoS) settings for the switch. The commands in this section allow you to control the priority and transmission rate of traffic.

Note: Commands you issue in the Interface Config mode only affect a single interface.

Commands you issue in the Global Config mode affect all interfaces.

classofservice dot1p-mapping

This command maps an 802.1p priority to an internal traffic class. The <userpriority> values can range from 0-7. The <trafficclass> values range from 0-6, although the actual number of available traffic classes depends on the platform. For more information about 802.1p priority, see “Voice VLAN Commands” on page 3-48

.

Format

Modes

classofservice dot1p-mapping <userpriority> <trafficclass>

• Global Config

• Interface Config no classofservice dot1p-mapping

This command maps each 802.1p priority to its default internal traffic class value.

Format

Modes no classofservice dot1p-mapping

• Global Config

• Interface Config classofservice ip-dscp-mapping

This command maps an IP DSCP value to an internal traffic class. The <ipdscp> value is specified as either an integer from 0 to 63, or symbolically through one of the following keywords: af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef.

Quality of Service (QoS) Commands v1.0, July 2009

8-2


The <trafficclass> values can range from 0-6, although the actual number of available traffic classes depends on the platform.

Format

Mode

classofservice ip-dscp-mapping <ipdscp> <trafficclass>

Global Config no classofservice ip-dscp-mapping

This command maps each IP DSCP value to its default internal traffic class value.

Format

Mode no classofservice ip-dscp-mapping

Global Config classofservice trust

This command sets the class of service trust mode of an interface. You can set the mode to trust one of the Dot1p (802.1p), IP DSCP, or IP Precedence packet markings. You can also set the interface mode to untrusted. If you configure an interface to use Dot1p, the mode does not appear in the output of the show running config command because Dot1p is the default.

Note: The classofservice trust dot1p command will not be supported in future releases of the software because Dot1p is the default value. Use the no classofservice trust command to set the mode to the default value.

Default

Format

Modes dot1p

classofservice trust {dot1p | ip-dscp | ip-precedence | untrusted}

• Global Config

• Interface Config no classofservice trust

This command sets the interface mode to the default value.

Format

Modes no classofservice trust

• Global Config



8-3


cos-queue min-bandwidth

This command specifies the minimum transmission bandwidth guarantee for each interface queue.

The total number of queues supported per interface is platform specific. A value from 0-100

(percentage of link rate) must be specified for each supported queue, with 0 indicating no guaranteed minimum bandwidth. The sum of all values entered must not exceed 100.

Format

Modes

cos-queue min-bandwidth <bw-0> <bw-1> … <bw-n>

• Global Config

• Interface Config no cos-queue min-bandwidth

This command restores the default for each queue's minimum bandwidth value.

Format

Modes no cos-queue min-bandwidth

• Global Config

• Interface Config cos-queue strict

This command activates the strict priority scheduler mode for each specified queue.

Format

Modes

cos-queue strict <queue-id-1> [<queue-id-2> … <queue-id-n>]

• Global Config

• Interface Config no cos-queue strict

This command restores the default weighted scheduler mode for each specified queue.

Format

Modes

no cos-queue strict <queue-id-1> [<queue-id-2> … <queue-id-n>]

• Global Config



8-4


traffic-shape

This command specifies the maximum transmission bandwidth limit for the interface as a whole.

Also known as rate shaping, traffic shaping has the effect of smoothing temporary traffic bursts over time so that the transmitted traffic rate is bounded.

Format

Modes

traffic-shape <bw>

• Global Config

• Interface Config no traffic-shape

This command restores the interface shaping rate to the default value.

Format

Modes no traffic-shape

• Global Config

• Interface Config show classofservice dot1p-mapping

This command displays the current Dot1p (802.1p) priority mapping to internal traffic classes for a specific interface. The <unit/slot/port> parameter is optional and is only valid on platforms that support independent per-port class of service mappings. If specified, the 802.1p mapping table of the interface is displayed. If omitted, the most recent global configuration settings are displayed. For more information, see “Voice VLAN Commands” on page 3-48

.

Format

Mode

show classofservice dot1p-mapping [<unit/slot/port>]

Privileged EXEC

The following information is repeated for each user priority.

Term

User Priority

Traffic Class

Definition

The 802.1p user priority value.

The traffic class internal queue identifier to which the user priority value is mapped.


8-5


show classofservice ip-precedence-mapping

This command displays the current IP Precedence mapping to internal traffic classes for a specific interface. The unit/slot/port parameter is optional and is only valid on platforms that support independent per-port class of service mappings. If specified, the IP Precedence mapping table of the interface is displayed. If omitted, the most recent global configuration settings are displayed.

Format

Mode

show classofservice ip-precedence-mapping [<unit/slot/port>]

Privileged EXEC


Term Definition

IP Precedence The IP Precedence value.

Traffic Class The traffic class internal queue identifier to which the IP Precedence value is mapped.

show classofservice ip-dscp-mapping

This command displays the current IP DSCP mapping to internal traffic classes for the global configuration settings.

Format

Mode show classofservice ip-dscp-mapping

Privileged EXEC


Term

IP DSCP

Traffic Class

Definition

The IP DSCP value.

The traffic class internal queue identifier to which the IP DSCP value is mapped.


8-6


show classofservice trust

This command displays the current trust mode setting for a specific interface. The <unit/slot/ port> parameter is optional and is only valid on platforms that support independent per-port class of service mappings. If you specify an interface, the command displays the port trust mode of the interface. If you do not specify an interface, the command displays the most recent global configuration settings.

Format

Mode

show classofservice trust [<unit/slot/port>]

Privileged EXEC

Term Definition

Non-IP Traffic

Class

The traffic class used for non-IP traffic. This is only displayed when the COS trust mode is set to trust IP Precedence or IP DSCP (on platforms that support IP DSCP).

Untrusted Traffic

Class

The traffic class used for all untrusted traffic. This is only displayed when the COS trust mode is set to 'untrusted'.

show interfaces cos-queue

This command displays the class-of-service queue configuration for the specified interface. The unit/slot/port parameter is optional and is only valid on platforms that support independent perport class of service mappings. If specified, the class-of-service queue configuration of the interface is displayed. If omitted, the most recent global configuration settings are displayed.

Format

Mode

show interfaces cos-queue [<unit/slot/port>]

Privileged EXEC

Term Definition

Queue Id

Minimum

Bandwidth

An interface supports n queues numbered 0 to (n-1). The specific n value is platform dependent.

The minimum transmission bandwidth guarantee for the queue, expressed as a percentage. A value of 0 means bandwidth is not guaranteed and the queue operates using best-effort. This is a configured value.

Scheduler Type Indicates whether this queue is scheduled for transmission using a strict priority or a weighted scheme. This is a configured value.

Queue

Management

Type

The queue depth management technique used for this queue (tail drop).

Quality of Service (QoS) Commands 8-7 v1.0, July 2009


If you specify the interface, the command also displays the following information.

Term

Interface

Interface

Shaping Rate

Definition

The unit/slot/port of the interface. If displaying the global configuration, this output line is replaced with a Global Config indication.

The maximum transmission bandwidth limit for the interface as a whole. It is independent of any per-queue maximum bandwidth value(s) in effect for the interface. This is a configured value.

Differentiated Services (DiffServ) Commands

This section describes the commands you use to configure QOS Differentiated Services

(DiffServ).

You configure DiffServ in several stages by specifying three DiffServ components:

1.

Class a.

Creating and deleting classes.

b.

Defining match criteria for a class.

2.

Policy a.

Creating and deleting policies b.

Associating classes with a policy c.

Defining policy statements for a policy/class combination

3.

Service a.

Adding and removing a policy to/from an inbound interface

The DiffServ class defines the packet filtering criteria. The attributes of a DiffServ policy define the way the switch processes packets. You can define policy attributes on a per-class instance basis. The switch applies these attributes when a match occurs.

Packet processing begins when the switch tests the match criteria for a packet. The switch applies a policy to a packet when it finds a class match within that policy.

The following rules apply when you create a DiffServ class:

• Each class can contain a maximum of one referenced (nested) class

• Class definitions do not support hierarchical service policies



A given class definition can contain a maximum of one reference to another class. You can combine the reference with other match criteria. The referenced class is truly a reference and not a copy since additions to a referenced class affect all classes that reference it. Changes to any class definition currently referenced by any other class must result in valid class definitions for all derived classes, otherwise the switch rejects the change. You can remove a class reference from a class definition.

The only way to remove an individual match criterion from an existing class definition is to delete the class and re-create it.

Note: The mark possibilities for policing include CoS, IP DSCP, and IP Precedence.

While the latter two are only meaningful for IP packet types, CoS marking is allowed for both IP and non-IP packets, since it updates the 802.1p user priority field contained in the VLAN tag of the layer 2 packet header.

diffserv

This command sets the DiffServ operational mode to active. While disabled, the DiffServ configuration is retained and can be changed, but it is not activated. When enabled, DiffServ services are activated.

Format

Mode diffserv

Global Config no diffserv

This command sets the DiffServ operational mode to inactive. While disabled, the DiffServ configuration is retained and can be changed, but it is not activated. When enabled, DiffServ services are activated.

Format

Mode no diffserv

Global Config


8-9


DiffServ Class Commands

Use the DiffServ class commands to define traffic classification. To classify traffic, you specify

Behavior Aggregate (BA), based on DSCP and Multi-Field (MF) classes of traffic (name, match criteria)

This set of commands consists of class creation/deletion and matching, with the class match commands specifying Layer 3, Layer 2, and general match criteria. The class match criteria are also known as class rules, with a class definition consisting of one or more rules to identify the traffic that belongs to the class.

Note: Once you create a class match criterion for a class, you cannot change or delete the criterion. To change or delete a class match criterion, you must delete and re-create the entire class.

The CLI command root is class-map .

class-map

This command defines a DiffServ class of type match-all. When used without any match condition, this command enters the class-map mode. The <class-map-name> is a case sensitive alphanumeric string from 1 to 31 characters uniquely identifying an existing DiffServ class.

Note: The class-map-name 'default' is reserved and must not be used.

The class type of match-all indicates all of the individual match conditions must be true for a packet to be considered a member of the class.This command may be used without specifying a class type to enter the Class-Map Config mode for an existing DiffServ class.

Note: The optional keywords [{ipv4 | ipv6}] specify the Layer 3 protocol for this class. If not specified, this parameter defaults to ‘ipv4’ . This maintains backward compatibility for configurations defined on systems before IPv6 match items were supported.


8-10


Format

Mode

Note: The CLI mode is changed to Class-Map Config or Ipv6-Class-Map Config when this command is successfully executed depending on the [{ipv4 | ipv6}] keyword specified.

class-map match-all <class-map-name> [{ipv4 | ipv6}]

Global Config no class-map

This command eliminates an existing DiffServ class. The <class-map-name> is the name of an existing DiffServ class. (The class name ‘default’ is reserved and is not allowed here.) This command may be issued at any time; if the class is currently referenced by one or more policies or by any other class, the delete action fails.

Format

Mode

no class-map <class-map-name>

Global Config class-map rename

This command changes the name of a DiffServ class. The <class-map-name> is the name of an existing DiffServ class. The <new-class-map-name> parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the class.

Default

Format

Mode none

class-map rename <class-map-name> <new-class-map-name>

Global Config


8-11


match ethertype

This command adds to the specified class definition a match condition based on the value of the ethertype. The <ethertype> value is specified as one of the following keywords: appletalk , arp , ibmsna , ipv4 , ipv6 , ipx , mplsmcast , mplsucast , netbios , novell , pppoe , rarp or as a custom ethertype value in the range of 0x0600-0xFFFF.

Format

Mode

match ethertype {<keyword> | custom <0x0600-0xFFFF>}

Class-Map Config

Ipv6-Class-Map Config match any

This command adds to the specified class definition a match condition whereby all packets are considered to belong to the class.

Default

Format

Mode none match any

Class-Map Config

Ipv6-Class-Map Config match class-map

This command adds to the specified class definition the set of match conditions defined for another class. The <refclassname> is the name of an existing DiffServ class whose match conditions are being referenced by the specified class definition.

