DGS-6600-48T - NAS D-LINK - Free user manual and instructions

USER MANUAL DGS-6600-48T D-LINK

Illustration of a multi-chamber electronic device with ports and connectors (no visible text or labels)

X CHASSIS

CLI Reference Guide

Product Model: DGS-6600 Series

Modular Layer 3 Chassis Ethernet Managed Switch

Software Release 1.00.029

DGS-6604 CLI Reference Guide

Software Release 1.00.029

Date: March 15, 2011

Copyright Statement

D-Link Corporation © 2011

All rights reserved.

Without our written permission this document may not be excerpted, reproduced, transmitted, or otherwise in all or part by any party by any means.

Preface

Version Description

This manual's command descriptions are based on the software release 1.00.029. The commands listed here are the subset of commands that are supported by the DGS-6600 series switches.

Note: Other Ethernet L2/L3 Chassis-Based Switch series Hardware using similar software may support a different subset of commands although generally the majority of the supported commands and options will be similar.

Audience

This reference manual is intended for network administrators and other IT networking professionals responsible for managing the DGS-6604 by using the D-LINK Command Line Reference (CLI). The CLI is the primary management interface to the D-LINK DGS-6604 which will be generally referred to as the “switch” within this manual. This manual is written in a way that assumes that you already have the experience and knowledge of Ethernet and modern networking principles for Local Area Networks.

Document Organization

Preface Describes how to use the CLI reference manual.
Feature Table of Contents	A clickable commnad list of the DGS-6604 commands grouped by their features and linked to the command descriptions..
Command Listings	A complete list of available commands arranged in alphabetical order.
Acronyms	A glossary of acronyms used throughout the reference manual.

Other Documentation

The documents below are a further source of information in regards to configuring and troubleshooting the switch. All the documents are available for download from D-Links web site www.d-link.com.

• DGS-6600 Series Quick Installation Guide
• DGS-6600 Series Hardware Installation Guide

Conventions

Convention Description
boldface font	Commands, command options and keywords are printed in boldface. Key words in the command line, are to be entered exactly as they are displayed.
UPPERCASE ITALICS font	Parameters or values that must be specified are printed in UPPERCASE ITALICS. Parameters in the command line, are to be replaced with the actual values that are desired to be used with the command.
[ ]	Square brackets enclose an optional value or set of optional arguments.
{a|b|c}	Braces enclose alternative keywords seperated by vertical bars. Generally, one of the keywords in the seperated list can be chosen.
[a|b|c]	Optional values or arguements are enclosed in square barackets and seperated by vertical bars. Generally, one of the vales or arguements in the seperated list can be chosen.
blue color screen	Blue color screen font: is used it presents an example of a screen console display including example entries of CLI command input with the corresponding output.

Notes, Notices, and Cautions

Below are examples of the 3 types of indicators used in this manual. When administering your switch using the information in this document, you should pay special attention to these indicators. Each example below provides an explanatory remark regarding each type of indicator.

NOTE: A NOTE indicates important information that helps you make better use of your device

NOTICE: A NOTICE indicates either potential damage to hardware or loss of data and tells you how to avoid the problem

CAUTION: A CAUTION indicates a potential for property damage, personal injury, or death.

Command Descriptions:

The information pertaining to each command in this reference guide is presented using a number of template fields. The fields are:

• Description - This is a short and consise statement describing the commands functionality.

- Syntax - The precise form to use when entering and issuing the command. The form conventions are described in the table shown under the section "Conventions" on page iv of this guide.

- Syntax Description - A table where each row describes the optional or required arguments, and their use, that can be issued with the command.

- Default - If the command sets a configuration value or administrative state of the switch then any default settings (i.e. without issuing the command) of the configuration is shown here.

- Command Mode - The mode in which the command can be issued. The modes are either User EXEC, Privileged EXEC, Global Configuration or a specific configuration mode. These modes are described in the section titled “Command Modes” on page v below.

- Command Usage - If necessary, a detailed description of the command and its various utilization scenarios is given here.

- Example(s) - Each command is accompanied by a practical example of the command being issued in a suitable scenario.

Command Modes

There are several command modes available in the command-line interface (CLI). The set of commands available to the user depends on both the mode the user is currently in and their privilege level. For each case, the user can see all the commands that are available in a particular command mode by entering a question mark (?) at the system prompt.

The command-line interface has four privilege levels:

- Basic User- Privilege Level 1. This user account level has the lowest priority of the user accounts and is allowed to configure the terminal control settings. The purpose of this type of user account level is for basic system checking. This user account can only show limited information that is not related to security. The most important limitation of this account is that there is no way of changing the access right level.

- Advanced User- Privilege Level 2. This user account level is very similar to a basic user except that an advanced user can enter privileged EXEC mode.

- Power User- Privilege Level 12. This user account level is used to grant system configuration rights for users who need to change or monitor system configuration, except for security related information such as user accounts and SNMP account settings, etc.

- Administrator- Privilege Level 15. This administrator user account level can monitor all system information and change any of the system configuration settings expressed in this configuration guide.

The command-line interface has a number of command modes. There are three basic command modes:

• User EXEC mode
• Privileged EXEC mode

• Global Configuration mode

All other sub-configuration modes can be accessed via global configuration mode.

When a user logs in to the Switch, the privilege level of the user determines the command mode the user will enter after initially logging in. The user will either log into user EXEC mode or privileged EXEC mode. Users with a basic user and advanced user level will log into the Switch in user EXEC mode. Users with power user and administrator level accounts will log into the Switch in privileged EXEC mode. Therefore, user EXEC mode can operate at either basic user level or advanced user level, and privileged EXEC mode can operate at either power user level or administrator level. The user can only enter global configuration mode from privileged EXEC mode. Therefore, global configuration mode can be accessed by users who have power user or administrator level user accounts. As for sub-configuration modes, a subset of those can only be accessed by users who have the highest secure administrator level privileges.

In user EXEC mode at advanced user level, the user is allowed to enter privileged EXEC mode by entering the enable password. In privileged EXEC mode, the user is allowed to exit to the user EXEC mode at advanced user level by entering the disable command. The enable password and disable commands are functions that can be used to switch between user EXEC mode and privileged EXEC mode.

The following state diagram describes the main command modes and how to enter each one:

graph TD
    A["Login"] -->|Basic User| B["User EXEC mode\nBasic user"]
    A -->|Advanced User| C["User EXEC mode\nAdvanced user"]
    A -->|Administrator| D["Privileged EXEC mode\nAdministrator"]
    B -->|Disable Power User| E["Privileged EXEC mode\nPower user"]
    C -->|Enable Administrator| F["Privileged EXEC mode\nAdministrator"]
    D -->|Disable Administrator| F
    E -->|config| G["Global configuration mode\nAdministrator/Power user"]
    F -->|config| G
    G -->|interface| H["Interface configuration mode\nAdministrator/Power user"]
    G -->|vlan| I["VLAN configuration mode\nAdministrator/Power user"]
    G -->|mgmt-if| J["Mgmt-if configuration mode\nAdministrator"]
    A -->|Power User| B
    A -->|Power User| C
    A -->|Power User| D
    B -->|Power User| E
    C -->|Power User| F
    D -->|Power User| G

Note: Not all configuration modes are listed in the above figure. For example, in global configuration mode, enter “router ospf” to enter OSPF router configuration mode

The following table briefly lists the available command modes. Only the basic command modes and some of the sub-configuration modes are enumerated. The basic command modes and basic sub-configuration modes are further described in the following chapters. Descriptions for the rest of the sub-configuration modes are not provided in this section. For more information on the additional sub-configuration modes, the user should refer to the chapters relating to these functions.

The available command modes and privilege levels are described below:

Command Mode & Privilege Level Purpose
User EXEC mode at Basic User level For checking basic system settings, allowing users to change the local terminal session settings, and verifying basic network connectivity. Checking security related settings is not allowed at this command mode and privilege level.
User EXEC mode at Advanced User level	This level has almost the same access rights as user EXEC mode at basic user level, except that a user in this mode and at this level can enter privileged EXEC mode by entering the enable command.
Privileged EXEC mode at Power User level	For changing both local and global terminal settings, monitoring, and performing certain system administration tasks. The system administration tasks that can be performed at this level includes the clearing of system configuration settings, except for any security related information, such as user accounts, SNMP account settings etc.
Privileged EXEC mode at Administrator level	This level is identical to privileged EXEC mode at power user level, except that a user at the administrator level can monitor and clear security related settings.
Global Configuration Mode at Power User level	For applying global settings, except for security related settings, on the entire Switch. In addition to applying global settings on the entire Switch, the user can access other sub-configuration modes from global configuration mode.
Global Configuration Mode at Administrator level	For applying global settings on the entire Switch. In addition to applying global settings on the entire Switch, the user can access other sub-configuration modes from global configuration mode.
Interface Configuration Mode at Power User level	For applying interface related settings.

Command Mode & Privilege Level Purpose

VLAN Interface Configuration Mode For applying VLAN interface related settings.

VLAN Configuration Mode For applying settings to a VLAN.

IP Access-List Configuration Mode For specifying filtering criteria for an IP access list.

User EXEC Mode at Basic User Level

This command mode is mainly designed for checking basic system settings, allowing users to change the local terminal session settings and carry out basic network connectivity verification. One limitation of this command mode is that it cannot be used to display information related to security. The most significant limitation of this command mode is that there is no way of changing the access right level of the logged in user.

This command mode can be entered by logging in as a basic user.

User EXEC Mode at Advanced User Level

User EXEC mode at advanced user level has the same purpose as user EXEC mode at basic user level, except that user EXEC mode at advanced user level is allowed to use the enable command to enter privileged EXEC mode.

This command mode can be entered by logging in as an advanced user or by using the disable command in privileged EXEC mode.

In the following example, the user is currently logged in as an advanced user in privileged EXEC mode and uses the disable command to return to user EXEC mode at advanced user level:

DGS-6604:15#disable
DGS-6604:2> 

Privileged EXEC Mode at Power User Level

Users logged into the Switch in privileged EXEC mode at this level can change both local and global terminal settings, monitor, and perform system administration tasks like clearing configuration settings (except for security related information such as user accounts, SNMP account settings etc.)

There are two methods that a user can use to enter privileged EXEC mode at power user level. The first method is to login to the Switch with a user account that has a privilege level of 12. The other method is to use the enable privilege LEVEL command in user EXEC mode.

In the following example, the user enters privileged EXEC mode at power user level by logging in with a user account called “power-user” that has a privilege level of 12:

User Access Verification

Username: power-user
Password:
DGS-6604 Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
DGS-6604:12# 

In the following example, the user enters the enable privilege LEVEL command in user EXEC mode to enter privileged EXEC mode at Power User level:

DGS-6604:2>enable privilege 12
DGS-6604:12# 

Privileged EXEC Mode at Administrator Level

This command mode has a privilege level of 15. Users logged in with this command mode can monitor all system information and change any system configuration settings mentioned in this Configuration Guide.

There are two methods that a user can use to enter privileged EXEC mode at administrator level. The first method is to login to the Switch with a user account that has a privilege level of 15. The second method requires a user to login to the Switch in as a user with an advanced user or power user level and and use the enable privilege LEVEL command.

In this command mode, the user can return to user EXEC mode at an advanced user level by entering the disable command.

In the following example, the user is currently logged in as an administrator in privileged EXEC mode and uses the disable command to return to user EXEC mode at an advanced user level:

DGS-6604:15#disable
DGS-6604:2> 

In the following example, the user enters the enable privilege LEVEL command in privileged EXEC mode at power user level to enter privileged EXEC mode at an administrator level:

DGS-6604:12#enable privilege 15
DGS-6604:15# 

Global Configuration Mode

The primary purpose of global configuration mode is to apply global settings on the entire Switch. Global configuration mode can be accessed at both power user and administrator level. However, security related settings are not accessible at power user level. In addition to applying global settings on the entire Switch, the user can also access other sub-configuration modes.

In order to access global configuration mode, the user must be logged in as an administrator or power user and use the configure terminal command in privileged EXEC mode.

In the following example, the user is logged in as an Administrator in privileged EXEC mode and uses the configure terminal command to access global configuration mode:

DGS-6604:15#configure terminal
DGS-6604:15(config)#

The exit command is used to exit global configuration mode and return to privileged EXEC mode.

The procedures to enter the different sub-configuration modes can be found in the related chapters in this Configuration Guide. The command modes are used to configure the individual functions.

Interface Configuration Mode

Interface configuration mode is used to configure the parameters for an interface or a range of interfaces. An interface can be a physical port, VLAN, or other virtual interface. Thus, interface configuration mode is distinguished further according to the type of interface. The command prompt for each type of interface is slightly different.

VLAN Interface Configuration Mode

VLAN interface configuration mode is one of the available interface modes and is used to configure the parameters of a VLAN interface.

To access VLAN interface configuration mode, use the following command in global configuration mode:

Command Explanation

DGS-6604:15 (config) #interface vlanVLAN-ID 

Enters VLAN interface configuration mode.

Command Listing by Feature

802.1x dot1x auth-mode — 125

dot1x auth-protocol — 126

dot1x control-direction — 127

dot1x default — 128

dot1x forward-pdu — 129

dot1x guest-vlan — 130

dot1x initialize — 132

dot1x max-req — 133

dot1x pae authenticator — 134

dot1x port-control — 135

dot1x re-authenticate — 136

dot1x re-authentication — 137

dot1x system-auth-control — 138

dot1x timeout — 139

dot1x user — 140

show dot1x — 439

show dot1x user — 442

AAA aaa authentication — 1

aaa authorization — 3

aaa group server — 4

show aaa — 423

show aaa group server — 426

server — 410

Access

Control Lists

ip access-group — 162

ip access-list — 163

mac access-group — 302

mac access-list — 303

ipv6 access-group — 245

ipv6 access-list — 247

periodic — 348

permit | deny (ip access-list) — 349

permit | deny (ipv6 access list) — 352

permit | deny (mac access-list) — 354

resequence access-list — 396

show access-group — 427

show access-list — 428

show time-range — 607

time-range — 692

Access

Management

banner login — 31

command prompt — 92

configure terminal — 94

disable — 115

enable — 142

enable password — 143

end — 144

exit — 145

help — 154

ip http server — 185

ip http service-port — 186

ip telnet server — 241

ip telnet service-port — 242 ip trusted-host — 243 login — 300 logout — 301 password encryption — 347 show enable password — 443 show history — 450 show ip trusted-host — 538 show username — 610 show user-session — 611 telnet — 679 terminal length — 684 terminal timeout — 685 terminal width — 686 username — 702

Basic IPv4 arp — 27

arp timeout — 28 clear arp-cache — 63 ip address — 164 show arp — 429 show ip interface — 490

Basic IPv6 clear ipv6 neighbors — 78

default ipv6 nd prefix — 106 ipv6 enable — 258 ipv6 address — 248 ipv6 hop-limit — 259

ipv6 nd managed-config-flag — 260
ipv6 nd other-config-flag — 261
ipv6 nd prefix — 262
ipv6 nd ra-interval — 263
ipv6 nd ra-lifetime — 264
ipv6 nd reachable-time — 265
ipv6 nd retrans-timer — 266
ipv6 nd suppress-ra — 267
ipv6 neighbor — 268
show ipv6 interface — 545
show ipv6 interface brief — 546
show ipv6 neighbors — 547

Basic Switch show environment — 444

show system — 604

show unit — 609

show version — 612

BGP address-family ipv4 — 11

aggregate-address — 12

bgp asnotation dot — 42

bgp always-compare-med — 41

bgp bestpath as-path ignore — 44

bgp bestpath compare-routerid — 46

bgp default ipv4-unicast — 47

bgp default local-preference — 48

bgp deterministic-med — 49

bgp enforce-first-as — 50

bgp log-neighbor-changes — 51
bgp router-id — 52
clear ip bgp — 67
clear ip bgp peer-group — 69
ip as-path access-list — 168
ip community-list — 169
match as-path — 312
match community — 313
neighbor advertisement-interval — 324
neighbor description — 325
neighbor filter-list — 326
neighbor peer-group (create group) — 327
neighbor peer-group (add group member) — 328
neighbor remote-as — 329
neighbor route-map — 330
neighbor send-community — 331
neighbor shutdown — 332
neighbor timers — 333
neighbor update-source — 334
neighbor weight — 335
network (BGP) — 340
router bgp — 401
set as-path — 418
set community — 419
set origin — 421
set weight — 422
show ip as-path access-list — 453

	show ip bgp — 454
	show ip community-list — 462
	show ip bgp filter-list — 458
	show ip bgp community-list — 456
	show ip bgp neighbors — 459
	synchronization — 677
	timers bgp — 691
Broadcast Storm	show storm-control — 602
	storm-control (Interface) — 665
	storm-control action (Interface) — 666
	storm-control level (Interface) — 668
	storm-control timer (Global) — 670
Chassis reboot — 387
DHCP Client (IPv6)	clear ipv6 dhcp client — 77
	ipv6 address — 249
	ipv6 dhcp client information refresh minimum — 253
	ipv6 dhcp client pd — 254
	show ipv6 general-prefix — 543
	show ipv6 dhcp — 539
DHCP Relay (IPv4)	ip dhcp relay — 174
	ip dhcp relay address — 175
	ip dhcp relay hops — 176
	ip dhcp relay information check — 177
	ip dhcp relay information option — 178
	ip dhcp relay information policy — 180
	ip dhcp relay information trust-all — 181

DHCP Relay (IPv6)

ip dhcp relay information trusted — 182 show ip dhcp relay — 469 show ip dhcp relay information trusted-sources — 470

DHCP Server (IPv4)

ipv6 dhcp relay destination — 256 show ipv6 dhcp relay interface — 542

accept dhcp client-identifier — 5 accept dhcp relay-agent — 6 bootfile — 55 based-on client-id — 33 based-on c-vid — 34 based-on interface-ip-address — 35 based-on mac-address — 36 based-on relay-ip-address — 37 based-on s-vid — 38 based-on vendor-class — 39 based-on user-class — 40 clear ip dhcp binding — 71 clear ip dhcp conflict — 73 clear ip dhcp server statistics — 75 default-router — 111 dns-server — 118 domain-name — 119 ip address-list — 167 ip dhcp ping packets — 171 ip dhcp ping timeout — 172 ip dhcp pool — 173

	lease — 294
	netbios node-type — 336
	netbios scope-id — 337
	netbios wins-server — 338
	next-server — 342
	service dhcp — 412
	subnet-mask — 673
	show ip dhcp binding — 463
	show ip dhcp conflict — 465
	show ip dhcp pool — 466
	show ip dhcp server statistics — 472
DoS Prevention	dos_prevention action — 120
	dos_prevention type — 121
	clear dos prevention counter — 65
	show dos_prevention — 437
DVMRP ip dvmrp — 183
File System delete — 112
GVRP clear gvrp statistics interface — 66

gvrp advertise (Interface) — 149 gvrp advertise (VLAN) — 150 gvrp dynamic-vlan-creation — 151 gvrp forbidden — 152 gvrp timer — 153 show gvrp configuration — 447 show gvrp statistics — 449

IGMP ip igmp access-group — 187

ip igmp last-member-query-interval — 189 iip igmp query-interval — 190 ip igmp query-max-response-time — 191 ip igmp robustness-variable — 192 ip igmp version — 201 show ip igmp group — 480 show ip igmp interface — 483

IGMP

Snooping

ip igmp snooping — 193 ip igmp snooping immediate-leave — 197 ip igmp snooping (multicast router) — 195 ip igmp snooping querier — 198 ip igmp snooping static-group — 199 show ip igmp snooping — 484 show ip igmp snooping group — 486 show ip igmp snooping mrouter — 489

Interface clear counters — 64

description — 113

interface — 159

interface range — 160

show interface — 451

IP Utility ping — 356

traceroute — 693

IP Multicast ip multicast-routing — 206

ip mroute — 202

show ip mroute — 493

IPv6 Protocol Independent

ipv6 route — 279

show ipv6 protocols — 556

show ipv6 route — 560

show ipv6 route summary — 562

IPv6 Tunnel interface tunnel — 161

ipv6 nd suppress-ra — 267

tunnel destination — 699

tunnel mode — 700

tunnel source — 701

Jumbo Frame ip mtu — 204

max-rcv-frame-size — 315

mtu — 319

L2 FDB clear mac address-table — 82

mac address-table aging destination-hit — 304

mac address-table aging-time — 305

mac address-table static — 306

multicast filtering-mode — 320

show mac address-table — 566

show mac address-table aging destination-hit — 568

show mac address-table aging-time — 569

show multicast filtering-mode — 572

LACP channel-group — 58

Iacp port-priority — 292

Iacp system-priority — 293

port-channel load-balance — 370

show channel-group — 431

Management Port

default-gateway (management port) — 101

ip address (management port) — 166

ip mtu (management port) — 205

ipv6 address (management port) — 251

ipv6 default-gateway (management port) — 252

mgmt-if — 316

show mgmt-if — 570

shutdown (Management Port) — 627

Mirror monitor session — 317

show monitor session — 571

MSTP instance — 158

name — 321

revision — 397

show spanning-tree mst — 597

spanning-tree mst (cost | port-priority) — 654

spanning-tree mst (forward | max-age | max-hops) — 655

spanning-tree mst configuration — 656

spanning-tree mst hello-time — 657

spanning-tree mst priority — 658

OSPFv2 area default-cost — 13

area nssa — 15

area range — 17

area stub — 19

area virtual-link — 21

auto-cost reference-bandwidth — 29

clear ip ospf — 76

default-information originate — 102

default-metric (OSPF) — 107

host area — 155

ip ospf authentication — 207

ip ospf authentication-key — 208

ip ospf cost — 209

ip ospf dead-interval — 210

ip ospf hello-interval — 211

ip ospf message-digest-key — 212

ip ospf priority — 213

ip ospf retransmit-interval — 214

ip ospf shutdown — 215

ip ospf transmit-delay — 216

network area — 341

passive-interface — 343

redistribute (OSPF) — 388

router-id — 402

router ospf — 406

show ip ospf — 495

show ip ospf border-routers — 497

show ip ospf database — 498 show ip ospf database asbr-summary — 500 show ip ospf database external — 502 show ip ospf database network — 503 show ip ospf database nssa-external — 505 show ip ospf database router — 507 show ip ospf database summary — 510 show ip ospf host-route — 512 show ip ospf interface — 513 show ip ospf neighbor — 515 show ip ospf virtual-links — 516

OSPFv3 area default-cost (IPv6) — 14

area range (IPv6) — 18 area stub (IPv6) — 20 area virtual-link (IPv6) — 25 auto-cost reference-bandwidth (IPv6) — 30 clear ipv6 ospf process — 79 default-information originate (IPv6 OSPF) — 103 default-metric (IPv6 OSPF) — 108 ipv6 ospf cost — 269 ipv6 ospf dead-interval — 270 ipv6 ospf hello-interval — 271 ipv6 ospf priority — 272 ipv6 ospf retransmit-interval — 273 ipv6 ospf shutdown — 274 ipv6 ospf transmit delay — 275 ipv6 router ospf area — 284

passive-interface (IPv6 OSPF) — 344 redistribute (IPv6 OSPF) — 390 router-id (IPv6) — 403 router ipv6 ospf — 405 show ipv6 ospf — 548 show ipv6 ospf border-routers — 550 show ipv6 ospf database — 551 show ipv6 ospf interface — 552 show ipv6 ospf neighbor — 553 show ipv6 ospf route — 554 show ipv6 ospf virtual-links — 555 show ipv6 protocols — 556

PIM ip pim — 217

ip pim accept-register — 218 ip pim bsr-candidate — 219 ip pim dr-priority — 221 ip pim join-prune-interval — 222 ip pim prune-limit-interval — 223 ip pim query-interval — 224 ip pim register-checksum - include-data — 225 ip pim register-suppression — 226 ip pim rp-address — 227 ip pim rp-candidate — 228 ip pim state - refresh origination - interval — 230 show ip pim — 518 show ip pim bsr — 519 show ip pim interface — 520

show ip pim mroute — 522 show ip pim neighbor — 524 show ip pim rp mapping — 526 show ip pim rp-hash — 527

Power Saving power-saving — 371

show power-saving — 577

Port Security clear port-security — 83

show port-security — 575 switchport port-security — 674

Protocol distance — 116

Independent

ip route — 237 ip route multi-path — 238 maximum-paths — 314 show ip protocols — 528 show ip route — 532 show ip route summary — 536

QoS class — 60

class class-default — 60 class-map — 61 color-aware — 91 match — 308 police — 358 police aggregate — 363 police cir — 364 policy-map — 368 qos aggregate-policer — 373

QinQ (VLAN Tunnel)

qos bandwidth — 376 qos cos — 377 qos deficit-round-robin — 378 qos dscp-mutation — 381 qos map cos-color — 382 qos map dscp-color — 383 qos map dscp-cos — 384 qos map dscp-mutation — 385 qos trust — 386 service-policy — 413 set — 416 show class-map — 435 show policy-map — 573 show qos aggregate-policer — 578 show qos interface — 579 show qos map — 583

clear vlan-tunnel ctag-mapping dynamic — 86 cos remarking — 98 show vlan-tunnel — 618 show vlan-tunnel ctag-mapping — 621 vlan encapsulation — 706 vlan remarking — 708 vlan-tunnel — 710 vlan-tunnel ctag-mapping dynamic — 711 vlan-tunnel ctag-mapping static — 712 vlan-tunnel ingress checking — 713 vlan-tunnel interface-type — 714

vlan-tunnel remove-inner-tag — 715

vlan-tunnel tpid — 716

RIP accept-lifetime — 7

default-information originate (RIP) — 104

default-metric (RIP) — 109

ip rip authentication key-chain — 231

ip rip authentication mode — 233

ip rip receive version — 234

ip rip send version — 235

ip rip v2-broadcast — 236

key chain — 288

key — 286

key-string — 290

neighbor — 322

network — 339

passive interface (RIP) — 345

redistribute (RIP) — 392

router rip — 407

send-lifetime — 408

show ip key-chain — 492

show ip rip database — 530

show ip rip interface — 531

timers — 688

version — 704

RIPng clear ipv6 rip — 80

default-information originate (RIP IPv6) — 105

default-metric (RIP IPv6) — 110

ipv6 rip metric-offset — 276

ipv6 rip split-horizon — 277

ipv6 rip split-horizon poisoned — 278

ipv6 router rip — 285

neighbor (RIP IPv6) — 323

passive-interface (RIP IPv6) — 346

redistribute (RIP IPv6) — 394

router ipv6 rip — 404

show ipv6 rip database — 558

show ipv6 rip interface — 559

show ipv6 protocols — 556

timers basic — 689

RMON rmon statistics — 398

Route Map route-map — 399

show route-map — 584

SNMP

Management

show snmp-server — 589

snmp-server — 628

snmp-server contact — 631

snmp-server enable traps — 632

snmp-server enable traps snmp — 633

snmp-server location — 640

system-name — 678

SNMPv3 show snmp — 586

show snmp user — 591

snmp-server community — 629

snmp-server engineID local — 635

snmp-server group — 636

snmp-server host — 638

snmp-server user — 641

snmp-server view — 643

SSH crypto key — 100

ip ssh — 239

show ip ssh — 537

show ssh — 600

STP clear spanning-tree detected-protocols — 85

show spanning-tree — 594

spanning-tree (Global configuration) — 646

spanning-tree (timers) — 648

spanning-tree ( Interface configuration ) — 647

spanning-tree cost — 649

spanning-tree fast-forwarding — 650

spanning-tree guard root — 651

spanning-tree link-type — 652

spanning-tree mode — 653

spanning-tree port-priority — 659

spanning-tree priority — 660

spanning-tree tcnfilter — 661

spanning-tree transmit hold-count — 662

Switch Port duplex — 141

flowcontrol — 146

shutdown (interface) — 626

speed — 663

Syslog clear logging — 81

logging file — 295

logging host — 296

logging level — 298

logging on — 299

show logging — 563

System File Management

boot config — 53

boot image — 56

copy — 95

clear running-config factory-defaults — 84

show boot — 430

show running-config — 585

show startup-config — 601

Time and SNTP clock set — 87

clock summer-time — 88

clock timezone — 90

show clock — 436

show sntp — 593

sntp server — 645

Traffic

show traffic-segmentation — 608

Segmentation

traffic-segmentation forward — 696

VLAN acceptable-frame — 9

access vlan — 10

dot1v binding protocol-group — 123

dot1v protocol-group — 124

hybrid vlan VLAN-ID — 156

ingress-checking — 157

mac-base ( VLAN ) — 307

pvid VLAN-ID — 372

show dot1v — 438

show vlan — 613

subnet-base ( VLAN ) — 672

trunk allowed-vlan — 698

vlan — 705

vlan name — 707

VRRP show vrrp — 622

show vrrp brief — 625

vrrp critical-ip — 717

vrrp ip — 719

vrrp preempt — 720

vrrp priority — 722

vrrp shutdown — 724

vrrp timers advertise — 725

aaa authentication

Use this command to enable the AAA authentication function (console, telnet, ssh or http) using the method or methods specified and to create a login list to specify the application or applications used for system access.

Note: Use aaa group server to first define authentication servers before aaa authentication can be configured.

aaa authentication [ login | enable ] [ console | telnet | http | ssh ] METHOD1 [ METHOD2...]

no aaa authentication [ login | enable ] [ console | telnet | http | ssh ] METHOD1 [ METHOD2...]

Syntax Description
login	(Optional) Enable authentication for normal login mode. Enter the console, telnet, or http keyword. If neither login nor enable are specified, both login and enable are implied.
enable	(Optional) Enable authentication for normal enable mode. Enter the console, telnet, or http keyword. If neither login nor enable are specified, both login and enable are implied.
console	(Optional) Specifies that the type of application used for system access authentication is console.
telnet	(Optional) Specifies that the type of application used for system access authentication is telnet.
http	(Optional) Specifies that the type of application used for system access authentication is http.
ssh	(Optional) Specifies that the type of application used for system access authentication is SSH.
METHOD1[METHOD2...]	Identifies the list of methods that the authentication algorithm tries in the given sequence. At least one method must be entered; up to two methods can be identified by keyword. The keywords for AAA authentication login and enable configuration methods are described as follows:localUses the local username database for authentication.groupGROUP-NAMEUses a subset of authentication servers for authentication as defined by the aaa group server command.

Default

No aaa authentication, local user authentication is specified for console, telnet, http, etc. application.

Command Mode Global configuration at privilege level 15

Usage Guideline

Use aaa authentication to enable authentication and create a login list to specify the application or applications used for system access.

If neither login or enable are specified, both are implied. If no application is specified, all applications (console, telnet, ssh, or http) are assumed valid for sytem access.

Multiple methods for the login/enable authentication per application can be specified. The new setting will overwrite the old association.

Use no aaa authentication to disable authentication for system access or to disable the login list of applications used for system access.

To configure AAA authentication, first define a group of authentication servers (use aaa group server command). If a specified group server cannot be found, an error message is displayed. The group server defines the type of authentication to be performed and the sequence in which they will be performed.

A method list describes authentication methods used in the sequential order listed. The method defines a security protocol, if any is used, for user authentication. More than one method can be defined to provide a backup authentication procedure. If the first method cannot be used or there is no response, the next method listed is used and so on for up to 2 defined methods. The process continues until either the user is authenticated successfully, or all methods listed are exhausted.

Note that if, at any point, access is denied by an authentication method employed, the authentication process is stopped, no more methods are eligible and no other attempts to authenticate are made.

The local method for authentication uses locally configured login and enable passwords to authenticate login attempts. The login and enable passwords are local to each switch and are not mapped to the individual user names. The local method is used by default for authentication if no method is listed. If a different authentication method is listed for login or enable, the switch will not attempt local authentication.

In order to use AAA authentication, at least one local user account for login must first be created and the enable password set up.

Example

The following example sets a login method list for an authenticate login attempt from all of the applications (including console, telnet, ssh, http). The methods start from group2.

Switch(config)# aaa authentication login group group2 local Switch(config)#

Verify the settings by entering the show aaa command.

aaa authorization

Use this command to enable the authorization function. Use the no form of the command to disable AAA authorization.

aaa authorization

no aaa authorization

Syntax None

Default Disabled

Command Mode Global configuration at privilege level 15

Usage Guideline

When the AAA authorization function is enabled, the system will use configuration settings authorized by the RADIUS server in addition to the RADIUS server authentication function. Settings can include VLAN assignment, user priority assignment and bandwidth assignment.

If AAA authorization is disabled, the system only accepts the authentication function from the RADIUS server and ignore any additional configuration settings supplied by the RADIUS server.

Example This example shows how to enable the authorization:

Switch# configure terminal
Switch(config)# aaa authorization 

Verify the settings by entering the show system protocol-state command.

aaa group server

Use the aaa group server command to enter AAA group server mode and identify AAA server groups used for AAA authentication. In AAA group server mode server hosts are grouped into distinct lists and distinct methods.

To remove a group server from the configuration list, use the no aaa group server form of this command.

aaa group server GROUP-NAME

no aaa group server GROUP-NAME

Syntax Description

GROUP-NAME Character string used to name the group of servers used for group server method AAA authentication. The group name can be up to 32 characters in length.

Default There is no aaa group server.

Command Mode Global configuration at privilege level 15

Usage Guideline

The AAA group server method is defined for AAA authentication for user login or configuration. The aaa authentication command is used to define the group server method and specify the AAA server group.

Use aaa group server command to enter AAA group server mode. If the group name specified does not exist, the switch creates the new group. Once in AAA group server mode, use the server command to define and configure servers added to the group.

Example
The following example shows the network access server configured to recognize two RADIUS host entries. The second host entry configured acts as fail-over backup to the first one. (The RADIUS host entries are tried in the order in which they are configured.)

Switch(config)#aaa group server group1
Switch(config-aaa-group-server)# server radius 172.19.10.100 key 12345678
Switch(config-aaa-group-server)# server radius 172.19.10.200 key 12345678
Switch(config-aaa-group-server)# end
Switch# 

Verify the settings by entering the show aaa group server command.

accept dhcp client-identifier

Use this command to turn on validation checking of the Client Identifier. Use the no form of the command to turn off validation checking of the Client Identifier.

accept dhcp client-identifier

no accept dhcp client-identifier

Syntax None

Default client identifier: not evaluated

Command Mode DHCP pool configuration

Usage Guideline

To validate the DHCP Client Identifier value sent by the client. If a DHCP client sends a DHCP Client Identifier option, the DHCP server validates the value to ensure it matches the hardware type and client hardware address. If the values match, the DHCP server provides service to the client. If the values do not match, the DHCP server does not respond to the client's request.

If the command is used to set the validation to not check the DHCP Client Identifier value sent by the client, then the DHCP server only checks the matching of the client's hardware type and hardware address as a host ID.

Example

The following example sets the DHCP pool1 to check the validation of the client identifier option as DHCP pool1 offers IP addresses.

switch > enable
switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# accept dhcp client-identifier
switch(config-dhcp)# 

accept dhcp relay-agent

To accept relay agent information use the accept dhcp relay-agent command, use the no form of the command to reject DHCP relay agent information.

accept dhcp relay-agent [circuit-id|remote-id]

no accept dhcp relay-agent [circuit-id|remote-id]

Syntax Description

circuit-id (Optional) Agent Circuit ID Sub-option.

remote-id (Optional) Agent Remote ID Sub-option

Default DHCP relay-agent is not accepted.

Command Mode DHCP pool configuration

Usage Guideline

If either of circuit-id and remote-id is not specified, it implies that both the circuit-id and remote-id options are applied with the command. If only the circuit-id or remote-id is specified, it implies that it only accepts DHCP packets containing either only a circuit-id or a remote-id.

Examples

The following example sets DHCP pool1 to accept circuit id and remote id relay agent information.

switch > enable
switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# accept dhcp relay-agent
switch(config-dhcp)# 

The following example sets DHCP pool1 to not accept remote id relay agent information.

switch > enable
switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# no accept dhcp relay-agent remote-id
switch(config-dhcp)# 

accept-lifetime

The accept-lifetime command is used to set a time period when an authentication key on a key chain is accepted as the valid key.

accept-lifetime START-TIME { infinite | END-TIME | duration SECONDS }

Syntax Description

START-TIME The beginning time that the key specified, by the key command, is valid to be received. The syntax can be either of the following:

HH:MM:SS MONTH DATE YEAR

HH:MM:SS DATE MONTH YEAR

HH-hours MM-minutes SS-seconds MONTH-first three letters of the month DATE-date (1-31) YEAR-year (four digits)

The default start time and the earliest acceptable date is January 1, 1993.

infinite Key is valid to be received from the start-time value on.
END-TIME	Key is valid to be received from the start-time value until the end-time value.The syntax is the same as that for the START-TIME. The end-time value must be after the start-time value. The default end time is an infinite time period.
duration SECONDS	Length of time (in seconds) that the key is valid to be received. The range is from 1 to 2147483647 (signed long).

Default Infinite

Command Mode Key-chain key configuration

Usage Guideline Only Routing Information Protocol (RIP) Version 2 uses key chains.

Specify a start time value and one of the following values: infinite, end-time, or duration seconds.

Example

The following example configures a key chain named chain1. Key 1 named "forkey1string" will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key 3 named "forkey3string" will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config-router)# exit
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# exit 

Verify the settings by entering the show ip key-chain command.

acceptable-frame

Use the acceptable-frame interface command to set the acceptable frame type of a port for IEEE 802.1Q VLANs. The default acceptable frame type is admit-all.

acceptable-frame { tagged-only | untagged-only | admit-all }

Syntax Description

tagged-only Set acceptable frame type for tagged only of the interface.

untagged-only Set acceptable frame type for untagged only of the interface.

admit-all Set acceptable frame type for all packets of the interface.

Default admit-all

Command Mode interface configuration

Usage Guideline The valid interfaces for this command are physical ports.

The acceptable-frame interface command can be used to set the acceptable frame types for physical port interfaces. If an acceptable frame type is tagged-only, only tagged packets of incoming packets will be received by the interface and untagged packets will be dropped. If untagged-only, only untagged packets will be received and tagged packets will be dropped. If admit-all, all packets will be received.

Example This example shows how to set the acceptable frame type to tagged-only of eth3.1.

Switch(config)# interface eth3.1
Switch(config-if)# acceptable-frame tagged-only

Verify the settings by entering the show vlan interface command.

access vlan

Use the access vlan interface configuration command to specify the access VLAN for the interface. Use default interface vlan command to reset to default setting.

access vlan VLAN-ID

default access vlan

Syntax Description
access vlan	Specifies the access VLAN for the interface.
VLAN-ID

Default VLAN 1

Command Mode Interface configuration

Usage Guideline The command is valid for physical ports or port-channel interfaces. If the VLAN does not exist, the VLAN will be automatically created and a message pompt will appear. By default, the port has access VLAN 1.

The following applies to access VLANs:

• An interface can be specified with only one access VLAN. The succeeding command overwrites the previous command.
• When this command is applied, the port will change to Access mode. If the port has been configured for other modes, Access mode will overwrite the previous mode. The port's PVID is changed to the specified VLAN.

Examples This example shows how to set an interface eth3.1 to an untagged member of VLAN 1000.

Switch(config)# interface eth3.1
Switch(config-if)# access vlan 1000 

Verify the settings by entering the show vlan interface command.

address-family ipv4

Use this command to enter address family configuration mode to configure a routing session using standard IP Version 4 address prefixes. Use the no form of this command to remove the IPv4 address family configuration from the running configuration.

address-family ipv4 [unicast]

no address-family ipv4 [unicast]

Syntax Description

unicast (Optional) Specifies IP Version 4 unicast address prefixes.

Default

Unicast prefix support is enabled by default when this command is entered without any optional keywords.

Command Mode Router configuration

Usage Guideline

Routing information for address family IPv4 unicast is advertised by default for each BGP routing session configured with the neighbor remote-as command unless the no bgp default ipv4-unicast command is used before configuring the neighbor remote-as command.

For all settings configured for IPv4 unicast, the settings also appear in BGP router configuration mode. That is, for address-family associated settings, the settings defined in IPv4 unicast address family mode is equivalent to the settings defined in the router configuration mode.

To leave address family configuration mode and return to router configuration mode without removing the existing configuration, enter the exit command.

Example

This example shows how to enter address family configuration mode for the IP Version 4 address family:

Switch(config)# router bgp 65100
Switch(config-router)# address-family ipv4
Switch(config-router-af)# exit
Switch(config-router)# 

aggregate-address

Use this command to configure BGP aggregate entries. Use the no form of the command to disable this function.

aggregate-address NETWORK-NUMBER/SUBNET-LENGTH [summary-only] [as-set]

no aggregate-address NETWORK-NUMBER/SUBNET-LENGTH [summary-only] [as-set]

Syntax Description

NETWORK-NUMBER/SUBNET-LENGTH	Specifies the number of network and the length of network that BGP will aggregate.
	The format of NETWORK-NUMBER/SUBNET-LENGTH can be 10.9.18.2/8.

summary-only (Optional) Filters all more-specific routes from updates.

as-set (Optional) Generates autonomous system set path information.

Default Disabled

Command Mode Router configuration

Usage Guideline

Aggregates are used to minimize the size of routing tables. Aggregation combines the characteristics of several different routes and advertises a single route. The aggregate-address command creates an aggregate entry in the BGP routing table if any more-specific BGP routes are available in the specified range. Using the summary-only parameter advertises the prefix only, suppressing the more-specific routes to all neighbors.

The as-set parameter creates an aggregate entry advertising the path for this route, consisting of all elements contained in all paths being summarized. Use the as-set parameter to reduce the size of the path information by listing the AS number only once, even if it was included in multiple paths that were aggregated. The as-set parameter is useful when aggregation of information results in an incomplete path information.

Example This example shows how to propagate network 172.0.0.0 and suppresses the more specific route 172.10.0.0:

Switch(config)# router bgp 65534
Switch(config-router)# aggregate-address 172.0.0.0/8 summary-only 

area default-cost

The cost of the default summary route sent into a not-so-stubby area (NSSA) or a stub area is defined with the area default-cost command in router configuration mode. The no area default-cost command is used to remove an assigned default route cost.

area AREA-ID default-cost COST

no area AREA-ID default-cost

Syntax Description
AREA-ID	Identifier for the NSSA or stub area. The identifier can be either a decimal value or an IP address.
COST COST for the default summary route used for a stub or NSSA. The acceptable value is a 24-bit number (0~16777215).

Default COST: 1

Command Mode Router configuration

Usage Guideline Use this command only on an Area Border Router (ABR) attached to a stub area or NSSA. The two stub area router configuration commands are area stub and area default-cost are configured as follows: for all routers and access servers attached to the stub area, the area should be configured as a stub area using the area stub option; the area default-cost command is used only on an ABR attached to the stub area. The default-cost provides the metric for the summary default route generated by the ABR into the stub area.

Example The following example assigns a default cost of 20 to stub network 10.0.0.0

Switch# configure terminal
Switch (config)# router ospf
Switch (config-router)# area 10.0.0.0 default-cost 20 

Verify the settings by entering the show ip ospf interface command.

area default-cost (IPv6)

To set the summary-default cost of a stub area, use the area default-cost command. To disable this function, use the no form of this command.

area AREA-ID default-cost COST

no area AREA-ID default-cost

Syntax Description

AREA-ID Identifier of the area about which routes are to be summarized. It can be specified as either a decimal value or as an IPv6 prefix.

COST (Optional) Metric or cost for this summary route, which is used during the OSPF SPF calculation to determine the shortest paths to the destination. The value can be 0 to 16777215.

Default Disabled

Command Mode Router configuration

Usage Guideline

This command is used only on an Area Border Router (ABR) attached to a stub area. In all routers and access servers attached to the stub area, the area should be configured as a stub area using the stub option of the area command. Use the area default-cost command only on an ABR attached to the stub area. The default-cost option provides the metric for the summary default route generated by the ABR into the stub area.

Examples The following example assigns a default cost of 10 to stub area 1.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router) # area 1 stub
Switch (config-router) # area 1 default-cost 10 

area nssa

Use this command to define an area as an NSSA (not-so-stubby) area. Use the no nssa command to remove the NSSA designation.

Note: For OSPFv3 this command is not supported.

area AREA-ID nssa [no-redistribution] [default-information-originate [metric METRIC-VALUE] [metric-type TYPE-VALUE]] [no-summary]

no area AREA-ID nssa [no-redistribution] [default-information-originate] [no-summary]

Syntax Description
AREA-ID	Specifies the identifier of the area distinguished as the NSSA. The identifier can be specified as either a decimal value or an IP address.
no-redistribution	(Optional) Type 7 external routes will not be re-distributed to the NSSA. When the user specifies to redistribute routes to the OSPF process, external routes will always be redistributed to the normal area. This function only takes effect when the router is an autonomus sytem boundary router (ASBR).
default-information-originate	(Optional) For ASBR, a Type 7 default route will be generated into the NSSA area when it exists in the redistributed routes. For ABR, when this option is specified, the type-7 default route will always be generated into the NSSA area.
metric METRIC-VALUE	(Optional) Specifies the metric for the default route. If not specified, the value will be 1. The range for METRIC-VALUE is 0-16777214.
metric-type TYPE-VALUE	(Optional) For OSPF, the external link type associated with the default route advertised into the OSPF routing domain. It can be one of two values: Type 1 external route or Type 2 external route. If a metric-type is not specified, the switch adopts a Type 2 external route.
no-summary	(Optional) This function only take effect when the router is an ABR. Summary routes are not advertised into the NSSA.

Default • No NSSA area is configured.

• External routes will be redistributed to the NSSA area in type 7 unless no-redistribute is specified.
• Type 7 default route will only be advertised by default when default-information-originate is specified.
• If no-summary is specified, the summary route will not be advertised to the NSSA area.

Command Mode Router configuration

Usage Guideline

There are no external routes in an OSPF stub area, so it is not possible to redistribute from another protocol into a stub area.

An NSSA allows external routes to be advertised to the area in type 7 link state advertisement (LSA). These routes are then leaked into other areas. Although, the external routes from other areas still do not enter the NSSA.

Use the area nssa command to simplify the administration of connecting a central site using OSPF to a remote site that is using a different routing protocol. Use this command to extend OSPF to cover the remote connection by defining the area between the central router and the remote router as an NSSA.

For ASBR NSSA re-distribution, external routes will only be redistributed to the NSSA when redistribution is configured for the associated OSPF process.

The external routes from other areas within the same AS will not be injected to the NSSA.

For an ASBR, a Type 7 default route will be generated into the NSSA when it exists in the redistributed routes.

For an ABR, when this option is specified, the type-7 default route will always be generated into the NSSA.

If there are multiple default routes generated into the NSSA, the following priority will be followed: Type 3 priority > Type 7 priority.