Default

Format

Mode none

match class-map <refclassname>

Class-Map Config

Ipv6-Class-Map Config


8-12


Note:

• The parameters <refclassname> and <class-map-name> can not be the same.

• Only one other class may be referenced by a class.

• Any attempts to delete the <refclassname> class while the class is still referenced by any <classmap-name> fails.

• The combined match criteria of <class-map-name> and <refclassname> must be an allowed combination based on the class type.

• Any subsequent changes to the <refclassname> class match criteria must maintain this validity, or the change attempt fails.

• The total number of class rules formed by the complete reference class chain (including both predecessor and successor classes) must not exceed a platform-specific maximum. In some cases, each removal of a refclass rule reduces the maximum number of available rules in the class definition by one.

no match class-map

This command removes from the specified class definition the set of match conditions defined for another class. The <refclassname> is the name of an existing DiffServ class whose match conditions are being referenced by the specified class definition.

Format

Mode

no match class-map <refclassname>

Class-Map Config

Ipv6-Class-Map Config match cos

This command adds to the specified class definition a match condition for the Class of Service value (the only tag in a single tagged packet or the first or outer 802.1Q tag of a double VLAN tagged packet). The value may be from 0 to 7.

Default

Format

Mode none

match cos <0-7>

Class-Map Config



8-13


match ip6flowlbl

This command adds to the specified class definition a match condition based on the IP6flowlbl of a packet. The label is the value to match in the Flow Label field of the IPv6 header (range 0-

1048575).

Format

Mode match ip6flowlbl < label >

Ipv6-Class-Map Configuration mode match destination-address mac

This command adds to the specified class definition a match condition based on the destination

MAC address of a packet. The <macaddr> parameter is any layer 2 MAC address formatted as six, two-digit hexadecimal numbers separated by colons (e.g., 00:11:22:dd:ee:ff). The

<macmask > parameter is a layer 2 MAC address bit mask, which need not be contiguous, and is formatted as six, two-digit hexadecimal numbers separated by colons (e.g., ff:07:23:ff:fe:dc).

Note: This command is not available on the GSM73xxSv1 platform.

Default

Format

Mode none

match destination-address mac <macaddr> <macmask>

Class-Map Config

Ipv6-Class-Map Config match dstip

This command adds to the specified class definition a match condition based on the destination IP address of a packet. The <ipaddr> parameter specifies an IP address. The <ipmask> parameter specifies an IP address bit mask and must consist of a contiguous set of leading 1 bits.

Default

Format

Mode none

match dstip <ipaddr> <ipmask>

Class-Map Config


8-14


match dstip6

This command adds to the specified class definition a match condition based on the destination

IPv6 address of a packet.

Default

Format

Mode none

match dstip6 <destination-ipv6-prefix/prefix-length>

Ipv6-Class-Map Config match dstl4port

This command adds to the specified class definition a match condition based on the destination layer 4 port of a packet using a single keyword or numeric notation. To specify the match condition as a single keyword, the value for <portkey> is one of the supported port name keywords. The currently supported <portkey> values are: domain, echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp, www. Each of these translates into its equivalent port number. To specify the match condition using a numeric notation, one layer 4 port number is required. The port number is an integer from 0 to 65535.

Default

Format

Mode none

match dstl4port {<portkey> | <0-65535>}

Class-Map Config

Ipv6-Class-Map Config match ip dscp

This command adds to the specified class definition a match condition based on the value of the IP

DiffServ Code Point (DSCP) field in a packet, which is defined as the high-order six bits of the

Service Type octet in the IP header (the low-order two bits are not checked).

The <dscpval> value is specified as either an integer from 0 to 63, or symbolically through one of the following keywords: af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef.

Note: The ip dscp, ip precedence, and ip tos match conditions are alternative ways to specify a match criterion for the same Service Type field in the IP header, but with a slightly different user notation.


8-15


Default

Format

Mode none

match ip dscp <dscpval>

Class-Map Config

Ipv6-Class-Map Config match ip precedence


Precedence field in a packet, which is defined as the high-order three bits of the Service Type octet in the IP header (the low-order five bits are not checked). The precedence value is an integer from

0 to 7.

Note: The IP DSCP, IP Precedence, and IP ToS match conditions are alternative ways to specify a match criterion for the same Service Type field in the IP header, but with a slightly different user notation.

Default

Format

Mode none

match ip precedence <0-7>

Class-Map Config match ip tos


TOS field in a packet, which is defined as all eight bits of the Service Type octet in the IP header.

The value of <tosbits> is a two-digit hexadecimal number from 00 to ff. The value of

<tosmask> is a two-digit hexadecimal number from 00 to ff. The <tosmask> denotes the bit positions in <tosbits> that are used for comparison against the IP TOS field in a packet. For example, to check for an IP TOS value having bits 7 and 5 set and bit 1 clear, where bit 7 is most significant, use a <tosbits> value of a0 (hex) and a <tosmask> of a2 (hex).

Note: The IP DSCP, IP Precedence, and IP ToS match conditions are alternative ways to specify a match criterion for the same Service Type field in the IP header, but with a slightly different user notation.


8-16


Default

Format

Mode

Note: This “free form” version of the IP DSCP/Precedence/TOS match specification gives the user complete control when specifying which bits of the IP Service Type field are checked. none

match ip tos <tosbits> <tosmask>

Class-Map Config match protocol


Protocol field in a packet using a single keyword notation or a numeric value notation.

To specify the match condition using a single keyword notation, the value for <protocolname > is one of the supported protocol name keywords. The currently supported values are: icmp , igmp , ip , tcp , udp . A value of ip matches all protocol number values.

To specify the match condition using a numeric value notation, the protocol number is a standard value assigned by IANA and is interpreted as an integer from 0 to 255.

Note: This command does not validate the protocol number value against the current list defined by IANA.

Default

Format

Mode none

match protocol {<protocol-name> | <0-255>}

Class-Map Config



8-17


match source-address mac

This command adds to the specified class definition a match condition based on the source MAC address of a packet. The <address > parameter is any layer 2 MAC address formatted as six, two-digit hexadecimal numbers separated by colons (e.g., 00:11:22:dd:ee:ff). The <macmask > parameter is a layer 2 MAC address bit mask, which may not be contiguous, and is formatted as six, two-digit hexadecimal numbers separated by colons (e.g., ff:07:23:ff:fe:dc).

Default

Format

Mode none

match source-address mac <address> <macmask>

Class-Map Config

Ipv6-Class-Map Config match srcip

This command adds to the specified class definition a match condition based on the source IP address of a packet. The <ipaddr> parameter specifies an IP address. The <ipmask> parameter specifies an IP address bit mask and must consist of a contiguous set of leading 1 bits.

Default

Format

Mode none

match srcip <ipaddr> <ipmask>

Class-Map Config match srcip6

This command adds to the specified class definition a match condition based on the source IP address of a packet.

Default

Format

Mode none match srci p6 <source-ipv6-prefix/prefix-length>

Ipv6-Class-Map Config match srcl4port

This command adds to the specified class definition a match condition based on the source layer 4 port of a packet using a single keyword or numeric notation. To specify the match condition as a single keyword notation, the value for <portkey> is one of the supported port name keywords



(listed below). The currently supported <portkey> values are: domain, echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp, www. Each of these translates into its equivalent port number, which is used as both the start and end of a port range.

To specify the match condition as a numeric value, one layer 4 port number is required. The port number is an integer from 0 to 65535.

Default

Format

Mode none

match srcl4port {<portkey> | <0-65535>}

Class-Map Config


DiffServ Policy Commands

Use the DiffServ policy commands to specify traffic conditioning actions, such as policing and marking, to apply to traffic classes

Use the policy commands to associate a traffic class that you define by using the class command set with one or more QoS policy attributes. Assign the class/policy association to an interface to form a service. Specify the policy name when you create the policy.

Each traffic class defines a particular treatment for packets that match the class definition. You can associate multiple traffic classes with a single policy. When a packet satisfies the conditions of more than one class, preference is based on the order in which you add the classes to the policy.

The first class you add has the highest precedence.

This set of commands consists of policy creation/deletion, class addition/removal, and individual policy attributes.

Note: The only way to remove an individual policy attribute from a class instance within a policy is to remove the class instance and re-add it to the policy. The values associated with an existing policy attribute can be changed without removing the class instance.

The CLI command root is policy-map .


8-19


assign-queue

This command modifies the queue id to which the associated traffic stream is assigned. The queueid is an integer from 0 to n -1, where n is the number of egress queues supported by the device.

Format

Mode

assign-queue <queueid>

Policy-Class-Map Config

Incompatibilities Drop drop

This command specifies that all packets for the associated traffic stream are to be dropped at ingress.

Format

Mode drop


Incompatibilities Assign Queue, Mark (all forms), Mirror, Police, Redirect mirror

This command specifies that all incoming packets for the associated traffic stream are copied to a specific egress interface (physical port or LAG).

Note: This command is not available on the GSM7328Sv1or GSM7352Sv1 platforms.

Format

Mode

mirror <unit/slot/port>


Incompatibilities Drop, Redirect


8-20


redirect

This command specifies that all incoming packets for the associated traffic stream are redirected to a specific egress interface (physical port or port-channel).

Note: This command is not available on the GSM7328Sv1 or GSM7352Sv1 platforms.

Format

Mode redirect <unit/slot/port>


Incompatibilities Drop, Mirror conform-color

Use this command to enable color-aware traffic policing and define the conform-color class map.

Used in conjunction with the police command where the fields for the conform level are specified.

The <class-map-name> parameter is the name of an existing DiffServ class map.

Note: This command may only be used after specifying a police command for the policyclass instance.

Format

Mode

conform-color <class-map-name>

Policy-Class-Map Config class

This command creates an instance of a class definition within the specified policy for the purpose of defining treatment of the traffic class through subsequent policy attribute statements. The

<classname> is the name of an existing DiffServ class.

Note: This command causes the specified policy to create a reference to the class definition.


8-21


Note: The CLI mode is changed to Policy-Class-Map Config when this command is successfully executed.

Format

Mode

class <classname>

Policy-Map Config no class

This command deletes the instance of a particular class and its defined treatment from the specified policy. <classname> is the names of an existing DiffServ class.

Note: This command removes the reference to the class definition for the specified policy.

Format

Mode

no class <classname>

Policy-Map Config mark cos

This command marks all packets for the associated traffic stream with the specified class of service value in the priority field of the 802.1p header (the only tag in a single tagged packet or the first or outer 802.1Q tag of a double VLAN tagged packet). If the packet does not already contain this header, one is inserted. The CoS value is an integer from 0 to 7.mark ip-dscp

Default

Format

Mode

1

mark-cos <0-7>


Incompatibilities Drop, Mark IP DSCP, IP Precedence, Police mark ip-dscp

This command marks all packets for the associated traffic stream with the specified IP DSCP value.


8-22


The <dscpval> value is specified as either an integer from 0 to 63, or symbolically through one of the following keywords: af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef .

Format

Mode

mark ip-dscp <dscpval>


Incompatibilities Drop, Mark CoS, Mark IP Precedence, Police mark ip-precedence

This command marks all packets for the associated traffic stream with the specified IP Precedence value. The IP Precedence value is an integer from 0 to 7.

Note: This command may not be used on IPv6 classes. IPv6 does not have a precedence field.

Format mark ip-precedence <0-7>

Mode Policy-Class-Map Config

Incompatibilities Drop, Mark CoS, Mark IP Precedence, Police

Policy Type In police-simple

This command is used to establish the traffic policing style for the specified class. The simple form of the police command uses a single data rate and burst size, resulting in two outcomes: conform and violate. The conforming data rate is specified in kilobits-per-second (Kbps) and is an integer from 1 to 4294967295. The conforming burst size is specified in kilobytes (KB) and is an integer from 1 to 128.

For each outcome, the only possible actions are drop, set-cos-transmit, set-dscp-transmit, set-prectransmit, or transmit. In this simple form of the police command, the conform action defaults to transmit and the violate action defaults to drop.

For set-dscp-transmit, a <dscpval> value is required and is specified as either an integer from 0 to 63, or symbolically through one of the following keywords: af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef.

For set-prec-transmit, an IP Precedence value is required and is specified as an integer from 0-7.



For set-cos-transmit an 802.1p priority value is required and is specified as an integer from 0-7.

Format police-simple {<1-4294967295> <1-128> conform-action {drop | set- prec-transmit <0-7> | set-dscp-transmit <0-63> | set-cos-transmit

<0-7> | transmit} [violate-action {drop | set-prec-transmit <0-7>

| set-dscp-transmit <0-63> | set-cos-transmit <0-7> | transmit}]}

Mode Policy-Class-Map Config

Incompatibilities Drop, Mark (all forms) policy-map

This command establishes a new DiffServ policy. The <policyname> parameter is a casesensitive alphanumeric string from 1 to 31 characters uniquely identifying the policy. The type of policy is specific to the inbound traffic direction as indicated by the in parameter.

Note: The CLI mode is changed to Policy-Map Config when this command is successfully executed..

Format

Mode

policy-map <policyname> in

Global Config no policy-map

This command eliminates an existing DiffServ policy. The <policyname> parameter is the name of an existing DiffServ policy. This command may be issued at any time. If the policy is currently referenced by one or more interface service attachments, this delete attempt fails.

Format

Mode

no policy-map <policyname>

Global Config


8-24


policy-map rename

This command changes the name of a DiffServ policy. The <policyname> i s the name of an existing DiffServ class. The <newpolicyname> parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the policy.

Format

Mode

policy-map rename <policyname> <newpolicyname>

Global Config

DiffServ Service Commands

Use the DiffServ service commands to assign a DiffServ traffic conditioning policy, which you specified by using the policy commands, to an interface in the incoming direction

The service commands attach a defined policy to a directional interface. You can assign only one policy at any one time to an interface in the inbound direction. DiffServ is not used in the outbound direction.

This set of commands consists of service addition/removal.

The CLI command root is service-policy .

service-policy

This command attaches a policy to an interface in the inbound direction. The <policyname> parameter is the name of an existing DiffServ policy. This command causes a service to create a reference to the policy.

Note: This command effectively enables DiffServ on an interface in the inbound direction. There is no separate interface administrative 'mode' command for

DiffServ.

Note: This command fails if any attributes within the policy definition exceed the capabilities of the interface. Once a policy is successfully attached to an interface, any attempt to change the policy definition, that would result in a violation of the interface capabilities, causes the policy change attempt to fail.


8-25

Format

Modes

service-policy in <policymapname>

• Global Config



Note: Each interface can have one policy attached.

no service-policy

This command detaches a policy from an interface in the inbound direction. The <policyname> parameter is the name of an existing DiffServ policy.

Note: This command causes a service to remove its reference to the policy. This command effectively disables DiffServ on an interface in the inbound direction.

There is no separate interface administrative 'mode' command for DiffServ.

Format

Modes

no service-policy in <policymapname>

• Global Config


DiffServ Show Commands

Use the DiffServ show commands to display configuration and status information for classes, policies, and services. You can display DiffServ information in summary or detailed formats. The status information is only shown when the DiffServ administrative mode is enabled.

show class-map

This command displays all configuration information for the specified class. The <classname> is the name of an existing DiffServ class.

Format

Modes

show class-map <class-name>

• Privileged EXEC

• User EXEC



If the class-name is specified the following fields are displayed:

Term Definition

Class Name

Class Type

The name of this class.

A class type of ‘all’ means every match criterion defined for the class is evaluated simultaneously and must all be true to indicate a class match.

The Layer 3 protocol for this class. Possible values are IPv4 and IPv6.

Class Layer3

Protocol

Match Criteria The Match Criteria fields are only displayed if they have been configured. Not all platforms support all match criteria values. They are displayed in the order entered by the user. The fields are evaluated in accordance with the class type. The possible Match Criteria fields are: Destination IP Address, Destination Layer 4 Port, Destination MAC Address,

Ethertype, Source MAC Address, VLAN, Class of Service, Every, IP DSCP, IP

Precedence, IP TOS, Protocol Keyword, Reference Class, Source IP Address, and

Source Layer 4 Port.

Values The values of the Match Criteria.

If you do not specify the Class Name, this command displays a list of all defined DiffServ classes.

The following fields are displayed:

Term

Class Name

Class Type

Definition

The name of this class. (Note that the order in which classes are displayed is not necessarily the same order in which they were created.)

A class type of ‘all’ means every match criterion defined for the class is evaluated simultaneously and must all be true to indicate a class match.

Reference Class

Name

The name of an existing DiffServ class whose match conditions are being referenced by the specified class definition.

show diffserv

This command displays the DiffServ General Status Group information, which includes the current administrative mode setting as well as the current and maximum number of rows in each of the main DiffServ private MIB tables. This command takes no options.

Format

Mode show diffserv

Privileged EXEC


8-27


Term Definition

DiffServ Admin mode The current value of the DiffServ administrative mode.

Class Table Size

Current /Max

The current number of entries (rows) and the maximum allowed entries (rows) in the Class Table.

Class Rule Table Size

Current /Max

The current number of entries (rows) and the maximum allowed entries(rows) in the Class Rule Table.

Policy Table Size

Current /Max

Policy Instance Table

Size Current /Max

Policy Attribute Table

Size Current /Max

Service Table Size

Current /Max

The current number of entries (rows) and the maximum allowed entries(rows) in the Policy Table.

Current number of entries (rows) and the maximum allowed entries(rows) in the Policy Instance Table.

Current number of entries (rows) and the maximum allowed entries(rows) in the

Policy Attribute Table.

The current number of entries (rows) i and the maximum allowed entries(rows) in the Service Table.

show policy-map

This command displays all configuration information for the specified policy. The

<policyname> is the name of an existing DiffServ policy.

Format

Mode

show policy-map [policyname]

Privileged EXEC

If the Policy Name is specified the following fields are displayed:

Term

Policy Name

Policy Type

Definition

The name of this policy.

The policy type (Only inbound policy definitions are supported for this platform.)

The following information is repeated for each class associated with this policy (only those policy attributes actually configured are displayed):

Term Definition

Assign Queue Directs traffic stream to the specified QoS queue. This allows a traffic classifier to specify which one of the supported hardware queues are used for handling packets belonging to the class.

Class Name The name of this class.


8-28


Term Definition

Committed Burst

Size (KB)

The committed burst size, used in simple policing.

Committed Rate

(Kbps)

The committed rate, used in simple policing,

Conform Action The current setting for the action taken on a packet considered to conform to the policing parameters. This is not displayed if policing is not in use for the class under this policy.

Conform COS The CoS mark value if the conform action is set-cos-transmit.

Conform DSCP

Value

The DSCP mark value if the conform action is set-dscp-transmit.

Conform IP

Precedence

Value

Drop

The IP Precedence mark value if the conform action is set-prec-transmit.

Mark CoS

Drop a packet upon arrival. This is useful for emulating access control list operation using

DiffServ, especially when DiffServ and ACL cannot co-exist on the same interface.

The class of service value that is set in the 802.1p header of inbound packets. This is not displayed if the mark cos was not specified.

Mark IP DSCP The mark/re-mark value used as the DSCP for traffic matching this class. This is not displayed if mark ip description is not specified.

Mark IP

Precedence

The mark/re-mark value used as the IP Precedence for traffic matching this class. This is not displayed if mark ip precedence is not specified.

Mirror

Non-Conform

Action

Copies a classified traffic stream to a specified egress port (physical port or LAG). This can occur in addition to any marking or policing action. It may also be specified along with a QoS queue assignment. This field does not display on GSM7328S and GSM7352S platforms.

The current setting for the action taken on a packet considered to not conform to the policing parameters. This is not displayed if policing not in use for the class under this policy.

Non-Conform

COS

Non-Conform

DSCP Value

The CoS mark value if the non-conform action is set-cos-transmit.

The DSCP mark value if the non-conform action is set-dscp-transmit.

Non-Conform IP

Precedence

Value

The IP Precedence mark value if the non-conform action is set-prec-transmit.

Policing Style The style of policing, if any, used (simple).

Redirect Forces a classified traffic stream to a specified egress port (physical port or LAG). This can occur in addition to any marking or policing action. It may also be specified along with a QoS queue assignment. This field does not display on GSM7328v1 and GSM7352Sv2 platforms.


8-29


If the Policy Name is not specified this command displays a list of all defined DiffServ policies.

The following fields are displayed:

Term

Definition

Policy Name The name of this policy. (The order in which the policies are displayed is not necessarily the same order in which they were created.)

Policy Type The policy type (Only inbound is supported).

Class Members List of all class names associated with this policy.

show diffserv service

This command displays policy service information for the specified interface and direction. The

<unit/slot/port> parameter specifies a valid unit/slot/port number for the system.

Format

Mode

show diffserv service <unit/slot/port> in

Privileged EXEC

Term Definition

DiffServ Admin

Mode

Interface

Direction

The current setting of the DiffServ administrative mode. An attached policy is only in effect on an interface while DiffServ is in an enabled mode.


The traffic direction of this interface service.

Operational

Status

Policy Name

The current operational status of this DiffServ service interface.

The name of the policy attached to the interface in the indicated direction.

Policy Details Attached policy details, whose content is identical to that described for the show policymap <policymapname> command (content not repeated here for brevity). show diffserv service brief

This command displays all interfaces in the system to which a DiffServ policy has been attached.

The inbound direction parameter is optional.

Format

Mode

show diffserv service brief [in]

Privileged EXEC


8-30


Term Definition

DiffServ Admin

Mode

The current setting of the DiffServ administrative mode. An attached policy is only active on an interface while DiffServ is in an enabled mode.

The following information is repeated for interface and direction (only those interfaces configured with an attached policy are shown):

Term

Interface

Direction

OperStatus

Policy Name

Definition





show policy-map interface

This command displays policy-oriented statistics information for the specified interface and direction. The <unit/slot/port> parameter specifies a valid interface for the system.

Note: This command is only allowed while the DiffServ administrative mode is enabled.

Format

Mode

show policy-map interface <unit/slot/port> [in]

Privileged EXEC

Term

Interface

Direction

Operational

Status

Policy Name

Definition





The following information is repeated for each class instance within this policy:

Term

Class Name

Definition

The name of this class instance.


8-31


Term

In Discarded

Packets

Definition

A count of the packets discarded for this class instance for any reason due to DiffServ treatment of the traffic class. show service-policy

This command displays a summary of policy-oriented statistics information for all interfaces in the specified direction.

Format

Mode show service-policy in

Privileged EXEC

The following information is repeated for each interface and direction (only those interfaces configured with an attached policy are shown):

Term

Interface

Operational

Status

Policy Name

Definition



The name of the policy attached to the interface.

MAC Access Control List (ACL) Commands

This section describes the commands you use to configure MAC ACL settings. MAC ACLs ensure that only authorized users have access to specific resources and block any unwarranted attempts to reach network resources.

The following rules apply to MAC ACLs:

• The maximum number of ACLs you can create is hardware dependent. The limit applies to all

ACLs, regardless of type.

• The system supports only Ethernet II frame types.

• The maximum number of rules per MAC ACL is hardware dependent.

• For the GSM7328Sv1, GSM7352Sv1, and GSM7328FS, if you configure an IP ACL on an interface, you cannot configure a MAC ACL on the same interface.


8-32


mac access-list extended

This command creates a MAC Access Control List (ACL) identified by <name> , consisting of classification fields defined for the Layer 2 header of an Ethernet frame. The <name> parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the MAC access list.

If a MAC ACL by this name already exists, this command enters Mac-Access-List config mode to allow updating the existing MAC ACL.

Note: The CLI mode changes to Mac-Access-List Config mode when you successfully execute this command.

Format

Mode

mac access-list extended <name>

Global Config no mac access-list extended

This command deletes a MAC ACL identified by <name> from the system.

Format

Mode

no mac access-list extended <name>

Global Config mac access-list extended rename

This command changes the name of a MAC Access Control List (ACL). The <name> parameter is the name of an existing MAC ACL. The <newname> parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the MAC access list.

This command fails if a MAC ACL by the name <newname> already exists.