Example This command show how to set the nssa area:

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# area 1 nssa 

Verify the settings by entering the show ip ospf command.

area range

Use this command to summarize and consolidate routes at an area boundary. Use the no area range command to disable this function.

area AREA-ID range PREFIX/PREFIX-LENGTH [advertise | not-advertise] [cost COST]

no area AREA-ID range [PREFIX/PREFIX-LENGTH]

Syntax Description
AREA-ID Specifies the identifier of the area for which routes are summarized. The identifier can be specified as either an IP address or a decimal value.
PREFIX/PREFIX-LENGTH	The prefix and length of prefix for the area range.
advertise	(Optional) Sets the status to advertise and generate a Type 3 summary link-state advertisement (LSA) for the specified address range.
not-advertise	(Optional) Sets the status to DoNotAdvertise for the specified address range. Type 3 summary LSA is suppressed, the component networks remain hidden.
COST Cost for specified summary route. The valid setting is 0 to 16777215.

Default Disabled

The default is advertise.

If cost is not specified, the cost of this route is found from the cost sets of component subnets and the maximum cost of those is chosen. (based on RFC2328).

Command Mode Router configuration

Usage Guideline

Use this command with ABRs to summarize the intra-area routes. This command is used to specify the summarized route for area 0 or for a non-zero area. It can be applied to the same area multiple times.Multiple area router configuration commands specifying the range option can be configured. Thus, OSPF can summarize addresses for many different sets of address ranges.For the same area, this command can also be specified multiple times.

Example

This example shows how to set one summary route to be advertised by the ABR to other areas for all subnets on network 192.168.0.0:

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# area 1 range 192.168.0.0/16 

Verify the settings by entering the show ip ospf command.

area range (IPv6)

To consolidate and summarize routes at an area boundary, use the area range command. To disable this function, use the no form of this command.

area AREA-ID range IPv6-PREFIX/PREFIX-LENGTH [advertise | not-advertise]

no area AREA-ID range IPv6-PREFIX / PREFIX-LENGTH

Syntax Description
AREA-ID	Identifier of the area for which routes are to be summarized. It can be specified as either a decimal value or as an IPv6 prefix.
IPv6-PREFIX IPv6 prefix
PREFIX-LENGTH IPv6 prefix length
advertise (Optional) Advertise and generate a Type 3 Inter-Area Prefix link-state advertisement (LSA) for the specified address range.
not- advertise	(Optional) Sets the status to DoNotAdvertise for the specified address range. The Type 3 Inter-Area Prefix LSA is suppressed, and the component networks remain hidden from other networks.

Default Disabled

Command Mode Router configuration

Usage Guideline	The area range command is used only with Area Border Routers. It is used to consolidate or summarize routes for an area. The result is that a single summary route is advertised to other areas by the ABR. Routing information is condensed at area boundaries. External to the area, a single route is advertised for each address range.
Examples	The following example specifies one summary route to be advertised by the Area Border Routers to other areas for IPv6 prefix 2001:0DB8:0:1::/64 and for the Router ID 20.0.1.10.

Switch> enable
Switch# configure terminal
Switch(config)# router ipv6 ospf
Switch(config-router)# router-id 20.0.1.10
Switch(config-router)# area 1 range 2001:0DB8:0:1::/64 

area stub

Use this command to configure an area as a stub area. Use the no area stub command to disable this function.

area AREA-ID stub [no-summary]

no area AREA-ID stub [no-summary]

Syntax Description
AREA-ID	Specifies the identifier of the stub area. The identifier can be specified as either an IP address or a decimal value.
no-summary	(Optional) When this option is specified, an ABR will not send summary link advertisements into the stub area.

Default Stub areas are not configured.

Summary link advertisements are sent into the stub area.

Command Mode Router configuraiton

Usage Guideline

When employed, this command must be configured on all routers and access servers in the stub area. Use area default-cost to specify the cost of the default internal route sent into a stub area by an Area Border Router (ABR).

Two router configuration commands, area stub and area default-cost are used for stub area router configuration. In all routers attached to the stub area, configure the area using the area stub command. Use the area default-cost command only for ABRs attached to the stub area.

To prevent advertising LSA summaries into a stub area use the no-summary option on ABRs attached to the stub area. The area is defined as a “totally stubby” area using the area stub no-summary command on the ABR.

The default summary route (Type 3) will be generated to the stub area (or NSSA area) when no-summary is specified in the command.

Example This command show how to set stub area:

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# area 1 stub 

Verify the settings by entering the show ip ospf command.

area stub (IPv6)

To set the summary-default cost of a stub area, use the area default-cost command. To disable this function, use the no form of this command.

area AREA-ID stub [no-summary]

no area AREA-ID stub [no-summary]

Syntax Description

AREA-ID Identifier of the area about which routes are to be summarized. It can be specified as either a decimal value or as an IPv4 address.

no-summary (Optional) Prevent an ABR from sending summary link advertisements into the stub area.

Default Disabled

Command Mode Router configuration

Usage Guideline

This command is used only on an ABR attached to a stub area. In all routers and access servers attached to the stub area, the area should be configured as a stub area using the area stub command. Use the area default-cost (IPv6) command on page 14 only on an ABR attached to the stub area. The area default-cost command provides the metric for the summary default route generated by the ABR into the stub area.

Use the no-summary argument with this command to define a totally stubby area. When routers in the area do not require to learn about summary LSAs from other areas, then a totally stubby area should be defined. To define a totally stubby area configure the ABR of that area using the area stub no-summary command.

Examples

In the following example, the area stub command is used to configure the router as a stub that advertises connected and summary routes.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router)# router-id 20.0.1.10
Switch (config-router)# area 1 stub 

area virtual-link

Use this command to configure a link between two backbone areas that are physically separated through other non-backbone area. Use the no area virtual-link command to remove a virtual link.

area AREA-ID virtual-link ROUTER-ID [ authentication [ message-digest ] ] [ hello-interval SECONDS ] [ dead-interval SECONDS ] [ transmit-delay SECONDS ] [ retransmit-interval SECONDS ] [ [ authentication-key PASSWORD ] | [ message-digest-key KEY-ID md5 KEY ] ]

no area AREA-ID virtual-link ROUTER-ID [dead-interval|hello-interval|tansmit-interval|retransmitinterval|authentication|authentication-key|message-digest-key KEY-ID]

Syntax Description
AREA-ID	Specifies the identifier of the transit area for the virtual link. The identifier can be specified as either an IP address or a decimal value.
ROUTER-ID The Router ID of the virtual link neighbor.
authentication	(Optional) Specifies authentication type. If no authentication type is specified for the virtual-link, the authentication type for the area will be used.
message-digest (Optional) Specifies that message-digest authentication be used.
hello-interval SECONDS	Specifies the interval in seconds, between the hello packets that the router sends on an interface. The valid setting is 1-65535.
dead-interval SECONDS	Specifies the interval in seconds, during which no packets are received and after which a neighbor is regarded as off-line. The valid setting is 1-65535.
transmit-delay SECONDS	The interval the router waits before it transmits a packet. The valid setting is 1-65535.
retransmit-interval SECONDS	The interval the router waits before it retransmits a packet. The valid setting is 1-65535.
authentication-key PASSWORD	(Optional) Password to be used by neighboring routers. The password is a continuous string of keyborad characters up to 8 bytes long. This password is a key to allow the authentication procedure to generate or verify the authentication field contained in the OSPF header. The authentication key is inserted directly into the OSPF header when originating routing protocol packets. Each network can be assigned a separate password on a per-interface basis. All neighboring routers on the same network must use the same password to be able to route OSPF traffic.
message-digest-key KEY-ID md5 KEY	(Optional) Key identifier and password to be used for Message Digest 5 (MD5) authentication by neighboring routers and this router. The KEY-ID argument is a number in the range from 1 to 255. The KEY consists of an alphanumeric string of up to 16 characters in length. All neighboring routers on the same network must have the identical key identifier and key, to be allowed to route OSPF traffic. There is no default value.

Default • AREA-ID: None

• ROUTER-ID: None
• authentication: null
• hello-interval:10 seconds
  • dead-interval: 40 seconds
  • transmit-delay: 1 second
• retransmit-interval: 5 seconds
• authentication-key: None
• message-digest-key: None

Command Mode Router configuration

Usage Guideline

In OSPF, all non-backbone areas must be connected to a backbone area. If the connection to the backbone is broken, the virtual link is used to re-establish the connection. Virtual links between any two backbone-routers that have an interface to a common non-backbone area can be configured. The protocol treats these two routers joined by a virtual link as if they were connected by an un-numbered point-to-point network. To configure a virtual link, include both the transit AREA ID and the corresponding virtual link neighbor's ROUTER-ID in the virtual link neighbor.

Configure the hello-interval to be the same for all routers attached to a common network. A short hello interval results in the router detecting topological changes faster but also an increase in the routing traffic.

As with the hello interval, the value of dead-interval must be the same for all routers and access servers attached to a common network.

The retransmit-interval is the expected round-trip delay between any two routers in a network. Set the value to be greater than the expected round-trip delay to avoid needless retransmissions.

The transmit-delay is the time taken to transmit a link state update packet on the interface. Before transmission, the link state advertisements in the update packet, are incremented by this amount. Set the transmit-delay to be greater than zero. Also, take into account the transmission and propagation delays for the interface.

Before using the area virtual-link authentication command, configure a password for virtual link using the area virtual-link authentication-key command. If the area virtual-link authentication message-digest command is used, configure the message-digest key for the virtual link using area virtual-link message-digest-key command.

The password created by the area virtual-link authentication-key command is used as a "key" that is inserted directly into the OSPF header when the switch system software originates routing protocol packets over this virtual link.

Usually, one key per interface (or virtual link) is used to generate authentication information when sending packets and to authenticate incoming packets. The same key identifier on the neighbor router must have the same KEY value.

The process of changing keys is as follows. Suppose the current configuration is as follows:

area 1 virtual-link 192.168.255.1 message-digest-key 100 md5 OLD

The configuration can be changed to the following:

area 1 virtual-link 192.168.255.1 message-digest-key 101 md5 NEW

The system assumes its neighbors do not have the new key yet, so it begins a rollover process. It sends multiple copies of the same packet, each authenticated by different keys. In this example, the system sends out two copies of the same packet; the first one authenticated by key 100 and the second one authenticated by key 101

Rollover allows neighboring routers to continue communication while the network administrator is updating them with the new key. Rollover stops once the local system finds that all its neighbors know the new key. The system detects that a neighbor has the new key when it receives packets from the neighbor authenticated by the new key.

After all neighbors have been updated with the new key, the old key should be removed. In this example, the following entry is used:

no area 1 virtual-link 192.168.255.1 message-digest-key 100

Examples

This following example shows how to establish a virtual link with hello-interval and dead-interval to 5 and 10 seconds respectively.

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# area 1 virtual-link 10.10.11.50 hello-interval 5 dead-interval 10 

Verify the settings by entering the show ip ospf virtual-links command.

This following example (on the next page) shows how to configure the following parameters for a virtual link at area 1 with the remote id as 192.168.255.1.

1. Specify "yourpass" as the key for simple password authentication.
2. Set authentication type to simple password.

Switch# configure terminal
Switch(config)# router ospf 1
Switch(config-router)# area virtual-link 192.168.255.1 authentication-key yourpass
Switch(config-router)# area 1 virtual-link 192.168.255.1 authentication 

Verify the settings by entering the show ip ospf virtual-links command.

area virtual-link (IPv6)

To define an OSPF virtual link, use the area virtual-link command with the optional parameters. To remove a virtual link, use the no form of this command.

area AREA-ID virtual-link ROUTER-ID [instance-id INSTANCE-ID] [hello-interval SECONDS] [dead-interval SECONDS] [transmit-delay SECONDS] [retransmit-interval SECONDS]

no area AREA-ID virtual-link ROUTER-ID

Syntax Description
AREA-ID	Specifies the area ID assigned to the virtual link. This can be either a decimal value or a valid IPv4 address. There is no default.
ROUTER-ID	Specifies the router ID associated with the virtual link neighbor. This can be either a decimal value or a valid IPv4 address. There is no default.
INSTANCE-ID	(Optional) Specifies an Instance identifier. To change this ID from an existing entry, configure the no area command first. The valid setting is from 0 to 255.
hello-interval SECONDS	(Optional) Specifies the interval in seconds, between the hello packets that the router sends on an interface. The valid setting is 1-65535.
dead-interval SECONDS	(Optional) Specifies the interval in seconds, during which no packets are received and after which a neighbor is regarded as off-line. The valid setting is 1-65535.
transmit-delay SECONDS	(Optional) The interval the router waits before it transmits a packet. The valid setting is 1-65535.
retransmit-interval SECONDS	(Optional) The interval the router waits before it retransmits a packet. The valid setting is 1-65535.

Default No OSPF virtual link is configured.

hello-interval SECONDS: 10 seconds

dead-interval SECONDS: 40 seconds

transmit-delay SECONDS: 1 second

retransmit-interval SECONDS: 5 seconds

Command Mode Router configuration

Usage Guideline

All areas in an OSPF autonomous system must be physically connected to the backbone area (area 0). In some cases where this physical connection is not possible, use a virtual link to connect to the backbone through a non-backbone area. As mentioned, use virtual links to connect two parts of a partitioned backbone through a non-backbone area. The area through which the virtual link is configured, is known as a transit area, and it must have the full routing information. The transit area cannot be a stub area.

In OSPF, all non-backbone areas must be connected to a backbone area. If the connection to the backbone is lost, the virtual link repairs the connection. Virtual links can be configured between any two backbone-routers that have an interface to a common non-backbone area. The protocol treats these two routers joined by a virtual link as if they were connected by an un-numbered point-to-point network. To configure a virtual link, include both the transit area ID and the corresponding virtual link neighbor's router ID in the virtual link neighbor.

Configure the hello-interval to be the same for all routers attached to a common network. A short hello interval results in the router detecting topological changes faster but also an increase in the routing traffic.

As with the hello interval, the value of dead-interval must be the same for all routers and access servers attached to a common network.

The retransmit-interval is the expected round-trip delay between any two routers in a network. Set the value to be greater than the expected round-trip delay to avoid needless retransmissions.

The transmit-delay is the time taken to transmit a link state update packet on the interface. Before transmission, the link state advertisements in the update packet, are incremented by this amount. Set the transmit-delay to be greater than zero. Also, take into account the transmission and propagation delays for the interface.

To configure a virtual link in OSPF for IPv6, a router ID must be used instead of an address. In the IPv6 version of OSPF, the virtual link takes the router ID rather than the IPv6 prefix of the remote router.

Examples

The following example establishes a virtual link with default values for all optional parameters.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router)# area 1 virtual-link 192.168.255.1 

arp

Use this command to add a static entry in the Address Resolution Protocol (ARP) cache. Use the no arp command to remove a static entry in the ARP cache.

arp IP-ADDRESS HARDWARE-ADDRESS

no arp IP-ADDRESS HARDWARE-ADDRESS

Syntax Description
IP-ADDRESS	IP address in four-part dotted decimal format corresponding to the local data-link address.
HARDWARE-ADDRESS	Local data-link Media Access (MAC) address (a 48-bit address).

Default No entries are entered in the ARP cache.

Command Mode Global configuration

Usage Guideline	Use the arp command to assign static and permanent entries to the ARP cache entries. The cache is used to store the IP addresses and the corresponding MAC address so that the addresses will not have to be repeatedly resolved. Static and permanent entries are used for devices that exchange data on a regular basis.To remove all non-static entries from the ARP cache, use the clear arp-cache command.
Example	This example shows how to add static ARP entry for a typical Ethernet host:

Switch(config)# arp 10.31.7.19 0800.0900.1834

Verify the settings by entering the show arp command.

arp timeout

Use the arp timeout command to set the ARP aging time for the ARP table.

arp timeout SECONDS

Syntax Description

SECONDS Number of seconds that dynamic entries will remain in the ARP table before being deleted; valid values are from 0 to 65535.

Default 14400 seconds (4 hours)

Command Mode VLAN interface configuration

Usage Guideline Only VLAN interfaces are valid for this command.

Example This example shows how to set the ARP timeout to 12000 seconds to allow entries to time out faster than the default setting:

Switch(config)# interface vlan1
Switch(config-if)# arp timeout 12000 

Verify the settings by using show ip interface command

auto-cost reference-bandwidth

Use this command to control how OSPF calculates default metrics for the interface. The no form of this command will reset the reference bandwidth to the default value.

auto-cost reference-bandwidth MBPS

no aut-cost reference-bandwidth

Syntax Description

MBPS The reference bandwidth in Mbps. The default reference bandwidth is 100 Mbps. The valid setting is 1 to 4294967.

Default Enabled

MBPS: 100

Command Mode Router configuration

Usage Guideline

By default OSPF calculates the OSPF metric for an interface by dividing the reference bandwidth by the bandwidth of interface. The default value for the reference bandwidth is 100Mbps. For example, a 100Mbps will have a metric of 1 and a 64K link will have a metric of 1562,

The auto-cost command is used to differentiate high bandwidth links. For multiple links with high bandwidth, specify a larger reference bandwidth value to differentiate costs on those links.

Before the cost is changed to the manual configuration mode, the cost must be configured in advance.

Example This following example shows how to set reference bandwidth to 50 Mbps.

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# auto-cost reference-bandwidth 50 

Verify the settings by entering the show ip protocol ospf command.

auto-cost reference-bandwidth (IPv6)

To control the reference value IPv6 OSPF uses when calculating metrics for interfaces, use the auto-cost reference-bandwidth command. To return the reference value to its default, use the no form of this command.

auto-cost reference-bandwidth MBPS

no auto-cost reference-bandwidth

Syntax Description

MBPS	MBPS Rate in Mbps bandwidth. The range is from 1 to 4294967. The default is 100.

Default MBPS: 100.

Command Mode Router configuration

Usage Guideline

The IPv6 OSPF metric is calculated as the Mbps value divided by the bandwidth, with Mbps equal to 100 by default, and bandwidth determined by the bandwidth command. The calculation gives Fast Ethernet a metric of 1.

Examples

The following example sets the auto-cost reference bandwidth to 1000 Mbps.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router)# auto-cost reference-bandwidth 1000 

banner login

Use banner login to enter the banner login mode in order to configure the banner login message. Use the default form of the command to set the login banner to factory default.

banner login LINE

default banner login

Syntax Description

LINE A displaced string and spaces are allowed. The maximum length is 320 characters. In addition, two special character sequences are used; '/n' is used as new line and '/r' is used as a carriage return. Please refer to the usage guideline for more detail.

Default Project dependent

Sample Banner Login Message:

DGS-6604 Chassis Ethernet Switch

Command Line Interface,

Firmware: Build 1.00.027

Copyright (c) 2011 D-Link Corporation, all rights reserved.

Where 2011 represents the year for release of the new firmware. It should be updated if needed by the subsequent release of the firmware.

Command Mode Global configuration

Usage Guideline

Use this command to define a customized banner to be displayed before the user is prompted for their username and password. Enter the banner login command followed by a desired display string and then execute the command by pressing ENTER to complete the modification.

When a multiple lines banner is needed, use special character sequences such as '/n' which represents a new line and '/r' which represents a carriage return. However if '/n' or '/r' is required to be displayed as part of the string in the line, then both '/n' and 'r' must be prefixed with another '/' as an escape sequence to override the special character sequence functionality, for example '/n', or '/r'.

At the end of each line is either a '/n' or '/r'. If more than 80 characters are entered without an '/n' or '/r' ending the line, then the line will be truncated and the first 80 characters are displayed.

Example This example shows how to modify the banner login message:

Switch:12(config)# banner login DGS-6604 Chassis Ethernet Switch Command Line Interface, Access for authorized users only. Please enter your username and password. Switch:12# 

based-on client-id

This command is used to specify the client identifier as a rule for IP address assignment from the DHCP address pool. Use the no form to remove the rule from DHCP address pool.

based-on client -id {hex|string} CLIENT-ID

no based-on client -id {hex|string} CLIENT-ID

Syntax Description

CLIENT-ID A sequence of bytes or a string defined on the client that is an unique identification of client.

HEXADECIMAL: The maximum length is 128 bytes.

STRING: The maximum length is up to 64 bytes.

Default None

Command Mode DHCP pool configuration

Usage Guideline

All rules take effect on the corresponding DHCP address pool and will have a logical AND operation conditions combined with other rules set by other based-on commands.

If a DHCP client sends the no DHCP Client Identifier option, the service continues to operate as it bases it on the hardware type and a client hardware address. If a DHCP client sends a DHCP Client Identifier option, the DHCP server validates the value to ensure the client identifier optional field matches the configured Client Identifier. If the values match, the DHCP server provides service to the client. If the values do not match, the DHCP server does not respond to the client's request.

Multiple based-on client-id commands create a list of client-ids for the DHCP address pool. When any request has a match in the list, the server will provide an IP address to the server based on DHCP Client Identifier option, but not the received client Hardware address.

Examples The following sets a rule used for the IP address assignment based 0x0152415320 for a Microsoft "Remote Access Server" (RAS).

switch(config)#ip dhcp pool pool1 switch(config-dhcp)#based-on client-id hex 0x0152415320

based-on c-vid

This command is used to specify the customer vlan ID (C-VID) as a rule for IP address assignment from the DHCP address pool. Use the no form of the command to remove the C-VID rule from DHCP address pool.

based-on c-vid V-ID [,|-]

no based-on c-vid V-ID [,|-]

Syntax Description

V-ID [,|-]

Specifies the V-ID list.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command is used to create the address binding rule for the DHCP address pool. The based-on c-vid command creates the address binding rules in an incremental way. That is, all of the C-VIDs created by based-on c-vid commands take effect on the corresponding DHCP address pool. However this command will be combined with logical AND operations with the other rules set by other based-on commands. For example if the first rule is based-on c-vid 100 and there is another based-on s-vid 200 command, then the address pool will only assign an IP address to the client with C-VID=100 and S-VID=200.

Examples

The following sets a rule used for IP address assignment based on C-VID 100 or 200 from the DHCP address pool1.

switch(config)#ip dhcp pool pool1
switch(config-dhcp)#based-on c-vid 100,200 

Then the rule is added to and now based on C-VID 100/200 and S-VID 1000.

switch(config-dhcp)#based-on s-vid 1000 

based-on interface-ip-address

This command is used to specify a rule for a DHCP address pool to respond to a request from the specified IP interface. Use the no form of the command to remove the rule from the DHCP address pool.

based-on interface-ip-address IP-ADDRESS

no based-on interface-ip-address IP-ADDRESS

Syntax Description

IP-ADDRESS Specifies the IP address of the interface.

Default None

Command Mode DHCP pool configuration

Usage Guideline

An additional rule can be set for a DHCP address pool based on interface IP address.

All of the DHCP IP address assignment rules take effect on the corresponding DHCP address pool. A based-on command will be combined using logical AND operations with the other rules set by all other based-on commands.

Examples

The following example sets a rule used for the IP address assignment (DHCP IP address pool1) based on interface 172.19.10.100.

switch(config)#ip dhcp pool pool1 switch(config-dhcp)#based-on interface-ip-address 172.19.10.100

based-on mac-address

This command is used to specify the host MAC address as a rule for IP address assignment from the DHCP address pool. Use the no form to remove the MAC address rule from the DHCP address pool.

based-on mac-address MAC-ADDRESS [,|-]

no based-on mac-address MAC-ADDRESS [,|-]

Syntax Description

MAC-ADDRESS [,|-] Specifies the MAC address list.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command is used to create the address binding rule for the DHCP address pool. based-on mac-address command creates the address binding rules in an incremental way. That is, all of the mac-addresses created by the based-on mac-address commands take effect on the corresponding DHCP address pool. However this command will be combined using logical AND operations with the other rules is set by all other based-on commands. For example if the first rule is based-on mac-address 00:80:00:11:22:00- 00:80:00:11:22:FF and there is another based-on c-vid 200 command, the address pool will only assign an IP address to the client with a MAC address in range of 00:80:11:22:xx and with its C-VID=200. Other than that, no IP address is offered from the corresponding DHCP address pool.

Examples

The following sets a rule used for IP address assignment based on MAC address 00:80:C8:11:22:xx from the DHCP address pool1.

switch(config)#ip dhcp pool pool1
switch(config-dhcp)#based-on mac-address 00:80:C8:11:22:00-00:80:C8:11:22:FF 

The following sets an additional rule used for IP address assignment based on MAC address 00:80:C8:11:33:00 and 00:80:C8:11:33:FF from the DHCP address pool1.

switch(config-dhcp)#based-on mac-address 00:80:C8:11:33:00,00:80:C8:11:33:FF 

based-on relay-ip-address

This command is used to specify a rule for the DHCP address pool's only response for BOOTP forwarder or relay. Use the no form of the command to remove the rule from a DHCP address pool.

based-on relay-ip-address IP-ADDRESS

no based-on relay-ip-address IP-ADDRESS

Syntax Description

IP-ADDRESS Specifies the IP address of BOOTP forwarder for relay.

Default None

Command Mode DHCP pool configuration

Usage Guideline

An additional rule can be set for DHCP address pool for each relay IP address.

All of the DHCP IP address assignment rules take effect to the corresponding DHCP address pool. All of the based-on commands will be combined using logical AND operations with other rules set by all the other based-on commands.

Examples The following example sets a rule used for IP address assignment (DHCP IP address pool1) based on the Relay IP address.

switch(config)#ip dhcp pool pool1
switch(config-dhcp)#based-on relay-ip-address 10.1.1.254 

based-on s-vid

This command is used to specify the service provider vlan ID (S-VID) as a rule for IP address assignment from the DHCP address pool. Use the no form of the command to remove the S-VID rule from the DHCP address pool.

based-on s-vid V-ID [,|-]

no based-on s-vid V-ID [,|-]

Syntax Description

V-ID [,|-] Specifies the V-ID list.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command is used to create the address binding rule for the DHCP address pool. The based-on s-vid command creates the address binding rules in an incremental way. That is, all of S-VID created by based-on s-vid commands take effect on the corresponding DHCP address pools. However this command will be combined using logical AND operations with the other rules set by other based-on commands. For example if the first rule is based-on s-vid 100 and there is another based-on c-vid 200 command, then the address pool will only assign an IP address to the client with C-VID=200 and S-VID=100.

Examples

The following sets a rule used for IP address assignment based on S-VID 100 or 200 from the DHCP address pool1.

switch(config)#ip dhcp pool pool1
switch(config-dhcp)#based-on s-vid 100,200 

Below the rule becomes based on S-VID 100/200 and C-VID 1000.

switch(config-dhcp)#based-on c-vid 1000 

based-on vendor-class

This command is used to create an address binding rule for the DHCP address pool based on the vendor class. Use the no form of the command to delete the related rule setting.

based-on vendor-class {hex HEXADECIMAL |string STRING}

no based-on vendor-class {hex HEXADECIMAL |string STRING}

Syntax Description
HEXADECIMAL A leading string, 0x has to be entered and then a following hexadecimal sequence must be entered. The maximum length is 128 bytes.
STRING	A displayable string with no spaces allowed. The maximum length is up to 64 bytes.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command is used to create the address binding rule for the DHCP address pool. One vendor class is allowed in one DHCP address pool. Use the no form of the command to remove the user-class rule.

For vendor classes, e.g. DHCP-requests from Windows 98SE/ME are sent with a vendor class of MSFT 98 and from Windows 2000/XP with a vendor class of MSFT 5.0. The received VendorClass-ID string is compared with the specified string. If the received string is longer than the specified string, then the excess characters are ignored. For example, specifying MSFT will match both Win98SE/ME and 2000/XP.

This command will be combined using logical AND operations with the other rules set by all the other based-on commands. For example if the first rule is based-on vendor-class string MSFT 5.0 and there is another based-on c-vid 200 command, the address pool only assigns an IP address to the client which has C-VID=200 and its vendor class set to MSFT 5.0.

Examples The following example sets the vendor class to match both Win98SE/ME and 2000/XP.

switch(config)#ip dhcp pool pool1
switch(config-dhcp)#based-on vendor-class string MSFT 

based-on user-class

This command is used so that DHCP administrators can define specific user class identifiers to convey information about a client's software configuration or about its user's preferences. Use the no form of the command to remove the related setting rule.

based-on user-class {hex HEXADECIMAL |string STRING}

no based-on user-class {hex HEXADECIMAL | string STRING}

Syntax Description
HEXADECIMAL	A leading string, 0x has to indicated and then a following hexadecimal sequence must be entered. The maximum length is 128 bytes.
STRING	Displayable string but no spaces are allowed. The maximum length is up to 64 bytes.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command is used to create the address binding rule for the DHCP address pool. One user class is allowed in one DHCP address pool. Use the no form of the command to remove user-class rule.This command will be combined using logical AND operations with the other rules set by all the other based-on commands. For example, if the first rule isbased-onuser-classalphaand there is anotherbased-onc-vid200command, the address pool will only assign an IP address to the client which has C-VID=200 and user class asalpha.

Examples

The following sets a rule used for IP address assignment based on the user classalphafrom DHCP address pool1.

switch(config)#ip dhcp pool pool1 switch(config-dhcp)#based-on user-class string alpha

The following sets a rule used for IP address assignment based on the user class 0x8080 from DHCP address pool1.

switch(config)#ip dhcp pool pool1 switch(config-dhcp)#based-on user-class hex 0x8080

bgp always-compare-med

Use this command to compare the Multi-Exit Discriminator (MED) for paths from neighbors in different autonomous systems. Use the no bgp always-comparemed command to disallow the comparison.

bgp always-compare-med

no bgp always-compare-med

Syntax None

Default Disabled

Command Mode Router configuration

Usage Guideline

The MED, as stated in RFC 1771, is an optional nontransitive attribute that is a four octet non-negative integer. The value of this attribute may be used by the BGP best path selection process to discriminate among multiple exit points to a neighboring autonomous system.

The MED is one of the parameters that is considered when selecting the best path among many alternative paths. The path with a lower MED is preferred over a path with a higher MED. During the best-path selection process, MED comparison is done only among paths from the same autonomous system. The bgp always-compare-med command is used to change this behavior by enforcing MED comparisons between all paths, regardless of the autonomous system from which the paths are received.

The bgp deterministic-med command on page 49 can be configured to enforce a deterministic comparison of the MED value between all paths received from within the same autonomous system.

Example This example shows how to configure the comparison of the MED from alternative paths, regardless of the autonomous system from which the paths are received:

Switch(config)# router bgp 65534
Switch(config-router)# bgp always-compare-med 

bgp asnotation dot

Use this command to change the default display and regular expression match format of BGP 4-byte AS numbers from asplain (decimal values) to dot notation. Use the no form of the command to reset the default 4-byte autonomous system number display and regular expression match format to asplain.

bgp asnotation dot

no bgp asnotation dot

Syntax None

Default

BGP AS numbers are displayed using asplain (decimal value) format in screen output, and the default format for matching 4-byte autonomous system numbers in regular expressions is asplain.

Command Mode Router configuration

Usage Guideline

BGP AS numbers that were allocated to companies were 2-byte numbers in the range from 1 to 65535 as described in RFC 4271. Due to increased demand for AS numbers, the IANA will start, in January 2009, to allocate four-byte AS numbers in the range from 65536 to 4294967295. RFC 5396 documents three methods of representing autonomous system numbers. BGP has implemented the following two methods:

• Asplain-Decimal value notation where both 2-byte and 4-byte AS numbers are represented by their decimal value. For example, 65525 is a 2-byte AS number and 65545 is a 4-byte autonomous system number.
• Asdot-Autonomous system dot notation where 2-byte AS numbers are represented by their decimal value and 4-byte AS numbers are represented by a dot notation. For example, 65525 is a 2-byte autonomous system number and 1.10 is a 4-byte AS number (this is dot notation for the 65545 decimal number).

After the command is performed, the output is converted in order to format it. For some of the information which is learned prior, for example: routes, the AS notation format follows the previous format. Therefore, the clear ip bgp command on page 67 must be used to convert to the current format.

Example

This example (on the next page) shows how to configure asnotation and shows the difference using the command show ip bgp:

Switch # show ip bgp
BGP table version is 30, local router ID is 10.10.11.50
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete 

Network Next Hop Metric LocPrf Weight Path  
*> 192.0.1.0/24 10.10.71.100 0 0 65636 i  
*> 192.0.2.0/24 10.10.71.100 0 0 65636 {80} i 

Total Entries: 2 entries, 2 routes
Switch #config terminal
Switch(config)# router bgp 1.6553465636
Switch(config-router)# bgp asnotation dot
Switch(config-router)# end
Switch # clear ip bgp *
Switch # show ip bgp
BGP table version is 30, local router ID is 10.10.11.50
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale 

Origin codes: i - IGP, e - EGP, ? - incomplete 

Network Next Hop Metric LocPrf Weight Path  
*> 192.0.1.0/24 10.10.71.100 0 0 1.101 100 i  
*> 192.0.2.0/24 10.10.71.100 0 0 1.101 100 {80} i 

Total Entries: 2 entries, 2 routes
Switch # 

bgp bestpath as-path ignore

Use this command to ignore AS path as a factor in the selection of the best path. Use the no form of the command to restore the default behavior and configure BGP to consider the AS path during route selection.

bgp bestpath as-path ignore

no bgp bestpath as-path ignore

Syntax None

Default AS path is considered in the best path selection.

Command Mode Router configuration

Usage Guideline

The following are the rules used for the best path selection process.

1. If the next hop associated with the route is unreachable, then the route is 1. If the next hop associated with the route is unreachable, then the route is dropped.
2. The next choice is the route with the largest weight is selected.
3. If weight cannot make the determination, then the largest LOCAL_PREF is used to determine the preferred route.
4. If the preferred route can still not be determined, then the route with the shortest AS_PATH list is preferred.
5. If the preferred route can still not be determined, then lowest origin type is preferred.
6. If the preferred route can still not be determined, then the lowest MED is preferred.
7. If the preferred route can still not be determined, then eBGP is preferred over iBGP paths.
8. Always prefer the path with the lowest IGP metric to the BGP next hop.
9. Check to determine if multiple paths require installation in the routing table for BGP Multipath.
10. When both paths are external, always prefer the path that was received first (the oldest one).
11. Always prefer the route that comes from the BGP router with the lowest router ID.
12. If the originator or router ID is the same for multiple paths, prefer the path with the minimum cluster list length.
13. Always prefer the path that comes from the lowest neighbor address.

Use the commands, bgp bestpath as-path ignore, bgp bestpath compare-router-id or bgp default local-preference to customize the path selection process.

Example

This example shows how to configure to ignore the AS path as the best path for autonomous system 65534:

Switch(config)# router bgp 65534 Switch(config-router)# bgp bestpath as-path ignore

bgp bestpath compare-routerid

Use this command to compare router IDs for the best-path selection process when external BGP (eBGP) paths are identical. Use the no form of the command to disable this function.

bgp bestpath compare-routerid

no bgp bestpath compare-routerid

Syntax None

Default

BGP receives routes with identical eBGP paths from eBGP peers and selects the first route received as the best path.

Command Mode Router configuration

Usage Guideline

When comparing similar routes from peers the BGP router does not consider the router ID of the routes. By default, it selects the first received route. Use this command to include the router ID in the selection process. When enabled, similar routes are compared and the route with the lowest router ID is selected. Unless manually defined, the router ID is the highest IP address on the router, with preference given to loopback addresses. Router ID can be manually set by using the bgp router-id command on page 52.

Example This example shows how to configure to compare the router-ids of identical eBGP paths for autonomous system 65534:

Switch(config)# router bgp 65534
Switch(config-router)# bgp bestpath compare-routerid 

bgp default ipv4-unicast

Use this command to enable the IP version 4 (IPv4) unicast address family for all neighbors. This affects the BGP global configuration. Use the no form of the command to disable this function.

bgp default ipv4-unicast

no bgp default ipv4-unicast

Syntax None

Default bgp default ipv4-unicast

Command Mode Router configuration

Usage Guideline

The bgp default ipv4-unicast command is used to enable the automatic exchange of IPv4 address family prefixes.

Example

This example shows how to configure BGP defaults and activate ipv4-unicast of a peer by default for autonomous system 65534:

Switch(config)# router bgp 65534
Switch(config-router)# bgp default ipv4-unicast 

bgp default local-preference

Use this command to change the default local preference value. To return the local preference value to the default setting, use the no form of this command.

bgp default local-preference NUMBER

no bgp default local-preference

Syntax Description

NUMBER Range of local preference is 0 to 4294967295. A higher number is preferred to a lower number in the comparison.

Default NUMBER: 100

Command Mode Router configuration.

Usage Guideline

The local preference attribute is a discretionary attribute that is used to apply a degree of preference to a route during the BGP best path selection process.

This attribute is exchanged only between iBGP peers and used to determine local policy. The route with the highest local preference becomes the preferred route.

Example

This example shows how to configure default value of the local preference to 200 for autonomous system 65534:

Switch(config)# router bgp 65534
Switch(config-router)# bgp default local-preference 200 

Verify the settings by entering show ip protocols bgp command.

bgp deterministic-med

Use this command to include the Multi Exit Discriminator (MED) value for comparison of the best path selection between all paths received from the same autonomous system. Use the no form of the command to prevent BGP from considering the MED attribute in path comparison.

bgp deterministic-med

no bgp deterministic-med

Syntax None

Default The default value is disabled.

Command Mode Router configuration

Usage Guideline

The bgp always-compare-med command on page 41 is used to enable the comparison of the MED value for paths from neighbors in different autonomous systems. After the bgp always-compare-med is enabled, all paths for the same prefix that are received from different neighbors in the same autonomous system, will be grouped together and sorted by the ascending MED value (received-only paths are ignored and not grouped or sorted).

The best path selection algorithm then picks the best paths using the existing rules; the comparison is first made on a per neighbor autonomous system basis and then on a global basis. The grouping and sorting of paths occurs immediately after this command is entered. For correct results, all routers in the local autonomous system must have this command enabled (or disabled).

The bgp deterministic-med command is used to enforce deterministic comparison of the MED value between all paths received from within the same autonomous system. When enabled, the result of the selection algorithm is the same regardless of the order in which the paths are received on the local router.

Example

This example shows how to configure to enable comparison of MED values for autonomous system 65534:

Switch(config)# router bgp 65534
Switch(config-router)# bgp deterministic-med 

bgp enforce-first-as

Use this command to enforce the first AS for the eBGP routes. To disable this feature, use the no form of this command.

bgp enforce-first-as

no bgp enforce-first-as

Syntax None

Default Disabled

Command Mode Router configuration.

Usage Guideline

This command specifies that any updates received from an external neighbor that do not have the neighbor's configured Autonomous System (AS), at the beginning of the AS path, in the received update must be denied. Enabling this feature adds to the security of the BGP network by not allowing traffic from unauthorized systems.

Example This example shows how to enable the security of the BGP network for autonomous system 65534. All incoming updates from eBGP peers are examined to ensure that the first AS number in the AS path is the local AS number of the transmitting peer:

Switch(config)# router bgp 65534
Switch(config-router)# bgp enforce-first-as 

bgp log-neighbor-changes

Use the bgp log-neighbor-changes command to enable logging of BGP neighbor resets. Use no bgp log-neighbor-changes to disable the logging.

bgp log-neighbor-changes

no bgp log-neighbor-changes

Syntax None

Default Disabled.

Command Mode Router configuration.

Usage Guideline

This command enables logging of both BGP resets and alternating status changes to use for troubleshooting purposes.

Unexpected neighbor resets might indicate high error rates or high packet loss in the network and should be investigated.

The neighbor status change messages are not tracked if the bgp log-neighbor-changes command is not enabled. The exception to this is for a reset reason, which is always available as output of the show ip bgp neighbors and show bgp ipv6 neighbors commands.

The logs for BGP neighbor changes will display on the console.

Example This example shows how to enable logging of BGP neighbor changes for autonomous system 65534:

Switch(config)# router bgp 65534
Switch(config-router)# bgp log-neighbor-changes 

Use the show logging buffer command to display the log for the BGP neighbor changes.

bgp router-id

Use this command to configure a fixed router ID for the Border Gateway Protocol (BGP) routing process. Use the no form of this command to remove the fixed router ID from the running configuration file.

bgp router-id IP-ADDRESS

no bgp router-id [IP-ADDRESS]

Syntax Description
IP-ADDRESS	Configures the router ID in IPv4 address format as the identifier of the local router running BGP.

Default The router ID is set to the highest IP address on a physical interface.

Command Mode Router configuration

Address family configuration

Usage Guideline

The bgp router-id command is used to configure a fixed router ID for a BGP routing.The router ID specified must be unique within the network. This command resets all active BGP peering sessions.

Example This example shows how to change the router ID with 192.168.1.1

Switch(config)# router bgp 65100
Switch(config-router)# bgp router-id 192.168.1.1 

boot config

Use this command to specify the file that will be used as the configuration file for the next boot up.

boot config [check] MEDIUM: URL

no boot config

Syntax Description
MEDIUM:URL Specifies the media where the file system is located.
	The valid values are flash:\, cf1:\,, etc. flash:\ represents system internal on-board FLASH memory. cf1:\ represents the first (left) open slot compact FLASH memory.
	URL - Specifies the file to be assigned.
check	(Optional) This option is used for show the configuration file information for the specified file. The information includes the file and model names.

Default Default configuration file is def_usr.conf

Command Mode Global configuration

Usage Guideline

The boot config command specifies the file system and file name of the configuration file to use for initialization (startup). The configuration file must be an ASCII file located in the specified file system.

The command takes affect immediately and will be kept in NVRAM.

In the following situations the boot configuration does not update and an error message is displayed:

• A configuration file is specified where the filename argument does not exist or is not valid causing the boot configuration to not update and an error message to be displayed.
• During initialization, the factory default configuration is used when the boot config setting does not exist or when it is null (such as at a first-time start-up). If the software detects a problem with the boot config file, the device uses the factory default configuration for system boot up.
• When using the no form of this command, the boot configuration resets to the default configuration

Use the show boot command to view the contents of the boot config configuration file.

Initially, a system file is used as the factory default configuration.

The specified URL must be represented by an absolute path. It cannot be represented by a relative path.

Examples

The following example shows how to specify the file switch-config as the startup configuration file:

Switch# configure terminal
Switch(config)# boot config flash:\switch-config
Switch(config)# end

Verify the settings by entering the show boot command.

The following example shows the result of specifying the incorrectly formed file yyy-config as the startup configuration file.

Switch# configure terminal
Switch(config)# boot config flash:\yyy-config.exe
Illegal configuration file
Switch(config)# end 

bootfile

This command is used to specify the name of the default boot image for a Dynamic Host Configuration Protocol (DHCP) client. To delete the boot image name, use the no form of the command.

boofile URL

no bootfile

Syntax Description

URL Specifies the path name and file name of the file that is used as a boot image. The maximum allowed string length is 127 characters

Default None

Command Mode DHCP pool configuration

Usage Guideline

Use this command to specify the name of the default boot image for a Dynamic Host Configuration Protocol (DHCP) client. The boot image can be located in the same DHCP server or other network servers.

Examples

The following example specifies mdubootfile as the name of the boot file for DHCP pool1.

switch > enable
switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# bootfile \dgs-6600\bootimage\mdubootfile.bin
switch(config-dhcp)# 

boot image

Use this command to specify the file used as the image file for the next boot.

boot image [ check ] MEDIUM: URL

Syntax Description
MEDIUM Specifies the media where the file system is located.
	The valid values are flash:\ and cf1:\. Flash:\ represents the on-board FLASH storage of the active control module. cf1:\ represents the first opened slot compact FLASH storage.
	URL: Specifies the file to be assigned.
check	(Optional) This option is used to show the firmware information for the specified file. The information includes file name, model name, version number, checksum, time stamp (if any).

Default None

Command Mode Global configuration

Usage Guideline This command is only available at privilege level 15.

The boot image command specifies the boot image file to be used for the next start up. Upon start up, the previous boot image becomes the secondary boot up image file.

There can be up to three boot image files in the list with the secondary position and tertiary position used as backup boot image files in sequence.

When this command is used to assign a file as the next-boot image file, the system will check the checksum and model to determine whether the file is a correct image file.

The specified URL must be represented by the absolute path. It cannot be represented by the relative path. Spaces are not allowed in either directory or file names of the absolute path as they will cause load failure of the boot image.

The check keyword option allows the user to check a new image file format to verify whether it is suitable to be a boot image or not. The option verifies and displays information such as the file name/content, version number, time stamp (it any), checksum, file size, etc.. The check option compares the information with that in the current boot image file.

If the storage media for the specified URL (filename) does not exist, an error message is displayed with the notification of the URL error.

Examples

The following example (on the next page) shows how to specify the switch to use the image file named switch-image1.bin as the boot image file for the next startup and the previous boot image,flash:\switch-image0.bin becomes the secondary boot image file in the list and changes the status to the backup boot image.

Switch# configure terminal
Switch(config)#boot image flash:\images\switch_image1.had
Checking image at local flash:\images\switch_image1.had ... Done.
Update bootlist .... Done.

Success 

Verify the settings by entering the show boot command.

channel-group

Use the channel-group command to assign an interface to a channel group.

Use no channel-group to remove an interface from a channel-group.

channel-group CHANNEL-NO mode { on| active| passive }

no channel-group

Syntax Description
CHANNEL-NO Specifies the Channel group ID.
mode { on | active | passive }	Specifies the mode of channel group as follows:• on - The interface is the static member of the channel-group.• active - The interface is to operate in LACP active mode.• passive - The interface is to operate in LACP passive mode.

Default None

Command Mode Interface configuration

Usage Guideline	The system automatically creates the port-channel when the channel group gets its first physical port.
	An interface can be in one mode only and in one channel-group only.
	If the mode on is specified in the command, the channel group is of a static type. If the mode active or passive is specified in the command, the channel group is LACP type. A channel group can only have either static member or dynamic members. That is, once the type of a channel group is determined, interfaces in other types cannot join the channel group.
	Only a physical port interface is allowed to specify the channel-group. The no command removes the interface from the channel group. If the channel group has no member port left after removal, it is deleted automatically.
	Configuration of a channel group has the following limitations:
	·If dot1x, port security, IP-MAC-Port binding, MAC AC or WAC are enabled for a port, the port cannot be specified as a channel group member.
	·In order to be a member of the LACP channel-group, the port must be set to full duplex. LACP will not prevent the user configuration of the port whether it is set to full duplex or not and if these ports have various duplex setting in the same channel group. LACP protocol behavior will choose the members that are set to full duplex for the link aggregation.

- In order to be a member of the LACP channel-group, the member ports must have the same speed setting. LACP will not prevent the user configuration if these ports have difference speed setting in the same channel group. LACP protocol behavior will choose the members that have the same speed to for the link aggregation.

Example

This example shows how to configure a channel group. It assigns the eth3.4 to 3.5 to port-channel 3 with the LACP mode active.

Switch(config)# interface range eth3.4-3.5
Switch(config-if)# channel-group 3 mode active 

Verify the settings by entering the show channel-group command

class

Use this command to specify the name of the class map in order to define its traffic policy and enter into policy-map class configuration mode. Use the no form of the command to remove the policy definition for the specified class. All the traffic that does not match any defined class will be classified to default class, class-default.

class NAME

no class NAME

class class-default

Syntax Description

NAME Specifies the name of the class map that the class policy. Up to 32 characters are allowed.