Format

Mode

mac access-list extended rename <name> <newname>

Global Config


8-33


{deny | permit} (MAC ACL)

This command creates a new rule for the current MAC access list. Each rule is appended to the list of configured rules for the list.

Note: The 'no' form of this command is not supported, since the rules within a MAC ACL cannot be deleted individually. Rather, the entire MAC ACL must be deleted and re-specified.

Note: An implicit 'deny all' MAC rule always terminates the access list.

A rule may either deny or permit traffic according to the specified classification fields. At a minimum, the source and destination MAC value must be specified, each of which may be substituted using the keyword any to indicate a match on any value in that field. The remaining command parameters are all optional, but the most frequently used parameters appear in the same relative order as shown in the command format.

The Ethertype may be specified as either a keyword or a four-digit hexadecimal value from

0x0600-0xFFFF. The currently supported <ethertypekey> values are: appletalk, arp, ibmsna, ipv4, ipv6, ipx, mplsmcast, mplsucast, netbios, novell, pppoe, rarp. Each of these translates into its equivalent Ethertype value(s).

Ethertype Keyword appletalk arp ibmsna ipv4 ipv6 ipx mplsmcast mplsucast netbios novell pppoe rarp

Corresponding Value

0x809B

0x0806

0x80D5

0x0800

0x86DD

0x8037

0x8848

0x8847

0x8191

0x8137, 0x8138

0x8863, 0x8864

0x8035


8-34


The vlan and cos parameters refer to the VLAN identifier and 802.1p user priority fields, respectively, of the VLAN tag. For packets containing a double VLAN tag, this is the first (or outer) tag.

The assign-queue parameter allows specification of a particular hardware queue for handling traffic that matches this rule. The allowed <queue-id> value is 0-(n-1), where n is the number of user configurable queues available for the hardware platform. The assign-queue parameter is valid only for a permit rule.

Note: The special command form {deny | permit} any any is used to match all Ethernet layer 2 packets, and is the equivalent of the IP access list “match every” rule.

Format

Mode

{deny|permit} {<srcmac> | any} {<dstmac> | any} [<ethertypekey> |

<0x0600-0xFFFF>] [vlan {eq <0-4095>}] [cos <0-7>] [[log] [assign-queue

<queue-id>]] [{mirror | redirect} <unit/slot/port>]

Mac-Access-List Config mac access-group

This command either attaches a specific MAC Access Control List (ACL) identified by <name> to an interface, or associates it with a VLAN ID, in a given direction. The <name> parameter must be the name of an existing MAC ACL.

An optional sequence number may be specified to indicate the order of this mac access list relative to other mac access lists already assigned to this interface and direction. A lower number indicates higher precedence order. If a sequence number is already in use for this interface and direction, the specified mac access list replaces the currently attached mac access list using that sequence number. If the sequence number is not specified for this command, a sequence number that is one greater than the highest sequence number currently in use for this interface and direction is used.

This command specified in 'Interface Config' mode only affects a single interface, whereas the

'Global Config' mode setting is applied to all interfaces. The VLAN keyword is only valid in the

'Global Config' mode. The 'Interface Config' mode command is only available on platforms that support independent per-port class of service queue configuration.

Note: You should be aware that the < out > option may or may not be available, depending on the platform.


8-35


Format

Modes

mac access-group <name> [vlan <vlan-id>] [in|out] [sequence <1-

4294967295>]

• Global Config

• Interface Config no mac access-group

This command removes a MAC ACL identified by <name> from the interface in a given direction.

Format

Modes

no mac access-group <name> [vlan <vlan-id>] in

• Global Config

• Interface Config show mac access-lists

This command displays a MAC access list and all of the rules that are defined for the MAC ACL.

Use the [name] parameter to identify a specific MAC ACL to display.

Format

Mode

show mac access-lists [name]

Privileged EXEC

Term Definition

Rule Number The ordered rule number identifier defined within the MAC ACL.

Action

Source MAC

Address

The action associated with each rule. The possible values are Permit or Deny.

The source MAC address for this rule.

Destination MAC

Address

The destination MAC address for this rule.

Ethertype

VLAN ID

COS

Log

The Ethertype keyword or custom value for this rule.

The VLAN identifier value or range for this rule.

The COS (802.1p) value for this rule.

Displays when you enable logging for the rule.

Assign Queue The queue identifier to which packets matching this rule are assigned.

Mirror Interface The unit/slot/port to which packets matching this rule are copied.


8-36


Term

Redirect

Interface

Definition

The unit/slot/port to which packets matching this rule are forwarded.

IP Access Control List (ACL) Commands

This section describes the commands you use to configure IP ACL settings. IP ACLs ensure that only authorized users have access to specific resources and block any unwarranted attempts to reach network resources.

The following rules apply to IP ACLs:

• Managed switch software does not support IP ACL configuration for IP packet fragments.

• The maximum number of ACLs you can create is hardware dependent. The limit applies to all

ACLs, regardless of type.

• The maximum number of rules per IP ACL is hardware dependent.

• On GSM7328S v1 and GSM7352S v1 platforms, if you configure a MAC ACL on an interface, you cannot configure an IP ACL on the same interface.

• Wildcard masking for ACLs operates differently from a subnet mask. A wildcard mask is in essence the inverse of a subnet mask. With a subnet mask, the mask has ones (1's) in the bit positions that are used for the network address, and has zeros (0's) for the bit positions that are not used. In contrast, a wildcard mask has (0’s) in a bit position that must be checked. A ‘1’ in a bit position of the ACL mask indicates the corresponding bit can be ignored. access-list

This command creates an IP Access Control List (ACL) that is identified by the access list number, which is 1-99 for standard ACLs or 100-199 for extended ACLs .

IP Standard ACL:

Format

Mode access-list <1-99> {deny | permit} {every | <srcip> <srcmask>} [log]

[assign-queue <queue-id>] [{mirror | redirect} <unit/slot/port>]

Global Config


8-37


IP Extended ACL:

Format

Mode

access-list <100-199> {deny | permit} {every | {{icmp | igmp | ip | tcp | udp | <number>} <srcip> <srcmask>[{eq {<portkey> | <0-65535>}

<dstip> <dstmask> [{eq {<portkey>| <0-65535>}] [precedence

<precedence> | tos <tos> <tosmask> | dscp <dscp>] [log] [assign-queue

<queue-id>] [{mirror | redirect} <unit/slot/port>]

Global Config


<1-99> or <100-199>

{deny | permit}

Range 1 to 99 is the access list number for an IP standard ACL.

Range 100 to 199 is the access list number for an IP extended ACL.

Specifies whether the IP ACL rule permits or denies an action. every Match every packet

{icmp | igmp | ip | tcp | udp Specifies the protocol to filter for an extended IP ACL rule.

| <number>}

<srcip> <srcmask>

[{eq {<portkey> |

<0-65535>}]

<dstip> <dstmask>

[precedence <precedence> | tos <tos> <tosmask> | dscp

<dscp>]

[log]

[assign-queue <queue-id>]

[{mirror | redirect} <unit/ slot/port>]

Specifies a source IP address and source netmask for match condition of the IP ACL rule.

Specifies the source layer 4 port match condition for the IP ACL rule.

You can use the port number, which ranges from 0-65535, or you specify the <portkey> , which can be one of the following keywords: domain, echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp , and www . Each of these keywords translates into its equivalent port number, which is used as both the start and end of a port range.

Specifies a destination IP address and netmask for match condition of the IP ACL rule.

Specifies the TOS for an IP ACL rule depending on a match of precedence or DSCP values using the parameters dscp , precedence , tos/tosmask .

Specifies that this rule is to be logged.

Specifies the assign-queue, which is the queue identifier to which packets matching this rule are assigned.

Specifies the mirror or redirect interface which is the unit/slot/port to which packets matching this rule are copied or forwarded, respectively. The mirror and redirect parameters are not available on the GSM7328Sv1 and GSM7352Sv1 platforms.


8-38


no access-list

This command deletes an IP ACL that is identified by the parameter < accesslistnumber> from the system. The range for < accesslistnumber> 1-99 for standard access lists and 100-

199 for extended access lists.

Format

Mode

no access-list <accesslistnumber>

Global Config ip access-list

This command creates an extended IP Access Control List (ACL) identified by < name >, consisting of classification fields defined for the IP header of an IPv4 frame. The < name > parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the

IP access list.

If an IP ACL by this name already exists, this command enters IPv4-Access_List config mode to allow updating the existing IP ACL.

Note: The CLI mode changes to IPv4-Access-List Config mode when you successfully execute this command.

Format

Mode

ip access-list <name>

Global Config no ip access-list

This command deletes the IP ACL identified by <name> from the system.

Format

Mode

no ip access-list <name>

Global Config


8-39


ip access-list rename

This command changes the name of an IP Access Control List (ACL). The < name > parameter is the names of an existing IP ACL. The <new name > parameter is a case-sensitive alphanumeric string from 1 to 31 characters uniquely identifying the IP access list.

This command fails is an IP ACL by the name <new name > already exists.

Format

Mode

ip access-list rename <name> <newname>

Global Config

{deny | permit} (IP ACL)

This command creates a new rule for the current IP access list. Each rule is appended to the list of configured rules for the list.

Note: The 'no' form of this command is not supported, since the rules within an IP ACL cannot be deleted individually. Rather, the entire IP ACL must be deleted and respecified.

Note: An implicit 'deny all' IP rule always terminates the access list.

Note: For the GSM7328Sv1 and GSM7352Sv1, the mirror and redirect parameters are not available.

Note: For the GSM7328Sv2 and GSM7352Sv2-based systems, the mirror parameter allows the traffic matching this rule to be copied to the specified <unit/slot/ port> , while the redirect parameter allows the traffic matching this rule to be forwarded to the specified <unit/slot/port> . The assign-queue and redirect parameters are only valid for a permit rule.

A rule may either deny or permit traffic according to the specified classification fields. At a minimum, either the every keyword or the protocol, source address, and destination address values must be specified. The source and destination IP address fields may be specified using the


8-40


keyword ‘ any ’ to indicate a match on any value in that field. The remaining command parameters are all optional, but the most frequently used parameters appear in the same relative order as shown in the command format.


Format

Mode

{deny | permit} {every | {{icmp | igmp | ip | tcp | udp | <number>}

<srcip> <srcmask>[{eq {<portkey> | <0-65535>} <dstip> <dstmask> [{eq

{<portkey>| <0-65535>}] [precedence <precedence> | tos <tos> <tosmask>

| dscp <dscp>] [log] [assign-queue <queue-id>] [{mirror | redirect}

<unit/slot/port>]

Ipv4-Access-List Config ip access-group

This command either attaches a specific IP ACL identified by <accesslistnumber> to an interface or associates with a VLAN ID in a given direction. The parameter <name> is the name of the Access Control List.

An optional sequence number may be specified to indicate the order of this IP access list relative to other IP access lists already assigned to this interface and direction. A lower number indicates higher precedence order. If a sequence number is already in use for this interface and direction, the specified access list replaces the currently attached IP access list using that sequence number. If the sequence number is not specified for this command, a sequence number that is one greater than the highest sequence number currently in use for this interface and direction is used.


Default

Format

Modes none

ip access-group <accesslistnumber> <name> [vlan <vlan-id>] <in |

out>[sequence <1-4294967295>]


• Global Config


8-41


no ip access-group

This command removes a specified IP ACL from an interface.

Default

Format

Mode none

no ip access-group <accesslistnumber> [vlan <vlan-id>] in


• Global Config acl-trapflags

This command enables the ACL trap mode.

Default

Format

Mode disabled acl-trapflags

Global Config no acl-trapflags

This command disables the ACL trap mode.

Format

Mode no acl-trapflags

Global Config show ip access-lists

This command displays an IP ACL <accesslistnumber> is the number used to identify the

IP ACL.

Format

Mode

show ip access-lists <accesslistnumber>

Privileged EXEC

Note: Only the access list fields that you configure are displayed.


8-42


Term Definition

Rule Number

Action

Match All

The number identifier for each rule that is defined for the IP ACL.


Indicates whether this access list applies to every packet. Possible values are True or

False.