Default None

Command Mode Policy-map configuration

Usage Guideline

The class map needs to be created before the policy can be configured for it. A class-map without any match commands cannot be configured as a class policy.

This command enters the policy-map class configuration mode. The user can use the set command and police command to define the QoS policy for the class.

class-default is the reserved name for the default class. All the traffic that does not match any defined class will be classified to class-default.

Examples
This example shows how to define a policy map, policy1 which defines policies for class, class-dscp-red. The packet that matches DSCP 10, 12, or 14 will be set to new DSCP 10 and policed by a single rate policer.

Switch(config)# class-map class-dscp-red
Switch(config-cmap)# match ip dscp 10,12,14
Switch(config-cmap)# exit
Switch(config)# policy-map policy1
Switch(config-pmap)# class class-dscp-red
Switch(config-pmap-c)# set ip dscp 10
Switch(config-pmap-c)# police 64 128 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit

Verify the settings by entering the show policy-map command.

class-map

To create a class map to be used for matching packets to a specified class, use the class-map command. To remove an existing class map from the switch, use the no form of this command. The class-map command enters the class-map configuration mode in which multiple issues of the match command on page 308 can be entered to configure the match criteria for this class.

class-map [ match-any] NAME

no class-map NAME

Syntax Description

NAME Name of the class for the class map. The name can be a maximum of 32 alphanumeric characters. The class name will be referenced in policy map to configure the policy for the class.

match-any (Optional) Determines how to evaluate the multiple match criteria. Match statements in this class map will be evaluated based on the logical “OR” function.

Default Only the class-default exists by default.

All traffic that does not match any defined class will be classified to class-default.

Command Mode Global configuration

Usage Guideline

Use the class-map command to specify the class that will create or modify the match criteria. This command enters class-map configuration mode where match commands are entered to configure the match criteria for this class. Packets that arrive at the ingress port are checked against the match criteria for a class map to determine if the packets belong to that class.

When configuring a class map, use one or more match commands to specify multiple match criteria. For example, use the match access-list command, the match protocol command, the match vlan command, the match dscp command, the match precedence command or the match cos command.

When configuring multiple match commands for a class, use the match-any keyword to specify whether to evaluate the multiple match criteria based on using logical OR.

A maximum of 256 class maps are allowed.

The name class-default is reserved.

Example

The following example (on the next page) specifies class_home_user as the name of a class map. In this class map, a match statement specifies that the

traffic that matches the access control list acl_home_user or match ipv6 protocol will be included in class_home_user.

Switch(config)# class-map match-any class_home_user
Switch(config-cmap)# match access-list acl_home_user
Switch(config-cmap)# match protocol ipv6
Switch(config-cmap)# exit
Switch(config)# 

Verify the settings by entering the show class-map command.

clear arp-cache

To remove dynamically created entries from the Address Resolution Protocol (ARP) cache, use the clear arp-cache command in Privileged EXEC mode.

clear arp-cache [interface INTERFACE-ID | IP-ADDRESS]

Syntax Description
INTERFACE-ID	(Optional) Removes only the ARP table entries associated with this interface such as for example, vlan100 for the VLAN interface.
IP-ADDRESS (Optional)	IP address to clear from the ARP table.

Default None

Command Mode Privileged EXEC

Usage Guideline This command is used to delete dynamic entries from the ARP cache. The user can select to delete all dynamic entries, specific dynamic entries, or dynamic entries that are associated with a specific IP interface.

Example This example shows how to remove all dynamic entries from the ARP cache.

Switch#clear arp-cache

clear counters

Use the command to clear counters for a specific port interface or all port interfaces.

clear counters [INTERFACE-ID [, | - ]]

Syntax Description
INTERFACE-ID	(Optional) Specifies the interface ID. If no interface is specified, all counters on applicable interfaces (physical ports) will be cleared.

Default None

Command Mode Privileged EXEC

Usage Guideline For now, only physical port counters are provided.

Examples This example shows how to clear counters of interface eth3.10.

Switch# clear counters eth3.10
Switch# 

The following example will clear all of physical ports' statistic counters.

Switch# clear counters
Switch# 

The following example will clear eth 3.1-3.24 physical port s' statistic counters.

Switch# clear counters eth3.1-3.24
Switch# 

clear dos prevention counter

Use this command to clear the counter of all attack types.

clear dos_prevention counter

Syntax None

Default None

Command Mode Global configuration.

Usage Guideline Use to reset counters of DoS prevention to zero.

Examples This example shows how to clear counters.

Switch(config)# clear dos_prevention counter
Switch(config)# 

Below is an example of using the show dos_prevention command to display the DoS frame counts:

Switch(config)#show dos_prevention
DoS Prevention Information
Action: Drop
Mirror Dst Port: Mirror Not Enable
Frame Counts: 242 

DoS Type State 

Land Attack Enabled
Blat Attack Enabled
Smurf Attack Enabled
TCP Null Enabled
TCP Xmas Enabled
TCP SYNFIN Enabled
TCP SYN SrcPort Less Than 1024 Enabled 

clear gvrp statistics interface

Use the clear gvrp statistics command to clear the statistics of a single port, a range of ports or all gvrp ports.

clear gvrp statistics [ interface INTERFACE-ID [, | -] ]

Syntax Description
INTERFACE-ID	(Optional) Specifies the interface to be cleared. If no interface is specified the statistics on all interfaces will be cleared.
,	(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range.
-	(Optional) Specifies a range of interfaces.

Default None

Command Mode Privileged EXEC

Usage Guideline This command clears the GVRP counters. If the interface-ID is not specified all GVRP counters for all interfaces will be cleared.

Example This example shows how to clear the GVRP statistics on all interfaces.

Switch# clear gvrp statistics
Switch# 

clear ip bgp

To reset BGP connections using hard or soft reconfiguration, use the clear ip bgp command.

clear ip bgp { * | AUTONOMOUS-SYSTEM-NUMBER | NEIGHBOR-ADDRESS} [ soft ] [ in | out ]

Syntax Description
* Specifies that all current BGP sessions will be reset.
AUTONOMOUS-SYSTEM-NUMBER	Specifies that sessions with BGP peers in the specified autonomous system will be reset.
NEIGHBOR-ADDRESS	Specifies that the session of the identified BGP neighbor will be reset. The value for this argument can be an IPv4 or IPv6 address.
in	(Optional) Initiates inbound reconfiguration. If neither the in nor out keywords are specified, both inbound and outbound sessions are reset.
out	(Optional) Initiates inbound or outbound reconfiguration. If neither the in nor out keywords are specified, both inbound and outbound sessions are reset.
soft (Optional) Initiates a soft reset. Does not reset the session.

Default None

Command Mode Privileged EXEC

Usage Guideline

Use of the clear ip bgp command allows a reset of the neighbor sessions with varying degrees of severity, depending on the specified keywords and arguments.

Use the * keyword to reset all neighbor sessions. The software will clear and then reset the neighbor connections. Use this form of the command in the following situations:

• Modifying the BGP timer specification
• Modifying the BGP administrative distances

Use the soft and out keywords to clear and reset only the outbound neighbor connections. Inbound neighbor sessions will not be reset. Use this form of the command in the following situations:

• Additions or modifications are made to the BGP-related access lists
• Modifying the BGP-related weights
• Modifying the BGP-related distribution lists
• Modifying the BGP-related route maps

Use the in keyword to clear only the inbound neighbor connections. Outbound neighbor sessions will not be reset. Use this form of the command in the following situations:

• Modifying the BGP-related weights
• Modifying the BGP-related distribution lists
• Modifying the BGP-related route maps

- Additions or modifications to BGP-related access lists.

If inbound routing tables are reset, all BGP routers must support route refresh capability (RFC 2918).

Example In the following example, the BGP session is reset for BGP neighbor 172.5.78.12:

Switch# clear ip bgp 172.5.78.12
Switch# 

clear ip bgp peer-group

To reset BGP connections using hard or soft reconfiguration for all the members of a BGP peer group, use the clear ip bgp peer-group command.

Without Address Family Syntax

clear ip bgp peer-group PEER-GROUP-NAME [soft] [in | out]

Syntax Description
PEER-GROUP-NAME Peer group name.
in	(Optional) Initiates inbound reconfiguration. If neither the in nor out keywords are specified, both inbound and outbound sessions are reset.
out	(Optional) Initiates inbound or outbound reconfiguration. If neither the in nor out keywords are specified, both inbound and outbound sessions are reset.
soft (Optional) Initiates a soft reset. Does not tear down the session.

Default None

Command Mode Privileged EXEC

Usage Guideline

The clear ip bgp peer-group command is used to initiate a hard reset or soft reconfiguration for neighbor sessions of BGP peer groups. A hard reset tears down and rebuilds the specified peering sessions and rebuilds the BGP routing tables. A soft reconfiguration uses stored prefix information to reconfigure and activate BGP routing tables without tearing down existing peering sessions.

Soft reconfiguration uses stored update information, at the cost of additional memory for storing the updates, to allow application of a new BGP policy without disrupting the network. Soft reconfiguration can be configured for inbound or outbound sessions.

Use this command whenever any of the following changes occur:

• Modifications to BGP-related weights
• Modifications to BGP-related distribution lists
• Modifications to BGP-related route maps

- Additions or modifications to the BGP-related access lists

The route refresh capability, as defined in RFC 2918, allows the local router to reset inbound routing tables dynamically by exchanging route refresh requests to supporting peers. The route refresh capability does not store update information locally for nondisruptive policy changes. It instead relies on dynamic exchange with supporting peers. Route refresh is advertised through BGP capability negotiation. All BGP routers must support the route refresh capability.

To determine if a BGP router supports this capability, use the show ip bgp neighbors command on page 459 command. The following message is displayed in the output when the router supports the route refresh capability:

Received route refresh capability from peer

If all BGP routers support the route refresh capability, use the clear ip bgp peer-group command with the in keyword. It is not necessary to use the soft keyword, because soft reset is automatically assumed when the route refresh capability is supported.

Examples

In the following example, all members of the BGP peer group named INTERNAL are reset:

Switch# clear ip bgp peer-group INTERNAL
Switch# 

In the following example, a soft reconfiguration is initiated for the inbound session with members of the peer group INTERNAL, and the outbound session is unaffected:

Switch# clear ip bgp peer-group INTERNAL soft in Switch# 

clear ip dhcp binding

Use this command to delete an address binding from the DHCP Server database.

clear ip dhcp binding [pool NAME] [ADDRESS]

Syntax Description
pool NAME	(Optional) Name of the DHCP pool. If the pool name option is not specified the command will parse all the DHCP pools for the specified binding.
ADDRESS	(Optional) The IP address of binding to be deleted. If no address is specified, all of bound addresses are cleared.

Default None

Command Mode Privileged EXEC

Usage Guideline

Use this command to delete the address of the binding. The address denotes the assigned client's IP address. If no IP address is specified, DHCP server clears all bindings.

Note the following behavior for the clear ip dhcp binding command:

• If the pool NAME option is not specified and an IP ADDRESS is specified, it is assumed that the IP address is an address in the global address space and the command will parse all the DHCP pools for the specified binding.
• If both the pool NAME option and the ADDRESS option are not specified, it is assumed that all bindings in all pools are to be deleted.
• If the pool NAME option is specified without the ADDRESS option being specified, then all the bindings in the specified pool will only be cleared.
• If the pool NAME option and an IP ADDRESS is specified, the specified binding will be deleted from the specified pool.

Examples The following example deletes the address binding 10.12.1.99 from DHCP server database:

swtich# clear ip dhcp binding 10.12.1.99
swtich# 

The following example deletes all bindings from all pools:

switch# clear ip dhcp binding 

The following example deletes address binding 10.13.2.99 from the address pool named pool2:

switch# clear ip dhcp pool pool2 binding 10.13.2.99
switch# 

Verify the settings by entering the show ip dhcp binding command.

clear ip dhcp conflict

Use this command to clear an address conflict from the DHCP server database.

clear ip dhcp conflict [pool NAME] [ADDRESS]

Syntax Description

pool NAME	(Optional) Name of the DHCP pool.
ADDRESS (Optional)	The IP address, that is in conflict, to be deleted

Default None

Command Mode Privileged EXEC

Usage Guideline

Use this command to delete the address in conflict. The DHCP server detects the conflict of an IP address by using a ping session. If no IP address is specified, DHCP server clears all known IP addresses that are in conflict.

The server detects conflicts using a ping session. The client detects conflicts using gratuitous Address Resolution Protocol (ARP).

Note the following behavior for the clear ip dhcp conflict command:

• If the pool NAME option is not specified and an IP ADDRESS is specified, the system parses all the DHCP pools for the address of the specified conflict.
• If the pool NAME option is not specified and no IP ADDRESS is specified, then the system deletes all address conflicts from all DHCP pools.
• If the pool NAME option is specified but no IP ADDRESS is specified, then all conflicts in the specified pool will only be cleared.
• If both the pool NAME option and an IP ADDRESS are specified, the specified address conflict will be deleted from the specified pool.

Examples

The following example shows an address conflict of 10.12.1.99 being deleted from the DHCP server database

switch# clear ip dhcp conflict 10.12.1.99
switch# 

The following example deletes all the address conflicts from the entire DHCP server database.

switch#clear ip dhcp conflict
switch# 

The following example deletes all the address conflicts from the address pool named pool1:

switch#clear ip dhcp conflict pool pool1
switch# 

clear ip dhcp server statistics

Use this command to reset all Dynamic Host Configuration Protocol (DHCP) server counters.

clear ip dhcp server statistics

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline

This command clears all of the DHCP statistic counters. That is all of counters will be initialized, or set to zero.

Example The following example resets all DHCP counters to zero.

switch# clear ip dhcp server statistics
switch# 

clear ip ospf

Use this command to restart the OSPF process.

clear ip ospf

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline

This command is used to restart the OSPF routing process. The following is a situation where this command can be used:

- When a new route-ID is configured, it will not take effect until next time the switch h is booted. When the OSPF process is restarted by this command, the new router-ID will take effect immediately without having to reboot the switch.

Example This example shows how to restart all of OSPF processes

Switch>enable
Switch# clear ip ospf 

clear ipv6 dhcp client

This command is used to restart the DHCPv6 client on an interface.

clear ipv6 dhcp client INTERFACE-NAME

Syntax Description
INTERFACE-NAME	Specifies the identifier of the switch interface on which to restart the DHCPv6 client.

Default None

Command Mode Privileged EXEC

Usage Guideline	The clear ipv6 dhcp client command restarts DHCP for an IPv6 client on a specified interface after first releasing and unconfiguring the previously acquired prefixes and other configuration options (for example, Domain Name System [DNS] servers).
Example	The following example restarts the DHCPv6 client for interface vlan1:

Switch > enable
Switch # clear ipv6 dhcp client vlan1
Success.
Switch # 

clear ipv6 neighbors

This command is used to clear the IPv6 neighbor information.

clear ipv6 neighbors [IFNAME]

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline The command clear ipv6 neighbors will only clear dynamic entries.

Example This example shows how to clear instances of IPv6 neighbors:

Switch > enable
Switch # clear ipv6 neighbors vlan1
Switch # 

clear ipv6 ospf process

To restart the state of IPv6 OSPF, use the clear ipv6 ospf process command.

clear ipv6 ospf [PROCESS-ID] process

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.

Default None

Command Mode User EXEC

Usage Guideline

When the clear ipv6 ospf process command is used, the IPv6 OSPF database is cleared and repopulated. Once the database is cleared and repopulated the SPF algorithm will be performed.

Use the PROCESS-ID option to clear only one IPv6 OSPF process. If the PROCESS-ID option is not specified, all IPv6 OSPF processes are cleared.

Example The following example restarts the SPF algorithm by clearing the IPv6 OSPF processes from the database.

Switch > enable
Switch # clear ipv6 ospf process 

clear ipv6 rip

To delete routes from the IPv6 RIP routing table, use the clear ipv6 rip command.

clear ipv6 rip

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline All IPv6 RIP routes are deleted.

Examples The following example deletes all the IPv6 routes for the RIP process.

Switch > enable
Switch # clear ipv6 rip 

clear logging

Use this command to clear log messages from the system logging buffer.

clear logging

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline Use this command to clear log messages from the logging buffer.

Example The following example to show how to clear log messages in buffer.

Switch# enable
Switch# clear logging
Switch# 

clear mac address-table

Use the clear mac address-table command to delete from the MAC address table:

• specific dynamic address,
• all dynamic addresses on a particular interface,
• all dynamic addresses,
  • or all dynamic addresses on a particular VLAN.

clear mac address-table { dynamic [ address MAC-ADDR | interface INTERFACE-ID | vlan VLAN-ID ] }

Syntax Description
address MAC-ADDR	Delete the specified dynamic MAC address.
interface INTERFACE-ID	The specified interface can be a physical port or port-channel.
vlan VLAN-ID	(Optional) Specifies the VLAN ID; valid values are from 1 to 4094.

Default None

Command Mode Privileged EXEC

Usage Guideline	When using the address MAC-ADDR argument, only the dynamic entries will be cleared.
Example	This example shows how to remove a specific MAC address from the dynamic address table:

Switch# clear mac address-table dynamic address 00:08:00:70:00:07

Verify the information was deleted by entering the show mac address-table command.

clear port-security

To delete all of the secured MAC addresses, except for manually configured secured MAC addresses, from the MAC address table, use the clear port-security command.

clear port-security [{address MAC-ADDR} | {interface INTEFACE-ID}] [vlan VLAN-ID]

Syntax Description
address MAC-ADDR	(Optional) Deletes the specified secure MAC address auto-learned.
Interface INTEFACE-ID	(Optional) Deletes all secure MAC addresses auto-learned on the specified physical.
vlan VLAN-ID	(Optional) Deletes the specified secure MAC address from the specified VLAN.

Default None

Command Mode Privileged EXEC

Usage Guideline

This command clears secure MAC address that are auto-learned only and not manually configured MAC addresses.

If the clear port-security command is entered without adding any keywords or arguments, the switch removes all the secure MAC addresses from the MAC address table.

If the clear port-security interface INTERFACE-ID command is entered, all the secure MAC addresses auto-learned on the specified interface are removed from the MAC address table.

Example This example shows how to remove a specific secure address from the MAC address table:

Switch# clear port-security address 0080.0070.0007
Switch# 

This example shows how to remove all the secure MAC addresses auto-learned on a specific interface:

Switch# clear port-security interface eth3.1 

clear running-config factory-defaults

Use this command to clear the system's running configuration.

clear running-config factory-defaults

Syntax None

Command Mode Privileged EXEC at level 15

Usage Guideline

The user can enter the clear running-config factory-defaults command to clear the system configuration retained in Dynamic RAM.

Before using the clear running-config factory-defaults command, save a backup of the configuration using the copy command or upload a configuration profile into the system. When the clear running-config factory-defaults command is entered, the system resets the running configuration with the factory default settings.

Since the command clears all of system configuration settings including IP parameters, any remote management applications will lose their connections. Therefore, before proceeding, a confirmation should be applied. In addition, it is suggested to reload a configuration file immediately after clearing the configuration.

The clear running-config command clears all system configuration settings including the MGMT-IP address which is set back to the factory default of 10.90.90.90/8.

Example

The following example demonstrates how to clear system running configuration.

Switch# clear running-config factory-defaults
...
Switch# 

clear spanning-tree detected-protocols

To restart the protocol migration, use the clear spanning-tree detected-protocol command.

clear spanning-tree detected-protocols [interface INTERFACE-ID]

Syntax Description
interfaceINTERFACE-ID	(Optional) Specifies the port interface that will trigger the detecting action. If no option is specified, every port is effected by this command.

Default None

Command Mode Privileged EXEC.

Usage Guideline

This configuration is only effective for RSTP version or MSTP mode. By issuing the command the port protocol migrating state machine will be forced to SEND_RSTP state. This action can be used to test whether all legacy bridges on a given LAN have been removed. If there is no STP Bridge on the LAN, the port will operate in the configured mode, either in RSTP or MSTP mode. Otherwise, the port will operate in STP mode.

RSTP and MST have built-in compatibility mechanisms that allow them to interact properly with other versions of IEEE spanning tree or other regions. For example, a bridge running RSTP can send 802.1D BPDUs on one of its ports when it is connected to a legacy bridge. An MST bridge can detect that a port is at the boundary of a region when it receives a legacy BPDU or an MST BPDU that is associated with a different region. These mechanisms are not always able to revert to the most efficient mode. For example, an RSTP bridge that is designated for a legacy 802.1D stays in 802.1D mode even after the legacy bridge has been removed from the link. Similarly, an MST port assumes that it is a boundary port when the bridges which it is connected to have joined the same region. To force the MST port to renegotiate with the neighbors, enter the clear spanning-tree detected-protocol command.

Entering the clear spanning-tree detected-protocol command with no arguments, applies the command to every port of the switch.

Example

This example shows how to trigger the protocol migration event for all ports:

Switch# clear spanning-tree detected-protocols

clear vlan-tunnel ctag-mapping dynamic

Use this command to clear all dynamically learned mappings between customer VLAN tags and source IPs.

clear vlan-tunnel ctag-mapping dynamic

Syntax None

Default None

Command Mode User EXEC

Usage Guideline

This command is used to clear all dynamically learned mappings between a customer VLAN tag and source IP in the switch software. When the setting of a VLAN tunnel is changed, as for example its interface-type or TPID, then the new setting could for example cause the system to send out control packets with the wrong customer VLAN tag. In this situation, use this command to clear the incorrect dynamically learned mapping entries to re-learn the correct customer VLAN tag mapping with the source IP.

Examples This example shows how to clear all dynamically learned customer VLAN tag mappings.

Switch# clear vlan-tunnel ctag-mapping dynamic
Switch# 

clock set

Use this command to manually set the system clock.

clock set HH:MM:SS DAY MONTH YEAR

Syntax Description

HH:MM:SS Current time in hours (24-hour format), minutes and seconds.

DAY Current day (by date) in the month.

MONTH Current month (by name, January, Jan, February, Feb, and so on).

YEAR Current year (no abbreviation).

Default Hardware Generated - 00:00:00 01 January 1993

Command Mode Privileged EXEC at Privilege level 15

Usage Guideline

Generally, if the system is synchronized by a valid outside timing mechanism, such as SNTP, it is not necessary to set the clock manually. Use this command if no other time sources are available. Use the clock timezone command on page 90 to configure the timezone applied to the clock settings. The clock configured by this command will be applied to RTC if it is available. The configured clock will not be stored in the configuration file.

If the clock is manually set and the SNTP server is configured, the system will still try to sync the clock with the server. If time sync is successful, the SNTP server set time replaces the manually set time.

If the SNTP state changes from enabled to disabled, the system clock continues operations but no longer attempts to sync time with the server.

Example
The following example shows how to manually set the software clock to 6:00 p.m. on Aug 22, 2010:

Switch# clock set 18:00:00 22 Aug 2010
Switch# 

Verify the settings by entering the show clock privileged EXEC command.

clock summer-time

Use one of the optional keyword formats of the clock summer-time command to configure the system time to automatically set the seasonal time adjustment (daylight saving time). To disable automatic seasonal time adjustment, use the no form of this command.

clock summer-time recurring WEEK DAY MONTH HH:MM WEEK DAY MONTH HH:MM [OFFSET]

clock summer-time date DATE MONTH HH:MM DATE MONTH HH:MM [OFFSET]

no clock summer-time

Syntax Description

recurring Indicates that a summer seasonal time change should start and end on the specified day and week of the specified month. For example: summer time adjustment begins Sunday in the first week of April.

date Indicates that summer time should start and end on the specified date of the specified month.

WEEK Week of the month (1 to 4 or last).

DAY Day of the week (sun, mon, and so on).

DATE Date of the month (1 to 31).

MONTH Month (by name , January, February, and so on).

HH:MM Time (24 hours format ) in hours and minutes.

OFFSET (Optional) Number of minutes to add during summer time (default is 60)The range of offset is 30, 60, 90 and 120.

Default Disabled

OFFSET: 60

Command Mode Global configuration

Usage Guideline

Use this command to automatically make seasonal time changes for the system clock.

The recurring mode is used to make time adjustment to begin and end on a specified week day, week and month. Use the date mode to make the time change begin and end on specified calendar dates. The syntax for both modes uses the first portion of the parameter to express the beginning of the time adjustment period while the ending of the period is expressed in the second portion.

Example

The following example shows how to specify that summer time starts on the first Sunday in April at 2 a.m. and ends on the last Sunday in October at 2 a.m:

Switch# configure terminal
Switch(config)# clock summer-time recurring 1 sun April 2:00 last sun October 2:00
Switch(config)# end 

Verify the settings by entering the show clock command.

clock timezone

Use the command to set the time zone for display purpose. To set the time to Coordinated Universal Time (UTC), use the no form of this command.

clock timezone {+|-} HOURS-OFFSET [MINUTES-OFFSET]

no clock timezone

Syntax Description

+|- '+' means time to be added to the UTC; '-' means time to be subtracted from the UTC.

HOURS-OFFSET Hours difference from UTC.

MINUTES-OFFSET (Optional) Minutes difference from UTC.

Default UTC

Command Mode Global configuration

Usage Guideline

The time obtained by SNTP server refers to the UTC time. The local time will be calculated based on UTC time, time zone, and the daylight saving configuration.

Example

The following example shows how to set the time zone to Pacific Standard Time (PST), which is 8 hours ahead of UTC:

Switch# configure terminal
Switch(config)# clock timezone - 8
Switch(config)# end 

Verify the settings by entering the show clock command.

color-aware

Use the color-aware command to specify the color aware mode for a class. Use the no form of the command to set the class to color blind mode.

color-aware

no color-aware

Syntax None

Default color-blind mode

Command Mode Policy-map class configuration

Usage Guideline

The color-aware command specifies that the configured policer for the traffic class will operate in color aware mode. In color aware mode, the initial color of the packet and the policer metering result determines the final color. The initial color of the packet is mapped from the incoming DSCP based on the DSCP to color map if the receiving port trusts DSCP. If the receiving port trusts CoS, then the initial color is mapped from the incoming CoS based on the CoS to color map

If the configured policer operates in color blind mode, then the policer metering result determines the final color.

Examples

The following example creates the policy map pcolor-map1 and configures the policy of running color aware mode and two rate policing for the class1 class in the policy map.

Switch(config)# policy-map pcolor-map1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# color-aware
Switch(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 exceed-action set-dscp-transmit 2 violate-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit

The following example attach the pcolor-map1 policy map to eth3.1 and sets the port to trust CoS and defines the CoS to color map.

Switch(config)# interface eth3.1
Swtich (config-if)# service-policy pcolor-map1
Swtich (config-if)# qos trust cos
Swtich (config-if)# qos map cos-color 1-7 to green
Swtich (config-if)# exit 

Verify the settings by entering the show policy-map command.

command prompt

Use this command to change the device cli prompt to, for example: the product name, system name, or other user-defined strings. The command can also specify whether to display the current privilege level in the prompt.

command prompt [level | no-level] [string STRING | product-name | system-name]

Syntax Description
level (Optional) The privilege level information is appended to prompt name.
no-level (Optional) No privilege level information is appended to prompt name.
string STRING	(Optional) Specifies the user-defined prompt. The valid length is 1-8 characters.The syntax is a user-defined string.
product-name (Optional) Use the product name as the prompt name
system-name	(Optional) Use the system name (as defined in SNMP System group MIB) as the prompt name.

Default product-name with privilege level

Command Mode Privileged EXEC

Usage Guideline

The prompt refers to the string that appears indicating to a user to input a command. It consists of two parts. The first part is the prompt name. The second part is the privileged level.Using this command, the user can change the prompt to use either the product name or system name and specify whether or not to display the privilege level in the promptEither one or both settings can be changed. If the user selects to use the product name or the system name as the prompt, only the first 8 characters are taken.The prompt will be changed immediately after the command is executed.

Examples This example shows how to change the prompt to use the system name.

DGS-6600:15# command prompt system-name switch:15# 

The following example shows how to set the command prompt back to default setting: (product name and privilege level).

switch:15# command prompt
DGS-6600:15# 

The following example shows how to hide the privilege information from the console prompt.

DGS-6600:15# command prompt no-level
DGS-6600# 

This example shows define alpha as the console prompt.

DGS-6600:15# command prompt level string alpha alpha:15# 

configure terminal

Use this command to enter the global configuration mode

configure terminal

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline

Entering into the configuration mode allows configuration settings of the switch to be entered or modified i.e. performing switch configuration.

Example This example shows how to enter into the configuration mode:

Switch#configure terminal
Switch(config)#

copy

Use the copy command to copy a image, log or configuration file from a remote or local source to a local or remote destination file.

copy SOURCE-URL DESTINATION-URL

copy SOURCE-URL tftp:\ IP-ADDRESS DIRECTORY FILENAME

copy tftp:\ IP-ADDRESS \ [ DIRECTORY \ ] FILENAME DESTINATION-URL

Syntax Description

SOURCE-URL Specifies the source URL for the source file to be copied.

The URL has two forms. One of them is represented by keyword. For the second form, it is prefixed by the media. The acceptable media are flash:\ and cf1:\.

Flash:\ refers to system internal on-board FLASH memory

cf1:\ represents the first opened slot compact FLASH memory.

The source can be either local or remote. For download purpose, the source is in remote server. For upload purpose, the source is located locally.

If the running-config is specified as the SOURCE-URL, the purpose is to upload the running configuration or save the running-configuration as the startup configuration.

If the system-log is specified as the SOURCE-URL, the system log can be retrieved to TFTP server.

If the startup-config is specified as the SOURCE-URL, the purpose is to upload the startup configuration and save it as: a file in the file system or as the running-configuration.

DESTINATION-URL Specifies the destination URL as the target for the copied file.

The URL has two forms. One of them is represented by keyword. For the second form, it is prefixed by media. The acceptable media are flash:\, cf1:.

Flash:\ refers to system internal on-board FLASH memory

cf1:\ represents the first opened slot compact FLASH memory.

The destination can be either local or remote. When downloading the destination is target is the local file system. When uploading the destination is on a remote server.

When running-config is specified as the DESTINATION-URL, it will write the source file contents as the running configuration.

When startup-config is specified as DESTINATION-URL, the source file contents will be saved as the next-boot configuration. It will save into the current configuration file in NVRAM and the file name will be maintained as the file name specified with boot config command.

IP-ADDRESS\ The IP address of TFTP server.

DIRECTORY\ The directory name of the source or destination file in TFTP server.

Default None

Command Mode Privileged EXEC

Level 15 for configuration copy.

Usage Guideline

The copy command (when the source/destination URL is running-config, startupconfig is only available at privilege level 15.

Use this command to download or upload the image file or the configuration file between remote TFTP server and the local file system. Also use this command to upload system log to TFTP server.

The copy SOURCE-URL DESTINATION-URL command is used to copy file from system flash to compact flash or vice versa.

To upload the running configuration or save the running-configuration to startup configuration, specify running-config as the SOURCE-URL. To save it to the startup config, specifies startup-config as the DESTINATION-URL.

Notice: If the destination is the startup-config file, the source file is directly copied to the file specified in boot config command. This means the original startup-config file is overwritten by the running configuration.

To apply a configuration file to the running configuration, specify running-config as the DESTINATION-URL.

Notice: If the source is a system-log and the destination is a file, the current system log information is saved to NVRAM with the specified name. Be aware that any copy running-config action does not imply any system log copy or saving action.

To represent a file in the remote TFTP server, the URL must be prefixed with tftp:.

If the SOURCE-URL or DESTINATION-URL is a tftp server, it uses switch port to connect the network under execution mode. Under management mode It uses the management port to connect the network.

In this chassis based switch, the runtime image also contains the operational code for the line cards. The operational code is automatically synced to the line card during the boot-up procedure.

Any file to be downloaded (or copied) to the directory to be an image file in the system's flash or downloaded (or copied) to be the startup-image will be checked and verified whether it is an image file with a correct checksum and model ID.

Any file to be downloaded (or copied) as the startup-config or the running-config will be checked and verified whether it is a configuraiton file or not (the boot config command will also check whether it is a configuraiton file or not first).

Examples

This example shows how to configure the switch (running configuration) to use a configuration (switch-config.txt) that is download from a TFTP server(10.1.1.254).

Switch# copy tftp:\10.1.1.254\config\switch-config.txt running-config
Configure using 10.1.1.254\config\switch-config.txt (y/n) [n]? y
Finished network download. (134 bytes)
Apply to system configuration... Completed.
Switch# 

This example shows how to upload (retrieve) the running configuration to a TFTP server for storage:

Switch# copy running-config tftp:\10.1.1.254\config\switch-config.txt
Upload configuration to tftp:10.1.1.254 \config\switch-config.txt, (y/n)[n]? y
Configuration has been copied successfully.
Switch# 

This example shows how to save the system running configuration into FLASH memory and use it for the next boot configuration:

Switch# copy running-config startup-config
Save system configuration (y/n) [n], y
Configuration has been copied successfully.
Switch# 

cos remarking

Use this command to remark the receiving CoS priority for a VLAN tunnel application. Use the no form of this command to set as customer CoS trusted.

cos remarking NEW-COS [C-VID [, | -]]

no cos remarking [ C-VID[, | -]]

Syntax Description
NEW-COS Specifies the new COS value to be added into the outer priority tag for VLAN encapsulation. Alternatively it is used to replace the priority tag for VLAN remarking. The available value is 0~7.
C-VID [, | -]	(Optional) Specifies the receiving packet with the inner VLAN (customer VLAN ID, CVID) in this list it will use the new COS value and it will be added into the outer priority tag (in VLAN encapsulation) or is used to replace the priority tag (in VLAN remarking).If C-VID[,|] is not specified for the no cos remarking command, then the ingress port will trust the user's priority tag and replicate/retain the priority tag except those customers' VLANs that have been set by cos remarking NEW-COS C-VID [, | -] command.If C-VID[,|] is not specified for the cos remarking NEW-COS command, then the ingress port will remark the user's priority tag and remark/replace the priority tag except those customers' VLANs that have been set by cos remarking NEW-COS C-VID [, | -] (cos remarking NEW-COS command is not set at the interface).The available values are 1~4094 and only the C-VID has been defined in VLAN encapsulation or VLAN remarking pair that can be accepted by this command. That is, the VLAN encapsulation or VLAN remarking pair must be defined, before the CoS remarking policy is changed.

Default No COS remarking is set. The user/inner cost is trusted at the interface.

Command Mode Interface configuration

Usage Guideline This command is used for UNI port for VLAN tunnel application.

Use the cos remarking command to remark the outer tag priority. As CoS remarking is applied for VLAN encapsulation, the new CoS value is added into the outer priority tag. As CoS remarking is applied to VLAN remarking, the new CoS value is used to remark(replace) the priority tag.

To retain the priority from the receiving packet, use no cos remarking to make the system replicate or retain the original priority tag value to/as the out-going priority tag. This is also referred as user/inner COS trusted. The COS tag replication is only applied to outer priority tag in VLAN encapsulation and the COS remarking (replacement) is applied for the VLAN remarking.

	Use the no cos remarking C-VID command (with optional parameters) to set the related C-VID as customer CoS trusted at the interface (cos remarking NEW-COS command is not set at the interface).
Example	Please follow the below example for a detailed step by step explanation
	1. Go to interface Ethernet 4.1
Siwthc(config)#>interface eth4.1
	2. Configure a VLAN encapsulation for C-VID 101-104 to S-VID 1001 and customer CoS trusted.
Switch(config-if)#>vlan encapsulation 1001 101-104
	3. Configure COS remarking for all incoming packets at Ethernet 4.1 as priority of 7.
Switch(config-if)#>cos remarking 7
	4. Remark C-VID 101 packet priority as 3, and others use priority 7 remarking.
Switch(config-if)#>cos remarking 3 101
	5. Change the interface as CoS trusted. That is C-VID 101 will be priority remarking, C-VID 102-104 still remained in customer CoS trusted state, and interface has been set as Customer CoS trusted.
Switch(config-if)#>no cos remarking
	6. The system will trust all of incoming packets CoS, because C-VID is set as Customer CoS trusted now.
Switch(config-if)#>no cos remarking 101

Verify the settings by entering show vlan-tunnel command.

crypto key

To generate and configure an RSA or DSA key pair, use the crypto key command.

crypto key { rsa|dsa } NBITS [ force ]

Syntax Description

rsa Configure an RSA key pair.

dsa Configure a DSA key pair.

NBITS Specifies the size of the key pair(s): For RSA the valid values are 512, 768, 1024, and 2048. For DSA the valid values are 512, 768, and 1024. For SSH version 2, the minimum recommended key size is 768 bits. A key size with a larger number provides higher security but takes longer to generate.

force (Optional) Regenerates the keys and suppresses the warning prompt for overwriting existing keys.

Default None

Command Mode Privileged EXEC

Usage Guideline

To support SSH login, an RSA or DSA key pair must first be generated. This command can generate either an RSA or DSA key to provide greater security when logging into the server using SSH. The NBITS value is required to specify the size of the key pair.

Example This example shows how to create an RSA key, 1024 bits:

Switch# crypto key rsa 1024
Generating RSA keys.... [OK]
Switch# 

default-gateway (management port)

Use this command to set the IP address of the default gateway. Use the no form of this command to revert to the default value.

default-gateway IP-ADDRESS

no default-gateway

Syntax Description

IP-ADDRESS IP address in four-part dotted decimal format.

Default IP-ADDRESS: 0.0.0.0.

Command Mode Management interface

Usage Guideline The management port will send out IP packets for other IP subnets through this IP address.

Example This example shows how to set 10.1.1.254 as the IP address of the default gateway.

switch#configure terminal
switch(config)#
switch(config)#mgmt-if
switch(mgmt-if)#default-gateway 10.1.1.254
switch(mgmt-if)#end 

Verify the settings by entering the show mgmt-if command

default-information originate

Use the default-information originate command to configure OSPF to generate a default external route (type 5 LSA) network 0.0.0.0. Use the no form of the command to disable the originate type 5 LSA default route.

default-information originate [always] [metric METRIC-VLAUE] [metric-type TYPE-VALUE]

no default-information originate

Syntax Description
always	(Optional) Always advertise the default route regardless whether a default route exists in the configuration or not.
metric METRIC-VALUE	(Optional) If metric is not specified, the default metric is 1.
metric-type TYPE-VALUE	(Optional for OSPF) Specifies the external link type associated with the route advertised into the OSPF routing domain. It can be one of two values: Type 1 external route or Type 2 external route. If a metric-type is not specified, the switch adopts a Type 2 external route. This is only for OSPF.

Default None

Command Mode Router configuration

Usage Guideline

The default-information originate command is used to configure a routing process, in order to advertise a default route (network 0.0.0.0). If always is not specified, then the default route will only be advertised when the redistribution statement is configured and the default route exists in the redistributed routes.

Example This example shows how to advertise the default route regardless whether a default route exists in the configuration or not.

Switch(config)#router ospf
Switch(config-router)# default-information originate always 

Verify the settings by entering the show ip protocols ospf command.

default-information originate (IPv6 OSPF)

Use default-information originate to configure an IPv6 OSPF to generate a default external route (type 0x4005 LSA). Use the no form of the command to disable the originate type 0x4005 LSA default route.

default-information originate [always] [metric METRIC-VALUE] [metric-type TYPE-VALUE]

no default-information originate

Syntax Description
always	(Optional) Always advertise the default route regardless whether a default route exists in the configuration or not.
metric	(Optional) If metric is not specified, the default metric is 1. The range off values allowable for the OSPFv3 metric is from 0-16777214.
METRIC-VALUE
metric-type	(Optional) IPv6 OSPF specifies the external link type associated with the default route advertised into the IPv6 OSPF routing domain. It can be one of two values:
TYPE-VALUE	1: Type 1 external route
	2: Type 2 external route
	If a metric-type is not specified, the Switch adopts a Type 2 external route. This is only for IPv6 OSPF.

Default None

Command Mode Router configuration

Usage Guideline

The default-information originate command is used to configure a routing process, in order to advertise a default route (prefix ::/0). When always is not specified, the default route will only be advertised when the redistribution statement is configured and the default route exists in the redistributed routes.

Example This example shows how to advertise the default route regardless whether a default route exists in the configuration or not.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch(config-router)# default-information originate always 

default-information originate (RIP)

To generate a default route into Routing Information Protocol (RIP), use the default-information originate command. To disable this feature, use the no form of this command.

default-information originate

no default-information originate

Syntax None

Default Disabled

Command Mode Router configuration

Usage Guideline Issuing this command generates a default route into RIP. The metric will always be one.

Example The following example shows how to generate a default route into RIP:

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# default-information originate 

Verify the settings by entering the show running-config command.

default-information originate (RIP IPv6)

To originate a default IPv6 route into RIP, use the default-information originate command. To remove the default IPv6 RIP route, use the no form of this command.

default-information originate

no default-information originate

Syntax None

Default Disabled

Command Mode Router configuration

Usage Guideline

Originating a default IPv6 route into RIP also forces the advertisement of the route in router updates sent on the interface. The advertisement of the route occurs regardless of whether the route is present in the IPv6 routing table.

Example

The following example originates a default IPv6 route into RIP and advertises the default route with all other routes.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 rip
Switch (config-router) # default-information originate 

default ipv6 nd prefix

This command is used to default the IPv6 RA prefix information.

default ipv6 nd prefix X:X::X:X/M

Syntax Description

X:X::X:X/M IPv6 network address. This argument must be in the form documented in RFC2373 where the address is specified in hexadecimal using 16-bit value between colons.
X:X::X:X: IPv6 address
M: IPv6 prefix length 

Default None

Command Mode VLAN interface configuration

Usage Guideline RA prefix entry must be created first.

Example This example shows how to default the IPv6 nd prefix instance:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (vlan1) # default ipv6 nd prefix 3ffe:501:ffff::/64
Switch (vlan1) # 

default-metric (OSPF)

To set default metric values for OSPF, use the default-metric command. Use the no form of the command to remove the default-metric setting.

default-metric METRIC-VALUE

no default-metric

Syntax Description

METRIC-VALUE Default metric value appropriate for the specified routing protocol.

Default METRIC-VALUE: 20

Command Mode Router configuration

Usage Guideline

The default-metric command is used in conjunction with the redistribute router command (redistribute (OSPF) command on page 388) to cause the current routing protocol to use the same metric value for all redistributed routes.

A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

The setting precedence that determines the metric is:

metric in redistributed command > default-metric setting.

Example

The following example shows a router redistributing RIP-derived routes into the OSPF domain and all redistributed routes are advertised with an OSPF metric of 10.

Switch(config)# router ospf
Switch(config-router)# default-metric 10
Switch(config-router)# redistribute rip
Switch(config-router)# end
Switch#

default-metric (IPv6 OSPF)

To set the default metric for IPv6 OSPF, use the default-mentic command. To return the metric to its default value, use the no form of this command.

default-metric METRIC-VALUE

no default-metric [METRIC-VALUE]

Syntax Description

METRIC-VALUE Default metric value. A number from 1 to 16777214.

Default METRIC-VALUE: 20

Command Mode Router configuration

Usage Guideline

The default-metric command is used in conjunction with the redistribute router configuration command (redistribute (IPv6 OSPF) command on page 390) to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with an incompatible metric. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

The order of the setting precedence to determine the metric is:

set metric in redistributed command > default-metric setting.

Example

The following example shows an IPv6 OSPF redistributing routes from RIP. All redistributed routes are advertised with a metric of 10.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router) # default-metric 10
Switch (config-router) # redistribute rip 

default-metric (RIP)

To set default metric values for Routing Information Protocol (RIP), use the default-metric command. To return to the default state, use the default form of the command.

default-metric METRIC-VALUE

default default-metric

Syntax Description

METRIC-VALUE Default metric value. (From 1 to 16).

Default METRIC-VALUE: 1

Command Mode Router configuration

Usage Guideline

The default-metric command is used in conjunction with the redistribute router configuration (redistribute (RIP) command on page 392) command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default-metric provides a reasonable substitute and enables the redistribution to proceed.

Example

The following example shows how to configure the default metric 5 to redistribute the OSPF routes. In other words, it assigns the OSPF-derived routes a RIP metric of 5. Note that the command redistribute ospf without a metric option, causes the OSPF redistribution to use the default metric.

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# default-metric 5
Switch(config-router)# redistribute ospf

Verify the settings by entering the show ip protocols rip command.

default-metric (RIP IPv6)

To set the default metric for IPv6 RIP, use the default-metric. To return the metric to its default value, use the no form of this command.

default-metric METRIC-VALUE

no default-metric [ METRIC-VALUE ]

Syntax Description

METRIC-VALUE Default metric value. A number from 1 to 16.

Default

no default METRIC-VALUE

Command Mode Router configuration

Usage Guideline

The default-metric command is used in conjunction with the redistribute router configuration command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with an incompatible metric. Whenever metrics cannot convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

Example The following example shows IPv6 RIP redistributing routes from OSPF. All redistributed routes are advertised with a metric of 10.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 rip
Switch (config-router) # default-metric 10
Switch (config-router) # redistribute ospf 

default-router

This command specifies the default router list for a DHCP client. Use the no form of this command to remove the default router list.

default-router IP-ADDRESS

no default-router IP-ADDRESS

Syntax Description

IP-ADDRESS Specifies the IP address of the default-router to DHCP clients.

Default None

Command Mode DHCP pool configuration

Usage Guideline

The IP address of the router should be on the same subnet as the client subnet. If the number of servers is more than one, then execute this command multiple times with different server IP addresses. Routers are listed in order of preference (address1 is the most preferred router, address2 is the next most preferred router, and so on).

Exmaple

This example shows how to specify 10.1.1.1 as the IP address of default-router in DHCP address pool.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# default-router 10.1.1.1 

delete

Use this command to delete a file.

delete FILE-SYSTEM: PATH-NAME FILE-NAME

Syntax Description
FILE-SYSTEM	Specifies the file system. The valid values are flash or cf1. flash represents the Compact FLASH storage of the control management unit. cf1 represents the first open slot of compact FLASH storage .
PATH-NAME(Optional)	Specifies the name of the directory.
FILE-NAME	The file to be deleted.

Default None

Command Mode Privileged EXEC

Usage Guideline A firmware image or a configuration file that is specified as the boot-up file cannot be deleted.

Example This example shows how to delete the file named test from the Flash card inserted in cf1.

If the file to be deleted is used as boot up image or configuration file, then it cannot be deleted and an error message will be displayed.

Switch#delete cf1:\test.txt
Delete cf1:\test.txt, (y/n) [n]? 

description

Use this command to add a description for an interface. Use the no description to clear the interface description.

description DESCRIPTION

no description

Syntax Description
DESCRIPTION	Add a description for an interface (up to 128 characters). The syntax is a general string that allows spaces.

Default None

Command Mode Interface configuration

Usage Guideline None

Example This example shows how to add a description for interface eth 3.10

Switch(config)# interface eth3.10
Switch(config-if)# description Physical Port 10 

Verify the settings by entering the show interface command.

dir

Use the dir command to display the information for a file or the list of files in the specified path name.

dir FILESYSTEM: [\PATH-NAME]

Syntax Description
FILES-SYSTEM	Specifies the file system. The valid values are flash and cf1; whereflashrepresents the compact FLASH (CF) storage of the control management unit andcf1represents the compact FLASH storage card inserted in the left slot from the front of the CM module.
PATH-NAME(Optional)	Specifies the name of the directory.

Default None

Command Mode Any EXEC or configuration mode

Usage Guideline None

Example

This example displays the list of files on the root directory of the file system on the system's cf1 flash.

Switch>dir cf1:\
log <DIR>
customer <DIR>
system <DIR>
runtime.1.00.017_DGS-6600.had 64212362 bytes
runtime.1.00.018_DGS-6600.had 73087296 bytes
Switch> 

disable

Use this command to return to the User EXEC mode from the Privileged EXEC mode.

disable

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline

The command will go to the User EXEC level from the power user level.

Example

This example shows how to logout after executing the disable command to return to the User EXEC mode.

Switch# disable
Switch> logout 

distance

Use the command distance to define an administrative distance for a protocol (RIP, OSPF, etc) or the routes that fall in the range of the specified networks-prefix. Use the no form of the command to remove the distance configuration and then the distance will go back to the default.

distance DISTANCE [NETWORK-PREFIX/PREFIX-LENGTH]

no distance DISTANCE [NETWORK-PREFIX/PREFIX-LENGTH]

Syntax Description
DISTANCE	An administrative distance. The default administrative distance for a static route is 1. The range of distance is 1 to 255. The lower value represents a better route.
NETWORK-PREFIX/PREFIX-LENGTH	(Optional) The network prefix and the prefix length specify the destination network. The Network-Prefix/Prefix-Length parameter is not supported for OSPF.

Default No static routes are established.

The table below shows the default distance of protocols:

Connected interface 0 The administrative distance of a Connected interface.
Static route 1 The administrative distance of a Static route.
Open Shortest Path First (OSPF)/OSPF6	110 The administrative distance of an OSPF route.
Routing Information Protocol (RIP)/RIPng	120 The administrative distance of a RIP route.
Unknown 255 The administrative distance of an unknown protocol route.

Command Mode Router configuration

Usage Guideline

This command is only used for routing protocols (RIP, OSPF). The distance command of a static route uses the ip route command on page 237 with the distance option. The distance of local interface can not be configured.

Numerically, an administrative distance is an integer from 1 to 255. In general, the higher the value is, the lower the trust rating is. An administrative distance of 255 means that the routing information source cannot be trusted at all and should be ignored.

Use the distance command to set the administrative distance for all the routes that fall in the range of the specified networks-prefix. That is, if the route is in the range of the networks-prefix, the distance specified for the network prefix will be applied to this route.

If the distances for specific routes are not specified, the distances of the routes learned by a routing protocol follows the distance of the routing protocol.

In the current configuration, there is a difference between RIP and RIPng.

1. The specified network prefix means the interface address for RIP.
2. The specified network prefix means the specific routes for RIPng.

If the distances for specific routes are specified, the distances of the routes are set to the specified value.

If the switch is operated at multi-path disabled mode, then the route with the lowest distance will be established as the active route. If the route that is found has failed, then this route will be automatically deactivated and the route with the next lower distance will be the active route.

If the switch is operated in the multi-path enabled mode, then routes with the same distances will be active at the same time.

Note 1: BGP Protocol does not support this command.

Note 2: OSPF does not support the parameter: [NETWORK-PREFIX/PREFIX-LENGTH].

Examples

This example shows how to set rip distance as 100, and route 30.0.0.0/8 with distance 90

Switch(config)# router rip
Switch(config-router)# distance 100
Switch(config-router)# distance 90 30.0.0.0/8 

This example shows how to remove the distance configuration of RIP (set to default distance of RIP, 120) and network 30.0.0.0/8

Switch(config)# router rip
Switch(config-router)# no distance 100
Switch(config-router)# no distance 90 30.0.0.0/8 

Verify the settings by entering the show ip protocols command.

dns-server

This command configures the IP address list of DNS servers available to DHCP clients. Use the no form of this command to remove the DNS server list.

dns-server IP-ADDRESS

no dns-server [IP-ADDRESS]

Syntax Description

IP-ADDRESS Specifies the IP address of DNS server to DHCP clients.

Default None

Command Mode DHCP pool configuration

Usage Guideline

This command configures the IP address list of DNS servers available to DHCP clients under the DHCP pool configuration mode. Servers are listed in order of preference. If the number of servers is more than 1, then execute this command multiple times with different server IP addresses.

Example

This example shows how to specify 10.1.1.1 as the IP address of DNS server in DHCP address pool.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# dns-server 10.1.1.1 

domain-name

This command configures the domain name for a DHCP client. Use the no form of this command to remove the domain name.

domain-name DOMAIN

no domain-name

Syntax Description

DOMAIN Specifies the domain name.

Default None

Command Mode DHCP pool configuration

Usage Guideline This command configures the domain name for a DHCP client.

Example

This example shows how to specify domain name as "dlink.com" in a DHCP address pool.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# domain-name dlink.com 

dos\_prevention action

Use this command to specify the action to perform when a DoS attack occurs

dos_prevention action {mirror INTERFACE-ID | trap_log}

no dos_prevention action {mirror|trap_log|all}

Syntax Description
action [ACTION]	Specifies the action the device should take when an attacking event occurs. Multiple actions can be specified. The no-form of this command can remove specific action or all actions.
	mirror INTERFACE-ID
	Mirror the attacking packets to specific port.
	trap_log
	The device can be configured to add logs or send traps when attack events occur. When attacking events occur continually, the logs or traps will be triggered once every 5 minutes. Note: Currently only logs are supported.

Default drop

Command Mode Global configuration

Usage Guideline	Used to configure actions that the device should take when attacking packets are received.
	The default action is drop and always set to on.
Examples	The following example shows how to configure to mirror attacking packets to eth4.1 port.

Switch(config)# dos_prevention action mirror eth4.1

The following example shows how to remove all actions.

Switch(config)# no dos_prevention action all

dos\_prevention type

Use this command to enable/disable DoS prevention mechanism. The packet matching and actions are handled by hardware. For each type of attack, the device will match the specific pattern automatically.

dos_prevention type {ATTACK-TYPES}

no dos_preventioin type {ATTACK-TYPES}

Syntax Description

type ATTACK-TYPES	Enables the DoS prevention mechanism for either a specified or all attacking type. When using the no-form of this command, the specified or all types are disabled.
	land_attack
	A LAND attack involves IP packets where the source and destination address are set to the address of the target device. It may cause a target device to reply to itself continuously.
	blat_attack
	This type of attack will send packets with TCP/UDP source ports equal to destination ports of the target device. It may cause a target device to respond to itself.
	Caution: use of the blat_attack type option results in suppression of RIP advertisements being transmitted.
	smurf_attack
	An Attacker sends a large amount of ICMP request packets to an IP broadcast address, the SIP of the attacking packets equals the victim's IP address. If a router delivers traffic to the IP broadcast address, then all host in that IP network will reply with ICMP packets to the victim's IP address.
	tcp_null_scan
	Port scanning by using specific packets.
	tcp_xmasscan
	Port scanning by using specific packets.
	tcp_synfin
	Port scanning by using specific packets.
	tcp_syn_srcport_less_1024
	Port scanning by using specific packets.
Syntax Description	- continued
	all
	All of the above types.

Default Disabled.

DoS prevention of all supported ATTACK-TYPE is disabled.

Command Mode Global configuration

Usage Guideline This command is used to enable/disable the DoS prevention mechanism for specific attack types or for all supported types.

Examples The following example shows how to enable the DoS prevention mechanism for a land_attack.

Switch# configure terminal
Switch(config)# dos_prevention type land_attack 

The following example shows how to enable the DoS prevention mechanism for all supported types.

Switch# configure terminal
Switch(config)# dos_prevention type all 

The following example shows how to disable the DoS prevention mechanism for all supported types.

Switch# configure terminal
Switch(config)# no dos_prevention type all 

dot1v binding protocol-group

Use the dot1v binding protocol-group interface configuration command to set a protocol VLAN group and bind VLAN of the port. The no form of this command can remove the port from the specific protocol VLAN group.

dot1v binding protocol-group GROUP-ID vlan VLAN-ID

no dot1v binding protocol-group [GROUP-ID]

Syntax Description
GROUP-ID	Specifies the protocol group ID to bind or remove. The valid GROUP-ID range is 1 to 16.
VLAN-ID Specifies the VLAN identifier of the protocol VLAN. Single VLAN ID is valid.

Default The default port is not bound to any protocol VLAN group.

Command Mode Interface configuration

Usage Guideline The valid interface for this command can be either a physical port or a port-channel. Use the dot1v binding protocol-group command to bind a protocol VLAN group with a VLAN ID. As a result, the packet that matches the specified protocol group will be associated with the VLAN binding with this group. The VLAN does not need to exist for the command to succeed. If the GROUP ID is not specified when using the command no dot1v binding protocol-group, the switch will remove all the protocol group and VLAN bindings at the specified interface.

Example This example shows how to bind a protocol VLAN group 10, VLAN id 3000 of ethernet port 3.2

Switch(config)# interface eth3.2
Switch(config-if)# dot1v binding protocol-group 10 vlan 3000 

Verify the settings by entering the show dot1v interface command.

dot1v protocol-group

Use the dot1v protocol-group global configuration command to add a protocol to a protocol group. Use no command to remove the specified protocol group, or to remove a protocol VLAN from the specified group.

dot1v protocol-group GROUP-ID frame { ethernet2 | snap | llc } TYPE-VLAUE

no dot1v protocol-group GROUP-ID [ frame { ethernet2 | snap | llc } TYPE-VLAUE ]

Syntax Description

GROUP-ID	Specifies the protocol group id to add, delete or configure. The valid GROUPID range is 1 to 16.
frame Specifies frame type to be bound in this entry.
ethernet2 Specifies operational protocol value of Ethernet II type frames.
snap Specifies operational protocol value of SNAP type frames.
llc Specifies operational protocol value of LLC type frames.
TYPE-VLAUE Specifies the protocol value of the specific frame type. The value is in hexadecimal form. Range is 0x0 to 0xFFFF.

Default The default protocol VLAN table is empty.

Command Mode Global configuration

Usage Guideline

The dot1v protocol-group command adds a protocol to a protocol group.

By setting the command multiple times, multiple protocols can be added to the same group.

The no dot1v protocol-group command will delete an existing protocol VLAN group.

If a specific protocol is specified with the no command, then this specific protocol will be removed from the specified group.

Example

This example shows how to create a protocol VLAN group with id 10, and bind protocol IPv6 (frame type is ethernet2 value is 0x86dd).

Switch(config)# dot1v protocol-group 10 frame ethernet2 0x86dd

Verfiy the settings by entering the show dot1v protocol-group command.

dot1x auth-mode

Use the dot1x auth-mode command to specify the 802.1x authentication mode.

dot1x auth-mode {port-based | host-based}

Syntax Description

port-based Specifies the authentication mode as port-based mode. In port-based mode if one supplicant successfully authenticated, other hosts connected to the same port are allowed to access the port. Each port implements one authenticator state machine.

host-based Specifies the authentication mode as host-based mode. In host-based mode, each host is identified by its MAC address. Only successfully authenticated hosts are allowed to access the port. Each MAC address implements one authenticator state machines.

Default port-based mode

Command Mode Interface configuration

Usage Guideline The maximum number of hosts allowed to connect to an 802.1X-enabled port is project-dependent.

Example The following example shows how to specify the authentication mode as host-based.

Switch(config)#interface eth4.3
Switch(config-if)# dot1x auth-mode host-based 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x auth-protocol

Use this command to specify the authentication method used for 802.1x authentication.

dot1x auth-protocol {local | radius}

Syntax Description

local Specifies local accounts for authentication

radius Specifies RADIUS servers for authentication

Default radius

Command Mode Global configuration

Usage Guideline

If local is specified, a user account should be configured. Please refer to the dot1x user command on page 140 to create new user accounts.

If radius is specified, a RADIUS server should be configured for authentication. Please refer to the server command on page 410 in AAA module.

Example The following example shows how to specify the authentication method as RADIUS.

Switch# configure terminal
Switch(config)# dot1x auth-protocol radius

Verify the settings by entering the show dot1x auth-configuration command.

dot1x control-direction

Use this command to configure the direction of the traffic on a controlled port as unidirectional (in) or bidirectional (both).

dot1x control-direction { both | in }

Syntax Description

both Enable bidirectional control. Both incoming and outgoing traffic through an 802.1X-enabled port are blocked if the port is not successfully authenticated.

in Enable unidirectional control. Incoming traffic through an 802.1X-enabled port is blocked if the port is not successfully authenticated.

Default both

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interface.

This command takes effect only when the global and per-port 802.1x enable command is configured.

When the port is in force-unauthorized or un-authorized state, the traffic direction is controlled based on this command.

When the port is in force-authorized or authorized state, the traffic is allowed in both directions.

Example The following example shows how to specifies the direction of the traffic through port eth4.1 as unidirectional.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x control-direction in 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x default

Using this command resets the configurable 802.1X parameters to the default values.

dot1x default

Syntax None

Default The default values are listed as following:

The authorization state on a controlled port is auto.

The direction of the traffic through a controlled port is bidirectional.

The number of maximum retransmit times which the switch will retransmit an EAP request frame to the supplicant before restarting the authentication process is 2.

The quiet-period, reauth-period, server-timeout, supp-timeout, and tx-period are 60, 3600, 30, 30, and 30 seconds, respectively.

Periodic re-authentication is disabled.

Command Mode Interface configuration

Usage Guideline This command is only valid on physical port interface.

Example

The following example shows how to reset the IEEE 802.1X parameters on port eth4.1.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x default 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x forward-pdu

Use this command to allow a 1X-disabled interface to forward 802.1X BPDU. Use the no form of this command to disable the forwarding function on a 1X-disabled interface.

dot1x forward-pdu

no dot1x forward-pdu

Syntax None

Default 802.1x BPDU is not forwarded when 802.1x is disabled.

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interface.

When the 802.1X functionality is disabled, and dot1x forward-pdu is configured for a port, the received 1x BPDU on the port will be flooded to the ports where forward-pdu is enabled and that are in the same VLAN.

Example This example shows how to enable 802.1X forward-pdu on a given interface.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x forward-pdu

Verify the settings by entering the show dot1x auth-configuration command.

dot1x guest-vlan

Use this command to enable the 802.1X guest VLAN function and specify the guest VLAN. Use the no form of this command to disable the guest VLAN function.

dot1x guest-vlan VLAN-ID

no dot1x guest-vlan

Syntax None

Default Disabled

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interfaces.

The guest VLAN is not supported in host-based mode.

The guest VLAN is only effective when a port is configured as 1X-enabled and dot1x port-control is in auto mode.

This command only supports ports in access VLAN mode. When configuring a guest VLAN for a port in other VLAN modes, an error messages appears.

The VLAN assignment of the guest VLAN is determined by following rules:

• If the guest VLAN is enabled, and the authentication state is unauthorized, the port belongs to the guest VLAN.
• If the guest VLAN is enabled with the authentication state authorized, and if RADIUS is authorizing VLAN access then the configured port will belong to the VLAN assigned by RADIUS server, else the port belong to the VLAN configured in the VLAN module.
• If guest VLAN is disabled, and the authentication state is unauthorized, the port belongs to the VLAN configured in VLAN module.
• If guest VLAN is disabled, with the authentication state authorized, and if RADIUS is authorizing VLAN access then the configured port will belong to the VLAN assigned by RADIUS server, else the port belong to the VLAN configured in the VLAN module.
• For a port configured for guest VLAN or RADIUS assigned VLAN, if the configured VLAN is not existing on the switch, the port will belong to the VLAN configured in VLAN module.

Examples

The example, on the next page, shows how to make eth4.1 join the IEEE 802.1x guest VLAN.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x guest-vlan 99

This example shows how to make eth4.1 leave the guest VLAN.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# no dot1x guest-vlan

Verify the settings by entering show do1x auth-configuration and show vlan interface command.

dot1x initialize

Use this command to initialize the authentication state machine of:

- a port in port-based mode.

-or-

- an associated MAC address in host-based mode.

dot1x initialize [ interface INTERFACE-ID [ mac-address MAC-ADDRESS ] ]

Syntax Description
interface INTERFACE-ID	(Optional) Specifies a physical interface to initialize. In port-based mode,initialize the authenticator state machine of a port. In host-based mode, initialize all authenticator state machines of associated MAC addresses on this port.
mac-address	(Optional) Specifies a MAC address to initialize. This option is valid only in host-based mode. Will initialize the authenticator state machine of this assigned MAC address on a specific port.
MAC-ADDRESS

Default None

Command Mode Privileged EXEC

Usage Guideline Entering dot1x initialize without any keyword will initialize all authentication states for all ports in port-based mode, or all MAC addresses associated in host-base mode.

Examples This example shows how to initialize the authentication state machine on eth4.1.

Switch# dot1x initialize interface eth4.1

This example shows how to initialize the authentication state machine associated with MAC address 00-40-10-28-19-78 on eth4.1.

Switch# dot1x initialize interface eth4.1 mac-address 00-40-10-28-19-78

dot1x max-req

Use this command to set the maximum number of times that the switch sends EAP-request/identity frames to the client before restarting the authentication process.

dot1x max-req TIMES

Syntax Description

max-req TIMES

Number of times that the switch retransmits an EAP frame to the client before restarting the authentication process. The range is 1 to 10.

Default TIMES: 2

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interface.

Example

This example shows how to set the maximum number of retransmit times on port eth4.1 to be 3.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x max-req 3

Verify the settings with the show dot1x auth-configuration command.

dot1x pae authenticator

Use this command to enable 802.1X authentication on a specific port. Use the no form of this command to disable 802.1X authentication on the port.

dot1x pae authenticator

no dot1x pae

Syntax Description

authenticator Enable 802.1X authentication on a specific port.

Default Disabled

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interface.

Use the dot1x system-auth-control command on page 138 to enable global 802.1x function before enabling 802.1X authentication on a specific port.

A port can be configured as a 1x-enable port only if the port is not a member port of a port channel, or a destination port of a port mirroring session.

Examples This example shows how to configure port eth4.1 as a 1X-enabled port.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x pae authenticator

This example shows how to disable 802.1x authentication on port eth4.1.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# no dot1x pae

Verify the settings by entering the show dot1x auth-configuration command.

dot1x port-control

Use this command to manually control the authorization state on a specific port.

dot1x port-control { auto | force-authorized | force-unauthorized }

Syntax Description
auto The state (authorized or unauthorized) for a specific port is determined according to the outcome of the authentication.
force-authorized	Specifies to force the port to change to the authorized state. The port allows access and all authentication packets are ignored.
force-unauthorized	Specifies to force the port to change to the unauthorized state. The port is blocked and all authentication packets are ignored.

Default auto

Command Mode Interface configuration

Usage Guideline This command is valid only for physical port interface.

Global 802.1x authentication function should be enabled using the dot1x system-auth-control command on page 138 before enabling 802.1X authentication on a specific port.

Example This example shows how to deny all access on eth4.1.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x port-control force-unauthorized 

Verify the settings with the show dot1x auth-configuration command.

dot1x re-authenticate

Use this command to re-authenticate a specific port or a specific MAC address.

dot1x re-authenticate [ interface INTERFACE-ID [ mac-address MAC-ADDRESS ] ]

Syntax Description
interface INTERFACE-ID	(Optional) Specifies a port to re-authenticate. This option is only valid for physical port interface.
mac-address MAC-ADDRESS	(Optional) Specifies a MAC address to re-authenticate. This option can be used only in host-based mode.

Default None

Command Mode Privileged EXEC

Usage Guideline

Entering dot1x re-authenticate without any keyword will re-authenticate all 1x-enabled ports in the port-based mode or all MAC addresses associated with 1x-enabled port in the host-based mode.

Examples This example shows how to re-authenticate eth4.1.

Switch# dot1x re-authenticate interface eth4.1

This example shows how to re-authenticate MAC address 00-40-10-28-19-78 on eth4.1.

Switch# dot1x re-authenticate interface eth4.1 mac-address 00-40-10-28-19-78

dot1x re-authentication

Use this command to enable periodic re-authentication. Use the no form of this command to disable periodic re-authentication.

dot1x re-authentication

no dot1x re-authentication

Syntax None

Default Disabled

Command Mode Interface configuration

Usage Guideline This command is valid only for physical port interface.

The number of seconds between re-authentication attempts can be configured using the dot1x timeout command on page 139 with the reauth-period keyword.

Examples This example enables periodic re-authentication on eth4.1.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x re-authentication 

This example shows how to disable periodic-re-authentication.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# no dot1x re-authentication 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x system-auth-control

Use dot1x system-auth-control to globally enable 802.1X authentication on a switch. Use the no form of this command to return to globally disable 802.1X function.

dot1x system-auth-control

no dot1x system-auth-control

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline None

Examples

This example shows how to globally enable 802.1X authentication on a switch.

Switch# configure terminal
Switch(config)# dot1x system-auth-control 

This example shows how to disable 802.1x authentication globally on a switch.

Switch# configure terminal
Switch(config)# no dot1x system-auth-control 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x timeout

Use this command to set timeout values for various 802.1X timers.

dot1x timeout {quiet-period SECONDS | reauth-period SECONDS | server-timeout SECONDS | supp-timeout SECONDS | tx-period SECONDS}

Syntax Description
quiet-period SECONDS	Number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client. The range is 0 to 65535.
reauth-period SECONDS	Number of seconds between re-authentication attempts. The range is 1 to 65535
server-timeout SECONDS	Number of seconds that the switch will wait when it does not receive notification from the authentication server. The range is 1 to 65535.
supp-timeout SECONDS	Number of seconds that the switch will wait when it does not receive any notification from the client. The range is 1 to 65535.
tx-period SECONDS	Number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before retransmitting the request. The range is 1 to 65535.

Default quiet-period: 60 seconds

reauth-period:3600 seconds

server-timeou: 30 seconds

supp-timeout: 30 seconds

tx-period: 30 seconds

Command Mode Interface configuration

Usage Guideline This command is only valid for physical port interface.

The reauth-period takes effect when re-authentication is configured by the dot1x re-authentication command on page 137.

Example This example sets quiet-period, reauth-period, server-timeout, supp-timeout, and tx-period on eth4.1 to be 20, 1000, 15, 15, and 10 seconds, respectively.

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if)# dot1x timeout quiet-period 20
Switch(config-if)# dot1x timeout reauth-period 1000
Switch(config-if)# dot1x timeout server-timeout 15
Switch(config-if)# dot1x timeout supp-timeout 15
Switch(config-if)# dot1x timeout tx-period 10 

Verify the settings by entering the show dot1x auth-configuration command.

dot1x user

Use this command to create a local account used for authentication. Use the no form of this command to delete local accounts.

dot1x user NAME password PASSWORD

no dot1x user [ NAME ]

Syntax Description
NAME	Specifies the name of a local account used for authentication. The valid length is from 1 to 32.
password	Specifies a password for a local account. The valid length is from 1 to 16.
PASSWORD

Default No local account is created.

Command Mode Global configuration

Usage Guideline	All accounts can be removed by entering no dot1x user without the NAME option.The local database can be used in both port-based and host-based mode.The maximum number of user accounts is project dependent.
Examples	This example creates a local account with username "yourname" and password "yourpass".

Switch# configure terminal
Switch(config)# dot1x user yourname password yourpass
Switch(config)#

This example deletes a local account with a username as "yourname".

Switch# configure terminal
Switch(config)# no dot1x user yourname 

Verify the settings by entering the show dot1x user command.

duplex

Use this command to configure the physical port interface speed/duplex setting.

duplex { full | half | auto }

Syntax Description

full Specifies to operate in full duplex mode.

half Specifies to operate in half duplex mode.

auto Specifies that the duplex mode will be determined by auto-negotiation.

Default auto

Command Mode Interface configuration

Usage Guideline

Physical port interfaces are valid for this configuration. If the duplex mode is not supported by the hardware, an error message will be returned.

The following hardware restrictions apply:

- 1000SX/LX is always fixed to 1000 and full duplex.

- For the 1000SX/LX module, the duplex command will not take any effect.

Auto-negotiation is enabled if either for speed or duplex. If speed is set to auto, and duplex is set to full or half mode, then only the speed will be negotiated. The advertised capability will be the configured duplex mode combined with all possible speeds. If speed is to set to a fixed speed and duplex is set to auto, then only duplex mode is negotiated. The advertised capability will be both full and half duplex mode combined with the configured speeds.

Before adding ports to a Port-Channel, please verify that all settings are identical on the candidate ports; otherwise the port members of a Port-Channel with different settings will operate in an indeterminate manner.

Example

This example shows how to configure interface eth3.1 to force the settings to a speed of 100Mbits and auto-negotiate to the duplex mode.

Switch(config)# interface eth3.1
Switch(config-if)# speed 100
Switch(config-if)# duplex auto

Verify the settings by entering the show interface command.

enable

Use this command to enter a Privileged EXEC mode.

enable [privilege LEVEL]

Syntax Description
privilege LEVEL	(Optional) Sets the privilege level for the user. The privilege levels are 12 and 15.

Default LEVEL: 15

Command Mode User EXEC

Usage Guideline Use the enable command to enter the Privileged EXEC mode and use the disable command on page 115 to return to the User EXEC mode from the power user level. The command only accepts level 12 and 15. An error message will appear if other levels are specified. If the enable password is configured for a level, the user will be requested to enter the password for the specified privileged level.

Example This example shows how to enter the Privileged EXEC mode:

Switch> enable
Input privileged level 15 password:
Switch# 

enable password

Use this command to setup the enable password to enter into different privileged modes. Use the no form of the command to return the password for all levels to an empty string. When a level is specified, the password for that level is returned to an empty string.

enable password privilege LEVEL password {plain-text| encrypted} PASSWORD

no enable password [privilege LEVEL]

Syntax Description
privilege LEVEL	Sets the privilege level the password will protect. The privilege level is either 12 or 15. If this argument is not specified in the command or in the no form of the command, the privilege level defaults to 15 (the traditional enable privileges).
plain-text	Specifies the password the user must enter to gain access to the switch. The password must be from 6 to 32 characters (the length of password in plain-text form may be project-dependant) and can contain embedded spaces. The password is case-sensitive. The syntax is a general string that allows spaces.
PASSWORD
encrypted	Specifies the password in the encrypted form based on SHA-I. For the encrypted form of the password, the length is fixed to 35 bytes long. The password is case-sensitive.
PASSWORD	Using the show username or show enable password command, an encrypted password can be copied and pasted to this command option.

Default No enable password is configured.

Command Mode Global configuration at privilege level 15

Usage Guideline Only accepts level 12 and 15.

An error message will appear if other levels are specified.

The exact password for the specific level needs to be used in order to enter the specific level of the privileged EXEC mode.

Each level has only one password in order to enter that level.

Example This example shows how to create an enable password for privilege level 15 with "MyEnablePassword".

Switch(config)# enable password MyEnablePassword

Verify the settings by entering the show enable password command.

end

Use this command to end the current configuration session and go back to the Privileged EXEC mode.

end

Syntax None

Default None

Command Mode Any configuration mode

Usage Guideline Using this command will end the configuration task in any configuration mode and go back to the Privileged EXEC mode.

If the current mode in any of the EXEC mode, this command will logout the session.

Example This example shows how to end the interface configuration and go back to privileged mode.

Switch (config-if) #end
Switch# 

exit

Use this command to end the current configuration mode and go back to the to the last mode used.

exit

Syntax None

Default None

Command Mode Any

Usage Guideline

The user can exit the current configuration mode and go back to the last mode used.

When the user is in User EXEC mode, this command will logout the session.

Example

This example shows how to exit from the interface configuration mode and return to the global configuration mode.

Switch (config-if) #exit

Switch (config) #

flowcontrol

Use this command to configure the flow control capability of the port interface.

flowcontrol [ send | receive ] { on | off }

Syntax Description

send (Optional) Flow control setting on send.

receive (Optional) Flow control setting on receive.

on Turn on the flow control.

off Turn off the flow control.

Default send: off

receive: off

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this configuration.

The command only assures that either the software configured or the administration state complies with the flowcontrol command.

The actual operation of the hardware may prevent the flowcontrol command to take effect. This is because flow control capability is determined by both the local port, device and its linked partner instead of just the local setting.

If auto-negotiation is disabled (i.e. the speed and duplex are both set to a non-auto setting), then the final flow-control setting will be determined by the configured flow control setting.

If auto-negotiation is enabled (i.e. the speed or duplex setting is set to auto), the final flow control setting will be based on the negotiated result between local side setting and the partner side setting. The configured flow control setting here is the local side setting.

If no option is selected for the direction, then both send and receive are applied.

Example

This example shows how to turn on the flow control send capability of interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# flowcontrol send on
Switch(config-if)# end

Verify the settings by entering the show interface command.

gvrp (Global)

Use the gvrp interface command to enable GVRP function globally, and use the no gvrp command to disable the GVRP function globally.

gvrp

no gvrp

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline None

Example

This example shows how to enable the GVRP protocol global state.

Switch(config)# gvrp
Switch(config)# 

Verify the settings by entering the show gvrp configuration command.

gvrp (Interface)

Use the gvrp interface command to enable GVRP function for a port, and use the no gvrp command to disable the GVRP function for a port.

gvrp

no gvrp

Syntax None

Default Disabled

Command Mode Interface configuration

Usage Guideline

Use the gvrp interface configuration command to enable/disable the GVRP protocol state.

Both physical port and port-channel interfaces are valid for this command. If a physical port is member of a port-channel, then this command should return an error message to indicate it.

The GVRP function cannot be enabled when the interface is at access mode.

Example This example shows how to enable Ethernet eth3.1 GVRP protocol state.

Switch(config)# interface eth3.1
Switch(config-if)# gvrp

Verify the settings by entering the show gvrp configuration interface command.

gvrp advertise (Interface)

Use the gvrp advertise command to specify that this VLAN will be advertised out by GVRP protocol. Use no gvrp advertise to disable this function.

gvrp advertise [ VLAN-ID [, | - ] ]

no gvrp advertise [ VLAN-ID [, | - ] ]

Syntax Description
VLAN-ID [ , | - ]	(Optional) Specifies a VLAN. The range is 1 to 4094. Specify a single VLAN ID, a range of VLANs separated by a hyphen, or a series of VLANs separated by comma.

Default Advertise

Command Mode Interface configuration

Usage Guideline	Use the gvrp advertise interface configuration command to enable the specified VLANs' GVRP advertise function on the specified interface. If no VLAN ID is specified, the advertise function of all VLANs to which the specified interface belongs will be enabled.
	Both physical port and port-channel interfaces are valid for this command. If a physical port is member of a port-channel, then this command should return an error message to indicate it.
	The GVRP advertise function cannot be enabled when the interface is in access mode.

Example This example shows how to enabled advertise function of VLAN 1000 at interface Ethernet eth4.1.

Switch(config)# interface eth4.1
Switch(config-if)# gvrp advertise 1000 

Verify the settings by entering the show gvrp configuration command.

gvrp advertise (VLAN)

Use the gvrp advertise command to specify that this VLAN will be advertised out by GVRP protocol. Use no gvrp advertise to disable this function.

gvrp advertise

no gvrp advertise

Syntax None

Default Advertise is enabled

Command Mode Config-VLAN configuration

Usage Guideline

If a VLAN has been configured to be advertised under the config-VLAN mode, GVRP protocol will advertise this VLAN if it has any member ports. However the command takes effect only in the running configuration, it is not stored in NV-RAM for the next start up configuration. In the interface mode, the command is stored in NV-RAM for next startup system configuration mode.

Example

This example shows how to configure VLAN 1000 to be advertised.

Switch(config)# VLAN 1000
Switch(config-VLAN)# gvrp advertise 

Verify the settings by entering the show gvrp configuration command.

gvrp dynamic-vlan-creation

Use the gvrp dynamic-vlan-creation command to enable dynamic VLAN creation, and use the no form of the command to disable the dynamic VLAN creation function.

gvrp dynamic-vlan-creation

no gvrp dynamic-vlan-creation

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

When gvrp dynamic-vlan-creation is enabled, and a port learns a new VLAN membership where the VLAN does not exist, the VLAN will be created automatically. Otherwise, the newly learned VLAN will not be created.

Example This example shows how to enable dynamic VLAN creation for GVRP.

Switch(config)# gvrp
Switch(config)# gvrp dynamic-vlan-creation

Verify the settings by entering the show gvrp configuration command.

gvrp forbidden

Use the gvrp forbidden command to specify the port as a forbidden member. Use the no gvrp forbidden command to remove the port as a forbidden member.

gvrp forbidden

no gvrp forbidden

Syntax None

Default None

Command Mode Interface configuration

Usage Guideline

The physical port and port-channel interfaces are both valid for this command. If a physical port is a member of a port-channel, entering the command returns an error message. If multiple interfaces are specified, the command can be executed partially. Error messages are sent if the interfaces fail to execute this command.

When the gvrp forbidden command is configured, all VLANs will be forbidden except the default VLAN (1) of this port.

If some VLANs have already been defined as allowable VLANs for the port, then these VLAN memberships will be removed when issuing the gvrp forbidden command. These memberships will not be recovered even when the no gvrp forbidden command is applied.

Example This example shows how to set Ethernet eth3.1 as a GVRP forbidden port.

Switch(config)# interface eth3.1
Switch(config-if)# gvrp forbidden

Verify the settings by entering the show gvrp configuration interface command

gvrp timer

Use the gvrp timer command to set the GVRP timer value for a port.

gvrp timer { join | leave | leave-all } TIMER-VALUE

Syntax Description

join Set the timer for joining the group. The unit is hundredths of a second.
leave Set the timer for leaving a group. The unit is hundredths of a second.
leave-all Set the time for leaving all groups. The unit is hundredths of a second.
TIMER-VALUE	The timer value in hundredths of a second.
<1-65535>

Default join: 20

leave : 60

leave-all : 1000

Command Mode Interface configuration

Usage Guideline The value of these parameters must comply to the following rules:

1. LEAVE_TIMER >= 3 * JOIN_TIMER
2. LEAVE_ALL_TIMER > LEAVE_TIMER

Example

This example shows how to set the leave-all timer to 5 seconds using the value 500 (hundredths of a second).

Switch(config)# interface eth3.1
Switch(config-if)# gvrp timer leave-all 500 

Verify the settings by entering the show gvrp configuration interface command.

help

To display a brief description of the help system, use the help command in any command mode.

help

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The help command provides a brief description of the context-sensitive help system, which functions as follows:

To list all commands available for a particular command mode, enter a question mark (?) at the system prompt.

To obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called word help, because it lists only the keywords or arguments that begin with the abbreviation entered.

To list the keywords and arguments associated with a command, enter a question mark (?) in place of a keyword or argument on the command line. This form of help is called command syntax help, because it lists the keywords or arguments that apply based on the command, keywords, and arguments that have already been entered.

Example

In the following example, the help command is used to display a brief description of the help system:

Switch# help

The switch CLI provides advanced help feature. When you need help, anytime at the command line please press '?'.

If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options.

Two styles of help are provided:

1. Full help is available when you are ready to enter a command argument (e.g. 'show ?') and describes each possible argument.

2. Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g. 'show ve?').

host area

Use the host area command to configure a stub host entry belonging to a particular area. Use the no form of this command to remove the host area configuration.

host IP-ADDRESS area AREA-ID [ cost COST ]

no host IP-ADDRESS area AREA-ID

Syntax Description
IP-ADDRESS Specifies IP address of the host.
AREA-ID	Specifies the identifier of the area for which authentication is to be enabled. The identifier can be specified as either an IP address or a decimal value (4 octets unsigned integer value).
COST Specifies cost for stub host entry. The range is 0 to 65535.

Default No host entry is configured.

Command Mode Router configuration

Usage Guideline Using this command, specific host routes can be advertised in the router-LSA as stub link.

Example This following example shows how to configure a stub host 172.16.10.100 at area 1.

Switch# configure terminal
Switch (config)# router ospf
Switch (config-router)# host 172.16.10.100 area 1 

Verify the settings by entering the show ip ospf host-route command.

hybrid vlan VLAN-ID

Use the hybrid VLAN command to set the VLAN characteristic. It sets the interface as a tagged member or untagged member.

hybrid vlan VLAN-ID [, | - ] { tagged | untagged }

no hybrid vlan [ VLAN-ID [, | - ] ]

Syntax Description

VLAN-ID Specifies the VLAN to add or remove tagging member from it.

tagged Specifies the port as a tagged member of specified VLAN(s).

untagged Specifies the port as an untagged member of specified VLAN(s).

, (Optional) Specifies a series of VLANs, or separate a range of VLANs from a previous range. Enter a space before and after the comma.

- (Optional) Specifies a range of VLANs. Enter a space before and after the hyphen.

Default The default hybrid-vlan is empty.

Command Mode Interface configuration

Usage Guideline	Physical ports or port-channels are valid interfaces for this command.
	By setting the hybrid VLAN command multiple times, a port can be a tagged member port or an untagged member port of multiple VLANs.
	If the VLAN does not exist, an error message is returned.
	When this command is applied, the port will change to hybrid mode. If the mode is changed, the setting for the previous mode will disappear.
	If a VLAN has already been defined as a tagged VLAN, applying this command in untagged VLAN mode will remove that membership.
	If a VLAN has already been defined as a un-tagged VLAN, applying this command in tagged VLAN mode will remove that membership.
	When using the no hybrid vlan command without specifying a VLAN ID, then the port's membership will be removed from all VLANs.

Example This example shows how to set an interface port 3.1 as a tagged member of VLAN 1000.

Switch(config)# interface eth3.1
Switch(config-if)# hybrid vlan 1000 tagged 

Verify the settings by entering the show vlan command.

ingress-checking

Use the ingress-checking to enable ingress frame checking at a port. Use the no ingress-checking to disable the ingress frame checking function.

ingress-checking

no ingress-checking

Syntax None

Default Enabled

Command Mode Interface configuration

Usage Guideline The valid interfaces for this command are physical ports.

Use the ingress-checking interface command to enable ingress checking at the switch interfaces. When ingress checking is enabled, if the port is not a member port of the VLAN associated with the incoming frames, the frames will be dropped. Use the no ingress-checking interface command to disable this function of a port.

Example

This example shows how to set ingress checking to enabled at ethernet port 4.1.

Switch(config)# interface eth4.1
Switch(config-if)# ingress-checking

Verify the settings by entering the show vlan interface command.

instance

To map a VLAN or a set of VLANs to a single Multiple Spanning Tree (MST) instance, use the instance command. To return the VLANs to the default instance (CIST), use the no form of this command.

instance INSTANCE-ID vlans VLANDID [, | .]

no instance INSTANCE-ID

Syntax Description
INSTANCE-ID	Instance to which the specified VLANs are mapped; valid values are from 1 to 63.
vlans VLANDID [ , | .]	Specifies the number of the VLANs to be mapped to the specified instance; valid values are from 1 to 4094.

Default No VLANs are mapped to any MST instance (all VLANs are mapped to the CIST instance).

Command Mode MST configuration

Usage Guideline Any unmapped VLAN is mapped to the CIST instance.

Examples This example shows how to map a range of VLANs to instance 2:

Switch(config)#spanning-tree mst configuration
Switch(config-mst)# instance 2 vlans 1-100 

This example shows how to map a VLAN to instance 5:

Switch(config)#spanning-tree mst configuration
Switch(config-mst)# instance 5 vlans 1100 

Verify the settings by entering the show spanning-tree mst configuration command.

interface

Enter the interface command to go into interface configuration mode. The command executed in this mode will be applied to the interface specified by the command.

interface INTERFACE-ID

Syntax Description

INTERFACE-ID The interface can be a physical port, port-channel, or VLAN.

Default None

Command Mode Global configuration

Usage Guideline The interface command puts the command line interface into interface configuration mode for a specified interface.

For the port-channel interface, it must be an existing channel-group.

For the VLAN interface, it must be a previously created VLAN.

Example This example shows how to enter the interface configuration mode for eth2.5:

Switch(config)# interface eth2.5
Switch(config-if)# 

interface range

Enter the interface range command to go into interface range configuration mode. The command executed in this mode will be applied to all interfaces specified by the command.

interface range INTERFACE-ID [, | - ]

Syntax Description

INTERFACE-ID The interface can be physical port, port-channel, or IP interface.

, Specifies a series of interface, or separate a range of interfaces from a previous range. No space before and after the comma.

- Specifies a range of interfaces. No space before and after the hyphen.

Default None

Command Mode Global configuration

Usage Guideline

This command puts the command line interface into configuration mode for the specified range of interfaces. The interfaces specified in a range can be different types, such as eth2.1-2.5, vlan100-200.

Example
This example shows how to enter the interface configuration mode for a range of ports from eth2.1-2.5.

Switch(config)# interface range eth2.1-2.5
Switch(config-if)# 

interface tunnel

Use the interface tunnel configuration command to add a tunnel and to enter the interface configuration mode. Use the no interface tunnel configuration command to remove a tunnel.

interface tunnel {tunnel-ID}

no interface tunnel {tunnel-ID}

Syntax Description

tunnel-ID Specifies the ID of the tunnel to be added, removed or configured. The valid tunnel ID range is 1-127.

Default None

Command Mode Global configuration

Usage Guideline None

Examples

The following example will add a tunnel of 2, and then enter into the interface configuration mode.

Switch(config)# interface tunnel 2
Switch (config-if)# 

The following example will remove IPv6 tunnel 2.

Switch(config)# no interface tunnel 2
Switch (config)# 

ip access-group

Use the ip access-group command to specify the IP access-list to be applied to an interface. Use the no form of this command to remove an IP access list.

ip access-group NAME [ in ]

no ip access-group NAME [ in ]

Syntax Description
NAME The name of the IP access-list to be applied. Up to 32 characters are allowed.The syntax is a general string that does not allow spaces.
in	(Optional) Specifies that the IP access-list will be applied to ingress traffic. If no option is specified, in direction is applied.

Default None

Command Mode Interface configuration

Usage Guideline

One MAC access-list, one IP access-list and one IPv6 access-list can be to the same interface. An error message is displayed if the user attempts to apply the second IP access list.The IP access list must be created before it can be applied to an interface. An error message is displayed if a list has not yet been created.The keywordin specifies ingress direction check .The association of an access-group with an interface will consume the filtering entry resources in the switch controller. If the command is applied successfully, the number of remaining entries is displayed. If the access-group contains a rule with a port operator (e.g. gt/lt operator), the number of remaining rules for the port operator is displayed. If the resource is insufficient to commit the command, an error message is displayed.There is a limitation on the number of port selectors that can be applied.If the maximum number of available port selectors is exceeded an error message is displayed.

Example

This example shows how to specify the IP access-list Strict-Control as an IP access group for eth3.2

Switch(config)# interface eth3.2 Switch(config-if)#ip access-group Strict-Control

Verify the settings by entering the show access-group privileged EXEC command.

ip access-list

Use the command to create or modify an IP access list. This command enters the user interface into the ip access-list configuration mode. Use no command to remove an IP access-list.

ip access-list [ extended ] NAME

no ip access-list [ extended ] NAME

Syntax Description
extended	(Optional) Used to create an IP access list (a list of related IP addresses such as source IP addresses or destination IP addresses) or an IP extended access-list (more information can be chosen).
NAME The name of the IP access list to be configured. The syntax is a general string that does not allow spaces, up to 32 characters in length.

Default Deny all traffic (implicit).

Command Mode Global configuration

Usage Guideline

The access list is always terminated by an implicit deny statement for all traffic and that is the default statement.When applying an IP access list to an interface, only one IP access list can be applied.The name must be unique among all (including MAC, IP, or IPv6) access-lists and the characters are case sensitive.An error message will appear if the allowed number is exceeded after execution of the command.An IP access list can not be deleted if it is applied at an interface.An IP extended access-list can only be grouped with an interface, but not any other S/W modules (such as PIM-DM, etc).

Examples

This example shows how configure an extended IP access-list, named Strict-Control and an IP access list, named pim-srcfilter.

Switch(config)#ip access-list extended Strict-Control
Swtch(config-ip-ext-acl)#permit tcp any 10.20.0.0 255.255.0.0
Swtch(config-ip-ext-acl)#exit
Swtch(config)#ip access-list pim-srcfilter
Switch(config-ip-acl)#permit host 172.16.65.193 any
Switch(config-ip-acl)# 

Verfiy the settings by entering the show access-list command.

ip address

Use ip address to set a primary or secondary IP address for an interface, or acquire an IP address on an interface from DHCP. Use the no form of the command to remove the IP settings configuration from the interface.

ip address { IP-ADDRESS SUBNET-MASK[ secondary ] | dhcp }

no ip address [ IP-ADDRESS SUBNET-MASK ]

Syntax Description
IP-ADDRESS The IP address to configure the interface with.
SUBNET-MASK The mask for the associated IP subnet of the IP address.
secondary	(Optional) Specifies that the configured address is a secondary IP address. If this keyword is omitted, the configured address is the primary IP address.
dhcp Acquire an IP address on an interface from the DHCP protocol.

Default 0.0.0.0/32.

Command Mode VLAN Interface configuration

Usage Guideline Only VLAN interfaces are valid for this command.

An interface can have one primary IP address and multiple secondary IP addresses. IP processing can be disabled on a particular interface by removing its IP address with the no ip address command. If the software detects another host using one of its IP addresses, an error message appears on the console.

The optional secondary keyword allows assignment of multiple secondary addresses. Secondary addresses are treated like the primary address, except that the system does not generate datagrams other than a routing update packet with secondary source addresses. For example, an SNMP trap is always generated with the primary address. However, the system can respond to a packet sent to the secondary address.

For now, only VLAN interfaces can be configured by this command.

If a VLAN interface has been configured with static IP address (except 0.0.0.0) or DHCP, a Layer 3 IP interface is created.

The no ip address command will remove all of the IP settings from the interface.

Example

This example (on the next page) shows how to set 10.108.1.27 as the primary address and 192.31.7.17 and 192.31.8.17 as the secondary addresses for VLAN 100:

Switch# configure terminal
Switch(config)# interface vlan100
Switch(config-if)# ip address 10.108.1.27 255.255.255.0
Switch(config-if)# ip address 192.31.7.17 255.255.255.0 secondary
Switch(config-if)# ip address 192.31.8.17 255.255.255.0 secondary
Switch(config)# end

Verify the settings by entering the show ip interface command.

ip address (management port)

Use the command to set the IP address of the Management Port. Use the no form of this command to revert to the default IP address.

ip address IP-ADDRESS / PREFIX-LENGTH

no ip address

Syntax Description

IP-ADDRESS IP address to be configured for the Management Port.

PREFIX-LENGTH Prefix Length.

Default 10.90.90.90/8.

Command Mode Management interface configuration

Usage Guideline

This is the IP address used for management access to the system. Use no ip address command to restore the default IP address 10.90.90.90/8.