The protocol to filter for this rule.

Protocol

Source IP

Address

The source IP address for this rule.

Source IP Mask The source IP Mask for this rule.

Source L4 Port

Keyword

The source port for this rule.

Destination IP

Address

Destination IP

Mask

The destination IP address for this rule.

The destination IP Mask for this rule.

Destination L4

Port Keyword

The destination port for this rule.

IP DSCP The value specified for IP DSCP.

IP Precedence The value specified IP Precedence.

IP TOS

Log

The value specified for IP TOS.




Redirect

Interface


show access-lists

This command displays IP ACLs, IPv6 ACLs, and MAC access control lists information for a designated interface and direction.

Format

Mode

show access-lists interface <unit/slot/port> in

Privileged EXEC

Term

ACL Type

Definition

Type of access list (IP, IPv6, or MAC).


8-43


Term

ACL ID

Sequence

Number

Definition

Access List name for a MAC or IPv6 access list or the numeric identifier for an IP access list.

An optional sequence number may be specified to indicate the order of this access list relative to other access lists already assigned to this interface and direction. A lower number indicates higher precedence order. If a sequence number is already in use for this interface and direction, the specified access list replaces the currently attached access list using that sequence number. If the sequence number is not specified by the user, a sequence number that is one greater than the highest sequence number currently in use for this interface and direction is used. Valid range is (1 to 4294967295).

IPv6 Access Control List (ACL) Commands

This section describes the commands you use to configure IPv6 ACL settings. IPv6 ACLs ensure that only authorized users have access to specific resources and block any unwarranted attempts to reach network resources.

The following rules apply to IPv6 ACLs:

• The maximum number of ACLs you create is 100, regardless of type.

• The system supports only Ethernet II frame types.

• The maximum number of rules per IPv6 ACL is hardware dependent.

Note: The IPv6 ACL is not available on the GSM7328Sv1 or GSM7352Sv1.

ipv6 access-list

This command creates an IPv6 Access Control List (ACL) identified by <name> , consisting of classification fields defined for the IP header of an IPv6 frame. The <name> parameter is a casesensitive alphanumeric string from 1 to 31 characters uniquely identifying the IPv6 access list.


8-44


If an IPv6 ACL by this name already exists, this command enters IPv6-Access-List config mode to allow updating the existing IPv6 ACL.

Note: The CLI mode changes to IPv6-Access-List Config mode when you successfully execute this command.

Format

Mode

ipv6 access-list <name>

Global Config no ipv6 access-list

This command deletes the IPv6 ACL identified by <name> from the system.

Format

Mode no ipv6 access-list <name>

Global Config ipv6 access-list rename

This command changes the name of an IPv6 ACL. The <name> parameter is the name of an existing IPv6 ACL. The <newname> parameter is a case-sensitive alphanumeric string from 1 to

31 characters uniquely identifying the IPv6 access list.

This command fails is an IPv6 ACL by the name <newname> already exists.

Format

Mode

ipv6 access-list rename <name> <newname>

Global Config

{deny | permit} (IPv6)

This command creates a new rule for the current IPv6 access list. Each rule is appended to the list of configured rules for the list.

Note: The ‘no’ form of this command is not supported, since the rules within an IPv6

ACL cannot be deleted individually. Rather, the entire IPv6 ACL must be deleted and respecified.


8-45


Note: An implicit ‘deny all’ IPv6 rule always terminates the access list.

A rule may either deny or permit traffic according to the specified classification fields. At a minimum, either the ‘every’ keyword or the protocol, source address, and destination address values must be specified. The source and destination IPv6 address fields may be specified using the keyword ‘any’ to indicate a match on any value in that field. The remaining command parameters are all optional, but the most frequently used parameters appear in the same relative order as shown in the command format.


The mirror parameter allows the traffic matching this rule to be copied to the specified <unit/ slot/port> , while the redirect parameter allows the traffic matching this rule to be forwarded to the specified <unit/slot/port> . The assign-queue and redirect parameters are only valid for a permit rule.

Format

Mode

{deny | permit} {every | {{icmp | igmp | ipv6 | tcp | udp |

<number>}[log] [assign-queue <queue-id>] [{mirror | redirect} <unit/ slot/port>]

IPv6-Access-List Config ipv6 traffic-filter

This command either attaches a specific IPv6 ACL identified by <name> to an interface or associates with a VLAN ID in a given direction. The <name> parameter must be the name of an existing IPv6 ACL.

An optional sequence number may be specified to indicate the order of this mac access list relative to other IPv6 access lists already assigned to this interface and direction. A lower number indicates higher precedence order. If a sequence number is already in use for this interface and direction, the specifiedIPv6 access list replaces the currently attached IPv6 access list using that sequence number. If the sequence number is not specified for this command, a sequence number that is one greater than the highest sequence number currently in use for this interface and direction is used.


8-46


This command specified in Interface Config mode only affects a single interface, whereas the

Global Config mode setting is applied to all interfaces. The vlan keyword is only valid in the

Global Config mode. The Interface Config mode command is only available on platforms that support independent per-port class of service queue configuration.


Format

Modes

ipv6 traffic-filter <name> [vlan <vlan-id>] <in | out>[sequence <1-

4294967295>]

• Global Config

• Interface Config no ipv6 traffic-filter

This command removes an IPv6 ACL identified by <name> from the interface(s) in a given direction.

Format

Modes

no ipv6 traffic-filter <name> [vlan <vlan-id>] in [sequence <1-

4294967295>]

• Global Config

• Interface Config show ipv6 access-lists

This command displays an IPv6 access list and all of the rules that are defined for the IPv6 ACL.

Use the [name] parameter to identify a specific IPv6 ACL to display.

Format

Mode

show ipv6 access-lists [name]

Privileged EXEC

Term

Rule Number

Action

Definition

The ordered rule number identifier defined within the IPv6 ACL.



8-47


Term Definition

Match All

Protocol

Source IP

Address

Source L4 Port

Keyword

Destination IP

Address

Indicates whether this access list applies to every packet. Possible values are True or

False.

The protocol to filter for this rule.

The source IP address for this rule.

The source port for this rule.

The destination IP address for this rule.

Destination L4

Port Keyword

IP DSCP

Flow Label

Log

The destination port for this rule.

The value specified for IP DSCP.

The value specified for IPv6 Flow Label.




Redirect

Interface


Auto-Voice over IP Commands

This section describes the commands you use to configure Auto-Voice over IP (VoIP) commands.

The Auto-VoIP feature explicitly matches VoIP streams in Ethernet switches and provides them with a better class-of-service than ordinary traffic. When you enable the Auto-VoIP feature on an interface, the interface scans incoming traffic for the following call-control protocols:

• Session Initiation Protocol (SIP)

• H.323

• Skinny Client Control Protocol (SCCP)

When a call-control protocol is detected, the switch assigns the traffic in that session to the highest

CoS queue, which is generally used for time-sensitive traffic.

auto-voip all

Use this command to enable VoIP Profile on the interfaces of the switch.


8-48


Default

Format

Mode disabled auto-voip all

Global Config no auto-voip all

Use this command to disable VoIP Profile on the interfaces of the switch.

Format

Mode no auto-voip all

Global Config auto-voip

Use this command to enable VoIP Profile on the interface.

Default

Format

Mode disabled auto-voip

Interface Config no auto-voip

Use this command to disable VoIP Profile on the interface.

Format

Mode no auto-voip all

Interface Config show auto-voip

Use this command to display the VoIP Profile settings on the interface or interfaces of the switch.

Format

Mode show auto-voip interface {<unit/slot/port>|all}

Privileged EXEC


8-49



AutoVoIP Mode The Auto VoIP mode on the interface.

Traffic Class The CoS Queue or Traffic Class to which all VoIP traffic is mapped to. This is not configurable and defaults to the highest CoS queue available in the system for data traffic.


8-50

Chapter 9

Utility Commands

This chapter describes the utility commands available in the CLI.

The Utility Commands chapter includes the following sections:

• “Auto Install Commands” on page 9-2

• “Dual Image Commands” on page 9-4

• “System Information and Statistics Commands” on page 9-6

• “Logging Commands” on page 9-18

• “System Utility and Clear Commands” on page 9-24

• “Simple Network Time Protocol (SNTP) Commands” on page 9-34

• “Simple Network Time Protocol (SNTP) Commands” on page 9-34

• “DHCP Server Commands” on page 9-40

• “DNS Client Commands” on page 9-55

• “Packet Capture Commands” on page 9-61

• “Cable Test Command” on page 9-83

• “sFlow Commands” on page 9-84

Note: The commands in this chapter are in one of four functional groups:



• Copy commands transfer or save configuration and informational files to and from the switch.


9-1 v1.0, July 2009


Auto Install Commands

This section describes the Auto Install Commands. Auto Install is a software feature which provides for the configuration of a switch automatically when the device is initialized and no configuration file is found on the switch. The Auto Install process requires DHCP to be enabled by default in order for it to be completed. The downloaded config file is not automatically saved to startup-config. An administrator must explicitly issue a save request in order to save the configuration. The Auto Install process depends upon the configuration of other devices in the network, including a DHCP or BOOTP server, a TFTP server and, if necessary, a DNS server.

There are three stepss to Auto Install:

1.

Configuration or assignment of an IP address for the device.

2.

Assignment of a TFTP server.

3.

Obtain a configuration file for the device from the TFTP server.

show autoinstall

This command displays the current status of the Auto Config process.

Format

Mode show autoinstall

Privileged EXEC

Term Definition

AutoInstall Mode The administrator mode is enabled or disabled.

AutoSave Modet If this option is enabled, the downloaded config file will be saved. Otherwise, administrator must explicitly issue a "copy running-config startup-config" command in order to save the configuration.

AutoInstall Retry

Count the number of attempts to download a configuration.

AutoInstall State The status of the AutoInstall.

Example

(switch) #show autoinstall

AutoInstall Mode............................... Stopped

AutoSave Mode.................................. Disabled

AutoInstall Retry Count........................ 3

AutoInstall State.............................. Waiting for boot options

Utility Commands 9-2 v1.0, July 2009


boot autoinstall auto-save

This command is used to enable automatically saving the downloaded configuration on the switch.

.

Default

Format

Mode

Disabled boot autoinstall auto-save

Privileged EXEC no boot autoinstall auto-save

This command is used to disable automatically saving the downloaded configuration on the switch..

Format

Mode no boot autoinstall auto-save

Privileged EXEC boot autoinstall start

The command is used to start Auto Install on the switch. Auto Install tries to download a config file from a TFTP server..

Format

Mode boot autoinstall start

Privileged EXEC boot autoinstall stop

The command is used to A user may terminate the Auto Install process at any time prior to the downloading of the config file. This is most optimally done when the switch is disconnected from the network, or if the requisite configuration files have not been configured on TFTP servers.

Termination of the Auto Install process ends further periodic requests for a host-specific file.

Format

Mode boot autoinstall stop

Privileged EXEC



boot autoinstall retry-count

This command is used to set the number of attempts to download a configuration. The valid range is from 1 to 6.

Default

Format

Mode

3 boot autoinstall retry-count

Privileged EXEC no boot autoinstall retry-count

This command is used to reset the number to the default. The default number is 3.

Format

Mode no boot autoinstall retry-count

Privileged EXEC

Dual Image Commands

The software supports a dual image feature that allows the switch to have two software images in the permanent storage. You can specify which image is the active image to be loaded in subsequent reboots. This feature allows reduced down-time when you upgrade or downgrade the software. delete

This command deletes the supplied image file from the permanent storage. The image to be deleted must be a backup image. If this image is the active image, or if this image is activated, an error message displays. The optional <unit> parameter is valid only on Stacks. Error will be returned, if this parameter is provided, on Standalone systems. In a stack, the <unit> parameter identifies the node on which this command must be executed. When this parameter is not supplied, the command is executed on all nodes in a Stack.

Format

Mode

delete [<unit>] {image1 | image2}

Privileged EXEC



boot system

This command activates the specified image. It will be the active-image for subsequent reboots and will be loaded by the boot loader. The current active-image is marked as the backup-image for subsequent reboots. The optional <unit> parameter is valid only in Stacking, where the unit parameter identifies the node on which this command must be executed. When this parameter is not supplied, the command is executed on all nodes in a Stack.

Format

Mode boot system [<unit>] <image-file-name>

Privileged EXEC show bootvar

This command displays the version information and the activation status for the current active and backup images on the supplied unit (node) of the Stack. If you do not specify a unit number, the command displays image details for all nodes on the Stack. The command also displays any text description associated with an image. This command, when used on a Standalone system, displays the switch activation status. For a standalone system, the unit parameter is not valid.

Format

Mode

show bootvar [<unit>]

Privileged EXEC filedescr

This command associates a given text description with an image. Any existing description will be replaced. For stacking, the [<unit>] parameter identifies the node on which this command must be executed. When this parameter is not supplied, the command is executed on all nodes in a

Stack.

Format

Mode filedescr [<unit>] {image1 | image2} <text-description>

Privileged EXEC

Utility Commands v1.0, July 2009

9-5


update bootcode

This command updates the bootcode (boot loader) on the switch. The bootcode is read from the active-image for subsequent reboots.The optional <unit> parameter is valid only on Stacks.

Error will be returned, if this parameter is provided, on Standalone systems. For Stacking, the

<unit> parameter identifies the node on which this command must be executed. When this parameter is not supplied, the command is executed on all nodes in a Stack.

Format

Mode

update bootcode [<unit>]

Privileged EXEC

System Information and Statistics Commands

This section describes the commands you use to view information about system features, components, and configurations. show arp switch

This command displays the contents of the IP stack’s Address Resolution Protocol (ARP) table.

The IP stack only learns ARP entries associated with the management interfaces - network or service ports. ARP entries associated with routing interfaces are not listed.

Format

Mode show arp switch

Privileged EXEC

Term Definition

IP Address IP address of the management interface or another device on the management network.

MAC Address Hardware MAC address of that device.

Interface For a service port the output is Management slot/port of the physical interface.

. For a network port, the output is the unit/


9-6


show eventlog

This command displays the event log, which contains error messages from the system. The event log is not cleared on a system reset. The <unit> is the switch identifier.

Format

Mode

show eventlog [<unit>]

Privileged EXEC

Term

File

Line

Task Id

Code

Time

Unit

Definition

The file in which the event originated.

The line number of the event.

The task ID of the event.

The event code.

The time this event occurred.

The unit for the event.

Note: Event log information is retained across a switch reset.

show hardware

This command displays inventory information for the switch.

Note: The show version command and the show hardware command display the same information. In future releases of the software, the show hardware command will not be available. For a description of the command output, see the command “show version” on page 9-8 .

Format

Mode show hardware

Privileged EXEC



show version

This command displays inventory information for the switch.

Note: The show version command will replace the show hardware command in future releases of the software.

Format

Mode show version

Privileged EXEC

Term Definition

Switch

Description

FRU Number

Part Number

Text used to identify the product name of this switch.

Machine Type The machine model as defined by the Vital Product Data.

Machine Model The machine model as defined by the Vital Product Data

Serial Number The unique box serial number for this switch.

The field replaceable unit number.

Manufacturing part number.

Hardware changes that are significant to software.

Maintenance

Level

Manufacturer

Burned in MAC

Address

Manufacturer descriptor field.

Universally assigned network address.

Software Version The release.version.revision number of the code currently running on the switch.

Operating

System

The operating system currently running on the switch.

The type of the processor microcode.

Network

Processing

Device

Additional

Packages

The additional packages incorporated into this system.



show interface

This command displays a summary of statistics for a specific interface or a count of all CPU traffic based upon the argument.

Format

Mode

show interface {<unit/slot/port> | switchport}

Privileged EXEC

The display parameters, when the argument is <unit/slot/port> , are as follows:

Parameters

Packets

Received

Without Error

Packets

Received With

Error

Broadcast

Packets

Received

Packets

Transmitted

Without Error

Transmit

Packets Errors

Collisions

Frames

Time Since

Counters Last

Cleared

Definition

The total number of packets (including broadcast packets and multicast packets) received by the processor.

The number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.

The total number of packets received that were directed to the broadcast address. Note that this does not include multicast packets.

The total number of packets transmitted out of the interface.

The number of outbound packets that could not be transmitted because of errors.

The best estimate of the total number of collisions on this Ethernet segment.

The elapsed time, in days, hours, minutes, and seconds since the statistics for this port were last cleared.

The display parameters, when the argument is “switchport” are as follows:

Term

Packets

Received

Without Error

Broadcast

Packets

Received

Definition





Term Definition

Packets

Received With

Error

Packets

Transmitted

Without Error

The number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.


Broadcast

Packets

Transmitted

The total number of packets that higher-level protocols requested to be transmitted to the

Broadcast address, including those that were discarded or not sent.

Transmit Packet

Errors

The number of outbound packets that could not be transmitted because of errors.

Address Entries

Currently In Use

The total number of Forwarding Database Address Table entries now active on the switch, including learned and static entries.

VLAN Entries

Currently In Use

The number of VLAN entries presently occupying the VLAN table.

Time Since

Counters Last

Cleared

The elapsed time, in days, hours, minutes, and seconds since the statistics for this switch were last cleared.

show interface ethernet

This command displays detailed statistics for a specific interface or for all CPU traffic based upon the argument.

Format

Mode show interface ethernet {<unit/slot/port> | switchport}

Privileged EXEC

When you specify a value for <unit/slot/port> , the command displays the following information.

Term Definition

Total Packets

Received

(Octets)

The total number of octets of data received by the processor (excluding framing bits but including FCS octets).

Packets

Received

Without Error




Term Definition

Unicast Packets

Received

The number of subnetwork-unicast packets delivered to a higher-layer protocol.

Multicast

Packets

Received

Broadcast

Packets

Received

The total number of packets received that were directed to a multicast address. Note that this number does not include packets directed to the broadcast address.


Receive Packets

Discarded

The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. A possible reason for discarding a packet could be to free up buffer space.

The total number of octets transmitted out of the interface, including framing characters.

Octets

Transmitted

Packets

Transmitted without Errors


Unicast Packets

Transmitted

The total number of packets that higher-level protocols requested be transmitted to a subnetwork-unicast address, including those that were discarded or not sent.

Multicast

Packets

Transmitted

Broadcast

Packets

Transmitted

The total number of packets that higher-level protocols requested be transmitted to a

Multicast address, including those that were discarded or not sent.

The total number of packets that higher-level protocols requested be transmitted to the

Broadcast address, including those that were discarded or not sent.

Transmit

Packets

Discarded

Most Address

Entries Ever

Used

The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. A possible reason for discarding a packet could be to free up buffer space.

The highest number of Forwarding Database Address Table entries that have been learned by this switch since the most recent reboot.

Address Entries

Currently in Use

The number of Learned and static entries in the Forwarding Database Address Table for this switch.

Maximum VLAN

Entries

The maximum number of Virtual LANs (VLANs) allowed on this switch.

The largest number of VLANs that have been active on this switch since the last reboot.

Most VLAN

Entries Ever

Used

Static VLAN

Entries

Dynamic VLAN

Entries

The number of presently active VLAN entries on this switch that have been created statically.

The number of presently active VLAN entries on this switch that have been created by

GVRP registration.



Term Definition

VLAN Deletes The number of VLANs on this switch that have been created and then deleted since the last reboot.

Time Since

Counters Last

Cleared

The elapsed time, in days, hours, minutes, and seconds, since the statistics for this switch were last cleared. show mac-addr-table

This command displays the forwarding database entries. These entries are used by the transparent bridging function to determine how to forward a received frame.

Enter all or no parameter to display the entire table. Enter a MAC Address and VLAN ID to display the table entry for the requested MAC address on the specified VLAN. Enter the count parameter to view summary information about the forwarding database table. Use the interface <unit/slot/port> parameter to view MAC addresses on a specific interface.

Use the vlan <vlan_id> parameter to display information about MAC addresses on a specified VLAN.

Format

Mode

show mac-addr-table [{<macaddr> <vlan_id> | all | count | interface

<unit/slot/port> | vlan <vlan_id>}]

Privileged EXEC

The following information displays if you do not enter a parameter, the keyword all, or the MAC address and VLAN ID. If you enter vlan <vlan_id> , only the Mac Address, Interface, and

Status fields appear.

Term Definition

Mac Address A unicast MAC address for which the switch has forwarding and or filtering information.

The format is 6 or 8 two-digit hexadecimal numbers that are separated by colons, for example 01:23:45:67:89:AB . In an IVL system the MAC address will be displayed as

8 bytes.

Interface The port through which this address was learned.

Interface Index This object indicates the ifIndex of the interface table entry associated with this port.



Term

Status

Definition

The status of this entry. The meanings of the values are:

• Static —The value of the corresponding instance was added by the system or a user when a static MAC filter was defined. It cannot be relearned.

• Learned —The value of the corresponding instance was learned by observing the source

MAC addresses of incoming traffic, and is currently in use.

• Management —The value of the corresponding instance (system MAC address) is also the value of an existing instance of dot1dStaticAddress. It is identified with interface 0/

1. and is currently used when enabling VLANs for routing.

• Self —The value of the corresponding instance is the address of one of the switch’s physical interfaces (the system’s own MAC address).

• GMRP Learned —The value of the corresponding was learned via GMRP and applies to

Multicast.

• Other —The value of the corresponding instance does not fall into one of the other categories.

If you enter the interface <unit/slot/port> parameter, in addition to the MAC

Address and Status fields, the following field appears:

Term

VLAN ID

Definition

The VLAN on which the MAC address was learned.

The following information displays if you enter the count parameter:

Term

Dynamic

Address count

Static Address

(User-defined) count

Total MAC

Addresses in use

Total MAC

Addresses available

Definition

Number of MAC addresses in the forwarding database that were automatically learned.

Number of MAC addresses in the forwarding database that were manually entered by a user.

Number of MAC addresses currently in the forwarding database.

Number of MAC addresses the forwarding database can handle.

show process cpu

This command provides the percentage utilization of the CPU by different tasks.


9-13


Note: It is not necessarily the traffic to the CPU, but different tasks that keep the CPU busy.

Format

Mode show process cpu

Privileged EXEC

The following shows example CLI display output.

(Switch) #show process cpu

Memory Utilization Report status bytes

------ ----------

free 192980480 alloc 53409968

Task Utilization Report

Task Utilization

----------------------- ----------- bcmL2X.0 0.75% bcmCNTR.0 0.20% bcmLINK.0 0.35%

DHCP snoop 0.10%

Dynamic ARP Inspection 0.10% dot1s_timer_task 0.10% dhcpsPingTask 0.20% show mbuf total

This command shows the total system buffer pools status.

Format

Mode show rmbuf total

Privileged EXEC

The following shows an example of CLI display output for the command.

(switch) #show mbuf total mbufSize 9284 (0x2444)

Current Time 0x1897fa


9-14


MbufsFree 150

MbufsRxUsed 0

Total Rx Norm Alloc Attempts 26212

Total Rx Mid2 Alloc Attempts 4087

Total Rx Mid1 Alloc Attempts 188943

Total Rx High Alloc Attempts 384555

Total Tx Alloc Attempts 2478536

Total Rx Norm Alloc Failures 0

Total Rx Mid2 Alloc Failures 0

Total Rx Mid1 Alloc Failures 0

Total Rx High Alloc Failures 0

Total Tx Alloc Failures 0 show running-config

Use this command to display or capture the current setting of different protocol packages supported on the switch. This command displays or captures commands with settings and configurations that differ from the default value. To display or capture the commands with settings and configurations that are equal to the default value, include the [all] option.

Note: Show running-config does not display the User Password, even if you set one different from the default.

The output is displayed in script format, which can be used to configure another switch with the same configuration. If the optional <scriptname> is provided with a file name extension of

“.scr”, the output is redirected to a script file.

Note: If you issue the show running-config command from a serial connection, access to the switch through remote connections (such as Telnet) is suspended while the output is being generated and displayed.