Example This example shows how to set 10.1.1.1 as the IP address of the Management Port.

Switch#configure terminal
Switch(config)#mgmt-if
Switch(mgmt-if)#ip address 10.1.1.1/8
Switch(mgmt-if)#end 

Verify the settings by entering the show mgmt-if command.

ip address-list

Use this command to specify the IP addresse range in a DHCP address pool and one of which is allowed to be bound with a DHCP client. Use the no form of this command to remove the range of IP addresses from the DHCP address pool.

ip address-list IP-ADDRESS [,|-]

no ip address-list IP-ADDRESS [,|-]

Syntax Description

IP-ADDRESS [,|-]

The IP address list to be added into DHCP address pool.

Default No IP addresses exist in any DHCP pool.

Command Mode DHCP pool configuration

Usage Guideline

This command is used to define the IP address list for a DHCP pool. Reasonable IP addresses should be carefully defined for the pool. For example, use the same network ID or same subnet for the all IP addresses.

Specify a host by specifying the IP address explicitly or specify a range of IP addresses using a hyphen between the start IP address and end IP address. Both the host and the range of IP addresses can be mixed together. Verify and confirm that the IP addresses chosen are part of the same network.

Example
This example shows how to configure the IP address range for pool1 in the IP address range of 10.1.1.1\~10.1.1.255 and exclude the address 10.1.1.200 from the pool.

Switch# configure terminal
Switch(config)# ip dhcp pool pool1
Switch(config-dhcp)# ip address-list 10.1.1.1-10.1.1.255
Switch(config-dhcp)# no ip address-list 10.1.1.200
Switch(config-dhcp)# 

Verify the address pool is added with the show ip dhcp pool command.

ip as-path access-list

Use this command to define a BGP Autonomous System (AS) path access list. Use the no form of this command to disable use of the access list.

ip as-path access-list ACCESS-LIST-NAME { permit | deny } REGEXP

no ip as-path access-list ACCESS-LIST-NAME

Syntax Description

ACCESS-LIST-NAME Specifies the name of the access list.

permitPermits access to matching conditions.

denyDenies access to matching conditions.

REGEXPSpecifies a regular expression to match the BGP AS paths.

Default None

Command Mode Global configuration

Usage Guideline

The named community access list is a filter based on regular expressions. If the regular expression matches the specified string representing the AS path of the route, then the permit or deny condition applies. Use this command to define the BGP access list globally, use the neighbor filter-list command in the router configuration mode to apply a specific access list.

Multiple commands can be applied to a list name.

Example
This example shows how to define an AS path access list named "mylist" to deny access to the neighbor with AS number 65535:

Switch(config)# ip as-path access-list mylist deny ^65535$
Switch(config)# ip as-path access-list mylist permit .*

Verify the settings by entering the show ip as-path access-list command.

ip community-list

Use this command to add a community list entry. Use the no form of this command to delete the community list entry.

ip community-list COMMUNITY-LIST-NAME { permit | deny } COMMUNITY

no ip community-list COMMUNITY-LIST-NAME [ {permit | deny } COMMUNITY]

Syntax Description
COMMUNITY-LIST-NAME	Specifies the community list name. The syntax is a general string up to 32 characters in length with no spaces.
permit Specifies the community to accept.
deny Specifies the community to reject.
COMMUNITY	This is a user-specified number (32-bits integer) represented by AA:NN, where AA (AS number) is the upper part of the word and NN (community number, user-specified) is the lower part of the word.It can also be one of the following reserved community:internet: Specifies routes.local-AS: Specifies routes not to be advertised to external BGP peers.no-advertise: Specifies routes not to be advertised to other BGP peers.no-export: Specifies routes not to be advertised outside of Autonomous System boundary.

Default BGP community exchange is not enabled by default. It is enabled on a per-neighbor basis with the neighbor send-community command.

The Internet community is applied to all routes or prefixes by default, until any other community value is configured with this command or the set community command.

Command Mode Global configuration

Usage Guideline

Use the community-lists to specify BGP community attributes. The community attribute is used for implementing policy routing. It is an optional, transitive attribute and facilitates transfer of local policies through different autonomous systems. It includes community values that are 32 bits long.This command can be applied multiple times.In the command no ip community access-list COMMUNITY-LIST-NAME if a permit or deny keyword is not specified, then all community lists bonded at the specified access list will be removed.

Example This example (on the next page) shows how to configure a community list

named“mycommlist” that permit routes from network 10 in autonomous system 50000:

Switch(config)# ip community-list mycommlist permit 50000:10

Verify the settings by entering the show ip community-list command.

ip dhcp ping packets

User this command to specify the number of packets that the DHCP server will send as a part of the ping operation. Use the no form of this command to prevent the server from pinging pool addresses.

ip dhcp ping packets COUNT

no ip dhcp ping packets

Syntax Description

COUNT The number of ping packets the DHCP server will send. From 0 to 10 where 0 stops the ping checks from being sent upon address assignment.

Default Two packets.

Command Mode Global configuration

Usage Guideline

Before a DHCP server attempts to assign a pool address a to client, it tries to ping the specific pool address. If the ping packet is unanswered, the DHCP server assumes this pool address is currently available and is safe to assign to a requesting client.

Example The following is a sample of configuring the number of ping packets as 3.

switch# configure terminal
switch(config)# ip dhcp ping packets 3 

ip dhcp ping timeout

Use this command to specify how long the DHCP server will wait for the ping reply from a pool address. Use the no form of this command to restore the wait time for the ping reply back to the default value (500ms).

ip dhcp ping timeout MILLISECONDS

no ip dhcp ping timeout

Syntax Description
MILLISECONDS	The interval of time from 100 to 1000 milliseconds that the DHCP server will wait for a ping reply.

Default 500 milliseconds.

Command Mode Global configuration

Usage Guideline Before the DHCP server attempts to assign a pool address to a client, it tries to ping the specific pool address. If the ping packet is unanswered, the DHCP server assumes this pool address is currently available and is safe to assign to the requesting client. This command sets the time that the DHCP server will wait for a reply from the address that it pinged.

Example The following is sample of configuring the ping timeout as 100.

switch# configure terminal
switch(config)# ip dhcp ping timeout 100 

ip dhcp pool

Use this command to configure a DHCP address pool on a DHCP Server and enter the DHCP pool configuration mode. Use the no form of this command to remove the address pool.

ip dhcp pool NAME

no ip dhcp pool NAME

Syntax Description

NAME The address pool name can either be a symbolic string or an integer. The maximum length is up to 64 characters.

Default Not configured

Command Mode Global configuration

Usage Guideline

This command changes the configuration mode to DHCP pool configuration mode, identified by the (config-dhcp)# prompt. In this mode, the administrator can configure pool parameters, for example, the IP subnet number and default router list.

Note that the DHCP pool name can play an important role if the DHCP host requests meet the IP address offering criteria of more than one DHCP pool. The pool name with the shortest name and lowest alphabet is the only pool allowed to offer the correct IP address to the host.

Example

The following example configures the address pool named "pool1".

switch# configure terminal
switch(config)# ip dhcp pool pool1 

ip dhcp relay

Use this command to enable Dynamic Host Configuration Protocol (DHCP) relay agent features on the switch. Use the no form of this command to disable DHCP relay agent features.

ip dhcp relay

no ip dhcp relay

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

Use this command to enable DHCP relay function. The DHCP relay function is disabled by default.

Example Enable DHCP relay function:

Switch > enable
Switch# configure terminal
Switch(config)# ip dhcp relay 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay address

Use this command to specify the DHCP relay server IP address. Use the no form of the command to delete a DHCP server. When using the no form of the command if no IP address is specified, all DHCP servers will be deleted.

ip dhcp relay address IP-ADDRESS

no ip dhcp relay address [IP-ADDRESS]

Syntax Description

IP-ADDRESS DHCP server IP address

Default None

Command Mode VLAN Interface configuration

Usage Guideline

Use this command to specify the DHCP server IP address. The DHCP request packets received by the device will be relayed to the specified DHCP servers.

Only VLAN interfaces are valid interfaces for this command.

Multiple DHCP server addresses can be specified on the same IP interface.

The specified DHCP servers are only effective when the interface is an IP interface.

For layer 2 devices, the DHCP servers need to be specified on the system IP interface. All the DHCP request packets received by a device will be relayed to these DHCP servers.

For layer 3 devices, all the DHCP request packets received by the IP interfaces will be relayed to the DHCP servers configured on this interface. If there are no DHCP servers configured on an IP interface, then the DHCP request packets will not be relayed. DHCP request packets received by the non-IP interfaces, will be relayed to the first IP interface that has DHCP servers configured.

Example

Enable DHCP relay function and set interface VLAN 100 with DHCP server ip address 10.1.1.1, the DHCP packet received on VLAN 100 will relay to DHCP server 10.1.1.1:

Switch# configure terminal
Switch(config)# interface vlan100
Switch(config-if)# ip dhcp relay address 10.1.1.1 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay hops

Use this command to configure the maximum number of relay hops that the DHCP packets can traverse.

ip dhcp relay hops HOP-COUNT

Syntax Description
HOP-COUNT	The number of relay hops that the DHCP packets can traverse. The valid setting is 1-16. Every time that a DHCP packet is relayed, the relay hop-count will be increment by 1. If the relay hop count in the received packet is equal to or greater then the specified value, the packet will be discarded.

Default 4

Command Mode Global configuration

Usage Guideline Use this command to specify the maximum number of relay hops that the DHCP packets can traverse.

Example This example shows how to set maximum number of router hops 5:

Switch# configure terminal
Switch(config)#ip dhcp relay hops 5 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay information check

Use this command to configure the DHCP relay agent to validate the relay agent information option in the received DHCP reply packet.

ip dhcp relay information check

no ip dhcp relay information check

Syntax None

Default Enabled

Command Mode Global configuration

Usage Guideline

When this check for the reply packet is enabled, the device will check that the option-82 field in DHCP reply packets it receives from the DHCP server is valid. If an invalid message is received, the relay agent drops it. If a valid message is received, the relay agent removes the option-82 field and forwards the packet.

If the check is disabled, a packet with an invalid option-82 field will be directly forwarded.

Example

Enabled DHCP relay agent check for the reply packet.

Switch# configure terminal
Switch(config)# ip dhcp relay information check 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay information option

Use this command to enable the insertion of the relay agent information option (option 82). Use the no form of the command to disable this function.

ip dhcp relay information option

no ip dhcp relay information option

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

Use this command to enable insertion of DHCP option 82.

When the DHCP 82 option is enabled, a DHCP packet received from a client will have the option 82 field inserted before being relayed to the server. The DHCP option 82 contains 2 suboptions: circuit ID and remote ID sub-options.

If the switch is standalone then the module field, within the circuit ID suboption, is always set to zero. The following describes the format of the Circuit and Remote ID suboption formats:

Circuit ID suboption format:

B	y t	e		1		2	3
Field	Sub-option Type	Length	Circuit IDType	Length	VLAN ID		Module #	Port #
Value	1	6	0	4	X		X	X

4

VLAN ID - The incoming VLAN ID of DHCP client packet.

Module # - For a standalone switch, Module # is always 0; For a stackable switch, Module is Unit ID.

Port # - The receiving port number of DHCP client packet, port number starts from 1.

Remote ID suboption format:

Byte	1	2	3	4	5	6	7	8	9	10
Field	Sub-option Type	Length	Remote ID Type	Length	MAC Address
Value	2	8	0	6	M1	M2	M3	M4	M5	M6

MAC address: the switch's system MAC address.

Example This example shows how to enable insertion of the option-82 field during the relay of DHCP request packets.

Switch# configure terminal
Switch(config)# ip dhcp relay information option 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay information policy

Use this command to configure the information re-forwarding policy for the DHCP relay agent.

ip dhcp relay information policy {drop | keep | replace}

Syntax Description
drop	Discards the packet that already has the relay option. This packet represents a packet that is relayed by a relay agent and already has the option inserted.
keep	When the DHCP request packets already have the relay option, then the relay option is left unchanged and directly relayed to the DHCP server.
replace	When the DHCP request packets already have the relay option, then it will be replaced by a new option.

Default replace

Command Mode Global configuration

Usage Guideline	The device may receive a DHCP request packet that already has the relay option. This packet represents a packet that is relayed by a relay agent and already has the option inserted. The gateway address in the received DHCP packet should not be zero since it represents the IP address of the predecessor DHCP relay agent.
Example	This example shows how to set the policy to drop the DHCP request packet that is relayed by other DHCP relay agent and already has option-82 inserted.

Switch# configure terminal
Switch(config)# ip dhcp relay information policy drop 

Verify the settings by entering the show ip dhcp relay command.

ip dhcp relay information trust-all

Use this global command to direct the DHCP relay agent to accept the packets with giaddr==0 (this relay agent is the first relay of this DHCP request packet) and the relay agent information option already present in the packet. Use the no form of the command to specify to drop these DHCP request packets.

ip dhcp relay information trust-all

no ip dhcp relay information trust-all

Syntax None

Default The interface default is un-trusted.

Command Mode Global configuration

Usage Guideline

When the IP DHCP relay information is trusted, and the gateway address in the DHCP request packet is set to all zeros, but the relay agent information option is present in the packet, then the DHCP relay agent will accept the packet.

When the packet is not trusted, then it will be discarded.

This command is under global configuration; it will enable/disable all existing VLANs' DHCP Relay Agent trusted relay agent information. However, the command takes effect only in the running configuration and is not kept in NVRAM for the next boot cycle using the startup configuration.

To configure a specific interface's trust status, use the ip dhcp relay information trusted interface command.

Example

This command shows how to enable all interfaces with the DHCP relay agent set to accept the packets with giaddr==0 and the relay agent information option already present in the packet.

Switch# configure
Switch(config)# ip dhcp relay information trust-all
Swtch(config)# 

Verify the settings by entering the show ip dhcp relay information trusted-sources command

ip dhcp relay information trusted

Use this interface command to direct the DHCP relay agent to accept the packets with giaddr==0 (this relay agent is the first relay of this DHCP request packet) and relay agent information option is already present in the packet. Use the no form of the command to configure to drop these DHCP request packet.

ip dhcp relay information trusted

no ip dhcp relay information trusted

Syntax None

Default The interface default is un-trusted.

Command Mode VLAN interface configuration

Usage Guideline

When IP DHCP relay information is trusted, if the gateway address in the DHCP request packet is set to all zeros but the relay agent information option is already present in the packet, the DHCP relay agent will accept the packet.

If it is un-trusted, then the packet will be discarded.

Example

This example shows how to enabled interface vlan100's DHCP relay agent to accept the packets with giaddr==0 and relay agent information option is already present in the packet.

Switch# configure
Switch# interface vlan100
Switch(config-if)# ip dhcp relay information trusted
Swtich(config-if)# end 

Verify the settings by entering the show ip dhcp relay information trusted-sources command.

ip dvmrp

Use this command to enable DVMRP on the current interface. Use the no form to disable DVMRP on the interface.

ip dvmrp

no ip dvmrp

Syntax None

Default Disabled

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

The VLAN interface will have DVMRP protocol enabled (or disabled).

Before enabling DVMRP function on an interface, it is necessary to enable IP multicast routing with the ip multicast-routing command in global configuration mode.

Only one multicast routing protocol can be enabled on an interface, make sure no other multicast routing protocol is configured before DVMRP is enabled. If another protocol is enabled, an error message is displayed.

Example This example shows how to enable the DVMRP protocol on the interface VLAN 1.

Switch(config)# interface vlan1
Switch(config-if)# ip dvmrp

Verify the settings by the show ip dvmrp interface command.

ip dvmrp metric

Use this command to configure the metric value on the current interface.

ip dvmrp metric METRIC

Syntax Description
METRIC	It can be a value from 1 to 31. A value of 32 sets the route metric to infinite or unreachable.

Default 1

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

For each source network reported, a route metric is associated with the route being reported. The metric is the sum of the interface metrics between the router originating the report and the source network. DVMRP uses the infinite or unreachable metric which is defined to be 32. This limits the breadth across the entire DVMRP network and is necessary to place an upper boundary on the convergence time of the protocol.

By default, a metric value of 1 is associated with each DVMRP route. Use the command to modify the metric value.

Example This example shows how to change the metric value to 2 of an interface.

Switch(config)# interface vlan1
Switch(config-if)# ip dvmrp metric 2 

Verfiy the settings by the show ip dvmrp interface command.

ip http server

Use this command to enable HTTP server. Use the no form of the command to disable HTTP server function.

ip http server

no ip http server

Syntax None

Default HTTP interface is enabled.

Command Mode Global configuration

Usage Guideline This command enables HTTP server function.

Example This example will disable the http server

Switch(config)# no ip http server

Verify the settings by entering the show system protocol-state command.

ip http service-port

Use this command to specify the HTTP service port. And use the default command to return the service port to 80.

ip http service-port TCP-PORT

default ip http service-port

Syntax Description

TCP-PORT TCP port number. TCP ports are numbered between 1 and 65535. The "well-known" TCP port for the HTTP protocol is 80.

Default Port 80

Command Mode Global configuration

Usage Guideline This command configures the TCP port number for HTTP.

Example This example set HTTP TCP port number to 100

Switch(config)# ip http service-port 100

Verify the settings by entering the show system protocol-state command.

ip igmp access-group

Using the ip igmp access-group command in interface configuration restricts a subnet's hosts to join only multicast groups that are permitted by an IP basic access list. It also can be used to restrict hosts (receivers) on a subnet to membership of only the (S,G) channels that are permitted by an IP basic access list. To disable the restrictions, use the no form of this command.

ip igmp access-group IP-ACL

no ip igmp access-group

Syntax Description
IP-ACL	Specifies an IP basic access list. (not an IP extended access list). There are two types of IP ACL lists. One is the IP basic ACL list used to consider only the packet IP address. The other list is the IP extended ACL which uses the packet's IP address as well as other IP information such as UDP/TCP port number, TOS, etc..

Default No access group is set.

Command Mode VLAN interface configuration

Usage Guideline

Use the ip igmp access-group command to filter groups from IGMP reports by using an IP basic access list. It also can filter sources and groups from IGMPv3 reports by using an IP basic access list. This command is used to restrict hosts on a subnet to join only multicast groups that are permitted by an IP basic access list. The command can also restrict hosts on a subnet to membership of only those (S, G) channels that are permitted by an IP basic access list.An IGMP access list accepts only an IP basic access list, allowing membership reports to be filtered based only on multicast group addresses.IGMPv3 allows multicast receivers not only to join to groups, but to groups based on including or excluding sources. For appropriate access control, it is therefore necessary to allow filtering of IGMPv3 messages not only by group addresses reported, but by group and source addresses.

Example

This example shows how to restrict the serviced IGMP group for VLAN 1000 to group 226.1.1.1. In the following example, at first, create an IP basic access list named igmp_filter which only permits the packets with destination is group address 226.1.1.1. Then, associate this access group in interface VLAN 1000.

Switch#configure terminal
Switch(config)# ip access-list igmp_filter
Switch(config-ip-acl)#permit any 226.1.1.1 255.255.255.255
Switch(config-ip-acl)# exit
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp access-group igmp_filter
Switch(config-if)# end 

Verfiy the settings by entering the show ip igmp interface command.

ip igmp last-member-query-interval

Use this command to configure the interval at which the router sends IGMP group-specific or group-source-specific (with IGMP Version 3) query messages. The command sets the timer value for both IGMP L3 queries and IGMP snooping.

ip igmp last-member-query-interval MILLISECONDS

Syntax Description
MILLISECONDS	Interval, in milliseconds, at which IGMP group-specific or group-source-specific (with IGMP Version 3) query messages are sent. The range is 1000 to 25000.

Default 1000 milliseconds

Command Mode VLAN interface configuration

Usage Guideline

When an IGMP querier receives a leave packet, it will send a group specific query or group source specific query. The leave timer starts once the IGMP querier receives a leave packet from an interface. If the interface does not receive the report packet before the leave timer expires, then the interface's membership will be removed from the group or channel that is to be leaved. The value of the leave timer is the value of the last-member-query-interval * the last-member-query-count.

The IGMP last-member-query-interval will be carried within IGMP group-specific queries or group-source-specific (with IGMP Version 3) query messages.

The last-member-query-count will have the same value as the robustness-variable.

When IGMP is disabled but IGMP snooping is enabled at the interface, then the IGMP last-member-query-interval value set with this command is used for IGMP snooping. If the command “ip igmp snooping immediate-leave” on page 197 is enabled, then this timer value is ignored and the interface's group or channel membership, identified in the leave request from the host, will be immediately removed from the IGMP snooping membership table.

Example

This example shows how to configure IGMP last member query interval value. It configures IGMP last member query interval value to 2 seconds on interface VLAN 1000.

Switch#configure terminal
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp last-member-query-interval 2000
Switch(config-if)# end 

Verify the settings by entering the show ip igmp interface command.

ip igmp query-interval

Use this command to configure the interval at which the router sends IGMP general-query messages periodically.

ip igmp query-interval SECONDS

Syntax Description

SECONDS Configure the frequency at which the designated router sends IGMP general-query messages.

By default, the designated router sends IGMP general-query messages every 125 seconds to keep the IGMP overhead very low on the hosts and networks.

The range is 1 to 31744.

Default 125 seconds

Command Mode VLAN interface configuration

Usage Guideline

This command is for use on the VLAN interface only. Use this Interface configuration command for modifying IGMP Group Member Query Interval on an interface.

The IGMP querier sends IGMP membership query messages at the interval specified by the ip igmp query-interval command to discover which multicast groups have members on the attached networks of the router. Hosts respond with IGMP report messages indicating that they want to receive multicast packets for specific groups (that is, indicating that the host wants to become a member of the group). IGMP query messages are addressed to the all-hosts multicast group, which has the address 224.0.0.1, and has an IP time-to-live (TTL) value of 1.

The igmp query-interval is also used for igmp snooping as IGMP is disabled but igmp snooping is enabled at the interface.

Example

This example shows how to configure the IGMP query interval to 300 seconds on interface VLAN 1000.

Switch# configure terminal
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp query-interval 300
Switch(config-if)# end

Verify the settings by entering the show ip igmp interface command.

ip igmp query-max-response-time

Use this command to configure the maximum response time advertised in IGMP queries.

ip igmp query-max-response-time SECONDS

Syntax Description

SECONDS Set the maximum response time, in seconds, advertised in IGMP queries. The range is 1 to 25.

Default 10 seconds

Command Mode VLAN interface configuration

Usage Guideline

This command controls the period during which the group member can respond to an IGMP query message before the router deletes the membership.

This command applies to interfaces configured for both IGMP Layer-3 multicast protocols and IGMP Snooping (L2 mode and the interface function as a querier). The group membership interval is equal to query-interval* robustness + max response time.

Example This example shows how to configure IGMP max query response time to 10 seconds on VLAN 1000.

Switch# configure terminal
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp query-max-response-time 10
Switch(config-if)# end 

Verify the settings by entering the show ip igmp interface command.

ip igmp robustness-variable

Use this command to tune for the expected packet loss on a network, i.e. the Robustness Variable of IGMP.

ip igmp robustness-variable VALUE

Syntax Description

VALUE Provides fine-tuning to allow for expected packet loss on a subnet. The value of the robustness variable is used in calculating the following IGMP message intervals:

• Group membership interval - Amount of time that must pass before a multicast router decides there are no more members of a group on a network. This interval is calculated as follows: (robustness variable * query interval) + (1 * query response interval).
• Other querier present interval - Amount of time that must pass before a multicast router decides that there is no longer another multicast router that is the querier. This interval is calculated as follows: (robustness variable * query interval) + (0.5 * query response interval).
• Last member query count - Number of group-specific queries or group-source-specific (with IGMP Version 3) query messages sent before the router assumes there are no local members of a group. The default number is the value of the robustness variable.

The robustness variable range is from 1 to 7.

Default VALUE: 2

Command Mode VLAN Interface configuration

Usage Guideline

This command is valid for the VLAN interface only. Use this command to modify the IGMP Robustness Variable on an interface.

The IGMP Robustness Variable determines the number of general queries that IGMP sends before aging out a multicast address when there is no IGMP report response. In other words, this variable is also used as "last member query count". The group membership interval is equal to query-interval* robustness + max response time.

The larger the Robustness Variable is set, the higher IGMP protocol packet loss is acceptable. IGMP can recover from robustness variable minus 1 lost IGMP packet.

Example

This example shows how to configure IGMP Robustness Variable value. It configures IGMP Robustness Variable value to 5 on interface VLAN 1000.

Switch# configure terminal
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp robustness-variable 5
Switch(config-if)# end 

Verify the settings by entering the show ip igmp interface command.

ip igmp snooping

Use this command to enable IGMP Snooping function on the switch. Use the no form of this command to disable IGMP Snooping function.

ip igmp snooping

no ip igmp snooping

Syntax None

Default IGMP snooping is disabled on all VLAN interfaces

The IGMP snooping global state is disabled by default. The global function control is not stored in NVRAM.

Command Mode VLAN interface configuration or Global configuration

Usage Guideline

Under interface configuration for an interface, the corresponding VLAN must first be created.

When the user executes the command under global configuration, it will enable/disable all existing VLAN IGMP snooping function. However the command takes effect only in the running configuration and it will not be kept in NVRAM for the next start up configuration. For a VLAN interface, the command can be kept in NVRAM for the next startup system configuration mode.

To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping under VLAN interface configuration mode.

Under global configuration mode, the command has a one time use limit. The command will, in that mode, enable IGMP snooping functions for all existing VLANs. Similarly, no ip igmp snooping will disable IGMP snooping function for all of the existing VLANs.

As a VLAN is deleted, the related IGMP snooping setting for the VLAN is also removed from system configuration.

Examples

This example shows how to globally enable IGMP Snooping for all existing VLANs.

Switch(config)# ip igmp snooping
Switch(config)# end
Switch# 

This example shows how to enable IGMP Snooping on VLAN1

Switch(config)# interface vlan1
Switch(config-if)# ip igmp snooping
Switch(config-if)# end
Switch#

Verfiy the settings by entering the show ip igmp snooping command.

ip igmp snooping (multicast router)

Use this command to configure the specified interface(s) as multicast router ports, or forbidden to be multicast router ports on the switch. Use the no form of this command to remove the interface(s) from multicast router ports, or forbidden multicast router ports.

ip igmp snooping { mrouter-designate | mrouter-not-allowed } interface INTERFACE-ID [, | - ]

no ip igmp snooping { mrouter-designate | mrouter-not-allowed } interface INTERFACE-ID [, | - ]

Syntax Description
mrouter-designate	Designate a range of interfaces as being connected to multicast-enabled routers.
mrouter-not-allowed	Designate a range of interfaces as being not connected to multicast-enabled routers.
INTERFACE-ID The interface can be a physical interface or a port-channel.
,	(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space is allowed before and after the comma.
- (Optional) Specifies a range of interfaces. No space is allowed before and after the hyphen.

Default No IGMP snooping multicast router port is configured.

Command Mode VLAN interface configuration

Usage Guideline

The valid interface can be a physical port or a port-channel for the INTERFACE-ID parameter.

The router member port can be either dynamically learned or statically configured into an IGMP snooping entity. With dynamic learning, the IGMP snooping entity will listen to IGMP, PIM, and DVMRP packet to identify whether the partner device is a multicast router.

To add a multicast router port statically, use the ip igmp snooping mrouter-designate configuration. On the opposite side, it is also possible to use ip igmp snooping mrouter-not-allowed to configure those ports that cannot become multicast router ports even the port has received IP multicast control protocol message.

The member port of a port channel can not be enabled with the ip igmp snooping {mrouter-designate | mrouter-not-allowed} command, an error message is displayed if the designated port is ineligible.

Examples This example shows how to add a multicast router port on vlan1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip igmp snooping mrouter-designate interface eth3.1
Switch(config-if)# exit
Switch(config)# 

Verfiy the settings by entering the show ip igmp snooping mrouter command.

This example displays a configuration error, eth3.1 (on vlan4) is not eligible to be designated as a multicast router interface for VLAN 5.

Switch(config)# interface vlan5
Switch(config-if)# ip igmp snooping mrouter-designate interface eth3.1
Error: eth3.1 is not vlan5 member
Switch(config-if)#exit
Switch(config)# 

This example displays an error, the system is not allowing the configuraiton because the VLAN interface is not eligible to be designated as a multicast router interface.

Switch(config)# interface vlan4
Switch(config-if)# ip igmp snooping mrouter-designate interface vlan5
% Interface type not support vlan5
Switch(config-if)# exit
Switch(config)# 

Verfiy the settings by entering the show ip igmp snooping mrouter command.

ip igmp snooping immediate-leave

Use this command to configure the IGMP Snooping immediate-leave function on VLAN interfaces. Use no ip igmp snooping immediate-leave to disable the immediate-leave function on the specified VLAN.

ip igmp snooping immediate-leave

no ip igmp snooping immediate-leave

Syntax None

Default Disabled

Command Mode VLAN Interface configuration

Usage Guideline

The ip igmp snooping immediate-leave command allows IGMP Snooping membership of an interface to be removed immediately without any further confirmation mechanism (such as time out) when the interface receives an IGMP leave message from the IGMP client.

Example

This example shows how to enable IGMP Snooping immediate-leave on VLAN 1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)#ip igmp snooping immediate-leave
Switch(config-if)# end 

Verfiy the settings by entering the show ip igmp snooping command.

ip igmp snooping querier

Use this command to enable the IGMP Snooping query function in Layer 2 networks. Use the no form of this command to disable the function of the IGMP Snooping Querier.

ip igmp snooping querier

no ip igmp snooping querier

Syntax None

Default Disabled

Command Mode VLAN Interface configuration

Usage Guideline

The system can work as the querier role when the querier for an IGMP snooping domain is enabled. If the system receives query packets from other routers, the IP address of the system and the IP address of the other routers is used to determine the final querier. The routers (network devices) with lower IP addresses become the querier.

The querier sends a general query at the interval specified by query-interval. Upon receiving the general query, the IGMP client (or host) needs to respond to the query packet in order to express that it remains in the specified group. The maximum response time instructs the client to report within the time period specified.

If the IGMP snooping entity does not receive a report from a client for a specific group after a specific time period, the port is removed from the member port list of the specific group. This specific time period is referred to as the group membership interval. The group membership interval is equal to query-interval* robustness variable + max response time.

The timeout period for a querier (other querier present interval) is query-interval * robustness variable + 1/2 max response time. The time-out period for learning of a router port is the same value as for the other querier present interval.

The query-interval value can be changed using the ip igmp query-interval command (defined in IGMP command document).

As IGMP is enabled on the specified VLAN of the switch, the IGMP snooping querier is suspended at the VLAN as if it were disabled, because of IGMP.

Example This example shows how to enable IGMP Snooping querier state on VLAN 1.

Switch> configure terminal
Switch(config)# interface vlan1
Switch(config-if)#ip igmp snooping querier
Switch(config-if)# end
Switch# 

Verfiy the settings by entering the show ip igmp snooping command.

ip igmp snooping static-group

Use this command to configure an IGMP snooping static group.

Use the no form of this command to delete an IGMP snooping static group.

ip igmp snooping static-group IP-ADDRESS [ source IP-ADDRESS] interface INTERFACE-ID [,|-]

no ip igmp snooping static-group [IP-ADDRESS [source IP-ADDRESS]

[ interface INTERFACE-ID [, | - ] ]]

Syntax Description
IP-ADDRESS	The first IP-ADDRESS is the IP multicast group address of a group which the user would like to see. (Optional) The second IP-ADDRESS is the IP address of a system where multicast data packets originate.
INTERFACE-ID [, | -]	The interface or an interface list. Only a physical interface or a port-channel is allowed.

Default No static-group

Command Mode VLAN interface configuration

Usage Guideline	This command applies to IGMP Snooping on a VLAN interface to statically add group membership entries and/or source records.
	If a physical port is used as interface parameter for this command and it is already one member port of a port-channel then the command is aborted and an error message indicates the condition.
	If the specified interface parameter (such as port or port-channel) interface does not belong to the VLAN where this command is going to apply the specified interfaces, then the system returns an error message to indicate that the command is ignored.
	The command creates an IGMP snooping static group.
	If an igmp snooping static-group configuration exists in the switch, then the switch has to respond to the IGMP query for these configured static-group addresses.
	The Reserved IP multicast address 224.0.0.X must be excluded from the configured group.
	The VLAN has to be created before creating an IGMP snooping static-group. When the associated VLAN is deleted, the related IGMP snooping static-group entries are also removed from system configuration.
Example	The following example, on the next page, shows how to statically add group and/or source records for IGMP Snooping.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip igmp snooping static-group 226.1.2.3 interface eth3.5
Switch(config-if)# exit
Switch(config)#interface vlan1
Switch(config-if)#ip igmp snooping static-group 226.1.2.6 source 10.1.2.3 interface eth3.5 

Verify the settings by entering the show ip igmp snooping group command.

ip igmp version

Use this command to change the IGMP version on the specified interface.

ip igmp version {1|2|3}

Syntax Description

1 Configure the Switch to run IGMP version 1.

2 Configure the Switch to run IGMP version 2.

3 Configure the Switch to run IGMP version 3.

Default 3

Command Mode VLAN interface configuration

Usage Guideline

If the IGMP interface version is configured to a lower version, then the higher version IGMP Report/Leave messages are ignored.

This version will apply to both IGMP and IGMP snooping operation.

Example

This example shows how to configure IGMP version. It configures the IGMP version to 3.

Switch# configure terminal
Switch(config)# interface vlan1000
Switch(config-if)# ip igmp version 3
Switch(config-if)# end

Verify the settings by entering the show ip igmp interface command.

ip mroute

Use this command to create a multicast static route (mroute).

Use the no form of this command to delete the route.

ip mroute SOURCE-NETWORK{ RPF-ADDRESS | Null } [ DISTANCE ]

no ip mroute SOURCE-NETWORK

Syntax Description
SOURCE-NETWORK Network address of the multicast source. Format: A.B.C.D/M.
RPF-ADDRESS RPF neighbor address for the multicast route.
Null	Indicates Null interface. When set to Null, the RPF check result will always be failed.
DISTANCE	(Optional) Specifies whether a unicast route or multicast static route is used for the RPF lookup. Lower distances have preference. If the multicast static route has the same distance as the other RPF sources, the multicast static route takes preference. Default is 0. Range is 0-255.

Default DISTANCE: 0

Command Mode Global configuration

Usage Guideline This command statically configures where multicast sources are located even when the unicast routing table shows something different. If the RPF-ADDRESS is a PIM neighbor, PIM join, graft, and prune messages are sent to it.

Examples The following example configures the multicast data source within network 192.168.6.0/24 to be accessible with the neighbor router 10.1.1.1.

Switch(config)#ip mroute 192.168.6.0/24 10.1.1.1

The following example configures the multicast data source within network 192.168.7.0/24 to be accessible with the neighbor router 10.1.1.1 and with the distance value of 100.

Switch(config)#ip mroute 192.168.7.0/24 10.1.1.1 100

The following example configures the multicast data source within a network number 192.168.8.0/24 to be discarded.

Switch(config)#ip mroute 192.168.8.0/24 null

The following example removes a previously configured ip mroute entry of 192.168.8.0/24.

Switch(config)#no ip mroute 192.168.8.0/24

Verify the settings using the show running-config command.

ip mtu

Use this command to set the MTU value in TCP/IP stack. Use the default form to restore to the default ip mtu size.

ip mtu BYTES

default ip mtu

Syntax Description

BYTES Set the IP MTU value in TCP/IP stack. The range is 1280 to 9692 bytes.

Default 1500 bytes

Command Mode VLAN interface configuration

Usage Guideline

IP packets sent by the device will be fragmented based on this value.

Some routing protocols, such as OSPF, will use this value to advertise routing updates.

Examples This example shows how to set ip mtu as 6000 bytes at vlan 4.

Switch# configure terminal
Switch(config)# interface vlan4
Switch(config-if) ip mtu 6000
Switch(config-if)# end

This example shows how to restore the default ip mtu.

Switch# configure terminal
Swtich(config)# interface vlan4
Switch(config-if)# default ip mtu
Switch(config-if)# end 

Verify the settings by entering the show interface command.

ip mtu (management port)

Use this command to set the IP layer maximum transfer unit of the Management Port. Use no form command to reset to the default ip mtu.

ip mtu BYTES

no ip mtu

Syntax Description

BYTES The maximum transfer unit in bytes. The range is 1500 to 9180 bytes.

Default 1500 bytes

Command Mode Management interface configuration

Usage Guideline IP packets sent by the device will be fragmented based on this value.

Example This example shows how to set the ip mtu of the Management Port to 1600 bytes.

Switch#configure terminal
Switch(config)#mgmt-if
Switch(mgmt-if)#ip mtu 1600
Switch(mgmt-if)#end 

Verify the settings by entering the show mgmt-if command

ip multicast-routing

Use this command to enable IP multicast routing. Use the no form of this command to disable IP Multicast routing.

ip multicast-routing

no ip multicast-routing

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline If the no ip multicast-routing command is used, the device stops routing multicast packets even when the protocols are enabled.

Example This example shows how to enable IP multicast routing.

Switch(config)# ip multicast-routing

Verify the settings by the show system protocol-state command.

ip ospf authentication

Use this command to send and receive OSPF packets with the specified authentication method. Use the no form of this command to disable the authentication.

ip ospf authentication [ message-digest ]

no ip ospf authentication

Syntax Description

message-digest (Optional) Use the message digest authentication.

Default No authentication

Command Mode Interface configuration

Usage Guideline

The authentication mode can be: no-authentication, use authentication key for authentication, or use message-digest key for authentication.

When it is specified to use the authentication key but the key is not configured, then null key will be used.

When it is specified to use the message digest but the digest key is not configured, then the null key will be used.

Example In the following example shows how to enable message authentication on interface VLAN 1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf message-digest-key 10 md5 yourpass
Switch(config-if)# ip ospf authentication message-digest 

Verify the settings by entering the show ip ospf interface command.

ip ospf authentication-key

Use this command to specify an OSPF authentication password for the neighboring routers. Use the no form of this command to remove an OSPF authentication password.

ip ospf authentication-key PASSWORD

no ip ospf authentication-key

Syntax Description

PASSWORD Specifies the authentication password. Any continuous string of characters that can be entered from the keyboard up to 8 bytes in length. The syntax is a general string that does not allow spaces.

Default None

Command Mode Interface configuration

Usage Guideline

This command creates a password (key) that is inserted into the OSPF header when the router originates routing protocol packets. Assign a separate password to each network for different interfaces. All neighboring routers on the same network with the same password exchange OSPF routing data.

Use the ip ospf authentication command to enable authentication. Simple password authentication allows a password to be configured for each interface. Configure the routers in the same routing domain with the same password.

Example

In the following example, an authentication key test is created on interface VLAN 1 in area 0. Note that first authentication is enabled for area 0.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf authentication-key test
Switch(config-if)# ip ospf authentication 

Verify the settings by entering the show ip ospf interface command

ip ospf cost

Use this command to explicitly specify the cost of sending a packet on an interface. Use the no form of the command to remove the assignment.

ip ospf cost COST

no ip ospf cost

Syntax Description

COST Specifies the value of the link-state metric. The range is 1 to 65535.

Default Cost is not configured

Command Mode Interface configuration

Usage Guideline

The interface cost indicates the overhead required to send packets across a certain interface. This cost is advertised as the link cost in the router link advertisement. The cost is inversely proportional to the bandwidth of an interface. The cost can be either manually assigned or be automatically determined.

By default, the cost of an interface is calculated based on the bandwidth (10E8 / bandwidth); use the ip ospf cost command to set the cost manually.

If the cost is explicitly assigned, the assigned cost will override the auto-determined cost. Otherwise, the auto-determined cost will be adopted.

Example

The following example shows sets the interface cost value to 10 on interface VLAN 1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf cost 10 

Verify the settings by entering the show ip ospf interface command.

ip ospf dead-interval

Use this command to set the interval during which no hello packets are received and after which a neighbor is declared dead. The no form of this command will reset the dead-interval to the default value.

ip ospf dead-interval SECONDS

no ospf dead-interval

Syntax Description

SECONDS Specifies the interval in seconds. The range is 1 to 65535.

Default 40 seconds

Command Mode Interface configuration

Usage Guideline

The dead-interval is the amount of time that the router waits to receive an OSPF hello packet from a neighbor before declaring the neighbor down.

This value is advertised in the router's hello packets. It must be the same for all routers on a specific network.

Specifying a smaller dead interval in seconds will give faster detection of a neighbor being down and improve convergence, but it may cause additional routing instability.

Example

The following example shows configuring dead-interval to 10 seconds on VLAN 1 interface.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf dead-interval 10 

Verify the settings by entering the show ip ospf interface command.

ip ospf hello-interval

Use this command to specify the interval between hello packets. The no-form of this command will reset the hello-interval to the default value.

ip ospf hello-interval SECONDS

no ip ospf hello-interval

Syntax Description

SECONDS Specifies the interval in seconds. The range is 1 to 65535.

Default 10 seconds

Command Mode Interface configuration

Usage Guideline

The hello-interval is advertised in the hello packets. Configure the same hello-interval for all routers on a specific network. A shorter hello interval ensures faster detection of topological changes but results in more routing traffic.

When configuring the hello-interval, if the hello-interval*4<=65535, then the dead-interval will be automatically updated to hello-interval*4.

Example

The following example shows setting the hello-interval to 3 seconds on interface VLAN 1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf hello-interval 3 

Verify the settings by entering the show ip ospf interface command.

ip ospf message-digest-key

Use this command to register an MD5 key for OSPF MD5 authentication.

Use the no form of this command to remove an MD5 key.

ip ospf message-digest-key KEY-ID md5 KEY

no ip ospf message-digest-key KEY-ID

Syntax Description

KEY-ID Specifies a value for key identifier. The range is 1 to 255.

KEY Specifies the OSPF password. The syntax is a general string, 1-16 characters with no spaces.

Default None

Command Mode Interface configuration

Usage Guideline

Message Digest Authentication is a cryptographic authentication. A key (password) and key-id are configured on each router. The router uses an algorithm based on the OSPF packet, the key, and the KEY-ID to generate a message digest that gets appended to the packet. Use this command for uninterrupted transitions between passwords. This is helpful for administrators who want to change the OSPF password without disrupting communication. The system begins a rollover process until all the neighbors have adopted the new password. This allows neighboring routers to continue communication while the network administrator is updating them with a new password. The router will stop sending duplicate packets once it detects that all of its neighbors have adopted the new password.

Maintain only one password per interface, removing the old password whenever a new one is added. This prevents the local system from continuing to communicate with the system that is using the old password. Removing the old password also reduces overhead during rollover. All neighboring routers on the same network must have the same password value to enable exchange of OSPF routing data.

Example

The following example shows how to set a new key 10 with password yourpass on interface VLAN 1.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf authentication message-digest
Switch(config-if)# ip ospf message-digest-key 10 md5 yourpass 

Verify the settings by entering the show ip ospf interface command.

ip ospf priority

Use this command to set the router priority to determine the designated router for the network. The no form of this command will reset the priority to the default value.

ip ospf priority PRIORITY

no ip ospf prority

Syntax Description

PRIORITY Specifies the priority of the router on the interface. The range is 0 to 255.

Default PRIORITY: 1

Command Mode Interface configuration

Usage Guideline

Set the priority to help determine the OSPF Designated Router (DR) for a network. If two routers attempt to become the DR, the router with the higher router priority becomes the DR. If the router priority is the same for two routers, the router with the higher router ID takes precedence.

Only routers with nonzero router priority values are eligible to become the designated or backup designated router. Configure router priority for multi-access networks (not point-to-point) only.

Example The following example shows setting the OSPF priority value to 3 on VLAN 1 interface.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf priority 3 

Verfiy the settings by entering the show ip ospf interface command.

ip ospf retransmit-interval

Use this command to specify the time between link-state advertisement (LSA) retransmissions for adjacencies belonging to the interface. The no form of this command will reset the retransmit-interval to the default value.

ip ospf retransmit-interval SECONDS

no ip ospf retransmit-interval

Syntax Description

SECONDS Specifies the interval in seconds. The range is 1 to 65535.

Default 5 seconds

Command Mode Interface configuration

Usage Guideline

After sending an LSA to a neighbor, the router keeps the LSA until it receives an acknowledgement. In case the router does not receive an acknowledgement during the set time (the retransmit interval value) it retransmits the LSA. Set the retransmission interval value conservatively to avoid needless retransmission. The interval should be greater than the expected round-trip delay between two routers.

Example

The following example shows setting the ospf retransmit interval to 10 seconds on sVLAN 1 interface

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf retransmit interval 10 

Verfiy the settings by entering the show ip ospf interface command

ip ospf shutdown

To initiate a graceful shutdown of Open Shortest Path First (OSPF) protocol at interface level, use the ip ospf shutdown command in router configuration mode. To restart the OSPF protocol on an interface, use the no form of this command.

ip ospf shutdown [ IFNAME ]

no ip ospf shutdown [ IFNAME ]

Syntax Description

IFNAME (Optional) Specifies a layer 3 interface. If no option is specified, the command applies to the entire OSPF process.

Default None

Command Mode Router configuration

Usage Guideline

Use the ip ospf shutdown command to place the OSPF protocol, on a specific interface, into shutdown mode.

If no interface is specified with this command, the entire protocol will shutdown in the least disruptive manner and notify its neighbors that it is not available.

Traffic that can follow another route through the network, will be directed to that alternate path.

Example
The following example shows how to initiate an OSPF protocol shutdown on the layer 3 interface (VLAN 1):

Switch(config)# router ospf
Switch(config-router)# ip ospf shutdown vlan1 

ip ospf transmit-delay

Use this command to set the estimated time it takes to transmit a link-state-update packet on the interface.

Use the no parameter with this command to return to the default value.

ip ospf transmit-delay SECONDS

no ip ospf transmit-delay

Syntax Description

SECONDS Specifies the interval in seconds. The range is 1 to 65535.

Default 1 second

Command Mode Interface configuration

Usage Guideline

The transmit delay value adds a specified time to the age field of an update. If the delay is not added, the time in which the LSA transmits over the link is not considered. This command is especially useful for low speed links. Remember to add transmission and propagation delays when setting the transmit delay value.

Example

The following example shows setting the OSPF transmit delay to 10 seconds on the VLAN 1 interface.

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip ospf transmit delay 10 

Verify the settings by entering the show ip ospf interface command.

ip pim

Enable PIM on the interface for either sparse mode or dense mode operation. Use the no form of the command to disable the PIM function on the interface.

ip pim {sparse-mode | dense-mode}

no ip pim {sparse-mode | dense-mode}

Syntax Description

sparse-mode Enables sparse mode of operation.

dense-mode Enables dense mode of operation.

Default IP multicast routing is disabled on all interfaces.

Command Mode Interface configuration.

Usage Guideline This command is only valid for the VLAN interface.