Note: If you use a text-based configuration file, the show running-config command will only display configured physical interfaces, i.e. if any interface only contains the default configuration, that interface will be skipped from the show running-config command output. This is true for any configuration mode that contains nothing but default configuration. That is, the command to enter a particular config mode, followed immediately by its ‘exit’ command, are both omitted from the show running-config command output (and hence from the startup-config file when the system configuration is saved.)



If option < changed > is used, this command displays/capture commands with settings/ configurations that differ from the defaul value.

• If all the flags in a particular group are enabled, then the command displays trapflags

<group name> all .

• If some, but not all, of the flags in that group are enabled, the command displays trapflags

<groupname> <flag-name>.

Format

Mode

show running-config [all | <scriptname> | changed]

Privileged EXEC show running-config interface

This command shows the current configuration on a particular interface. The interface could be a physical port or a virtual port—like a LAG or VLAN. The output captures how the configuration differs from the factory default value.

Format

Mode

show running-config interface {<unit/slot/port>} | VLAN <id> | LAG <id>}

Interface Config show sysinfo

This command displays switch information.

Format

Mode show sysinfo

Privileged EXEC

Term Definition

Switch

Description

Text used to identify this switch.

System Name Name used to identify the switch.The factory default is blank. To configure the system name, see “snmp-server” on page 10-41 .

System Location Text used to identify the location of the switch. The factory default is blank. To configure the system location, see “snmp-server” on page 10-41 .

System Contact Text used to identify a contact person for this switch. The factory default is blank. To configure the system location, see “snmp-server” on page 10-41 .

System Object ID The base object ID for the switch’s enterprise MIB.

System Up Time The time in days, hours and minutes since the last switch reboot.



Term Definition

MIBs Supported A list of MIBs supported by this agent.

show tech-support

Use the show tech-support command to display system and configuration information when you contact technical support. The output of the show tech-support command combines the output of the following commands:

• show version

• show sysinfo

• show port all

• show isdp neighbors

• show logging

• show event log

• show logging buffered

• show trap log

Format

Mode show tech-support

Privileged EXEC terminal length

Use this command to set the number of lines of output to be displayed on the screen, i.e. pagination, for the show running-config and show running-config all commands.

The terminal length size is either zero or a number in the range of 5 to 48. After the userconfigured number of lines is displayed in one page, the system prompts the user “ --More-- or

(q)uit.” Press q or Q to quit, or press any key to display the next set of < 5-48 > lines. The command terminal length 0 disables pagination and, as a result, the output of the show running-config command is displayed immediately.

Default

Format

Mode

24 lines per page terminal length < 0 |5-48>

Privileged EXEC



no terminal length

Use this command to set the terminal length to the default value.

Format

Mode no terminal length

Privileged EXEC show terminal length

Use this command to display the value of the user-configured terminal length size.

Format

Mode show terminal length

Privileged EXEC

Logging Commands

This section describes the commands you use to configure system logging, and to view logs and the logging settings.

logging buffered

This command enables logging to an in-memory log that keeps up to 128 logs.

Default

Format

Mode disabled; critical when enabled logging buffered

Global Config no logging buffered

This command disables logging to in-memory log.

Format

Mode no logging buffered

Global Config



logging buffered wrap

This command enables wrapping of in-memory logging when the log file reaches full capacity.

Otherwise when the log file reaches full capacity, logging stops.

Default

Format

Mode enabled logging buffered wrap

Privileged EXEC no logging buffered wrap

This command disables wrapping of in-memory logging and configures logging to stop when the log file capacity is full.

Format

Mode no logging buffered wrap

Privileged EXEC logging cli-command

This command enables the CLI command logging feature, which enables the 7000 series software to log all CLI commands issued on the system.

Default

Format

Mode enabled logging cli-command

Global Config no logging cli-command

This command disables the CLI command Logging feature.

Format

Mode no logging cli-command

Global Config



logging console

This command enables logging to the console. You can specify the <severitylevel> value as either an integer from 0 to 7 or symbolically through one of the following keywords: emergency

(0), alert (1), critical (2), error (3), warning (4), notice (5), info (6), or debug

(7).

Default

Format

Mode disabled; critical when enabled

logging console [severitylevel]

Global Config no logging console

This command disables logging to the console.

Format

Mode no logging console

Global Config logging host

This command enables logging to a host. You can configure up to eight hosts. The

<ipaddr|hostname> is the IP address of the logging host. The <addresstype> indicates the type of address ipv4 or ipv6 or dns being passed. The <port> value is a port number from 1 to 65535. You can specify the <severitylevel> value as either an integer from 0 to 7 or symbolically through one of the following keywords: emergency (0), alert (1), critical

(2), error (3), warning (4), notice (5), info (6), or debug (7).

Default

Format

Mode

• port—514

• level—critical (2)

logging host <ipaddr|hostname> <addresstype>

[<port>][<severitylevel>]

Global Config



logging host remove

This command disables logging to host. See “show logging hosts” on page 9-22 for a list of host indexes.

Format

Mode

logging host remove <hostindex>

Global Config logging syslog

This command enables syslog logging. The <portid> parameter is an integer with a range of 1-

65535.

Default

Format

Mode disabled

logging syslog [port <portid>]

Global Config no logging syslog

This command disables syslog logging.

Format

Mode no logging syslog

Global Config show logging

This command displays logging configuration information.

Format

Mode show logging

Privileged EXEC

Term Definition

Logging Client

Local Port

CLI Command

Logging

Port on the collector/relay to which syslog messages are sent.

Shows whether CLI Command logging is enabled.

Console Logging Shows whether console logging is enabled.


9-21


Term Definition

Console Logging

Severity Filter

The minimum severity to log to the console log. Messages with an equal or lower numerical severity are logged.

Buffered

Logging

Shows whether buffered logging is enabled.

Syslog Logging Shows whether syslog logging is enabled.

Log Messages

Received

Number of messages received by the log process. This includes messages that are dropped or ignored.

Log Messages

Dropped

Number of messages that could not be processed due to error or lack of resources.

Log Messages

Relayed

Number of messages sent to the collector/relay.

show logging buffered

This command displays buffered logging (system startup and system operation logs).

Format

Mode show logging buffered

Privileged EXEC

Term

Buffered (In-

Memory)

Logging

Buffered

Logging

Wrapping

Behavior

Buffered Log

Count

Definition

Shows whether the In-Memory log is enabled or disabled.

The behavior of the In Memory log when faced with a log full situation.

The count of valid entries in the buffered log. show logging hosts

This command displays all configured logging hosts. The <unit> is the switch identifier and has a range of 1-8.

Format

Mode

show logging hosts <unit>

Privileged EXEC



Term Definition

Host Index (Used for deleting hosts.)

IP Address /

Hostname

Port

IP address or hostname of the logging host.

Severity Level The minimum severity to log to the specified address. The possible values are emergency

(0), alert (1), critical (2), error (3), warning (4), notice (5), info (6), or debug (7).

The server port number, which is the port on the local host from which syslog messages are sent.

Host Status The state of logging to configured syslog hosts. If the status is disable, no logging occurs.

show logging traplogs

This command displays SNMP trap events and statistics.

Format

Mode show logging traplogs

Privileged EXEC

Term Definition

Number of Traps

Since Last Reset

The number of traps since the last boot.

Trap Log

Capacity

The number of traps the system can retain.

Number of Traps

Since Log Last

Viewed

The number of new traps since the command was last executed.

Log The log number.

System Time Up How long the system had been running at the time the trap was sent.

Trap The text of the trap message.


9-23


logging persistent

Use this command to configure the Persistent logging for the switch. The severity level of logging messages is specified at severity level. Possible values for severity level are (emergency|0, alert|1, critical|2, error|3, warning|4, notice|5, info|6, debug|7) .

Default

Format

Mode

Disable

logging persistent <severity level>

Global Config no logging persistent

Use this command to disable the persistent logging in the switch.

Format

Mode no logging persistent

Global Config

System Utility and Clear Commands

This section describes the commands you use to help troubleshoot connectivity issues and to restore various configurations to their factory defaults.


9-24


traceroute

Use the traceroute command to discover the routes that packets actually take when traveling to their destination through the network on a hop-by-hop basis. Traceroute continues to provide a synchronous response when initiated from the CLI.

Default

Format

Mode

• count: 3 probes

• interval: 3 seconds

• size: 0 bytes

• port: 33434

• maxTtl: 30 hops

• maxFail: 5 probes

•

• initTtl: 1 hop traceroute < ipaddr|hostname > [ initTtl < initTtl >] [ maxTtl < maxTtl >]

[ maxFail < maxFail >] [ interval < interval >] [ count < count >]

[ port < port >] [ size < size >]

Privileged EXEC

Using the options described below, you can specify the initial and maximum time-to-live (TTL) in probe packets, the maximum number of failures before termination, the number of probes sent for each TTL, and the size of each probe.

Parameter Description ipaddr|hostname The ipaddr value should be a valid IP address. The hostname value should be a valid hostname.

initTtl maxTtl maxFail

Use initTtl to specify the initial time-to-live (TTL), the maximum number of router hops between the local and remote system. Range is 0 to 255.

Use maxTtle to specify the maximum TTL. Range is 1 to 255.

interval

Use maxFail to terminate the traceroute after failing to receive a response for this number of consecutive probes. Range is 0 to 255.

Use interval to specify the time between probes, in seconds. Range is 1 to 60 seconds.

count port

Use the optional count parameter to specify the number of probes to send for each

TTL value. Range is 1 to 10 probes.

Use the optional port parameter to specify destination UDP port of the probe. This should be an unused port on the remote destination system. Range is 1 to 65535.

size Use the optional size parameter to specify the size, in bytes, of the payload of the

Echo Requests sent. Range is 0 to 65507 bytes.



Example: The following are examples of the CLI command.

traceroute Success:

(Switch) # traceroute 10.240.10.115 initTtl 1 maxTtl 4 maxFail 0 interval 1 count

3 port 33434 size 43

Traceroute to 10.240.10.115 ,4 hops max 43 byte packets:

1 10.240.4.1 708 msec 41 msec 11 msec

2 10.240.10.115 0 msec 0 msec 0 msec

Hop Count = 1 Last TTL = 2 Test attempt = 6 Test Success = 6 traceroute Failure:

(Switch) # traceroute 10.40.1.1 initTtl 1 maxFail 0 interval 1 count 3 port 33434 size 43

Traceroute to 10.40.1.1 ,30 hops max 43 byte packets:

1 10.240.4.1 19 msec 18 msec 9 msec

2 10.240.1.252 0 msec 0 msec 1 msec

3 172.31.0.9 277 msec 276 msec 277 msec

4 10.254.1.1 289 msec 327 msec 282 msec

5 10.254.21.2 287 msec 293 msec 296 msec

6 192.168.76.2 290 msec 291 msec 289 msec

7 0.0.0.0 0 msec *

Hop Count = 6 Last TTL = 7 Test attempt = 19 Test Success = 18 traceroute ipv6

Use the traceroute command to discover the routes that packets actually take when traveling to their destination through the network on a hop-by-hop basis. The < ipv6address|hostname > parameter must be a valid IPv6 address or hostname. The optional

< port > parameter is the UDP port used as the destination of packets sent as part of the traceroute. This port should be an unused port on the destination system. The range for < port > is zero (0) to 65535. The default value is 33434.

Default

Format

Mode port: 33434 traceroute ipv6 < ipv6-address|hostname > [ port < port >]

Privileged EXEC



clear config

This command resets the configuration to the factory defaults without powering off the switch.

When you issue this command, a prompt appears to confirm that the reset should proceed. When you enter y , you automatically reset the current configuration on the switch to the default values. It does not reset the switch.

Format

Mode clear config

Privileged EXEC clear mac-addr-table

This command clears the dynamically learned MAC addresses of the switch.

Format

Mode clear mac-addr-table

Privileged EXEC clear logging buffered

This command clears the messages maintained in the system log.

Format

Mode clear logging buffered

Privileged EXEC clear counters

This command clears the statistics for a specified <unit/slot/port>, for all the ports, or for the entire switch based upon the argument.