Use this command to specify the PIM operating mode for an interface. The interface can be either operated in the sparse mode or the dense mode.

To switch the PIM operating mode please use no ip pim {sparse-mode | dense-mode} to disable PIM at first then set the new mode required. PIM needs to be disabled first since only one multicast routing protocol can be enabled on one interface. When the command ip pim dense-mode is issued, PIM dense mode will be configured on the interface. Therefore when the command ip pim sparse-mode is issued, attempting to execute sparse mode on the interface, the system will reply with an error message because PIM dense mode is already configured on that interface.

Enabling PIM on an interface also enables Internet Group Management Protocol (IGMP) operation on that interface.

Before the PIM function is enabled on an interface, enable IP multicast routing by issuing the command ip multicast-routing in global configuration mode.

Example This example shows how to enable PIM-SM protocol on a specified interface.

Switch(config)# interface vlan1
Switch(config-if)# ip pim sparse-mode 

Verify the settings by entering the show ip pim interface command.

ip pim accept-register

To configure a candidate rendezvous point (RP) router to filter PIM register messages, use the ip pim accept-register command in global configuration mode. To disable this function, use the no form of this command.

ip pim accept-register source-list ACCESS-LIST-NAME

no ip pim accept-register

Syntax Description

source-list ACCESS- Specifies the name of the basic IP access list name. LIST-NAME

Default Disabled

Command Mode Global configuration

Usage Guideline This command can be only specified once. The later applied command will override the previous setting. Use this command to prevent unauthorized sources from registering with the RP. If an unauthorized source sends a register message to the RP, the RP will immediately send back a register-stop message.

Example The following example shows how to restrict the RP from allowing sources in the Source Specific Multicast (SSM) range of addresses to register with the RP. These statements need to be configured only on the RP.

Switch# configure terminal
Switch(config)# ip access-list Summer-Movie
Switch(config-ip-acl)# deny any 232.0.0.0 255.0.0.0
Switch(config-ip-acl)# permit any any
Switch(config-ip-acl)# exit
Switch(config)# ip pim accept-register source-list Summer-Movie 

Verify the settings by the show ip pim command.

ip pim bsr-candidate

Use this command to configure the router to advertise itself as a candidate bootstrap router (BSR). Use the no form of this command to remove this router as a candidate for being a BSR.

ip pim bsr-candidate INTERFACE-ID [HASH-MASK-LENGTH] [PRIORITY]

no ip pim bsr-candidate

Syntax Description
INTERFACE-ID Interface ID, from which the BSR address is derived, in order to make it a candidate.
HASH-MASK-LENGTH	Configure hash mask length for RP selection. The range is 0 to 32. The mask (32 bits maximum) that is to be logically ANDed with the group address before the hash function is executed. All groups with the same seed hash (correspond) to the same RP. For example, if this value is 24, only the first 24 bits of the group addresses matter. Therefore one RP can be derived for multiple groups.
PRIORITY	Configure priority for a BSR candidate. The range is 0 to 255. The BSR with the larger priority is preferred. If the priority values are the same, the router with the larger IP address is the BSR.

Default The router is not a BSR candidate.

HASH-MASK-LENGTH: 30

Priority : 64.

Command Mode Global configuration

Usage Guideline This command is valid in the SM mode

This command causes the router to send bootstrap messages to all its PIM neighbors, with the address of the designated interface as the BSR address.

The following 2 conditions will cause BSR changes:

(1) Bootstrap Timer Expires
(2) Receive Preferred BSM.

In condition (1), the router is a Candidate-BSR, it will start to originate Bootstrap messages and perform the BSR election. For condition (2), the router will store the RP-Set from the preferred BSR.

Functionality of hash-mask is defined in RFC4601 4.7.2. The hash function is used by all routers within a domain, to map a group to one of the RPs from the matching set of group-range-to-RP mappings (all of this set has the same longest mask length and the same highest priority). The algorithm takes as input the group address, and the addresses of the candidate RPs from the mappings, and gives as output, one RP address to be used.

Example

The following example shows how to configure the IP address of the router on VLAN 1 to be a candidate BSR with hash-mask length of 20 and priority of 192:

Switch(config)# ip pim bsr-candidate vlan1 20 192
Switch(config)# 

Verify the settings by using the show ip pim command.

ip pim dr-priority

Use this command to change the Designated Router Priority value inserted into the DR Priority option of the PIM Hello message. Use default command to return the setting to default.

ip pim dr-priority PRIORITY

default ip pim dr-priority

Syntax Description

PRIORITY The value of DR priority in the range of 0 to 4294967295. A larger value of this argument means a higher priority.

Default PRIORITY: 1

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

This command is only effective for the SM mode.

When a DR is a candidate for election, the following conditions apply:

• The router with the highest priority value configured on an interface will be elected as the DR. If this priority value is the same on multiple routers, then the router with the highest IP address configured on an interface will be elected as the DR.
• If a router does not advertise a priority value in its hello messages, the router is regarded as having the highest priority and will be elected as the DR. If there are multiple routers with this priority status, then the router with the highest IP address configured on an interface will be elected as the DR.

Example The following example sets the DR priority of the vlan 1 interface to 200.

Switch(config)# interface vlan1
Switch(config-if)# ip pim dr-priority 200 

Verify the settings by entering the show ip pim interface command.

ip pim join-prune-interval

Use this command to configure a Join/Prune interval value different from the default (60 seconds).

ip pim join-prune-interval SECONDS

Syntax Description

SECONDS The number of seconds that can be configured for the interval between Join/Prune messages. The range is 1 to 18000.

Default 60 seconds

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

This command is valid for SM only.

When configuring the Join/Prune interval, the user needs to consider the factors, such as configured bandwidth and expected average number of multicast route entries for the attached network or link (for example, the period would be longer for lower-speed links, or for routers in the center of the network that expect to have a larger number of entries).

For SM-mode, the router will periodically send the join message based on this interval. The hold-time in a Join/Prune message is 3.5 * join-prune-interval. The receiving router will start a timer based on this hold-time, and prune the interface if no join message is received on this interface.

Example

The following example changes the PIM Join/Prune timer to 120 seconds.

Switch(config)# interface vlan1
Switch(config-if)# ip pim join-prune-interval 120 

Verify the settings by entering the show ip pim interface command.

ip pim prune-limit-interval

Use this command to configure the time interval for the prune limit timer to limit the Pruning rate on a LAN.

ip pim prune-limit-interval SECONDS

Syntax Description
SECONDS	Specifies the value of Prune Limit Timer (in seconds), which is used to prevent Prune storms on a LAN. The range is 1 to 18000.

Default 210 seconds

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

This command is valid for PIM-DM only.

This interval is used to configure prune-limit-timer which limits the Pruning rate on a LAN. It is only used when the Upstream(S,G) state machine is in the Pruned state. A Prune cannot be sent if this timer is running. This timer is normally set to default value 210 seconds.

Example The following example configures interface VLAN 1 with the PIM prune limit timer interval set to 120 seconds.

Switch(config)# interface vlan1
Switch(config-if)# ip pim prune-limit-interval 120 

Verify the settings by entering the show ip pim interface command.

ip pim query-interval

Use this command to configure the frequency of PIM hello message.

ip pim query-interval SECONDS

Syntax Description

SECONDS The number of seconds that can be configured for the interval between Hello messages. The range is 1 to 18000.

Default 30 seconds

Command Mode VLAN interface configuration

Usage Guideline This command is only valid for the VLAN interface.

This command is valid for both SM and DM.

A PIM router learns PIM neighbors via the hello message.

Routers configured for IP multicast send PIM hello messages to detect PIM routers. For SM, hello messages are also used to determine which router will be the designated router for each LAN segment.

If the router has interfaces operating in the SM mode, the designated router will send Registration messages to the rendezvous point (RP).

Example The following example changes the PIM hello interval to 45 seconds.

witch(config)# interface vlan1
Switch(config-if)# ip pim query-interval 45

Verify the settings by entering the show ip pim interface command.

ip pim register-checksum-include-data

Use this command to configure the option to calculate the Register checksum over the whole packet. Use the no form of this command to disable calculating the Register checksum over the whole packet.

ip pim register-checksum-include-data { group-list ACCESS-LIST-NAME}

no ip pim register-checksum-include-data

Syntax Description

group-list	Specifies the name of the basic IP access list name
ACCESS-LIST-NAME

Default Disabled

By default, the Register Checksum is calculated only over the header.

Command Mode Global configuration

Usage Guideline	This command is valid for SM mode and used to provide compatible interoperability with other manufacturer devices per the following:
	This command is used to inter-operate with some legacy CISCO® manufactured routers using older CISCO® IOS^TM versions. This command is needed for the first hop router for encapsulation of the register packet. This function needs to be enabled in order to inter-operate with legacy CISCO® devices using older IOS^TM versions.
	If group-list is not specified, then the setting will be applied to all groups.
	This command can be only specified once. The later applied command will override the previous setting.
Example	The following example shows how to enable register checksum over whole packet.

Switch(config)# ip pim register-checksum-include-data

Verify the settings by using the show ip pim command.

ip pim register-suppression

Use this command to configure the register-suppression time.

ip pim register-suppression SECONDS

Syntax Description

SECONDS Register suppression time-out value in seconds. The range is 11 to 255.

Default 60 seconds

Command Mode Global configuration

Usage Guideline This command is valid for SM mode.

When a DR receives the register-stop message, it will start the suppression timer. During the suppression time a DR will stop sending Register-encapsulated data to the RP.

This timer should be configured on the designated router.

Note: the parameter Register Probe Time in RFC 4601 is fixed to 5 (not configurable). It is fixed to 5 because the value of the Register Probe Time must be less than half the value of the Register Suppression Time to prevent a possible negative value in the setting of the Register-Stop Timer. The minimal value for Register Suppression Time is 11.

Example

This example shows how to configure the register-suppression time to 30 seconds.

Switch(config)# ip pim register-suppression 30

Verify the settings by the show ip pim command.

ip pim rp-address

Use this command to statically configure the rendezvous point (RP) address for multicast groups. To remove an RP address, use the no form of this command.

ip pim rp-address IP-ADDRESS [group-list ACCESS-LIST-NAME] [override]

no ip pim rp-address IP-ADDRESS

Syntax Description
IP-ADDRESS IP address of a router to be a PIM RP.
group-list ACCESS-LIST-NAME	(Optional) Specifies the name of multicast ACCESS-LIST for which multicast groups that the RP should use.If the access-list is not specified, the default multicast group is 224.0.0.0/4.
override (Optional) When there is a conflict between static RP configuration and the information learned by BSR, static RP configuration has the higher priority than the BSR learned information.

Default None

Command Mode Global configuration

Usage Guideline This command is only valid for SM mode.

Use this command to statically define the RP address for multicast groups that are to operate in sparse mode.

A User can use a single RP for more than one group. The conditions specified by the access list determine which groups that the RP can use. A PIM router can define multiple RPs, but only one RP can be defined per multicast group.

To configure the static-RP function in the PIM SM domain, this command needs to be configured across all of the routers in the PIM domain.

Multiple RP addresses can be specified by the command. Only one access-list can be specified for an RP. The new setting overrides the old one.

Example The following example sets the PIM RP address to 10.90.90.90 for multicast group 225.2.2.2 only:

Switch(config)# ip access-list PIM-Control
Switch(config-ip-acl)# permit any host 225.2.2.2
Switch(config-ip-acl)# exit
Switch(config)# ip pim rp-address 10.90.90.90 group-list PIM-Control 

Verify the settings by using the show ip pim command.

ip pim rp-candidate

Use this command to configure the router as an RP candidate. Use the no form of this command to remove the router as a candidate RP.

ip pim rp-candidate INTERFACE-ID [ group-list ACCESS-LIST-NAME ] [interval SECONDS] [priority PRIORITY]

no ip pim rp-candidate [INTERFACE-ID]

Syntax Description
INTERFACE-ID	Specifies the interface ID. The IP address associated with this interface is advertised as a candidate RP address.
group-list ACCESS-LIST-NAME	(Optional) Specifies the name of the multicast access list that defines the group prefixes that are advertised in association with the RP address. If no group-list is specified, the switch is a candidate RP for all groups.
interval SECONDS	(Optional) Indicates the RP candidate advertisement interval. The range is from 1 to 16383 seconds. The default value is 60 seconds.
priority PRIORITY	(Optional) Indicates the RP priority value. The range is from 0 to 255. The default value is 192.

Default The router is not an RP candidate by default.

interval: 60 seconds

priority: 192

Command Mode Global configuration

Usage Guideline This command is valid for SM mode.

Only one group access list can be specified for the command.

The command can be applied multiple times, each for a different interface.

This command causes the router to send a PIM Version 2 message advertising itself as a candidate RP to the BSR.

Use this command only in backbone routers that have good connectivity to all parts of the PIM domain. That is, a stub router that relies on an on-demand dialup link to connect to the rest of the PIM domain is not a good candidate RP.

Example The following example (on the next page) shows how to configure the router to advertise itself as a candidate RP to the BSR in its PIM domain. A basic IP access list, named PIM-Control, which specifies the group prefix (239.0.0.0/8), is

associated with the RP that has the address identified by VLAN interface 1 and with priority 3.

Switch(config)# ip access-list PIM-Control
Switch(config-ip-acl)# permit any 239.0.0.0 255.0.0.0
Switch(config-ip-acl)# exit
Switch(config)# ip pim rp-candidate vlan1 group-list PIM-Control priority 3 

Verify the settings by using the show ip pim command.

ip pim state-refresh origination-interval

Configure a PIM-DM State-Refresh origination interval different from the default value (60 seconds). The origination interval is the number of seconds between PIM-DM State Refresh control messages.

ip pim state-refresh origination-interval SECONDS

Syntax Description

SECONDS The number of seconds that can be configured for the interval between state-refresh messages. The range is 4 to 100.

Default 60 seconds

Command Mode Interface configuration

Usage Guideline This command is valid for the DM mode.

Configure this command on the first hop, PIM dense mode routers that are directly connected to sources for PIM-DM multicast groups.

The purpose of this message is to reduce overhead spent on the cycle in flooding and pruning of traffic. For each state-refresh origination interval, the first-hop router will initiate this message and send it to the down-stream hops. Thus, the down-stream routers can do an action similar to prune. On receiving this prune, the upstream will refresh the Prune timer, and thus not flood the traffic to the corresponding interfaces.

Example The following example sets the State Refresh Origination Interval to 100 seconds.

Switch(config)# interface vlan1
Switch(config-if)# ip pim state-refresh origination-interval 100

Verify the settings by entering the show ip pim interface command.

ip rip authentication key-chain

Use this command to enable authentication for RIP Version 2 packets and to specify the key that can be used on an interface. To prevent authentication, use the no form of this command.

ip rip authentication key-chain NAME-OF-KEY

no ip rip authentication key-chain

Syntax Description

NAME-OF-KEY Enables authentication and specifies the key that are valid.

Default No authentication is provided for RIP packets.

Command Mode Interface configuration

Usage Guideline

If no key is configured with the key-chain command, no authentication is performed on the interface.

This command also specifies that the interface will use the key chain for authentication.

Example

The following example configures a key chain named chain1. Key1 named "forkey1string" will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key3 named "forkey3string" will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config-router)# exit
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit 

Verify the settings by entering the show ip protocols rip command.

ip rip authentication mode

To configure the type of authentication used in Routing Information Protocol (RIP) Version 2 packets, use the ip rip authentication mode command in interface configuration mode. Use the no form of the command to disable the authentication function.

ip rip authentication mode { text | md5 }

no ip rip authentication mode

Syntax Description

text Clear text authentication.

md5 Keyed Message Digest 5 (MD5) authentication.

Default Clear text authentication (text)

Command Mode Interface configuration

Usage Guideline	Only VLAN interfaces at which IP addresses are configured are valid interfaces for this command.
	RIP Version 1 does not support authentication. This command only affects RIPv2.
Example	The following example shows how to configure the authentication mode of the interface to md5 at interface VLAN 2:

Switch(config)# interface vlan2
Switch(config-if)# ip rip authentication mode md5 

Verify the settings by entering the show ip rip interface command.

ip rip receive version

Use this command to specify a RIP version to receive on each interface. Use the no form of the command to let the version follow the setting specified in the router configuration mode.

ip rip receive version VERSION-ID [, | - ]

no ip rip receive version

Syntax Description

VERSION-ID

The Version ID can be either 1 or 2. That is RIP accepts only RIP Version 1 packets on the interface or accepts only RIP Version 2 packets on the interface. It also can be a list of version IDs such as 1,2 (or 1-2), meaning that both RIP Version 1 and Version 2 packets are acceptable on the RIP enabled interface.

Default Global RIP version receive setting

Command Mode Interface configuration

Usage Guideline This command applies only to the interface being configured.

Examples

The following example shows how to configure interface (VLAN 1) to accept both RIP Version 1 and Version 2 packets:

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip rip receive version 1-2
Switch(config-if)# end 

The following example shows how to configure the interface (VLAN 1) to only accept RIP Version 1 packets:

Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ip rip receive version 1
Switch(config-if)# end 

Verify the settings by entering the show ip rip interface command.

ip rip send version

Use this command to specify a RIP version to send on an interface basis. Use the no form of the command to let the version following the setting specified in the router configuration mode.

ip rip send version VERSION-ID [, | - ]

no ip rip send version

Syntax Description
VERSION-ID	The RIP Version ID can be either 1 or 2. That is, send out only RIP Version 1 packets on the interface or send out only RIP Version 2 packets on the RIP enabled interface. It also can be a list of version IDs such as 1,2 (or 1-2) meaning that both RIP Version 1 and Version 2 packets can be sent out from the RIP enabled interface.

Default Global RIP version transmitt setting

Command Mode Interface configuration

Usage Guideline This command applies only to the interface being configured.

Examples The following example shows how to configure the interface (VLAN 100) to send both RIP Version 1 and Version 2 packets:

Switch# configure terminal
Switch(config)# interface vlan100
Switch(config-if)# ip rip send version 1,2
Switch(config-if)# end

The following example shows how to configure the interface (VLAN 100) to send only RIP Version 2 packets:

Switch# configure terminal
Switch(config)# interface vlan100
Switch(config-if)# ip rip send version 2
Switch(config-if)# end

Verify the settings by entering the show ip rip interface command.

ip rip v2-broadcast

Use this command to allow Routing Information Protocol (RIP) Version 2 update packets to be sent as broadcast packets instead of multicast packets, Use the no form of the command to go back to multicast sending of the packet.

ip rip v2-broadcast

no ip rip v2-broadcast

Syntax None

Default Disabled

The RIPv2 update packets are to be sent as multicast packets.

Command Mode Interface configuration

Usage Guideline

Use the ip rip v2-broadcast command to broadcast RIP Version 2 broadcast updates to hosts that do not listen to multicast broadcasts. Version 2 updates (requests and responses) will be sent to the IP broadcast address (e.g. 10.70.89.255) instead of the IP multicast address 224.0.0.9.

In order to reduce unnecessary load on those hosts that are not listening to RIP Version 2 broadcasts, the system uses an IP multicast address for periodic broadcasts. The IP multicast address is 224.0.0.9.

This command applies only to the interface being configured.

Example

The following example shows how to configure the interface (VLAN 100) to broadcast Version 2 RIP packets:

Switch# configure terminal
Switch(config)# interface vlan100
Switch(config-if)# ip rip send version 2
Switch(config-if)# ip rip v2-broadcast
Switch(config-if)# end

Verify the settings by entering the show ip rip interface command.

ip route

Use ip route to add a static route entry. Use the no form of the command to remove a static route entry.

ip route {NETWORK-PREFIX NETWORK-MASK | NETWORK-PREFIX/PREFIX-LENGTH} IP-ADDRESS [distance DISTANCE]

no ip route {NETWORK-PREFIX NETWORK-MASK | NETWORK-PREFIX/PREFIX-LENGTH} [IP-ADDRESS]

Syntax Description
NETWORK-PREFIX NETWORK-MASK	The network prefix and the network mask specify the destination network.
NETWORK-PREFIX/PREFIX-LENGTH	The network prefix and the prefix length specify the destination network.
IP-ADDRESS IP address of the next hop that can be used to reach destination network.
distance DISTANCE (Optional) An administrative distance. The default administrative distance for a static route is 1. The range of distance is 1 to 255. The lower value represents a better route.

Default No static routes are configured.

Command Mode Global configuration

Usage Guideline

When an administrative distance is specified, it flags a static route that can be overridden by dynamic information.

When the NETWORK -PREFIX is 0.0.0.0 and the NETWORK -MASK is 0, then the command will create a static default route.

The distances of routes are used in the following ways:

In single path mode, the route with the best distance will be the active route if multiple routes can reach the same destination. If multiple routes are equidistant, then one of them must be chosen as the active route.

For the single path mode, the route with the best distance and route type is selected as the primary, (active path) the other distances are available as backup paths. The active path is always considered the path with the best route type selected from the reachable paths with the best distance.

Examples This example shows how to add static default route entry with next-hop 10.1.1.254:

Switch(config)# ip route 0.0.0.0/0 10.1.1.254

Verify the settings by entering the show ip route command.

ip route multi-path

Use ip route multi-path to enable multiple paths for same route. Use the no form of the command to disable multiple paths.

ip route multi-path

no ip route multi-path

Syntax None Description

Default Enabled

Command Mode Global configuration

Usage Guideline If there are multiple routes with the same network-prefix co-existing, specify the route operation mode (multi-path or not) to select the routes that will be active.

For the no command, it disables the multiple path function. Only one of the multiple paths will be active.

Note: The active path may change from one path to the other under multiple paths mode, as long as the available route with a greater priority becomes reachable.

Examples This example shows how to enable multiple paths function.

Switch(config)# ip route multi-path 

This example shows how to disable multiple paths function.

Switch(config)# no ip route multi-path 

Verify the settings by entering the show ip route summary command.

ip ssh

Use this command to configure Secure Shell (SSH) control parameters or enable the SSH service on the switch. Use the no ip ssh command to disable the SSH service.

ip ssh [ timeout SECONDS | authentication-retries NUMBER | service-port TCP-PORT]

no ip ssh

Syntax Description
timeout SECONDS	(Optional) The time interval that the switch waits for the SSH client to respond. The range is 120-600. The SSH session will be closed when the session has been idle for this timeout period.
authentication-retries NUMBER	(Optional) The number of authentication attempts after which the session is reset or authentication failed. The range is 2-20.
service-portTCP-PORT	Optional) Specifies the service port, such as TCP port 22, to which Secure Shell (SSH) needs to connect. TCP ports are numbered between 1 and 65535.

Default Initial SSH service: Disabled

timeout: 120 seconds.

Maximum authentication retries: 3

service port: 22

Command Mode Global configuration

Usage Guideline

The command configures Secure Shell (SSH) server parameters on the switch.

The idle timer ("timeout" option) is refreshed when the SSH client sends the message to the server. When the idle timer expires and the SSH server does not receive any messages from the client, the session will be released.

The SSH server can be configured with extra authentication retries for setting up an SSH session. The connection will be failed when the number of authentication attempts equals the maximum number of authentication attempts (retries) allowable.

Examples This example shows how to enable the SSH service.

Switch# configure terminal
Switch(config)# ip ssh

This example shows how to set the SSH timeout to 160 seconds.

Switch# configure terminal
Switch(config)# ip ssh timeout 160

This example shows how to set the number of SSH authentication-retries to 2. The connection will be failed when the number of authentication retries reaches 2 tries without success.

Switch# configure terminal
Switch(config)# ip ssh authentication-retries 2 

This example shows how to change the service-port to 3000. The SSH client must connect using this service port number.

Switch# configure terminal
Switch(config)# ip ssh service-port 3000

Verify the settings by entering the show ip ssh command.

ip telnet server

Use this command to enable the TELNET server function. Use the no form of the command to disable the TELNET server function.

ip telnet server

no ip telnet server

Syntax None

Default Enabled

Command Mode Global configuration

Usage Guideline

Telnet is a network protocol used on the Internet or local area networks to provide a general bidirectional interactive communications facility. Using the Telnet protocol, users can control a device, through a TCP connection which transmits data in plain text.

This command is used to enable/disable the IP TELNET server function. The SSH access interface is separated controlled through SSH commands.

Example This example shows how to enable telnet server function.

Switch(config)# ip telnet server

Verify the settings by entering the show system protocol-state command.

ip telnet service-port

Use this command to specify the service port for the TELNET server. Use the default command to return the service port to 23.

ip telnet service-port TCP-PORT

default ip telnet service-port

Syntax Description
TCP-PORT	The TCP port number. TCP ports are numbered between 1 and 65535. The well-known TCP port for the TELNET protocol is 23.

Default TCP-PORT 23

Command Mode Global configuration

Usage Guideline This command configures the TCP port number for the TELNET server. The Telnet server listens on port number 23 for connection requests in the default configuration.

Example This example shows how to change the service port to 3000.

Switch(config)# ip telnet service-port 3000

Verify the settings by entering the show system protocol-state command.

ip trusted-host

Use this command to create the trusted host entries on the switch. Use the no ip trusted-host command to remove the trusted host entries.

ip trusted-host {IP-ADDRESS / NETWORK-ADDRESS/PREFIX-LENGTH} [snmp] [http] [telnet]]

no ip trusted-host [IP-ADDRESS | NETWORK-ADDRESS/PREFIX-LENGTH] [snmp] [http] [telnet]

Syntax Description

IP-ADDRESS IPv4 address of the trusted host.
NETWORK-	IPv4 network of the trusted host.
ADDRESS/PREFIX-
LENGTH
snmp (Optional) Specifies that the host is valid for snmp.
http (Optional) Specifies that the host is valid for http.
telnet (Optional) Specifies that the host is valid for telnet.

Default No default hosts

Command Mode Global configuration at privilege level 15.

Usage Guideline

The ip-trusted host command creates the trusted host entries with access to the management interface. When a trusted-host is not configured, then all hosts are trusted. When adding a trusted-host, if the access interface (snmp, http, or telnet) is not specified, then it applies to all interfaces.

Once a trusted-host is configured with an access interface allowed, then only the configured trusted-hosts are allowed access to the access interfaces associated with their entry. If an access interface is not specified in the trusted-host list, then all access to that access interface will be blocked.

The number of trusted hosts is project dependent.

For the no command, when the host is not specified, all hosts will be deleted for the specified access interface. If no access interface is specified, the specified host will be deleted for all access interfaces. If both the host and access interface are not specified, all trusted hosts will be deleted.

Examples

This example shows how to add a trusted host with IP address 163.10.50.126 to snmp access interface.

Switch(config)# ip trusted-host 163.10.50.126 snmp

This example shows how to remove the trusted host with IP address 163.10.50.126 for all access interfaces.

Switch(config)# no ip trusted-host 163.10.50.126

You can verify your settings by entering the show ip trusted-host command.

ipv6 access-group

Use the ipv6 access-group command to specify the IPv6 access-list to be applied to an interface. Use the no form of the command to remove an IPv6 access list.

Ipv6 access-group NAME [in]

no ipv6 access-group NAME [in]

Syntax Description
NAME	The name of the IPv6 access-list to be applied. Up to 32 characters are allowed. The syntax is a general string that does not allow spaces.
in	(Optional) Specifies that the IPv6 access-list will be applied in the ingress direction. If no option is specified, the in direction is applied.

Default None

Command Mode Interface configuration

Usage Guideline

Up to one MAC access-list, one IP access-list and one IPv6 access-list can be applied to the same interface. An error message will be displayed if the user attempts to apply the second IPv6 access list.

The IPv6 access list must be created before it can be applied to the interface. Otherwise, an error message will be displayed.

The keyword in specifies the ingress direction check.

The association of an access-group with an interface will consume the filtering entry resource of the switch controller. If the command is applied successfully, the number of remaining maximum entries will be displayed. If the rule of the access-group contains port operator, gt/lt operator, the number of remaining port operators will be displayed. If the resources are insufficient to commit the command, an error message will be displayed.

There is limitation on the number of port operator resources. The maximum number is project dependent.

If the commit, of the command, will exceed the maximum number of available port selectors, an error message will be displayed.

An access-group is applied to the interface, which will consume the filter entry resource. When the access-group is applied successfully, the number of remaining filter entry resource will be displayed. If the access-group were using a port operator (for example: gt/lt) for the rule, it will display the number of remaining port operator resource.

If the remaining resources of filter entry or port operator is insufficient, an error message will display when the access-group is applied.

Example

This example shows how to specify the IPv6 access-list ip6-control as an IPv6 access group for eth3.3

Switch(config)# interface eth3.3
Switch(config-if)#ipv6 access-group ip6-control in 

Verify the settings by entering show access-group.

ipv6 access-list

Use this command to create or modify an IPv6 access list. This command will enter into the ipv6 access-list configuration mode. Use the no form of the command to remove an IPv6 access-list.

ipv6 access-list extended NAME

no ipv6 access-list extended NAME

Syntax Description
NAME	The name of the IPv6 access-list to be configured. A maximum of 32 characters.The syntax is a general string that does not allow spaces.

Default No IPv6 access list is defined.

The access list defaults to an implicit deny statement for all traffic.

Command Mode Global configuration

Usage Guideline

The name must be unique among all (including MAC, IP, and IPv6) access-lists. The characters are case sensitive.The maximum number of IPv6 access-list supported by the system is project dependent.An error message will appear if the allowed number is exceeded after the execution of the command.An IPv6 access list can not be deleted if it is applied to interfaces.The access list is always terminated by an implicit deny statement for all traffic.

Examples

This example shows how to configure an IPv6 extended access-list, named ip6-control.

Switch(config)#ipv6 access-list extended ip6-control
Swtich(config-ipv6-ext-acl)#permit tcp any 2002:f03::1 ffff::
Switch(config-ipv6-ext-acl)# 

This example shows how configure an IPv6 extended access-list, named ip6-std-control.

Switch(config)#ipv6 access-list extended ip6-std-control
Swtich(config-ipv6-ext-acl)#permit tcp any fe80::101:1 ffff:ffff:ffff::
Switch(config-ipv6-ext-acl)# 

Verify the settings by entering the show access-list command.

ipv6 address

This command is used to assign the IPv6 address to an interface of the switch. The no form of this command deletes the IPv6 address assigned to the interface.

ipv6 address X:X::X:X/M

no ipv6 address [X:X::X:X/M]

Syntax Description

X:X::X:X/M IPv6 network address. This argument must be in the form documented in RFC2373 where the address is specified in hexadecimal format using a 16-bit value between colons.

X:X::X:X: IPv6 address

M: IPv6 prefix length, maximum length is 64.

Default None

Command Mode VLAN interface configuration

Usage Guideline

The VLAN interface must be created first. If IPv6 is disabled, it will be enabled after the IPv6 address is configured. When using the no ipv6 address command without other parameters, it removes all ipv6 global addresses configured on this interface.

Example This example shows how to add an IPv6 address to a VLAN interface:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 address 3ffe:501:ffff:0:a01:2ff:fe39:1/64
Switch (config-if) # 

ipv6 address

This command is used to add or delete an IPv6 address to an interface. The address is configured using an IPv6 general prefix and when set it enables IPv6 processing on the interface. To remove the address from the interface, use the no form of this command.

ipv6 address { IPV6-ADDRESS/PREFIX-LENGTH | PREFIX-NAME SUB-BITS/PREFIX-LENGTH }

no ipv6 address { IPV6-ADDRESS/ PREFIX-LENGTH | PREFIX-NAME SUB-BITS/ PREFIX-LENGTH }

Syntax Description
IPV6-ADDRESS The IPv6 address to be used.
PREFIX-LENGTH	The length of the IPv6 prefix. A decimal value that indicates how many of the high-order contiguous bits of the address comprise the prefix (the network portion of the address). A slash mark must precede the decimal value.The maximum prefix length can not exceed 64.
PREFIX-NAME	A general prefix, which specifies the leading bits of the network to be configured on the interface. The general prefix name can be 1-16 characters.
SUB-BITS The subprefix bits and host bits of the address to be concatenated with the prefixes provided by the general prefix.Note:The general prefix is specified using the PREFIX-NAME argument above.The SUB-BITS argument must be in the form documented in RFC2373 where the address is specified in hexadecimal using 16-bit values between colons.

Default No IPv6 addresses are assigned to the interface.

Command Mode Interface configuration

Usage Guideline

The ipv6 address command allows multiple IPv6 addresses to be configured on an interface in a variety of forms with varying options. The most common way is to specify the IPv6 address with the prefix length.

Addresses may also be defined using the general prefix mechanism, which separates the aggregated IPv6 prefix bits from the subprefix and host bits. In this case, the leading bits of the address are defined in a general prefix, which is globally configured or learned (for example, through use of DHCP-PD), and then applied using the prefix-name argument. The subprefix bits and host bits are defined using the sub-bits argument.

Examples

The following example shows how to enable IPv6 processing on the interface and configure an address based on the general prefix called my-prefix and the directly specified bits:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan2
Switch (config-if) # ipv6 address my-prefix 0:0:0:1::1/64 

Assuming the general prefix named my-prefix has the value of 3ffe:1:2::/48, then the interface would be configured with the global address: 3ffe:1:2:1::1/64. If no general prefix named my-prefix is set, then no IPv6 address will be set.

If the general prefix named my-prefix is an acquired through a DHCPv6 Client prefix delegation, then the global address would be configured after the prefix is received from the DHCPv6 Client.

The following example shows how to remove a general prefix named my-prefix on the interface:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan2
Switch (config-if) # no ipv6 address my-prefix 0:0:0:1::1/64 

The following example shows how to manually configure a global address:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan2
Switch (config-if) # ipv6 address 3ffe:22:22:22::2/64 

After the command is entered, the global address 3ffe:22:22:22::2/64 will be immediately set.

The following example shows how to manually remove a global address from the configuration:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan2
Switch (config-if) # no ipv6 address 3ffe:22:22:22::2/64 

After the command is entered, the global address 3ffe:22:22:22::2/64 will be immediately removed.

ipv6 address (management port)

Use this command to set the IPv6 address of the Management Port. Use the no form of this command to set the IPv6 address of the Management Port to the default value.

ipv6 address IPv6-ADDRESS/PREFIX-LENGTH

no ipv6 address

Syntax Description

IPv6-ADDRESS IPv6 address, X:X::X:X

PREFIX-LENGTH Prefix Length.

Default

Default IPv6 address is: ::/0.

Command Mode Management interface configuration

Usage Guideline

Users can manage the system by accessing this IPv6 address. Use the no ipv6 address command to restore the default IPv6 address

Example This example shows how to set 2000::1/64 as the IPv6 address of the Management Port.

Switch (mgmt-if) #
Switch (mgmt-if) #ipv6 address 2000::1/64 

Verify the settings by entering the show mgmt-if command

ipv6 default-gateway (management port)

Use this command to set the IPv6 address of the IPv6 default gateway that is used by the management port. Use the no form of this command to set the IPv6 default gateway to the default value.

ipv6 default-gateway IPv6-ADDRESS

no ipv6 default-gateway

Syntax Description

IPv6-ADDRESS IPv6 address, X:X::X:X

Default Empty

Command Mode Management interface configuration

Usage Guideline

The management port will send out IPv6 packets destined for other IP subnets using this IPv6 address as the gateway router.

Example This example shows how to set 2000::2 as the IPv6 address of the default gateway.

Switch(mgmt-if)#ipv6 default-gateway 2000::2
Switch(mgmt-if)# 

Verify the settings by entering the show mgmt-if command

ipv6 dhcp client information refresh minimum

To configure the minimum acceptable refresh time of the DHCPv6 client information on a specified interface. To remove the configured refresh time, use the no form of this command.

ipv6 dhcp client information refresh minimum SECONDS

no ipv6 dhcp client information refresh minimum

Syntax Description

SECONDS The refresh time, in seconds. The minimum value that can be used is 600 seconds, and the maximum value can be 65535 seconds.

Default Unlimited

Command Mode Interface configuration

Usage Guideline

The ipv6 dhcp client information refresh minimum command specifies the minimum acceptable refresh time of the DHCPv6 client information. If the server sends an information refresh time option of less than the configured minimum refresh time, the configured minimum refresh time will be used instead.

This command may be configured in several situations:

• In unstable environments where unexpected changes are likely to occur.
• For planned changes, including renumbering, an administrator can gradually decrease the time as the planned event nears.
• Limit the amount of time before new services or servers are available to the client, such as the addition of a new Simple Network Time Protocol (SNTP) server or a change of address for a Domain Name System (DNS) server.

Setting ipv6 dhcp client information refresh minimum or no ipv6 dhcp client information refresh minimum will not enable or disable the DHCPv6 client prefix delegation function.

Example The following example configures a maximum of 2 hours before the DHCPv6 client information will be refreshed:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp client information refresh minimum 7200 

ipv6 dhcp client pd

This command enables a specified IPv6 interface's DHCP client process and it enables the request for prefix delegation through the same interface. To disable requests for prefix delegation, use the no form of this command.

ipv6 dhcp client pd { PREFIX-NAME | hint IPV6-PREFIX } [ rapid-commit ]

no ipv6 dhcp client pd

Syntax Description
PREFIX-NAME	IPv6 general prefix name. The prefix name will be associated with general prefix-name setting of an interface. The general prefix name can be 1-16 characters.
hint An IPv6 prefix sent as a hint.
IPv6-PREFIX	IPv6 general prefix. It will be filled in the Solicit message to request an IPv6 prefix.
rapid-commit	(Optional) Allow two-message exchange method for prefix delegation. The rapid-commit option will be filled in the Solicit message to request two message handshaking.

Default The prefix delegation is disabled.

Command Mode Interface configuration

Usage Guideline

If DHCPv6 is not running yet, executing the ipv6 dhcp client pd command starts the DHCPv6 protocol for an IPv6 client process. Use no ipv6 dhcp client pd to disable the DHCPv6 client.

Further, the ipv6 dhcp client pd command enables request for prefix delegation on the interface where this command is configured. When prefix delegation is enabled and a prefix is successfully acquired, the prefix is stored in the IPv6 general prefix pool with an internal name defined by the IPV6-PREFIX argument. Other commands and applications (such as the ipv6 address command) can then refer to the prefixes in the general prefix pool.

The hint keyword with the IPV6-PREFIX argument enables the configuration of an IPv6 prefix. That prefix will be included in DHCHv6 solicit and request messages sent by the interface's IPv6 client DHCP. The included prefixes, in the messages, are sent as a hint for the prefix-delegating routers. Only one prefix can be configured for each delegation hint request message.

Re-configuring prefix hint will change the hint setting, and setting no ipv6 dhcp client pd will clear the prefix hint option. Care should be taken in setting the hint option as it will not enable DHCPv6 client prefix delegation function.

The rapid-commit keyword enables the use of the two-message exchange protocol for prefix delegation and other settings. If it is enabled, the client will include the rapid commit option in a solicit message.

The DHCP for IPv6 client, server, and relay functions are mutually exclusive on an interface.

Examples

The following example enables prefix delegation, where dhcp-prefix is the general prefix name configured by ipv6 address command.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan2
Switch (config-if) # ipv6 address dhcp-prefix 0:0:0:7272::72/64
Switch (config-if) # exit
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp client pd dhcp-prefix 

The following example configures a hint for prefix-delegation.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp client pd hint 2001:0DB8:1::/48 

The following example configures a rapid-commit delegation.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp client pd dhcp-prefix rapid-commit 

The following example configures a delegation with hint prefix and rapid-commit simultaneously.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp client pd hint 2001:0DB8:1::/48
Switch (config-if) # ipv6 dhcp client pd dhcp-prefix rapid-commit 

ipv6 dhcp relay destination

These commands are used to enable or disable the DHCP relay function.

ipv6 dhcp relay destination IPV6-ADDRESS [VLAN-INTERFACE]

no ipv6 dhcp relay destination

Syntax Description

IPV6-ADDRESS Relay destination address.

This argument must be in the form documented in RFC 2373 where the address is specified in hexadecimal using 16-bit values between colons.

VLAN-INTERFACE Relay to which VLAN-interface.

Valn-interface specifies output interface for a destination. If this argument is configured, client messages are forwarded to the destination address through the link to which the output interface is connected.

Default DHCP relay: Disabled

IPV6-ADDRESS: None

VLAN-INTERFACE: NULL.

Command Mode Interface configuration

Usage Guideline

The ipv6 dhcp relay destination command specifies a destination address to which client messages are forwarded and it enables DHCP for IPv6 relay service on the interface. When relay service is enabled on an interface, a DHCP for IPv6 message received on that interface will be forwarded to all configured relay destinations. The incoming DHCP for IPv6 message may have come from a client on that interface, or it may have been relayed by another relay agent.

The relay destination can be a unicast address of a server or another relay agent, or it may be a multicast address. The following are the two types of relay destination addresses:

• A link-scoped unicast or multicast IPv6 address, for which, a user must specify an output interface
• A global or site-scoped unicast or multicast IPv6 address, for which, a user CANNOT specify the output interface. The output interface will be determined by routing table.

If no output interface is configured for a destination, the output interface is determined by routing tables. In this case, it is recommended that a unicast or multicast routing protocol be running on the router. Multiple destinations can be configured on one interface, and multiple output interfaces can be configured for one destination. When the relay agent relays messages to a multicast address, it sets the hop limit field in the IPv6 packet header to 32.

Unspecified, loopback and node-local multicast addresses are not acceptable as the relay destination. If any one of them is configured, the message "Invalid destination address" is displayed.

Note that it is not necessary to enable the relay function on an interface for it to accept and forward an incoming relay reply message from servers. By default, the relay function is disabled, and there is no relay destination on an interface. The no form of the command removes a relay destination on an interface or deletes an output interface for a destination. If all relay destinations are removed, the relay service is disabled on the interface.

DHCP for the IPv6 client, server, and relay functions is mutually exclusive on an interface. When one of these functions is already enabled and a user tries to configure a different function on the same interface, one of the following messages is displayed: "Interface is in DHCP client mode," "Interface is in DHCP server mode," or "Interface is in DHCP relay mode."

One VLAN interface only can be configured to one DHCP relay server.

Example

This example shows how to sets the relay destination server address on vlan1:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 dhcp relay destination FE80::250:A2FF:FEBF:A056 vlan2 

This example shows how to disable relay agent on vlan1

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # no ipv6 dhcp relay destination 

ipv6 enable

This command is used to enable and disable the IPv6 protocol on an interface of the switch. The no form of this command can disable the IPv6 protocol.

ipv6 enable

no ipv6 enable

Syntax None

Default Disabled.

Command Mode VLAN interface configuration

Usage Guideline

The interface must be created before the ipv6 enable command is executed. When the interface up, ipv6 enable will also add a link-local address to the interface and remove it when using the no form of the command. This means that when using ipv6 enable, depending whether the interface is up or down, the command will add or delete the link-local address respectively.

Example This example shows how to enable the IPv6 protocol:

Switch> enable
Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# ipv6 enable
Switch(config-if)# 

ipv6 hop-limit

This command is used to configure the IPv6 hop limit setting for an interface of this switch. The no form of this command resets the IPv6 hop limit to the default value.

ipv6 hop-limit <0-255>

no ipv6 hop-limit

Syntax Description

<0-255>

The IPv6 hop limit range, "0" means not specified on this interface and to use the default value to send a packet.

Default Hop limit: 64

Command Mode VLAN interface configuration

Usage Guideline The VLAN interface must be created first before this command can be used.

Example This example shows how to configure IPv6 hop limit setting:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 hop-limit 255
Switch (config-if) # 

ipv6 nd managed-config-flag

This command is used to turn on the IPv6 RA (router advertisement) management configure flag setting on an interface of this switch. The no form of this command turns off this flag.

ipv6 nd managed-config-flag

no ipv6 nd managed-config-flag

Syntax None

Default Off

Command Mode VLAN interface configuration

Usage Guideline The VLAN interface must be created first before this command can be used.

Example This example shows how to configure IPv6 manage config flag setting:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd managed-config-flag
Switch (config-if) # 

ipv6 nd other-config-flag

This command is used to turn on the IPv6 RA (router advertisement) other configure flag incidence per interface on this switch. The no form of this command turns off this flag.

ipv6 nd other-config-flag

no ipv6 nd other-config-flag

Syntax None

Default other configure flag: off

Command Mode VLAN interface configuration

Usage Guideline The VLAN interface must be created first before this command can be used.

Example This example shows how to configure IPv6 other configure flag incidence:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd other-config-flag
Switch (config-if) # 

ipv6 nd prefix

This command is used to add or modify IPv6 prefix information to RA (router advertisement) for an interface of this switch. If the prefix already exists, then the command modifies the parameter. The no form of the command removes it.

ipv6 nd prefix X:X::X:X/M <0-4294967295> <0-4294967295> [off-link | no-autoconfig]

no ipv6 nd prefix X:X::X:X/M

Syntax Description

X:X::X:X/M IPv6 network address. This argument must be in the form documented in RFC2373 where the address is specified in hexadecimal format using a 16-bit value between colons.

X:X::X:X: IPv6 address

M: IPv6 prefix length

<0-4294967295> Valid life time in seconds.

<0-4294967295> Preferred lifetime in seconds.

off-link Turn off on-link flag.

no-autoconfig Turn off autoconfig flag.

Default 0-4294967295: 2592000

0-4294967295: 604800

off-link: On

no-autoconfig: On

Command Mode VLAN interface configuration

Usage Guideline The VLAN interface must be created first before this command can be used.

Example This example shows how to configure IPv6 prefix information incidence:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd prefix 3ffe:501:ffff:100::/64 30000 20000
Switch (config-if) # 

ipv6 nd ra-interval

This command is used to configure the IPv6 RA (router advertisement) interval timer for an interface of this switch. The no form of this command sets the lifetime to the default value.

ipv6 nd ra-interval <4-1800> [<3-1350>]

no ipv6 nd ra-interval

Syntax Description

<4-1800> Maximum interval value in seconds.

<3-1350> Minimum interval value in seconds.

Must be smaller than the maximaum value * 0.75

Default <4-1800>: 600

<3-1350>: 198

Command Mode VLAN interface configuration

Usage Guideline

The VLAN interface must be created first before this command can be used. If the minimum interval value is not configured, the minimum interval value will be automatically assigned per the following rules.

1. If maximum timer >= 9 seconds, then it is configured to the maximum value * 0.33.
2. If maximum timer < 9 seconds, then it is configured to the maximum value.

Example This example shows how to configure the IPv6 RA interval timer setting:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd ra-interval 1500 1000
Switch (config-if) # 

ipv6 nd ra-lifetime

This command is used to configure the IPv6 RA (router advertisement) lifetime on an interface of this switch. The no form of this command sets the lifetime to the default value.

ipv6 nd ra-lifetime <0-9000>

no ipv6 nd ra-lifetime

Syntax Description

<0-9000> The IPv6 router advertisement lifetime range in seconds.

Default 1800

Command Mode VLAN interface configuration

Usage Guideline The VLAN interface must be created first before this command can be used.

Example This example shows how to configure IPv6 ra lifetime incidence:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd ra-lifetime 9000
Switch (config-if) # 

ipv6 nd reachable-time

This command is used to configure IPv6 RA (router advertisement) reachable time on an interface of this switch. The no form of this command sets the reachable time to the default value.

ipv6 nd reachable-time <0-3600000>

no ipv6 nd reachable-time

Syntax Description

<0-3600000>

The IPv6 router advertisement reachable time range in milliseconds.

Default 0

Command Mode VLAN interface configuration

Usage Guideline

The VLAN interface must be created first before this command can be used. When the reachable time is set to the default value or set to "0", the system will run for 30 seconds on this interface, but the RA packet will be set to "0".

Example This example shows how to configure the IPv6 reachable time setting:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd reachable time 3600000
Switch (config-if) # 

ipv6 nd retrans-timer

This command is used to configure IPv6 RA (router advertisement) retrans timer per interface on this switch. The no form of this command sets the retrans timer to the default value.

ipv6 nd retrans-timer <0-4294967295>

no ipv6 nd retrans-timer

Syntax Description

<0-4294967295> The IPv6 router advertisement retrans timer range in milliseconds.

Default 0

Command Mode VLAN interface configuration

Usage Guideline

The VLAN interface must be created first before this command can be used. When the reachable time is set to the default value or set to "0", the system will use 1 second for this interface, but the RA packet will be set to "0".

Example This example shows how to configure the IPv6 retrans timer setting:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd retrans-timer 4294967295
Switch (config-if) # 

ipv6 nd suppress-ra

This command is used to suppress IPv6 RA (router advertisement) on an interface of this switch. Use the no ipv6 nd suppress-ra configuration command to enable the sending of IPv6 router advertisements on an ISATAP tunnel interface.

ipv6 nd suppress-ra

no ipv6 nd suppress-ra

Syntax None

Default Suppress RA

(Sending of IPv6 router advertisements is disabled by default on an ISATAP tunnel interface)

Command Mode VLAN interface configuration

Usage Guideline

The VLAN interface must be created first before this command can be used.

ISATAP tunnel interfaces are valid for this command. Other types of tunnel interfaces are invalid.

Example This example shows how to suppress IPv6 RA's:

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if) # ipv6 nd suppress-ra 

ipv6 neighbor

This command is used to add a static ipv6 neighbor entry. The no form of this command deletes the IPv6 neighbor entry.

ipv6 neighbor X:X::X:X IFNAME MAC

no ipv6 neighbor X:X::X:X IFNAME

Syntax Description

X:X::X:X IPv6 address. This argument must be in the form documented by RFC2373 where the address is specified in hexadecimal using a 16-bit value between colons.

XXXX: IPv6 address

IFNAME The IP Interface name

MAC The MAC address, in XX-XX-XX-XX-XX-XX format

Default None

Command Mode Global configuration.

Usage Guideline None

Example This example shows how to configure an IPv6 neighbor entry:

Switch > enable
Switch # configure terminal
Switch (config) # ipv6 neighbor fe80::1 vlan1 00-01-80-11-22-99
Switch (config) # 

ipv6 ospf cost

To explicitly specify the cost of sending a packet on an interface, use the ipv6 ospf cost command. To reset the interface cost to the default value, use the no form of this command.

ipv6 ospf cost COST [instance-id INSTANCE-ID]

no ipv6 ospf cost [instance-id INSTANCE-ID]

Syntax Description
COST	Unsigned integer value expressed as the link-state metric. It can be a value in the range from 1 to 65535.
INSTANCE-ID	(Optional) Instance identifier. To change this ID, please issue the "no" command first. The valid setting is from 0 to 255.

Default Cost: Unconfigured

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline

To modify the cost from the default value, set the metric manually using the ipv6 ospf cost command. Using the bandwidth command changes the link cost as long as the ipv6 ospf cost command is not used. The link-state metric is advertised as the link cost in the router link advertisement.

Example The following example sets the interface cost value to 65.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 ospf cost 65 

ipv6 ospf dead-interval

To set the time period used, during which hello packets are not detected, before neighbors declare the router down, use the ipv6 ospf dead-interval command. To return to the default time, use the no form of this command.

ipv6 ospf dead-interval SECONDS [instance-id INSTANCE-ID]

no ipv6 ospf dead-interval [instance-id INSTANCE-ID]

Syntax Description
SECONDS	Specifies the interval in seconds. The value must be the same for all nodes on a specific network.It can be a value in the range from 1 to 65535.
INSTANCE-ID	(Optional) Instance identifier. To change this ID, please configure "no" command first. The valid setting is from 0 to 255.

Default Seconds: 40

Default INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline The interval is advertised in router hello packets. This value must be the same for all routers and access servers on a specific network.

Example The following example sets the IPv6 OSPF dead interval to 60 seconds.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 ospf dead-interval 60 

ipv6 ospf hello-interval

To specify the interval between hello packets sent from an interface, use the ipv6 ospf hello-interval command. To return to the default time, use the no form of this command.

ipv6 ospf hello-interval SECONDS [instance-id INSTANCE-ID]

no ipv6 ospf hello-interval [instance-id INSTANCE-ID]

Syntax Description
SECONDS	Specifies the interval in seconds. The value must be the same for all nodes on a specific network. It can be a value in the range from 1 to 65535.
INSTANCE-ID	(Optional) Instance identifier. To change this ID, configure the "no" command first. The valid setting is from 0 to 255.

Default Seconds: 10

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline This value is advertised in the hello packets. The shorter the hello interval, the earlier topological changes will be detected, but more routing traffic will ensue. This value must be the same for all routers and access servers on a specific network.

Example The following example sets the interval between hello packest to 15 seconds.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 ospf hello-interval 15 

ipv6 ospf priority

To set the router priority, which helps determine the designated router for this network, use the ipv6 ospf priority. To return to the default value, use the no form of this command.

ipv6 ospf priority PRIORITY [instance-id INSTANCE-ID]

no ipv6 ospf priority [instance-id INSTANCE-ID]

Syntax Description
PRIORITY	A number value that specifies the priority of the router. The range is from 0 to 255.
INSTANCE-ID	(Optional) Instance identifier.To change this ID, please configure "no" command first.The valid setting is from 0 to 255.

Default Priority: 1

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline

Setting the priority helps determine the OSPF Designated Router (DR) for a network. If two routers attempt to become the DR, the router with the higher router priority becomes the DR. If the router priority is the same for two routers, the router with the higher router ID takes precedence.

Only routers with non-zero router priority values are eligible to become the designated or backup designated router. Configure router priority for multi-access networks (not point-to-point) only.

Example The following example sets the router priority value to 4.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 ospf priority 4 

ipv6 ospf retransmit-interval

This command specifies the time between link-state advertisement (LSA) retransmissions for adjacencies belonging to an interface.

ipv6 ospf retransmit-interval SECONDS [instance-id INSTANCE-ID]

no ipv6 ospf retransmit-interval [instance-id INSTANCE-ID]

Syntax Description
SECONDS	The interval the router waits before it retransmits a packet. The valid setting is 1-65535.
INSTANCE-ID	(Optional) Instance identifier. In order to change this ID, configure the "no" command first. The valid setting is from 0 to 255.

Default Seconds: 5

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline

After sending an LSA to a neighbor, the router keeps the LSA until it receives an acknowledgement. In case the router does not receive an acknowledgement, during the set time (the retransmit interval value), it retransmits the LSA. Set the retransmission interval value conservatively to avoid needless retransmissions. The interval should be greater than the expected round-trip delay between two routers.

Example The following example sets the retransmit interval value to 6 seconds.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if)# ipv6 ospf retransmit-interval 6 

ipv6 ospf shutdown

To initiate an IPv6 OSPF protocol graceful shutdown at the interface level, use the ipv6 ospf shutdown command. To restart the OSPF protocol on an interface, use the no form of this command

ipv6 ospf shutdown [IFNAME]

no ipv6 ospf shutdown [IFNAME]

Syntax Description

IFNAME

(Optional) Interface type and number. If no option is specified, apply to the whole IPv6 OSPF process.

Default Disabled

Command Mode Router configuration

Usage Guideline

Use the ipv6 ospf shutdown command to put IPv6 OSPF under a specific interface in shutdown mode. If no interface is specified for this command in router configuration mode, it will shutdown the protocol in the least disruptive manner and notify its neighbors that it is leaving. All traffic, that has another path through the network, will be directed to that alternate path.

Note: When this command is used to shutdown IPv6 OSPF on all interfaces, then at this time the device will clear the LSDBs and leave them empty. This behavior is not the same as with the IPv4 OSPF protocol.

Example

The following example shows how to initiate an IPv6 OSPF protocol shutdown on the layer 3 interface (VLAN 1):

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router)# ipv6 ospf shutdown vlan1 

ipv6 ospf transmit delay

To set the estimated time required to send a link-state update packet on the interface, use the ipv6 ospf transmit-delay command. To return to the default value, use the no form of this command.

ipv6 ospf transmit-delay SECONDS [instance-id INSTANCE-ID]

no ipv6 ospf transmit-delay [instance-id INSTANCE-ID]

Syntax Description
SECONDS	The interval the router waits before it transmits a packet. The valid setting is 1-65535.
INSTANCE-ID	(Optional) Instance identifier. To change this ID, configure the "no" command first. The valid setting is from 0 to 255.

Default SECONDS: 1

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline

Before being transmitted, Link-State Advertisements (LSAs) in the update packet must have their ages incremented by the amount specified in the seconds. The value assigned should take into account the transmission and propagation delays for the interface.

If the delay is not added before transmission over a link, the time in which LSAs propagate over the link will not be considered. This setting has more significance on very low-speed links.

Example The following example sets the transmit delay value to 3 seconds.

Switch > enable
Switch # configure terminal
Switch (config) # interface vlan1
Switch (config-if)# ipv6 ospf transmit-delay 3 

ipv6 rip metric-offset

To set the IPv6 RIP metric for an interface, use the ipv6 rip metric-offset command. To return the metric to its default value, use the no form of this command.

ipv6 rip metric-offset METRIC-VALUE

no ipv6 rip metric-offset

Syntax Description
METRIC-VALUE	Value added to the metric of an IPv6 RIP route received in a report message. A number from 1 to 16.

Default The default metric value is 1.

Command Mode Interface configuration

Usage Guideline When an IPv6 RIP route is received, the interface metric value set by the ipv6 rip metric-offset command is added before the route is inserted into the routing table. Increasing the IPv6 RIP metric value of an interface will increase the metric value of IPv6 RIP routes received over the interface.

Use the ipv6 rip metric-offset command to influence which routes are used.

The IPv6 RIP metric is in the hop count.

Example The following example configures a metric increment of 10 for the RIP routing process.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 rip metric-offset 10 

ipv6 rip split-horizon

To enable IPv6 RIP split-horizon mechanism, use the ipv6 rip split-horizon command. To disable the split horizon processing of IPv6 RIP updates, use the no form of this command.

ipv6 rip split-horizon

no ipv6 rip split-horizon

Syntax None

Default This command is disabled by default.

Command Mode Interface configuration

Usage Guideline

This command configures split horizon processing of IPv6 RIP router updates. If split horizon is configured on interfaces where the networks are learned, then the advertisement of networks sent out from those same interfaces is suppressed.

When both split horizon and poison reverse are configured, then split horizon behavior is replaced by poison reverse behavior routes. The poison reverse behavior routes are learned via RIP and are advertised out the interface over which they were learned. They are advertised with an unreachable metric.

Example

The following example configures split horizon processing for the IPv6 RIP routing process.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 rip split-horizon 

ipv6 rip split-horizon poisoned

To configure the poison reverse processing of IPv6 RIP router updates, use the ipv6 rip split-horizon poisoned command. To disable the poison reverse processing of IPv6 RIP updates, use the no form of this command.

ipv6 rip split-horizon poisoned

no ipv6 rip split-horizon

Syntax None

Default Poison reverse is configured.

Command Mode Interface configuration

Usage Guideline

This command configures poison reverse processing of IPv6 RIP router updates. When poison reverse is configured, routes learned via RIP are advertised with an unreachable metric out from the interface over which they were learned.

If both poison reverse and split horizon are configured, then simple split horizon behavior is replaced by poison reverse behavior.

Example

The following example configures poison reverse processing for the IPv6 RIP routing process.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 rip split-horizon poisoned 

ipv6 route

Use ipv6 route to add an IPv6 static route entry. Use the no form of the command to remove an IPv6 static route entry.

ipv6 route NETWORK-PREFIX / PREFIX-LENGTH {NEXT-HOP-ADDRESS | INTERFACE-TYPE INTERFACE-NUMBER NEXT-HOP-ADDRESS} [distance DISTANCE]

no ipv6 route NETWORK-PREFIX / PREFIX-LENGTH [NEXT-HOP-ADDRESS | INTERFACE-TYPE INTERFACE-NUMBER NEXT-HOP-ADDRESS]

Syntax Description
NETWORK-PREFIX / PREFIX-LENGTH	The network prefix and the prefix length specify the destination network.
NEXT-HOP-ADDRESS	The IPv6 address of the next hop that can be used to reach the specified network.Note: An interface must be specified when using a link-local address as the next hop (the link-local next hop must also be an adjacent router). If an interface is specified, a global IPv6 address cannot be used as the next hop address.This argument must be in the form documented in RFC 2373 where the address is specified in hexadecimal using 16-bit values between colons.
INTERFACE-TYPE	Interface type. For more information about supported interface types, use the question mark (?) online help function.When using the interface-type argument with tunnel interfaces, there is no need to specify the NEXT-HOP-ADDRESS.When using the interface-type argument with broadcast interfaces, always specify the NEXT-HOP-ADDRESS or ensure that the specified prefix is assigned to the link. A link-local address should be specified as the next hop for broadcast interfaces.
INTERFACE-NUMBER	Interface number. For more information about the numbering syntax for supported interface types, use the question mark (?) online help function.
DISTANCE (Optional)	An administrative distance. The default value is 1, which gives static routes precedence over any other type of route except connected routes.

Default No static route is configured.

Command Mode Global configuration

Usage Guideline: See the following sections.

Configuring Default Route

Configuring a default route is useful and simple for managing the IPv6 forwarding path. By giving the NETWORK-PREFIX and PREFIX-LENGTH as zero, the system will setup the default path(s) for IPv6 traffic. Using the following commands to create or delete the default route of the system.

Practical Usage

Operators may prefer to specify a default path for the managed devices. By specifying a default gateway, traffic inside the managed topology always has the proper path to follow. Usually, routers on smaller networks may need this configuration, since they have less CPU computing power or less memory to keep the entire routing table of the topology.

Examples

Imagine the topology is illustrated below. The device on the edge may not have enough power to forward all the IPv6 traffic to the world. Therefore, it needs a default route to serve the connected IPv6 nodes to communicate with nodes on Internet.

graph TD
    A["User Group"] --> B["Intranet"]
    C["User Group"] --> B
    D["User Group"] --> B
    E["User Group"] --> B
    F["User Group"] --> B
    G["User Group"] --> B
    H["Internet"] --> B
    I["Internet"] --> B
    B --> J["Cloud Node"]
    style A fill:#f9f,stroke:#333
    style C fill:#bbf,stroke:#333
    style D fill:#bfb,stroke:#333
    style E fill:#ffb,stroke:#333
    style F fill:#fbb,stroke:#333
    style G fill:#fbb,stroke:#333
    style H fill:#bbf,stroke:#333
    style I fill:#bbf,stroke:#333

This example shows how to create a default route.

Switch > enable
Switch # configure terminal
Switch (config) # ipv6 route ::/0 vlan 1 fe80::0200:00ff:fe00:a0a0 

After configuring the default route, the edge router will forward the unknown IPv6 traffic to the core router. By doing this, users connected to the edge router can connect to the world (WAN/internet).

This example shows how to delete an existing default route.

Switch > enable
Switch # configure terminal
Switch (config) # no ipv6 route ::/0 vlan 1 fe80::0200:00ff:fe00:a0a0 

Configuring a General Static Route

To establish static IPv6 routes, use the ipv6 route command in global configuration mode. To remove a previously configured static route, use the no form of this command.

Default No static routes are configured.

Practical Usage

Operators may prefer to specify the forwarding path of certain traffic. By doing this, the traffic of certain applications in the managed domain will always be forwarded to the expected destination. When the network prefixes and prefix-length are both zero, it implies the specific static route is the default route. A default route presents the final forwarding path of choice should the system not find the matched forwarding rule in routing table. By assigning the address of the next-hop only, the system will forward the IP traffic to this address if, there is no matched forwarding rule by default.

Examples

Imagine the topology as illustrated below. There is a proxy server to access the Intranet. All the users on the Intranet are required to setup this same proxy to communicate with the WEB servers outside the Intranet. However, there is a default gateway configured on the edge route. The HTTP communication from users connected to the edge router will exhaust all the bandwidth available for the Intranet. Therefore, we need a static route to save the bandwidth available for the Intranet.

graph TD
    A["Internet"] --> B["Intranet"]
    B --> C["PROXY"]
    C --> D["User Group 1"]
    C --> E["User Group 2"]
    C --> F["User Group 3"]
    B --> G["User Group 4"]
    B --> H["User Group 5"]
    style A fill:#90EE90,stroke:#333
    style B fill:#90EE90,stroke:#333
    style C fill:#FFD700,stroke:#333
    style D fill:#E6F1E6,stroke:#333
    style E fill:#E6F1E6,stroke:#333
    style F fill:#E6F1E6,stroke:#333
    style G fill:#B2C4A2,stroke:#333

This example shows how to create a static route destined for the network where proxy server resides.

Switch > enable
Switch # configure terminal
Switch (config) # ipv6 route 2001:0DB8::/32 vlan 1 fe80::0200:00ff:fe00:a0a0 

Then we can use the show command to check whether the configured static route works or not.

Switch > enable
Switch # show ipv6 route
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
I - IS-IS, B - BGP

C 2177:0:4:141::/64 is directly connected, vlan141
S 2177:0:3:134::/64 [1/0] via 2177:0:4:906::8003

Total Entries: 2 entries, 2 routes 

This example shows how to delete an existing static route.

Switch > enable
Switch # configure terminal
Switch (config) # no ipv6 route 2001:0DB8::/32 vlan 1 fe80::0200:00ff:fe00:a0a0 

Configuring a Floating Static Route

Usually, floating static routes are static routes that are being used to back up dynamic routes learned through configured routing protocols. Normally a floating static route is configured with a higher administrative distance than the dynamic routing protocol it is backing up. As a result, the dynamic route learned through the routing protocol is always used in preference to the floating static route. If the dynamic route learned through the routing protocol is lost, the floating static route will be used in its place. That is an IPv6 floating static route can be achieved through the ipv6 route command with a greater distance number. Additionally, to extend the usability, floating static routes can also be allowed to back up static routes, since each route in a system has its own distance.

To establish floating static IPv6 routes, use the ipv6 route command in global configuration mode. To remove a previously configured floating static route, use the no form of this command.

Default No floating static routes are configured.

Practical Usage

Operators may like to specify the priorities of multiple routes destined for the same network. When multiple routes destined for the same network exist, a network device needs to decide which route should be registered into the routing table. The higher priority routes will be active, while lower priority routes will be backup. The following lists the default priority of available kinds of routes in the system.

• LOCAL INTERFACE 0

• STATIC 1

• RIP 120

• RIPNG 120
• OSPF 110
• OSPF6 110
• EBGP 20
• IBGP 200
  • ISIS 115

Examples

Assume that a routing protocol originates the same route to the same destination as an existing static route. However, an operator would like to select the calculation of the best route to choose from the routing protocols first. To do that the operator needs to change the priority of the static route, since the default priority of static routes is usually higher than dynamic routes.

This example shows how to create floating static routes. The System will ultimately choose the higher priority (with less distance value) route to be the master route toward the same destination. In this case, the route with distance 11 will be chosen as the master route toward the destination 2001:0DB8::/32.

Switch > enable
Switch # configure terminal
Switch (config) # ipv6 route 2001:0DB8::/32 vlan 1 fe80::0200:00ff:fe00:a0a0 distance 11
Switch (config) # ipv6 route 2001:0DB8::/32 vlan 2 fe80::0200:00ff:fe00:b0b0 distance 22 

This example shows how to delete the previously configured static route.

Switch > enable
Switch # configure terminal
Switch (config) # no ipv6 route 2001:0DB8::/32 vlan 1 fe80::0200:00ff:fe00:a0a0 

ipv6 router ospf area

To enable IPv6 OSPF on an interface, use the ipv6 router ospf area command. To disable IPv6 OSPF routing for interfaces defined, use the no form of this command.

ipv6 router ospf area AREA-ID [tag PROCESS-ID] [instance-id INSTANCE-ID]

no ipv6 router ospf area AREA-ID [tag PROCESS-ID] [instance-id INSTANCE-ID]

Syntax Description
AREA-ID	The identifier of the area for which the vlan interface is to be enabled. It can be specified as either a decimal value or as an IPv4 address.
PROCESS-ID	(Optional) An internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.
INSTANCE-ID	(Optional) Instance identifier. To change this ID, configure the "no" command first. The valid setting is from 0 to 255.

Default IPv6 OSPF is disabled.

PROCESS-ID: null

INSTANCE-ID: 0

Command Mode Interface configuration

Usage Guideline

Before enabling IPv6 OSPF on an interface using the ipv6 router ospf area command, IPv6 must be enabled on the interface, and IPv6 routing must be enabled on the switch. There is no limit to the number of ipv6 router ospf area commands that can be used on the router. At least two interfaces must be configured for IPv6 OSPF to run.

If the configuration is based on a specific process, then the no form of the command must include the process information.

Example The following example enables IPv6 OSPF on an interface.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 router ospf area 0 instance-id 2 

ipv6 router rip

To enable the IPv6 RIP routing process on an interface, use the ipv6 router rip command. To disable the IPv6 RIP routing process on an interface, use the no form of this command.

ipv6 router rip

no ipv6 router rip

Syntax None

Default Disabled

Command Mode Interface configuration

Usage Guideline

The ipv6 router rip interface configuration command is used to enable IPv6 RIP explicitly on required interfaces. In IPv4, the network network-number router configuration command is used to implicitly specify the interfaces on which to run IPv4 RIP.

Example

The following example enables the IPv6 RIP routing process on VLAN 1.

Switch > enable
Switch # configure terminal
Switch (config)# interface vlan1
Switch (config-if)# ipv6 router rip 

key

Use the key command to identify a key on a key chain used for routing protocol authentication. Use the no key command to remove the key from the key chain.

key KEY-ID

no key KEY-ID

Syntax Description
KEY-ID	The ildentification number of an authentication key of a key chain. The available range for the key ID is a number from 0 to 2147483647, up to 32 key IDs can be configured. The key identification numbers need not be consecutive.

Default There are no keys configured on the key chain.

Command Mode key-chain configuration

Usage Guideline

Only Routing Information Protocol (RIP) Version 2 uses key chains.

Using the key command will enter into the key-chain key configuration mode.

It is useful to have multiple keys on a key chain so that the software can sequence through the keys as they become invalid over a period of time. This is based on the accept-lifetime, send-lifetime and key chain key command settings.

If the last key expires, authentication will be invalid.

If there was a discrepancy in the set time of the router's keys, the first valid key will be chosen.

To remove all keys, remove the key chain with the no key chain command.

Example

The following example configures a key chain named chain1. Key1 named "forkey1string" will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key3 named "forkey3string" will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config-router)# exit
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit 

To verify the settings, enter the show ip key-chain command.

key chain

To manage authentication keys, define a key chain, identify the keys that belong to the key chain, and specify how long each key is valid by using the key chain command. To remove the key chain, use the no form of this command.

key chain NAME-OF-KEY

no key chain NAME-OF-KEY

Syntax Description

NAME-OF-KEY The name used for a key chain (a displayable string). The maximum string length of key chain is 32. If the string includes spaces, then it must be enclosed in quotes (""). A key chain must have at least one key and can have up to 32 keys.

Default No key chains are configured.

Command Mode Global configuration

Usage Guideline

Routing Information Protocol (RIP) Version 2 uses key chains for authentication.

To enable authentication, a key chain with named keys must first be created.

It is recommended that only one key chain be configured per interface.

Example

The following example configures a key chain named chain1. Key1 named "forkey1string" will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key3 named "forkey3string" will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config-router)# exit
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# end 

To verify the settings, use the show ip key-chain command.

key-string

Use the key-string command ito specify the authentication string for a key. Use the no key-string command to remove the authentication string.

key-string TEXT

no key-string [TEXT]

Syntax Description

TEXT The required authentication string sent and received in packets using the routing protocol being authenticated. The string can consist of 1 to 16 alphanumeric characters, the first character cannot be a number.

Default No key chains are configured.

Command Mode key-chain key configuration

Usage Guideline Routing Information Protocol (RIP) Version 2 uses key chains for authentication. Each key can have only one key string.

Example

The following example configures a key chain named chain1. Key1 named forkey1string will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key3 named forkey3string will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# end 

Verify the settings by entering the show ip key-chain command.

lapc port-priority

Use the lacp port-priority command to configure the port priority. Use the no form to configure the port priority to the default.

Iacp port-priority PRIORITY

no lacp port-priority

Syntax Description

PRIORITY Specifies the port priority. The range is 1 to 65535.

Default 32768

Command Mode Interface configuration

Usage Guideline

The lacp port-priority command is used to specify which ports can join a port channel and which ports are specified to be in backup mode. In a port priority comparison, a numerically lower value has a higher priority. If two or more ports have the same priority, the port number determines the priority.

Example

This example shows how to configure the port priority to 20000 on interface eth3.4 to eth3.5.

Switch(config)# interface range eth3.4-3.5
Switch(config-if)# lacp port-priority 20000 

Verify the settings with the show channel-group command.

lapc system-priority

Use the lacp system-priority command to configure the system priority used for LACP ports. Use the no form to configure the system priority to the default.

Iacp system-priority PRIORITY

no lacp system-priority

Syntax Description

PRIORITY Specifies the system priority. The range is 1 to 65535.

Default 32768.

Command Mode Global configuration

Usage Guideline

During Link Aggregation Control Protocol (LACP) negotiation, the system priority and port priority of the local partner are exchanged with the remote partner. If the maximum number of actual members exceeds the limitation, the switch uses port priority to determine whether the port status will be in backup mode or active mode. The LACP system priority determines which switch controls the port priority for the aggregated link. The port priorities of the other switch are ignored.

In a system priority comparison, a numerically lower value has a higher priority.

If two switches have the same system priority, the LACP system ID (MAC address) determines the priority.

The LACP system priority command applies to all LACP port channels on the switch.

Example

This example shows how to configuration the system priority to 30000.

Switch(config)# lacp system-priority 30000

Verify the settings with the show channel-group command

lease

Use this command to configure the lease duration of an IP address that is assigned from a DHCP server to a client. Use the no form of this command to restore the default value.

lease { DAYS [HOURS | MINUTES] | infinite }

no lease

Syntax Description
DAYS Specifies the duration of the lease in number of days
HOURS	(Optional) Specifies the number of hours in the lease. The DAYS value must be configured prior to HOURS.
MINUTES	(Optional) Specifies the number of minutes in the lease. The DAYS and HOURS values must be configured prior to MINUTES.
Infinite Specifies the lease is unlimited

Default 1 day

Command Mode DHCP pool configuration

Usage Guideline This command specified the duration of a lease. This command can only be executed under DHCP pool configuration mode, identified by the (config-dhcp)# prompt. Examples The following is a sample of configuring the lease, in address pool "pool1", to 1 day.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# lease 1 

The following is sample of configuring the lease, in address pool "pool1", to 1 hour.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# lease 0 1 

logging file

Use the logging file command to enable the storage of log messages to FLASH memory from the logging buffer.

logging file

Syntax None

Default None

Command Mode Global configuration

Usage Guideline Use this command to save log messages from the logging buffer to flash.

Example The example below sets log messages to be saved to flash.

Switch> enable
Switch# configure terminal
Switch(config)# logging file 

logging host

Use the logging host command to log system messages to a remote host. Remove logging hosts from the configuration with the no logging host command.

logging host IPADDRESS [ port UDP-PORT] [severity {emergency |alert |critical |error |warning |notice |informational|debugging}] [facility {local0|local1| local2| local3| local4| local5| local6| local7}]

no logging host [IP-ADDRESS]

Syntax Description
IP-ADDRESS Specifies the IP address of the host to be used as the syslog server.
port UDP-PORT	(Optional) The UDP port number to be used for the syslog server. Valid values are 514 or any value from 1024 to 65535.
severity Specifies the severity of log messages that will be sent to the server.
	emergency System is unusable
	alert Action must be taken immediately.
	critical critical condition
	error error conditions
	warning warning condition
	notice normal but significant condition
	informational informational message
	debugging debugging message
facility	Specifies the facility (refer to options listed in the below rows) in the log messages to be sent to the server.
	local0 local use 0
	local1 local use 1
	local2 local use 2
	local3 local use 3
	local4 local use 4
	local5 local use 5
	local6 local use 6
	local7 local use 7

Default IP-ADDRESS: None

UDP port: 514.

severity: informational

facility: local7

Command Mode Global configuration

Usage Guideline

The number of supporting SYSLOG servers is project dependent. When the number of configured SYSLOG servers reaches the maximum capacity, a new SYSLOG server is unable to be configured before and existing entry is deleted using the command no logging host.

The severity level limits the logging of system messages sent to Syslog servers to only those messages at and up to the specified level. For example, if the trap severity is debugging, all logs in the Syslog daemon are sent to the log server host. If the level of log trap is alert, then only alert and emergency logs are sent.

The keyword facility specifies the syslog facility in the SYSLOG messages which are sent to the server.

For the no command, if the IP address is not specified, all logging hosts will be deleted.

Example The below example shows how to create a log server with the host address

20.3.3.3 . The command configures the server to receive logs with a severity level set to critical

Switch> enable
Switch# configure terminal
Switch(config)# logging host 20.3.3.3 severity critical 

Verify the settings with the show logging host command.

logging level

Use this command to limit messages logged to the message buffer based on facility (type of messages to capture) and severity level.

logging level all SEVERITY

Syntax Description

all All facilities

SEVERITY Value for the severity level of system messages to capture. Severity level definitions are shown in the following table.

Severity Level Severity Type Description
0	emergency system is unusable
1	alert action must be taken	immediately
2	critical critical conditions
3	error	error conditions
4	warning	warning conditions
5	notice	normal but significant condition
6	informational	informational messages
7	debugging	debugging messages

Default SEVERITY: 5

Command Mode Global configuration

Usage Guideline The command limits the logging of system messages to the syslog buffer to only those messages for the specified facility at and up to the specified severity level. For example, if the buffer severity is 7 (debugging) then all logs in syslog daemon will log to buffer. If buffer severity is 1 (alert), then only alert and emergency logs will be logged to buffer.

Example The below example limits logs with severity alert and emergency to be logged to buffer for all facilities.

switch> enable
switch# configure terminal
Switch(config)# logging level all 1 

Verify the settings by entering the show logging command.

logging on

Use the logging on command to start logging system messages on this switch. Use the no form of this command to stop logging.

logging on

no logging on

Syntax None

Default Logging of system messages is on.

Command Mode Global configuration

Usage Guideline To enable logging of system messages, use the logging on command in global configuration mode.

Example To set logging of system messages to on, execute the below commands.

Switch> enable
switch# configure terminal
Switch(config)# logging on 

Verify the settings with the show logging command.

login

Use this command to login to the switch with a specified username.

login

Syntax None

Default None

Command Mode User EXEC

Usage Guideline Change a login username by using this command.

When logging in using a TELNET connection, if all of the attempts fail, the connection will be returned to the logout state. For a direct console connection, the session will also be returned to the logout state.

Example

This example shows how to login with username user1.

Switch>login

User Access Verification

Username: user1
Password:

DGS-6604 Chassis-based High-Speed Switch
Command Line Interface

Firmware: 1.00.029
Copyright (c) 2011 D-Link Corporation. All rights reserved.
Switch# 

logout

Use this command to close an active terminal session by logging off the switch.

logout

Syntax None

Default None

Command Mode User EXEC

Usage Guideline

Close an active terminal session by logging off the device using the logout command.

Example This example shows how to logout from the switch.

Switch# disable
Switch> logout 

mac access-group

Use the mac access-group command to specify a MAC access list to be applied to an interface. Use the no mac access-group command to remove the access group control from the interface.

mac access-group NAME [in]

no mac access-group NAME [in]

Syntax Description
NAME The name of the MAC access list to be applied. Up to 32 characters are allowed.The syntax is a general string that does not allow spaces.
in	Specifies that the MAC access list will be applied in the ingress direction.

Default If the in direction is not specified, the default will be the in direction.

Command Mode Interface configuration

Usage Guideline

Only one MAC access list can be applied to the same interface. An error message is sent if an attempt is made to apply a second MAC access list and the attempt is ignored.The MAC access list must first be created using themac access-listcommand before it can be applied to interface. Otherwise, an error message will be displayed.The keyword inspecifies the ingress direction check.One MAC access-list, one IP access-list and one IPv6 access-list can be applied to the same interface.The association of an access-group with an interface will consume the filtering entry resource in the switch controller. If the command is applied successfully, the number of remaining max entries will be displayed. If the resource is insufficient to commit the command, an error message will be displayed.

Example This example shows applied MAC access-list "daily-profile" to eth3.1

Switch(config)# interface eth3.1
Switch(config-if)# mac access-group daily-profile in 

Verify the settings with the show access-group command.

mac access-list

Use the mac access-list command to create a MAC access list in the configuration. Enter this command to go into mac access-list configuration mode. Use the no form of the command to delete a MAC access list.

mac access-list extended NAME

no mac acces-list extended NAME

Syntax Description

NAME The name of the MAC access list being created. The syntax is a general string with no spaces of up to 32 characters.

Default An implicit deny statement for all addresses.

Command Mode Global configuration

Usage Guideline

To apply an access list to an interface, create the list with the mac access-list extended command. An interface can have only one MAC access list, one IP access list and one IPv6 access list applied to it. Use this command to enter the mac access-list configuration mode, then use the permit/deny command to specify the entries.

Access lists names must be unique among access lists. Access list names are case sensitive.

A configured access list is always terminated by an implicit deny statement for all addresses.

An error message will appear if the allowed number of lists is exceeded.

If both a MAC access list and an IP access-list or IPv6 access-list are applied to an interface, the packet will be processed using the MAC access list first. If the packet is not dropped by the MAC access list, the packet will be then processed by the IP access list or the IPv6 access list. This order of packet handling therefore gives higher priority to the MAC access list.

Example

This example shows how to enter the mac access-list configuration mode for "daily-profile":

Switch(config)# mac access-list extended daily-profile Switch(config-mac-ext-acl)#

Verify the access list configuration settings with the show access-list command.

mac address-table aging destination-hit

Use the MAC address-table aging destination-hit command to enable the destination MAC address triggered update function (Updates the hit bit of the MAC address entry based on the destination MAC of the forwarding packet).

Use the no form of the command to disable the triggered updated function.

mac address-table aging destination-hit

no mac address-table aging destination-hit

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

The source MAC address triggered update function is always enabled. When a user enables the destination MAC address triggered update function by entering the "mac address-table aging destination-hit" command, the hit bit of MAC address entries will be updated. It will be updated for either the destination MAC addresses or the source MAC addresses when the forwarding packet is matched. The destination MAC address triggered update function increases the frequency of the MAC address entries hit bit update and will reduce the traffic flooding when the aging of MAC address entries expires.

Example This example shows how to enable the destination MAC address triggered update function.

Switch:15(config)# mac address-table aging destination-hit

Verify the setting by entering the show mac address-table aging destination-hit command.

mac address-table aging-time

Use this command to set the length of time that a dynamic entry remains in the MAC address table.

mac address-table aging-time SECONDS

Syntax Description

SECONDS Aging time in seconds. The valid range is 0 or 10 to 1000000 seconds. 0 means that the aging function is disabled so entries never age out.

Default SECONDS: 300

Command Mode Global configuration

Usage Guideline Set the aging time to 0 to disable the MAC address table aging out function.

Example This example shows how to set the aging time to 200 seconds:

Switch(config)# mac address-table aging-time 200

Verify the setting by entering the show mac address-table aging-time command.

mac address-table static

Use the mac address-table static command to add a static address to the MAC address table. Use the no mac address-table static command to remove static addresses from the table.

mac address-table static MAC-ADDR vlan VLAN-ID interface INTERFACE-ID [, | - ]

no mac address-table static MAC-ADDR vlan VLAN-ID [interface INTERFACE-ID] [, | - ]

Syntax Description
MAC-ADDR	Destination MAC address (unicast or multicast) to add to the address table. Packets with this destination address received in the specified VLAN are forwarded to the specified interface. The acceptable formats are 00-01-80-40-30-20, 00:01:80:40:30:20, 000180403020, and 0001.8040.3020.
vlan VLAN-ID	Specifies the VLAN which will receive the packet with the specified MAC address destination. The range is 1 to 4094.
interface INTERFACE-ID	Specifies the interface to which received packets are forwarded to. Both physical ports and port-channels are valid.

Default Not configured

Command Mode Global configuration

Usage Guideline A unicast MAC address entry can be specified with only one interface.

A multicast MAC address entry can be specified with multiple interfaces.

To delete a unicast MAC address entry, it is not necessary to specify the interface ID. When deleting a multicast MAC address entry, if the interface ID is specified, only that interface is removed. Otherwise, the entire multicast MAC entry will be removed.

An error message will appear if the entry to be removed does not exist.

Example This example shows how to add static address C2:F3:22:0A:12:F4 to the MAC address table. When a packet is received in VLAN 4, with this MAC address as its destination, the packet is forwarded to the specified interface:

Switch(config)# mac address-table static C2:F3:22:0A:12:F4 vlan 4 interface eth3.1

Verify the setting by entering the show mac address-table command.

mac-base ( VLAN )

Use the mac-base command to create a MAC-based VLAN ID assignment entry. Use the no form of this command to remove a MAC-based VLAN ID assignment entry.

mac-base MAC-ADDRESS

no mac-base MAC-ADDRESS

Syntax Description

MAC-ADDRESS Specifies the MAC address for the entry.

VLAN-ID Specifies the VLAN ID for the entry.

Default Not configured

Command Mode VLAN configuration

Usage Guideline

Use the mac-base command to create a MAC-based VLAN ID assignment entry. Any frame with a source MAC address matching the entry is classified as a member of the VLAN associated with the entry.

Example This example shows how to create a MAC-based VLAN ID entry.

Switch(config)#vlan 101
Switch(config-vlan)#mac-base 00-80-cc-00-00-11
Switch(config-vlan)#exit

Verify the settings with the show vlan command.

match

Use the match command in the class map configuration mode to configure the match criteria for a class-map. Use the no form of the command to remove the match criteria.

match {access-list ACCESS-LIST-NAME | cos COS-LIST | [ip] dscp DSCP-LIST | [ip] precedence IP-PRECEDENCE-LIST/| protocol PROTOCOL-NAME | vlan VLAN-LIST}

no match { access-list ACCESS-LIST-NAME | cos COS-LIST | [ip] dscp DSCP-LIST | [ip] precedence IP-PRECEDENCE-LIST | protocol PROTOCOL-NAME | vlan VLAN-ID-LIST}

Syntax Description
access-list ACCESS-LIST-NAME	Name of an access-list that will be used as the match criteria. The only allowed access-list is the ip access-list with a permit rule to class the pass-through traffic, other traffic is not classified for any QoS service.
cos COS-LIST	Specific IEEE 802.1Q CoS value. The COS_LIST is from 0 to 7; Enter one or more CoS values separated by commas.
dscp DSCP-LIST	Numbers (0 to 63) representing differentiated services code point values. Enter one or more differentiated service code point (DSCP) values separated by commas. .
precedenceIP-PRECEDENCE-LIST	Numbers (0 to 7) representing the IP precedence values. Enter one or more precedence values separated by commas.
protocolPROTOCOL-NAME	Name of the protocol (for example, bgp) used as a matching criterion. See the "Usage Guidelines" for a list of protocols supported by most routers.
vlan VLAN-ID-LIST	VLAN identification number, numbers, or range of numbers. Valid VLAN identification numbers must be in the range of 1 to 4094.

Default Not configured

Command Mode Class-map configuration

Usage Guideline

To use the match command, the user must first enter the class-map command to specify the name of the class to establish the match criteria with. The treatment of these matched packets is defined by the user through the setting of Quality of Service (QoS) policies in the policy-map class configuration mode.

The match access-list command specifies a named ACL whose contents are used as the match criteria against which packets are checked to determine if they belong to the class. The packets that are permitted by the access list will be included in the class.

To match a packet on the basis of a Layer 2 class of service (CoS) marking, use the match cos command in class-map configuration mode. To remove a specific Layer 2 CoS marking as a match criterion, use the no form of this command.

To identify one or more differentiated service code point (DSCP), use the match dscp command in class-map configuration mode. To remove a specific DSCP

value from a class map, use the no form of this command. As an example for the match dscp command, if the user wants to match the DCSP values of 0, 1, 2, 3, 4, 5, 6, or 7 (note that only one of the IP DSCP values needs to be matched, not all of the specified DSCP values), enter the match dscp 0,1,2,3,4,5,6,7 command. This command is used by the class map to identify the specified DSCP value on a packet as a match with the traffic class configured.

To identify IP precedence values to use as the match criteria, use the match precedence command in class-map configuration mode. To remove IP precedence values from a class map, use the no form of this command. For example, to use the precedence values of 0, 1, 2, or 3 (note that only one of the precedence values needs to be matched, not all of the specified precedence values), enter the match ip precedence 0,1.2.3 command or match ip precedence 0-3 command.

To configure the match criteria for a class map on the basis of the specified protocol, use the match protocol command in class-map configuration mode. To remove protocol-based match criterion from a class map, use the no form of this command.

To match and classify traffic on the basis of the virtual local-area network (VLAN) identification number, use the match vlan command in class-map configuration mode. To remove a previously specified VLAN identification number as a match criterion, use the no form of this command

The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class.

Supported Protocols:
The following table lists the reference for the supported protocols.

Protocol	Description
arp IP Address Resolution Protocol (ARP)
bgp Border Gateway Protocol
dhcp Dynamic Host Configuration
dns Domain Name Server lookup
egp Exterior Gateway Protocol
ftp File Transfer Protocol
ip IP (version 4)
netbios NetBIOS
nfs Network File System
ntp Network Time Protocol
ospf Open Shortest Path First
pppoe	Point-to-Point Protocol over Ethernet
rip Routing Information Protocol
rtsp Real-Time Streaming Protocol
ssh Secured shell
telnet Telnet
tftp Trivial File Transfer Protocol

Examples The following example specifies a class map called class-home-user and configures the access list named acl-home-user to be used as the match criteria for that class:

Switch(config)# class-map class-home-user
Switch(config-cmap)# match access-list acl-home-user
Switch(config-cmap)# exit

In the following example, classes called voice and video-n-data are created to classify traffic based on the CoS values. QoS treatment is then given to the appropriate packets in the cos-based-treatment policy map (in this example, the QoS treatment is a single rate policer and a two rate policer for class voice and video-n-data respectively). The service policy configured in this example is attached to Ethernet interface 3.1.

Switch(config)# class-map voice
Switch(config-cmap)# match cos 7
Switch(config-cmap)# exit
Switch(config)# class-map video-n-data
Switch(config-cmap)# match cos 5
Switch(config-cmap)# exit
Switch(config)# policy-map cos-based-treatment
Switch(config-pmap)# class voice
Switch(config-pmap-c)# police 8000 1000 exceed-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# class video-n-data
Switch(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 exceed-action drop violate-action drop
exceed-action 2 violate-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface eth3.1
Switch(config-if)# service-policy cos-based-treatment 

The following example specifies a class map called cos and specifies that the CoS values of 1, 2, and 3 are match criteria for the class:

Switch(config)# class-map cos
Switch(config-cmap)# match cos 1,2,3
Switch(config-cmap)# exit

Verify the settings by entering the show class-map command.

match as-path

Use this command to match a BGP autonomous system path access list. To delete an entry, use the no form of this command.

match as-path ACCESS-LIST-NAME

no match as-path ACCESS-LIST-NAME

Syntax Description

ACCESS-LIST-NAME Specifies the name of AS path access list.

Default Not configured

Command Mode Route-map configuration

Usage Guideline

The values set by the match as-path and set weight commands override global values. For example, the weights assigned with the match as-path and set weight route-map configuration commands override the weight assigned using the neighbor weight command.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. To modify only a portion of the data, a second route-map section must be configured with an explicit match statement.

match means that the AS path list exactly matches the AS path, or is a subset of the AS path list.

Example This example shows how to add a match statement to the policy routing entry with name myPolicy:

Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# match as-path PATH_ACL

Verify the settings with the show route-map command.

match community

Use the match community command to match a Border Gateway Protocol (BGP) community. Use the no match community command to remove the entry from the list and return to the default condition.

match community COMMUNITY-LIST-NAME [exact]

no match community COMMUNITY-LIST-NAME [exact]

Syntax Description

COMMUNITY-LIST-NAME

The name of the community list.

exact (Optional) Requires an exact match. All of the communities specified must be present and no other communities are allowed.

Default Not configured

Command Mode Route-map configuration

Usage Guideline

A route is not advertised for outbound route maps or accepted for inbound route maps if the route does not match at least one match clause relating to a route-map command. In order to modify only a portion of the route data it is necessary to configure a second route-map section that specifies an explicit match.

Matching based on the community list number is one of the types of match commands applicable to BGP.

This route map set command is only for BGP.

When exact is specified, the communities of the route must be exactly the same as the permitted communities specified in the community-list (by the command ip community-list).

When exact is not specified, at least one community of the route must match one of the permitted communities in the community-list, and that community does not match any deny community.

Example

In the following example, routes that match the community list ALPHA-COMMUNITY, which is 101:200, have their weights then set to 100. Any route that has community 101:200 alone (exact match) will have its weight set to 100. The route policy is named myPolicy:

Switch(config)#ip community-list ALPHA-COMMUNITY permit 101:200
Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# match community ALPHA-COMMUNITY exact
Switch(config-route-map)# set weight 100 

Verify the settings with the show route-map command

maximum-paths

To control the maximum number of parallel routes that an IP routing protocol can support, use the maximum-paths command in router configuration mode.

maximum-paths NUMBER-PATHS

Syntax Description
NUMBER-PATHS	Maximum number of parallel routes that an IP routing protocol installs in a routing table; valid values are from 1 to 8.

Default NUMBER-PATHS: 6

Command Mode Global configuration

Usage Guideline None

Example The following example shows how to allow a maximum of 8 paths to a destination for an Open Shortest Path First (OSPF) routing process::

Router(config)# maximum-paths 8

Verify the settings by entering the show ip route summary command.

max-rcv-frame-size

Use the command to set the maximum Ethernet frame size allowed. Use the default form to restore the default max-rcv-frame-size size.

max-rcv-frame-size BYTES

default max-rcv-frame-size

Syntax Description

BYTES Set the maximum Ethernet frame size allowed. The range is 1536 to 9728 bytes.