Format

Mode

clear counters {<unit/slot/port> | all}

Privileged EXEC


9-27


clear igmpsnooping

This command clears the tables managed by the IGMP Snooping function and attempts to delete these entries from the Multicast Forwarding Database.

Format

Mode clear igmpsnooping

Privileged EXEC clear pass

This command resets all user passwords to the factory defaults without powering off the switch.

You are prompted to confirm that the password reset should proceed.

Format

Mode clear pass

Privileged EXEC clear port-channel

This command clears all port-channels (LAGs).

Format

Mode clear port-channel

Privileged EXEC clear traplog

This command clears the trap log.

Format

Mode clear traplog

Privileged EXEC clear vlan

This command resets VLAN configuration parameters to the factory defaults.

Format

Mode clear vlan

Privileged EXEC



enable password

This command prompts you to change the Privileged EXEC password. Passwords are a maximum of 64 alphanumeric characters. The password is case sensitive. The option [encrypted] allows the administrator to transfer the enable password between devices without having to know the password. In this case, the <password> parameter must be exactly 128 hexadecimal characters..

Format

Mode enable password <passwor> [encrypted]

Privileged EXEC logout

This command closes the current telnet connection or resets the current serial connection.

Note: Save configuration changes before logging out.

Format

Modes logout

• Privileged EXEC

• User EXEC ping

Use this command to determine whether another computer is on the network. Ping provides a synchronous response when initiated from the CLI and Web interfaces.

Default

Format

Modes

• The default count is 1.

• The default interval is 3 seconds.

• The default size is 0 bytes.

ping <ipaddress|hostname> [count <count>] [interval <interval>] [size

<size>]

• Privileged EXEC

• User EXEC



Using the options described below, you can specify the number and size of Echo Requests and the interval between Echo Requests.

Parameter count interval size

Description

Use the count parameter to specify the number of ping packets (ICMP Echo requests) that are sent to the destination address specified by the <ip-address> field. The range for <count> is 1 to 15 requests.

Use the interval parameter to specify the time between Echo Requests, in seconds.

Range is 1 to 60 seconds.

Use the size parameter to specify the size, in bytes, of the payload of the Echo

Requests sent. Range is 0 to 65507 bytes.

The following are examples of the CLI command.

ping success:

(Switch) #ping 10.254.2.160 count 3 interval 1 size 255

Pinging 10.254.2.160 with 255 bytes of data:

Received response for icmp_seq = 0. time= 275268 usec



----10.254.2.160 PING statistics----

3 packets transmitted, 3 packets received, 0% packet loss round-trip (msec) min/avg/max = 274/279/276 ping failure:

In Case of Unreachable Destination:

(Switch) # ping 192.168.254.222 count 3 interval 1 size 255


Received Response: Unreachable Destination

Received Response :Unreachable Destination

Received Response :Unreachable Destination

----192.168.254.222 PING statistics----

3 packets transmitted,3 packets received, 0% packet loss round-trip (msec) min/avg/max = 0/0/0

In Case Of Request TimedOut:

(Switch) # ping 1.1.1.1 count 1 interval 3


----1.1.1.1 PING statistics----



1 packets transmitted,0 packets received, 100% packet loss round-trip (msec) min/avg/max = 0/0/0 quit

This command closes the current telnet connection or resets the current serial connection. The system asks you whether to save configuration changes before quitting.

Format

Modes quit

• Privileged EXEC

• User EXEC reload

This command resets the switch without powering it off. Reset means that all network connections are terminated and the boot code executes. The switch uses the stored configuration to initialize the switch. You are prompted to confirm that the reset should proceed. The LEDs on the switch indicate a successful reset.

Format

Mode reload

Privileged EXEC save

This command makes the current configuration changes permanent by writing the configuration changes to system NVRAM.

Format

Mode save

Privileged EXEC


9-31


copy

The copy command uploads and downloads files to and from the switch. You can also use the copy command to manage the dual images ( image1 and image2 ) on the file system. Upload and download files from a server by using TFTP or Xmodem. SFTP and SCP are available as additional transfer methods if the software package supports secure management.

Format

Mode copy <source> <destination>

Privileged EXEC

Replace the <source> and <destination> parameters with the options in table below. For the <url> source or destination, use one of the following values:

{xmodem | tftp://<ipaddr|hostname>|<ip6address|hostname>/<filepath>/<filename>

[noval]

| sftp|scp://<username>@<ipaddr>|<ipv6address>|<filepath>|<filename>}

For TFTP, SFTP and SCP, the <ipaddr|hostname> parameter is the IP address or host name of the server, <filepath> is the path to the file, and <filename> is the name of the file you want to upload or download. For SFTP and SCP, the <username> parameter is the username for logging into the remote server via SSH.

Note: < ip6address > is also a valid parameter for routing packages that support IPv6.

Warning: Remember to upload the existing Switch CLI.cfg file off the switch prior to loading a new release image in order to make a backup.

Parameters for the copy command are listed int the following table:

Source nvram:backup-config nvram:clibanner nvram:errorlog nvram:Switch CLI.cfg

nvram:log

Destination nvram:startup-config

<url>

<url>

<url>

<url>

Description

Copies the backup configuration to the startup configuration.

Copies the CLI banner to a server.

Copies the error log file to a server.

Uploads the binary config file to a server.

Copies the log file to a server.



Source Destination Description nvram:script

<scriptname> nvram:startup-config nvram:startup-config nvram:traplog system:running-config

<url>

<url>

<url>

<url>

<url> nvram:backup-config

<url>

<url> nvram:startup-config nvram:clibanner nvram:Switch CLI.cfg

nvram:script

<destfilename> nvram:script

<destfilename> noval

Copies a specified configuration script file to a server.

Copies the startup configuration to the backup configuration.

Copies the startup configuration to a server.

Copies the trap log file to a server.

Saves the running configuration to nvram.

Downloads the CLI banner to the system.

Downloads the binary config file to the system.

Downloads a configuration script file to the system.

During the download of a configuration script, the copy command validates the script. In case of any error, the command lists all the lines at the end of the validation process and prompts you to confirm before copying the script file.

When you use this option, the copy command will not validate the downloaded script file. An example of the

CLI command follows:

(NETGEAR Switch CLI Routing) #copy tftp://1.1.1.1/file.scr nvram:script file.scr noval

<url> nvram:sshkey-dsa

<url>

<url> nvram:sshkey-rsa1 nvram:sshkey-rsa2

Downloads an SSH key file. For more information, see

“Secure Shell (SSH) Commands” on page 10-16 .

Downloads an SSH key file.

Downloads an SSH key file.

<url>

<url>

<url> nvram:sslpem-dhweak nvram:sslpem-dhstrong nvram:sslpem-root nvram:sslpem-server

Downloads an HTTP secure-server certificate.


Downloads an HTTP secure-server certificate. For more information, see “Hypertext Transfer Protocol

(HTTP) Commands” on page 10-20 .


<url>

<url>

<url>

<url>

<url>

{image1 | image2} nvram:startup-config nvram:system-image kernel

{image1 | image2}

<url>

Downloads the startup configuration file to the system.

Downloads a code image to the system.

Downloads a code file by xmodem, zmodem, or TFTP.

Download an image from the remote server to either image. In a stacking environment, the downloaded image is distributed to the stack nodes.

Upload either image to the remote server.



Source image1 image2

{image1 | image2}

{image1 | image2}

Destination Description image2 image1 unit://<unit>/{image1 | image2}

Copy image1 to image2 .

Copy image2 to image1 .

Copy an image from the management node to a given node in a Stack. Use the unit parameter to specify the node to which the image should be copied. unit://*/{image1 | image2} Copy an image from the management node to all of the nodes in a Stack.

Simple Network Time Protocol (SNTP) Commands

This section describes the commands you use to automatically configure the system time and date by using SNTP.

sntp broadcast client poll-interval

This command sets the poll interval for SNTP broadcast clients in seconds as a power of two where <poll-interval> can be a value from 6 to 10.

Default

Format

Mode

6

sntp broadcast client poll-interval <poll-interval>

Global Config no sntp broadcast client poll-interval

This command resets the poll interval for SNTP broadcast client back to the default value.

Format

Mode no sntp broadcast client poll-interval

Global Config


9-34


sntp client mode

This command enables Simple Network Time Protocol (SNTP) client mode and may set the mode to either broadcast or unicast.

Default

Format

Mode disabled

sntp client mode [broadcast | unicast]

Global Config no sntp client mode

This command disables Simple Network Time Protocol (SNTP) client mode.

Format

Mode no sntp client mode

Global Config sntp client port

This command sets the SNTP client port id to a value from 1-65535.

Default

Format

Mode

123

sntp client port <portid>

Global Config no sntp client port

This command resets the SNTP client port back to its default value.

Format

Mode no sntp client port

Global Config


9-35


sntp unicast client poll-interval

This command sets the poll interval for SNTP unicast clients in seconds as a power of two where

<poll-interval> can be a value from 6 to 10.

Default

Format

Mode

6

sntp unicast client poll-interval <poll-interval>

Global Config no sntp unicast client poll-interval

This command resets the poll interval for SNTP unicast clients to its default value.

Format

Mode no sntp unicast client poll-interval

Global Config sntp unicast client poll-timeout

This command will set the poll timeout for SNTP unicast clients in seconds to a value from 1-30.

Default

Format

Mode

5

sntp unicast client poll-timeout <poll-timeout>

Global Config no sntp unicast client poll-timeout

This command will reset the poll timeout for SNTP unicast clients to its default value.

Format

Mode no sntp unicast client poll-timeout

Global Config sntp unicast client poll-retry

This command will set the poll retry for SNTP unicast clients to a value from 0 to 10.

Default 1


Format

Mode


sntp unicast client poll-retry <poll-retry>

Global Config no sntp unicast client poll-retry

This command will reset the poll retry for SNTP unicast clients to its default value.

Format

Mode no sntp unicast client poll-retry

Global Config sntp server

This command configures an SNTP server (a maximum of three). The optional priority can be a value of 1-3, the version a value of 1-4, and the port id a value of 1-65535.

Format

Mode

sntp server <ipaddress|hostname> [<priority> [<version> [<portid>]]]

Global Config no sntp server

This command deletes an server from the configured SNTP servers.

Format

Mode

no sntp server remove <ipaddress|hostname>

Global Config clock timezone

When using SNTP/NTP time servers to update the switch’s clock, the time data received from the server is based on Coordinated Universal Time (UTC) which is the same as Greenwich Mean

Time (GMT). This may not be the time zone in which the switch is located. Use the clock timezone command to configure a time zone specifying the number of hours and optionally the number of minutes difference from UTC. To set the switch clock to UTC, use the no form of the command.

Format

Mode

Default clock timezone zone-name +/-hours-offset [+/-minutes-offset]

Global Config no clock timezone



Zone name: A name to associate with the time zone

Hours-offset: Number of hours difference with UTC

Minutes-offset: Number of minutes difference with UTC no clock timezone

This command sets the switch to UTC time.

Format

Mode no clock timezone

Global Config show sntp

This command is used to display SNTP settings and status.

Format

Mode show sntp

Privileged EXEC

Term Definition

Last Update

Time

Time of last clock update.

Last Unicast

Attempt Time

Last Attempt

Status

Time of last transmit query (in unicast mode).

Status of the last SNTP request (in unicast mode) or unsolicited message (in broadcast mode).

Broadcast Count Current number of unsolicited broadcast messages that have been received and processed by the SNTP client since last reboot.

Multicast Count Current number of unsolicited multicast messages that have been received and processed by the SNTP client since last reboot.

show sntp client

This command is used to display SNTP client settings.

Format

Mode show sntp client

Privileged EXEC


9-38


Term Definition

Client Supported

Modes

Supported SNTP Modes (Broadcast, Unicast, or Multicast).

SNTP Version The highest SNTP version the client supports.

Port SNTP Client Port.

Client Mode Configured SNTP Client Mode.

show sntp server

This command is used to display SNTP server settings and configured servers.

Format

Mode show sntp server

Privileged EXEC

Term Definition

Server Host

Address

IP address or hostname of configured SNTP Server.

Server Type Address Type of Server.

Server Stratum Claimed stratum of the server for the last received valid packet.

Server

Reference