Default BYTES: 1536 bytes

Command Mode Interface command for physical port and port channel but not for VLAN.

Usage Guideline

Oversize frames will be dropped and the check is done within the ingress ports.

Use the command to transfer large frames or jumbo frames through the switch system to optimize server-to-server performance.

When a port is removed from the port-channel member list, the max-rcv-frame-size setting for the port will be reset to the default setting.

Examples This example shows how to set max-rcv-frame-size as 6000 bytes at eth4.1

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if) max-rcv-frame-size 6000
Switch(config-if)# end

This example shows how to restore the default max-rcv-frame-size

Switch# configure terminal
Swtich(config)# interface eth4.1
Switch(config-if)# default max-rcv-frame-size
Switch(config-if)# end

Verify the settings by entering the show interface command.

mgmt-if

Use this command to enter into the management interface mode. Commands entered in this mode will be applied to the management port.

mgmt-if

Syntax None

Default None

Command Mode Global configuration

Usage Guideline None

Example The following example displays how to enter the management interface mode.

Switch(config)# mgmt-if
Switch(mgmt-if)# 

Verify the settings using the show mgmt-if command.

monitor session

Use monitor session to create a port mirroring session, allowing source ports as mirrored ports to be monitored through a destination port. Use the no form of this command to delete all or a specific port mirroring session, or remove either a destination port or a source port within a specific port mirroring session.

monitor session SESSION-NUMBER destination interface INTERFACE-ID

monitor session SESSION-NUMBER source interface INTERFACE-ID [, | - ] [both | rx | tx ]

no monitor session SESSION-NUMBER destination interface INTERFACE-ID

no monitor session SESSION-NUMBER source interface INTERFACE-ID [, | - ] [ both | rx | tx]

no monitor session [ SESSION-NUMBER ]

Syntax Description
SESSION-NUMBER	Specifies the session number identified with the port mirroring session.
destination	Specifies the port mirroring destination. A destination can be a physical port or a port channel.
source Specifies the port mirroring source. A source can be a physical port or a port channel.
interfaceINTERFACE-ID	Specifies the destination or source interface for a port mirroring session. For both source and destination interfaces, physical ports and port-channel interfaces are valid interface types.
,(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space before and after the comma.
-(Optional) Specifies a range of interfaces. No space before and after the hyphen.
both, rx, tx	(Optional) Specifies the traffic direction to monitor. If not specified, the source interface sends both transmitted and received traffic.

Default Not configured

Command Mode Global configuration

Usage Guideline The following applies to monitoring:

• A desination port and source port cannot be the same port.
• A port-channel can be specified as a monitor source or as a monitor destination.
• A channel-group member port cannot be specified as a monitor source port or destination port.
• For a monitor session, multiple source interfaces can be specified. However, only one destination interface can be specified. An interface cannot

be a source interface of one session and destination port of another session simultaneously.

• For a destination port, all the layer 2 settings configured for this port are all ineffective.
• IEEE 802.1x authentication on a port cannot be enabled for a destination port, but is allowed on the source port.

Entering no monitor session without specifying a session number deletes all port mirroring sessions.

Examples

This example shows how to create a port mirroring session with session number 1. It assigns a physical port (eth3.1) as a destination port and three source physical ports (eth3.2, eth3.3, and eth3.4) as mirrored ports.

Switch# configure terminal
Switch(config)# monitor session 1 destination interface eth3.1
Switch(config)# monitor session 1 source interface eth3.2-3.4
Switch(config)# end

This example shows how to remove two source ports from a created port mirroring session with session number 1.

Switch# configure terminal
Switch(config)# no monitor session 1 source interface eth3.2,eth3.4
Switch(config)# end

Verify the settings by entering the show monitor session command.

mtu

Use the command to set the MTU value. This value is used to monitor oversize IP packets. Use default form to restore to the default mtu size.

mtu BYTES

default mtu

Syntax Description

BYTES Set the monitor threshold. The settable range is 1280 to 9692 bytes.

Default BYTES: 1500 bytes

Command Mode Interface command for physical port and port channel but not for VLAN.

Usage Guideline

Oversize packets will be sent to the control module blade for further processing and the check is done in egress ports. This is especially important to support IPv6 because an IPv6 router should send out ICMP messages to source device for an MTU violation situation.

As a port is removed from the port-channel member list, the MTU setting for the port will be reset to the default setting.

One should set appropriate values to these MTUs to avoid unexpected results. In the general case, max- rcv-frame-size is larger than the ip mtu and mtu to cover L2 header size. mtu is set as the same value as ip mtu.

Examples This example shows how to set mtu as 6000 bytes at eth4.1

Switch# configure terminal
Switch(config)# interface eth4.1
Switch(config-if) mtu 6000
Switch(config-if)# end

This example shows how to restore the default mtu

Switch# configure terminal
Swtich(config)# interface eth4.1
Switch(config-if)# default mtu
Switch(config-if)# end

Verify the settings by entering the show interface command

multicast filtering-mode

Use the multicast filtering mode command to configure the method how an interface handles unknown multicast packets.

multicast filtering-mode { forward-all | forward-unregistered | filter-unregistered }

Syntax Description
forward-all Flood all multicast packets based on VLAN domain.
forward-unregistered	Forward the registered multicast packet based on forwarding table, and flood all un-registered multicast packets based on VLAN domain.
filter-unregistered	Forward the registered packets based on forwarding table, and filter all un-registered multicast packets.

Default forward-unregistered

Command Mode Interface configuration

Usage Guideline Only VLAN interfaces support this command.

Example This example shows how to set the multicast filtering mode to filter-unregistered.

Switch(config)# interface vlan1
Switch(config-if)# multicast filtering-mode filter-unregistered 

Verify the setting by entering the show multicast filtering-mode command.

name

Use the name command to set the name of an MST region. To return to the default name, use the no form of this command.

name NAME

no name

Syntax Description

NAME The name given for a specified MST region. The name string has a maximum length of 32 characters and the type is a general string which allows spaces.

Default NAME: (The MAC Address of the Bridge)

Command Mode MST configuration

Usage Guideline

If two or more switches have the same VLAN mapping and configuration version number, the switches are considered to be in different MST regions if the region names are different. Use the name command to differentiate MST regions.

Caution: Use care when the name command is used to set the name of an MST region. A mistake can put the switch in a wrong or different region. The MST region name is a case-sensitive parameter.

Example

This example shows how to configure the MSTP configuration name to 'alpha'.

Switch(config)#spanning-tree mst configuration
Switch(config-mst)# name alpha

Verify the settings by entering the show spanning-tree mst configuration command.

neighbor

Use the neighbor command to define a neighboring router with which to exchange routing information. Use the no form to remove an entry.

neighbor IP-ADDRESS

no neighbor IP-ADDRESS

Syntax Description

IP-ADDRESS

IP address of a peer router with which routing information will be exchanged.

Default Not configured

Command Mode Router configuration

Usage Guideline

This command allows point-to-point (non-broadcast) exchange of routing information. Additional neighbors or peers can be specified using multiple neighbor commands.

When used in combination with the passive-interface router configuration command, routing information can be exchanged between a subset of routers and access servers on a LAN.

Example

In the following example, RIP updates are sent to all interfaces except vlan1 on network 10.0.0.0/8. However, in this case a neighbor router configuration command is included. This command permits routing updates to be sent to specific neighbors. One copy of the routing update is generated per neighbor:

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# network 10.0.0.0/8
Switch(config-router)# passive-interface vlan1
Switch(config-router)# neighbor 10.50.71.50 

Verify the settings by entering the show ip protocols rip command

neighbor (RIP IPv6)

To define a neighboring router with which to exchange routing information, use the neighbor command in router configuration mode. Use the no form of the command to remove an entry.

neighbor IPv6-ADDRESS IFNAME

no neighbor IPv6-ADDRESS IFNAME

Syntax Description
IPv6-ADDRESS	IPv6 link-local address of a router with which routing information will be exchanged.
IFNAME The specified interface type and interface number

Default Not configured

Command Mode Router configuration

Usage Guideline	This command permits the point-to-point exchange of routing information.
	Multiple neighbor commands can be used to specify additional neighbors or peers.
	When it is used in combination with the passive-interface router configuration command, routing information can be exchanged between a subset of routers and access servers on a LAN.
Example	In the following example, RIPng updates are sent to a specified interface vlan1 on fe80::1. This command permits routing updates to be sent to specific neighbors. One copy of the routing update is generated per neighbor:

Switch# configure terminal
Switch(config)# router ipv6 rip
Switch(config-router)# neighbor fe80::1 vlan1 

Verify the settings by entering the show ipv6 rip database command

neighbor advertisement-interval

Use this command to set the minimum interval between each transmission of Border Gateway Protocol (BGP) routing updates. Use the no form of the command to return to the default configuration.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } advertisement-interval SECONDS

default neighbor { IP-ADDRESS | PEER-GROUP-NAME } advertisement-interval

Syntax Description
IP-ADDRESS Specifies IP address prefixes.
PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.
SECONDS	The interval, in seconds, between each transmission of UPDATE messages. The range is from 1 to 600.

Default SECONDS: 30 seconds for external peers

SECONDS: 5 seconds for internal peers

Command Mode Address family configuration

Router configuration

Usage Guideline When a BGP peer group is specified using the PEER-GROUP-NAME argument, all the members of the peer group inherit the characteristic configured with this command.

Example The following address family configuration mode example sets the minimum time between sending BGP routing updates to 15 seconds:

Switch(config)# router bgp 65100
Switch(config-router)# address-family ipv4
Switch(config-router-af)# neighbor 10.4.4.4 advertisement-interval 15 

Verify the settings by entering the show ip bgp neighbor command.

neighbor description

Use this command to associate a text description with a neighbor. Use the no form of the command to remove the description.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } description TEXT

no neighbor { IP-ADDRESS | PEER-GROUP-NAME } description

Syntax Description

IP-ADDRESS Specifies IP address prefixes.

PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.

TEXT Specifies a descriptive string for the neighbor. The maximum length is 80 characters. The syntax is a general string that allows space.

Default None

Command Mode Router configuration

Usage Guideline

When a BGP peer group is specified using the PEER-GROUP-NAME argument, all the members of the peer group inherit the characteristics configured with this command.

Example

The following example shows how to configure a description for the neighbor 172.16.10.10:

Switch(config)# router bgp 65100
Switch(config-router)# neighbor 172.16.10.10 description ABC in China 

Verify the settings by entering the show ip bgp neighbor command.

neighbor filter-list

Use this command to create a BGP filter. Use the no form of the command to disable this function.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } filter-list AS-PATH-LIST-NAME { in | out }

no neighbor { IP-ADDRESS | PEER-GROUP-NAME } filter-list AS-PATH-LIST-NAME { in | out }

Syntax Description

IP-ADDRESS Specifies the IP address prefix.

PEER-GROUP-NAME The name of a Border Gateway Protocol (BGP) peer group.

AS-PATH-LIST-NAME The name of an autonomous system path access list. Define this access list with the ip as-path access-list command.

Default Disabled

Command Mode Router configuration

Usage Guideline

This command specifies an access list filter for updates based on BGP autonomous system paths. Each filter is an as-path access list based on regular expressions.

Each neighbor can only have 1 in and 1 out access list.

Example The following example shows how to configure the BGP neighbor with IP address 172.16.1.1 to not send advertisements about any path which is through or from the adjacent autonomous system 123:

Switch(config)# ip as-path access-list myacl deny _123_
Switch(config)# ip as-path access-list myacl deny ^123$
Switch(config)# ip as-path access-list myacl permit .* 
Switch(config)# router bgp 65100
Switch(config-router)# network 10.108.0.0
Switch(config-router)# neighbor 192.168.6.6 remote-as 123
Switch(config-router)# neighbor 172.16.1.1 remote-as 47
Switch(config-router)# neighbor 172.16.1.1 filter-list myacl out 

Verify the settings, in User Exec Mode, by entering the show ip protocols bgp command.

neighbor peer-group (create group)

Use this command to create a peer group. Use the no form of the command to remove a peer group.

neighbor PEER-GROUP-NAME peer-group

no neighbor PEER-GROUP-NAME peer-group

Syntax Description

PEER-GROUP-NAME Name of the BGP peer group

Default Not configured

Command Mode Router configuration

Address family configuration

Usage Guideline

Often in a BGP or multiprotocol BGP speaker, multiple neighbors are configured with the same update policies (that is, the same outbound route maps, distribution lists, filter lists, update source, and so on).

Neighbors with the same update policies can be grouped into peer groups to simplify configuration and make update calculations more efficient.

Example This example shows how to create a peer group named ALPHA-GROUP

Switch(config)# router bgp 65100
Switch(config-router)# neighbor ALPHA-GROUP peer-group 

neighbor peer-group (add group member)

Use this command to add a neighbor into a peer group. Use the no form of the command to remove a neighbor from a peer group.

neighbor IP-ADDRESS peer-group PEER-GROUP-NAME

no neighbor IP-ADDRESS peer-group PEER-GROUP-NAME

Syntax Description

IP-ADDRESS IP address of the neighbor.

PEER-GROUP-NAME Name of the BGP peer group

Default None

Command Mode Router configuration

Address family configuration

Usage Guideline

The neighbor at the specified IP address inherits all the configured options of the peer group.

Example This example shows how to add a group member 10.1.1.254 to the peer group, named ALPHA-GROUP.

Switch(config)# router bgp 65100
Switch(config-router)# neighbor ALPHA-GROUP peer-group
Switch(config-router)# neighbor 10.1.1.254 peer-group ALPHA-GROUP 

Verify the settings by entering the show ip bgp neighbor command in User EXEC mode.

neighbor remote-as

Use this command to add an entry to the Border Gateway Protocol (BGP) neighbor table. Use the no form of this command to remove an entry from the table.

neighbor { IP-ADDRESS | PEER-GROUP-NAME} remote-as AS-NUMBER

no neighbor { IP-ADDRESS | PEER-GROUP-NAME} remote-as AS-NUMBER

Syntax Description

IP-ADDRESS IP address of the neighbor.

PEER-GROUP-NAME The Name of a BGP peer group.

AS-NUMBER The number of autonomous system to which the neighbor belongs. Range for 2-byte numbers is 1 to 65535. Range for 4-byte numbers is 65536 to 4294967295 or 1.0 to 65535*65535.

Default Not configured

Command Mode Router configuration

Usage Guideline

Use this command to add the IP address of the neighbor, in the specified autonomous system, to the BGP neighbor table of the local router.

Specifying a neighbor with an autonomous system number, that matches the autonomous system number specified in the router bgp global configuration command, identifies the neighbor as internal to the local autonomous system. Otherwise, the neighbor will be considered as external.

When a BGP peer group is specified using the PEER-GROUP-NAME argument, all the members of the peer group inherit the characteristics configured with this command.

By default, neighbors that are defined using the neighbor remote-as command in router configuration mode exchange only unicast address prefixes.

Example
This example shows how to specify a router with the address 10.108.2.1 as a neighbor in autonomous system number 110:

Switch(config)# router bgp 65100
Switch(config-router)# network 10.108.0.0
Switch(config-router)# neighbor 10.108.2.1 remote-as 110 

Verify the settings by entering the show ip bgp neighbor command.

neighbor route-map

Use this command to apply a route map to incoming or outgoing routes. Use the no form of the command to remove the route map.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } route-map MAP-NAME { out }

no neighbor { IP-ADDRESS | PEER-GROUP-NAME } route-map MAP-NAME { out }

Syntax Description

IP-ADDRESS Specifies IP address prefixes.

PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.

MAP-NAME Name of the route map.

out Applies the route-map to the outgoing routes.

Default None

Command Mode Address family configuration

Router configuration

Usage Guideline

When issued in address family configuration mode, this command applies a route map to that particular address family only. When issued in router configuration mode, this command applies a route map to IP Version 4 unicast routes only.

If an outbound route map is specified, it is proper behavior to only advertise routes that match at least one section of the route map.

When a BGP peer group is specified using the PEER-GROUP-NAME argument, all the members of the peer group inherit the characteristic configured with this command. Specifying the command for a neighbor overrides the inbound policy that is inherited from the peer group.

Example

The following example in router configuration mode applies a route map named internal-map to a BGP outgoing route from 172.16.70.24:

Switch(config)#router bgp 5
Switch(config)#neighbor 172.16.70.24 route-map internal-map out
Switch(config)#route-map internal-map permit 10
Switch(config-route-map)#match as-path 1
Switch(config-route-map)#set origin incomplete
Swtch(config-route-map)#end
Switch(config)# 

Verify the settings by entering the show ip bgp neighbor command.

neighbor send-community

Use this command to specify that the communities attribute should be sent to a BGP neighbor, use the no form of this command to remove the entry.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } send-community [both | standard | extended]

no neighbor { IP-ADDRESS | PEER-GROUP-NAME } send-community [both | standard | extended]

Syntax Description

IP-ADDRESS Specifies IP address prefixes.

PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.

both (Optional) Specifies that both standard and extended communities will be sent.

standard (Optional) Specifies that only standard communities will be sent.

extended (Optional) Specifies that only extended communities will be sent.

Default None

Command Mode Address family configuration

Router configuration

Usage Guideline

When a BGP peer group is specified using the PEER-GROUP-NAME argument, then all the members of the peer group inherit the characteristics configured with this command.

Example
The following example, using the address family configuration mode, sets the send-community with the both option (standard and extended):

Switch(config)# router bgp 65100
Switch(config-router)# address-family ipv4
Switch(config-router-af)# neighbor 10.4.4.4 send-community both 

Verify the settings by entering the show ip bgp neighbor command.

neighbor shutdown

Use this command to disable a neighbor or peer group. Use the no form of this command to re-enable a neighbor or peer group.

neighbor { IP-ADDRESS | PEER-GROUP-NAME} shutdown

no neighbor { IP-ADDRESS | PEER-GROUP-NAME} shutdown

Syntax Description

IP-ADDRESS Specifies IP address prefixes.
PEER-GROUP-NAME	Name of a Border Gateway Protocol (BGP) peer group.

Default None

Command Mode Router configuration

Usage Guideline

Use this command to terminate any active session for the specified neighbor or peer group and remove all associated routing information. In the case of a peer group, a large number of peering sessions could be suddenly terminated.

Example

The following example shows how to disable any active session for the neighbor 172.16.10.10:

Switch(config)# router bgp 65100
Switch(config-router)# neighbor 172.16.10.10 shutdown 

Verify the settings by entering the show ip bgp neighbor command.

neighbor timers

Use this command to set the timers for a specific BGP peer or peer group. Use the no form of this command to clear the timers for a specific BGP neighbor.

neighbor { IP-ADDRESS | PEER-GROUP-NAME} timers KEEP-ALIVE HOLD-TIME

no neighbor { IP-ADDRESS | PEER-GROUP-NAME} timers

Syntax Description
IP-ADDRESS Specifies IP address prefixes.
PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.
KEEP-ALIVE The frequency (in seconds) that specifies how often the switch sends keepalive messages to its peer. The default is 60 seconds. The range is from 0 to 65535.
HOLD-TIME	The elapsed time (in seconds) after not receiving a keepalive message that the software declares a peer dead. The default is 180 seconds. The range is from 0 to 65535.

Default KEEPALIVE: 60 seconds

HOLDTIME: 180 seconds

Command Mode Router configuration

Usage Guideline The timers configured for a specific neighbor, or peer group, override the timers configured for all BGP neighbors using the timers bgp command.

Example The following example shows how to configure the KEEP-ALIVE timer to 120 seconds and the HOLD-TIME timer to 360 seconds for the neighbor 172.16.10.10:

Switch(config)# router bgp 65100
Switch(config-router)# neighbor 172.16.10.10 timer 120 360 

Verify the settings by entering the show ip bgp neighbor command.

neighbor update-source

Use this command to allow internal BGP sessions to use any operational interface for TCP connections. Use the no form of this command to restore the interface assignment to the closest interface.

neighbor { IP-ADDRESS | PEER-GROUP-NAME } update-source INTERFACE-ID

no neighbor { IP-ADDRESS | PEER-GROUP-NAME } update-source INTERFACE-ID

Syntax Description

IP-ADDRESS Specifies IP address prefixes

PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group

INTERFACE-ID Specifies the interface ID

Default The best local address is used.

Command Mode Router configuration

Usage Guideline Use this command in conjunction with any specified interface on the router.

Example The following example shows how to configure the internal BGP sessions to use VLAN 1 for the neighbor 172.16.10.10:

Switch(config)# router bgp 65100
Switch(config-router)# neighbor 172.16.10.10 update-source vlan1 

Verify the settings by entering the show ip bgp neighbor command.

neighbor weight

Use this command to specify the weight associated with a specific neighbor. To remove a weight assignment, use the no form of this command.

neighbor {IP-ADDRESS | PEER-GROUP-NAME} weight NUMBER

no neighbor {IP-ADDRESS | PEER-GROUP-NAME} weight

Syntax Description

IP-ADDRESS Specifies IP address prefixes.

PEER-GROUP-NAME Name of a Border Gateway Protocol (BGP) peer group.

weight NUMBER Weight to assign. Acceptable values are from 0 to 65535.

Default Routes learned through another BGP peer have a default weight: 0

Routes sourced by the local router have a default weight: 32768.

Command Mode Address family configuration

Router configuration

Usage Guideline The weight specified by this command determines the weight to be associated with the routes learned from a specified neighbor.

Example The following address family configuration mode example sets the weight of the neighbor 10.4.4.4 to 10000:

Switch(config)# router bgp 65100
Switch(config-router)# address-family ipv4
Switch(config-router-af)# neighbor 10.4.4.4 weight 10000 

Verify the settings by entering the show ip bgp neighbor command.

netbios node-type

This command is used to configure the NetBIOS node's type for Microsoft Dynamic Host Configuration Protocol (DHCP) clients. Use the no form of this command to restore the configuration of the NetBIOS node's type back to default configuration (Hybrid).

netbios node-type NTYPE

no netbios node-type

Syntax Description

NTYPE Specifies the type of NetBIOS node. Valid types are listed below:

• b-node - Broadcast
• p-node - Peer-to-peer
• m-node - Mixed
  • h-node - Hybrid (recommended)

Default NTYPE: h-node

Command Mode DHCP pool configuration

Usage Guideline

This command configures the NetBIOS node's type; the recommended type is h-node (Hybrid). It determines what methods NetBios will use to register and resolve names.

• b-node - The broadcast system uses broadcasts.
• p-node - A p-node system uses only point-to-point name queries to a name server (WINS).
• m-node - An m-node system broadcasts first, and then queries the name server.
• Hybrid - A hybrid system queries the name server first, and then broadcasts.

Resolution through LMHOSTS and/or Domain Name Service (DNS), if enabled, will follow these methods.

Example The following is sample of configuring the Netbios node type as h-node.

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# netbios node-type h-node 

netbios scope-id

This command configures the NetBIOS scope id for Microsoft Dynamic Host Configuration Protocol (DHCP) clients. Use the no form of this command to remove the configuration of NetBIOS scope id.

netbios scope-id STRING

no netbios scope-id

Syntax Description

STRING A character string. The maximum length is 18 characters.

Default None

Command Mode DHCP pool configuration

Usage Guideline

The Scope ID is a character string which is appended to the NetBIOS name for all NetBIOS communications over TCP/IP. It provides a method to isolate a collection of computers that can then only communicate with each other.

Example

The following is sample of configuring the NetBIOS Scope ID as the string "alpha".

switch#configure terminal
switch(config)#ip dhcp pool pool1
switch(config-dhcp)#netbios scope-id alpha
switch(config-dhcp)# 

netbios wins-server

To configure the IP address of a WINS server for Microsoft Dynamic Host Configuration Protocol (DHCP) clients. Use the no form of this command to remove the configuration of WINS server.

netbios wins-server [IP-ADDRESS]

no netbios wins-server [IP-ADDRESS]

Syntax Description

IP-ADDRESS The IP address of the WINS server.

Default Not configured

Command Mode DHCP pool configuration

Usage Guideline

This command is used to configure a primary and secondary WINS server. The primary preference is the old WINS. The maximum number of configurable WINS servers is dependent on each project.

Examples The following example configures a primary WINS server as 10.1.1.100.

switch(config-dhcp)#netbios wins-server 10.1.1.100

The following example configures a secondary WINS server as 10.1.1.200.

switch(config-dhcp)#netbios wins-server 10.1.1.200

The following example removes the WINS server 10.1.1.100 so that 10.1.1.200 becomes the primary WINS server.

switch(config-dhcp)#no netbios wins-server 10.1.1.100

network

Use the command to specify that the network utilizes Routing Information Protocol (RIP). To remove an RIP network entry, use the no form of this command.

network NETWORK-PREFIX / MASK

no network NETWORK-PREFIX / MASK

Syntax Description

NETWORK-PREFIX / MASK	The network prefix and the prefix length specify the destination network in the form of xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx or xxx.xxx.xxx.xxx/x.
	Example: 10.9.18.2 255.0.0.0 or 10.9.18.2/8

Default Not configured

Command Mode Router configuration

Usage Guideline

Use this command to specify networks to which routing updates are sent and received. If a network is not specified, the interfaces in that network will not be advertised in any RIP update.

Example

The following example shows how to define RIP as the routing protocol to be used on all interfaces connected to networks 192.168.70.0/24 and network 10.99.0.0/16

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# network 192.168.70.0/24
Swtch(config-router)# network 10.99.0.0/16
Switch(config-router)# end 

Verify the settings by entering the show ip protocols rip command.

network (BGP)

Use this command to configure the networks to be advertised by the Border Gateway Protocol (BGP) protocol. To remove an entry from the routing table, use the no form of this command.

network { NETWORK-NUMBER [/SUBNET-LENGTH] | NETWORK-NUMBER [mask NETWORK-NUMBER]} [route-map MAP-TAG]

no network { NETWORK-NUMBER [/SUBNET-LENGTH] | NETWORK-NUMBER [mask NETWORK-NUMBER]} [route-map MAP-TAG]

Syntax Description

NETWORK-NUMBER Specifies the number of the network that BGP will advertise.
SUBNET-LENGTH*	(Optional) Specifies the prefixlength of the network or sub-network.
mask NETWORK-NUMBER*	(Optional) Specifies the network or sub-network mask with a mask address.
route-map MAP-TAG	(Optional) Specifies the identifier of a configured route map. The route map should be examined to filter the networks to be advertised. If not specified, all networks are advertised.

* Note: Specification of the sub-network can be in the form of a subnet mask or a stated length. It is recommended to use the subnet mask form as xxx.xxx.xxx.xxx which is similar to Windows or Linux OS setting. However, that form will be interchangeable between for example, 10.9.18.2/8 and 10.9.18.2 255.0.0.0.

Default None

Command Mode Router configuration

Address family configuration

Usage Guideline

BGP networks are learned from connected routes, from dynamic routing and from static route sources.

Use this command to specify a network as local to this autonomous system; this will then add it to the BGP routing table. For exterior protocols, the network command controls which networks are advertised. Interior protocols use the network command to determine where to send updates.

When the synchronized state is enabled, BGP advertises a network entry if the router has the route information for the entry

Example The following example sets up network 10.108.0.0 to be included in the BGP updates for the AS number of 65100

Switch(config)# router bgp 65100 Switch(config-router)# network 10.108.0.0

network area

Use this command to enable OSPF routing with a specified Area ID. It enables this routing on interfaces with IP addresses that match the specified network address. Use the no parameter with this command to remove the configuration and disable OSPF routing on the interfaces.

network SUBNET-PREFIX/ SUBNET-MASK-LENGTH area AREA-ID

network SUBNET-PREFIX SUBNET-MASK area AREA-ID

no network SUBNET-PREFIX/ SUBNET-MASK-LENGTH area AREA-ID

no network SUBNET-PREFIX SUBNET-MASK area AREA-ID

Syntax Description
SUBNET-PREFIX Specifies the address A.B.C.D IPv4 network prefix.
SUBNET-MASK-LENGTH	Specifies the IPv4 network prefix length.
SUBNET-MASK Specifies the subnet mask used by the network.
AREA-ID	Specifies the identifier of the area for which a VLAN interface is to be enabled.The identifier can be specified as either an IP address or a decimal value.

Default None

Command Mode Router configuration

Usage Guideline OSPF routing can be enabled per IPv4 subnet basis. Each subnet can belong to one particular OSPF area. Network addresses can be defined using the prefix length or a wild card mask.

If there are conflicts, error messages will be returned.

Example The following example shows how to define OSPF area 3 for the interfaces belonging to 10.0.0.0/8:

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# network 10.0.0.0/8 area 3 

Verify the settings with the show ip ospf command.

next-server

Configure the next server in a DHCP client's boot process. Use the no form of this command to remove the boot server list.

next-server IP-ADDRESS

no next-server

Syntax Description

IP-ADDRESS

The IP address of next-server in a DHCP client's boot process.

Default Not configured

Command Mode DHCP pool configuration

Usage Guideline

The configured IP addresses of next-server are used as a boot server in the DHCP client's boot process. Typically, servers are Trivial File Transfer Protocol (TFTP) servers and are listed in order of preference.

Example

The following is a sample of configuring 10.1.1.1 as the IP address of next-server in the DHCP client's boot process in pool named "pool1"

switch# configure terminal
switch(config)# ip dhcp pool pool1
switch(config-dhcp)# next-server 10.1.1.1 

passive-interface

Use the passive-interface command to disable sending OSPF protocol packets on an interface. To re-enable sending and receiving routing updates, use the no form of this command.

passive-interface IFNAME

no passive-interface IFNAME

Syntax Description

IFNAME Specifies a layer 3 interface (VLAN).

Default Routing updates are sent on the interface.

Command Mode Router configuration

Usage Guideline The valid interface for this configuration is VLAN.

If an interface is passive, no adjacency can be formed on the passive interface and the OSPF protocol packets are not sent or received through the specified interface. However, the network of the passive interface will be advertised through another non-passive interface.

Example This command shows how to set interface VLAN 1 to the passive mode.

Switch# configure terminal
Switch (config)# router ospf
Switch(config-router)##passive-interface vlan1 

Verify the settings by entering the show ip ospf interface command.

passive-interface (IPv6 OSPF)

To disable sending IPv6 OSPF protocol packets on an interface, use the passive-interface command. To re-enable sending and receiving routing updates, use the no form of this command.

passive-interface IFNAME

no passive-interface IFNAME

Syntax Description

IFNAME Interface type and number i.e VLAN 1.

Default

Routing updates are sent and received on all interfaces where the routing protocol is enabled.

No interfaces are configured as passive.

Command Mode Router configuration

Usage Guideline

If the sending of routing updates is disabled on an interface, the particular address prefix will continue to be advertised to other interfaces, and updates from other routers on that interface continue to be received and processed.

IPv6 OSPF routing information is neither sent nor received through the specified router interface. The specified interface address appears as a stub network in the IPv6 OSPF domain.

Example The following example sets interface VLAN 1 to the passive mode:

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router)# passive-interface vlan1 

Verify the settings by entering the show ipv6 ospf interface command.

passive interface (RIP)

To disable sending routing updates on an interface, use the passive-interface command. To re-enable sending routing updates, use the no form of this command.

passive-interface IFNAME

no passive-interface IFNAME

Syntax Description

IFNAME Specifies the Interface type and Interface number.

Default Routing updates are sent on the interface.

Command Mode Router configuration

Usage Guideline

If the sending of routing updates is disabled on an interface, the particular subnet will continue to be advertised to other interfaces. In addition, updates from other routers on that interface will continue to be received and processed.

Examples

The following example shows how to disable sending routing updates on the interface VLAN 1:

Switch# configure terminal
Switch(config)#router rip
Switch(config-router)# passive-interface vlan1
Switch(config-router)#exit
Switch(config)# 

Verify the settings by entering the show ip rip interface command.

passive-interface (RIP IPv6)

To disable sending routing updates on an interface, use the passive-interface command. To re-enable sending routing updates, use the no form of this command.

passive-interface IFNAME

no passive-interface IFNAME

Syntax Description

IFNAME Specifies the Interface type and Interface number.

Default Routing updates are sent on the interface.

Command Mode Router configuration

Usage Guideline

If the sending of routing updates is disabled on an interface, the particular subnet will continue to be advertised to other interfaces. In addition, updates from other routers on that interface will continue to be received and processed.

Example The following example shows how to disable sending routing updates on the interface VLAN 1:

Switch# configure terminal
Switch(config)#router ipv6 rip
Switch(config-router)# passive-interface vlan1
Switch(config-router)#exit 

Verify the settings by entering the show ipv6 rip interface command.

password encryption

Use the password encryption command to enable encryption of the password defined by both:

- the username command

- and -

- the enable command

before they are stored in the configuration file. Using the no command will disable the encryption.

password encryption

no password encryption

Syntax None

Default Disabled

Command Mode Global configuration at privilege level 15

Usage Guideline

The user account configuration information will be stored in the configuration file, and can be applied to the system later.

If the password encryption is enabled, the password will be in encrypted form.

When password encryption is disabled, and the user specifies the password in plain text form, the password will be in plain text form. However, if the user specifies the password in encrypted form, or if the password has been converted to encrypted form by the last enable password encryption command, the password will stay in the encrypted form. Once in the encrypted form it cannot revert to plaintext.

Example

The below example shows how to enable password encryption.

Switch(config)# password encrypt

Verify the settings by entering the show system protocol-state command.

periodic

Use the periodic command to specify the period of time to be covered in a time range profile.

periodic { daily HH:MM to HH:MM | monthly DATE HH:MM to [DATE] HH:MM | weekly WEEKLY-DAY HH:MM to [WEEKLY-DAY] HH:MM }

Syntax Description
daily HH:MM to HH:MM	Specifies the time of day with an hour:minute format HH:MM, using a 24-hour clock (for example, 14:30). The first HH:MM time entered must be earlier than the second HH:MM. Note: The HH range is 00 ~ 23; The MM range is 00 ~ 59.
weekly WEEKLY-DAY HH:MM to [ WEEKLY-DAY] HH:MM	Specifies the day of the week and time of day in the format day HH:MM, where the day of the week name is used i.e. monday, tuesday, wednesday, thursday, friday, saturday, and sunday.If the ending day of the week is the same as the starting day of the week, it can be omitted (then it is the same as the daily format).
monthly DATE HH:MM to [ DATE] HH:MM	Specifies the numeric date, from 1 to 31, and the time of day, in the format DATE HH:MM.If the day does not exist on the calender, the specified time period will be skipped. For example, since April has only 30 days an entry such as “April 31” will be ignored.

Default None

Command Mode Time-range configuration

Usage Guideline

Up to 6 periods can be specified in the same profile. A new period entry can partially overlap an older existing one. If a new period's starting and the ending time are identical to a previous entry, a warning message is displayed and the configuration will not be accepted.

Note: To remove an individual period entry delete the time-range and then create a new time-range to which the correct period entry can be added.

Example

This example shows how to make a time-range which includes the periods daily 09:00 to 12:00, 00:00 Saturday to 23:59 Sunday, and 19:00 of the 1st day to 17:00 of the 2nd day of every month.

Switch(config)#time-range rdtim
Switch(config-time-range)#periodic daily 9:00 to 12:00
Switch(config-time-range)#periodic weekly saturday 00:00 to sunday 23:59
Switch(config-time-range)#periodic monthly 1 19:00 to 2 17:00
Switch(config)#end 

Verify the settings by entering the show time-range command.

permit | deny (ip access-list)

Use the permit command to define the rule for packets to be access based on their IP header information. Use the no permit command to remove a permit entry. Use the deny command to add a deny entry. Use the no deny command to remove a deny entry.

{ permit | deny } tcp { any | host SRC-IP-ADDR | SRC-IP-ADDR MASK } [ OPERATOR PORT ] { any | host DST-IP-ADDR | DST-IP-ADDR MASK } [ OPERATOR PORT ] [ precedence PRECEDENCE | tos TOS | dscp DSCP ] [time-range PROFILE-NAME ] [ priority PRIORITY ]

{ permit | deny } udp { any | host SRC-IP-ADDR | SRC-IP-ADDR MASK } [ OPERATOR PORT ] { any | host DST-IP-ADDR | DST-IP-ADDR MASK } [ OPERATOR PORT ] [ precedence PRECEDENCE | tos TOS | dscp DSCP ] [ time-range PROFILE-NAME ] [ priority PRIORITY ]

{ permit | deny } [ gre | esp | eigrp | icmp | igmp | ospf | pim | vrrp | protocol-id PROTOCOL-ID ] { any | host SRC-IP-ADDR | SRC-IP-ADDR MASK } { any | host DST-IP-ADDR | DST-IP-ADDR MASK } [ precedence PRECEDENCE | tos TOS | dscp DSCP ] [ time-range PROFILE-NAME ] [ priority PRIORITY ]

no { permit | deny } tcp { any | host SRC-IP-ADDR | SRC-IP-ADDR MASK} [OPERATOR PORT] { any | host DST-IP-ADDR | DST-IP-ADDR MASK} [OPERATOR PORT] [precedence PRECEDENCE|tos TOS|dscp DSCP] [time-range]

no { permit | deny} udp { any | host SRC-IP-ADDR | SRC-IP-ADDR MASK } [ OPERATOR PORT ] { any | host DST-IP-ADDR | DST-IP-ADDR MASK } [ OPERATOR PORT ] [ precedence PRECEDENCE | tos TOS | dscp DSCP ] [ time-range ]

no { permit | deny } [ gre | esp | eigrp | icmp | igmp | ospf | pim | vrrp | protocol-id PROTOCOL-ID ] {any | host SRC-IP-ADDR | SRC-IP-ADDR MASK } { any | host DST-IP-ADDR | DST-IP-ADDR MASK } [ precedence PRECEDENCE | tos TOS | dscp DSCP ] [ time-range ]

Syntax Description

any Means any source IP address or any destination IP address.
host SRC-IP-ADDR	Specifies a specific source IP address.
SRC-IP-ADDR MASK Specifies a group of source IP addresses by using mask.
host DST-IP-ADDR	Specifies a specific destination IP address.
DST-IP-ADDR MASK Specifies a group of destination IP addresses by using mask.
precedence PRECEDENCE	(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7.
dscp DSCP	(Optional) Specifies the Differentiated Services Control pointer (DSCP) value, as specified by a number from 0 to 63.
tos TOS	(Optional) Packets can be filtered by the type of service level, as specified by a number from 0 to 255.
OPERATOR PORT	(Optional) Compares source or destination port. OPERATOR can be lt (less than, match on a lower port number), gt (greater than, match on a greater port), eq (equal, match on a specific port).The PORT argument can be the L4 TCP/UDP source or destination port, as specified by a number from 0 to 65535.
time-range PROFILE-NAME	(Optional) Specifies the name of time-period profile for activation of the access-list. In the no form of the commands, this option, time-range (without PROFILE-NAME), removes the setting of the active timer-period, rather than removing the whole entry.
PRIORITY The range is 1 to 65535. The less number represents for the better priority. It represents the rule sequence number.
tcp, udp, icmp, igmp, gre, esp, eigrp, ospf, pim, vrrp	Layer 4 protocols.
PROTOCOL-ID Protocol ID refers to the protocol field in the IP header, as specified by a number from 0 to 65535.

Default None

Command Mode

Usage Guideline

ip access-list configuration or ip extended access-list configuration

An interface can have only one MAC access list, one IP access list and one IPv6 access list applied to it.

The time range profile must be created before it can be specified in the statement. Otherwise an error message will be displayed.

An error message will be displayed if the maximum number defined by the system is exceeded.

All the configurable arguments (excluding time-range and priority) can be used to differentiate one from another. These arguments are called differentiated arguments. To remove an entry with the no form of this command, it is necessary to specify the entry using the same value of all differentiating arguments that have been specified (includes all optional parameters except time-range and priority).

To update the time-range or priority, specify the entry with the same value of all differentiating arguments, that have been configured, and the update value for the time-range or priority.

The priority value must be unique in the domain of an access-list. If a priority value that is already present is entered, an error message will be shown.

Example

This example shows create three entries for an ip access-list, named "Strict-Control". The three entries are: tcp packets destined to network 10.20.0.0/16, tcp packets destined to host 10.100.1.2 and all icmp packets.

Switch(config)# ip access-list extended Strict-Control
Switch(config-ip-ext-acl)# permit tcp any 10.20.0.0 255.255.0.0
Switch(config-ip-ext-acl)# permit tcp any host 10.100.1.2
Switch(config-ip-ext-acl)# permit icmp any any
Switch(config-ip-ext-acl)# exit 

Verify the settings by entering the show access-list command.

permit | deny (ipv6 access list)

Use the permit command to add an entry to the IPv6 access-list. Use the no permit command to remove a permit entry from the IPv6 access-list. Use the deny command to add a deny entry to the IPv6 access-list. Use the no deny command to remove a deny entry from the IPv6 access-list.

{ permit | deny } {tcp | udp} { any | host SRC-IPV6-ADDR | SRC-IPV6-ADDR MASK } [ OPERATOR PORT ] { any | host DST-IPV6-ADDR | DST-IPV6-ADDR MASK } [ OPERATOR PORT ] [traffic-class TRAFFIC-CLASS ] [time-range PROFILE-NAME] [ priority PRIORITY ]

{ permit | deny } [icmpv6 | ospfv3 | nextheader NEXTHEADER] { any | host SRC-IPV6-ADDR | SRC-IPV6-ADDR MASK } { any | host DST-IPV6-ADDR | DST-IPV6-ADDR MASK } [traffic-class TRAFFIC-CLASS] [time-range PROFILE-NAME ] [priority PRIORITY ]

no { permit | deny } {tcp | udp} { any | host SRC-IPV6-ADDR | SRC-IPV6-ADDR MASK } [OPERATOR PORT ] { any | host DST-IPV6-ADDR | DST-IPV6-ADDR MASK } [OPERATOR PORT ] [traffic-class TRAFFIC-CLASS ] [time-range ]

no { permit | deny} [icmpv6 | ospfv3 | nextheader NEXTHEADER] { any | host SRC-IPV6-ADDR | SRC-IPV6-ADDR MASK} { any | host DST-IPV6-ADDR | DST-IPV6-ADDR MASK} [traffic-class TRAFFIC-CLASS ] [time-range ]

Syntax Description
Any An abbreviation for the IPv6 prefix ::/0
host SRC-IPV6-ADDR	Specifies a specific source IPv6 address.
SRC-IPV6-ADDR MASK	Specifies a source IPv6 addresses by using a mask.
host DST-IPV6-ADDR	Specifies a specific destination IPv6 address.
DST-IPV6-ADDR MASK	Specifies a group of destination IPv6 addresses by using a mask.
tcp, udp, icmpv6, ospfv3 L4 protocol type of the next header in the IPv6 header.
nexheader NEXTHEADER	The value of the nexheader in IPv6 header. The range is from 0 to 255
traffic-class TRAFFIC-CLASS	(Optional) Specifies the traffic class value in IPv6 header. The acceptable range is from 0 to 255.
OPERATOR PORT	(Optional) Compares source or destination port. OPERATOR can be lt (less than, match on a lower port number), gt (greater than, match on a greater port), eq (equal, match on a specific port).The PORT argument can be the L4 TCP/UDP source or destination port. The acceptable range is from 0 to 65535 for eq operator. The acceptable range is from 0 to 65534 for gt operator. The acceptable range is from 1 to 65534 for lt operator
time-range	(Optional) Specifies the name of time-period profile for activation the access-list.

Syntax Description

PROFILE-NAME	Used with the no form of the commands, this option, time-range (without PROFILE-NAME), means to remove the setting of an active timer-period, rather than remove the whole entry.
PRIORITY The range is 1 to 65535. The lower the number represents a better priority. It is used as the rule sequence number.

Default None

Command Mode IPv6 access-list extended configuration

Usage Guideline

The time range profile needs to be created before it can be specified in the statement. Otherwise an error message will be displayed.

All the configurable arguments (time-range and priority are excluded) can be used to differentiate one from another. These arguments are called differentiated arguments. To remove an entry, in the no form of this command, specify the entry with the same value of all differentiating arguments specified prior (includes all optional parameters but the time-range and priority are excluded).

Tto update the time-range or priority, specify the entry with the same value of all differentiating arguments, which are configured, and the update value for time-range or priority.

The priority value must be unique in the domain of an access-list. If a priority value entered is already present, an error message will be shown.

Example

This example shows create three entries for an ipv6 extended access-list, named "ipv6-control". The three entries are: permit tcp packets destined to network ff02::0:2/16, permit tcp packets destined to host ff02::1:2 and permit all icmp packets.

Switch(config)# ipv6 access-list extended ipv6-control
Switch(config-ipv6-ext-acl)#permit tcp any ff02::0:2 ffff::
Switch(config-ipv6-ext-acl)#permit tcp any host ff02::1:2
Switch(config-ipv6-ext-acl)#permit icmpv6 any any
Switch(config-ipv6-ext-acl)# exit 

Verify the settings by entering the show access-list command.

permit | deny (mac access-list)

Use the permit command to define the rule for packets to be based on their MAC address. Use the deny command to define the rule for packets that are to be denied. Use the no permit command to remove a permit entry, and use the no deny command to remove a deny entry.

{ permit | deny } { any | host SRC-MAC-ADDR | SRC-MAC-ADDR MASK } { any | host DST-MAC-ADDR | DST-MAC-ADDR MASK } [ ethernet-type TYPE | llc dsap DSAP ssap SSAP cntl CNTL ] [ dot1p PRIORITY-TAG ] [ VLAN VLAN-ID ] [ time-range PROFILE-NAME ] [ priority PRIORITY ]

no { permit | deny } { any | host SRC-MAC-ADDR | SRC-MAC-ADDR MASK } { any | host DST-MAC-ADDR | DST-MAC-ADDR MASK } [ ethernet-type TYPE | llc dsap DSAP ssap SSAP cntl CNTL ] [ dot1p PRIORITY-TAG ] [ VLAN VLAN-ID ] [ time-range ]

Syntax Description
any Specifies any source MAC address or any destination MAC address.
host SRC-MAC-ADDR	Specifies a specific source MAC address.
SRC-MAC-ADDR MASK	Specifies a group of source MAC addresses using a mask.
host DST-MAC-ADDR	Specifies a specific destination MAC address.
DST-MAC-ADDR MASK	Specifies a group of destination MAC addresses by using mask.
ethernet-type TYPE	(Optional) Specifies that the protocol type for the Ethernet_II packet or a SNAP packet by specifying the Ethernet type value which is a number from 0 to 65535.
llc dsap DSAP ssap SSAP cntl CNTL	(Optional) Specifies the protocol type for the LLC packet by specifying the DSAP, SSAP and CONTROL number which is a number from 0 to 255.
dot1p PRIORITY-TAG	(Optional) Priority tag in value of 0~7.
VLAN VLAN-ID	(Optional) Specifies the VLAN ID which a number from 1 to 4094.
time-range PROFILE-NAME	(Optional) Specifies the name of a time-period profile for activation of the access-list.With the no form of this command, this option, time-range (without PROFILE-NAME), removes the setting of an active timer-period, rather than removing the whole entry.
priority PRIORITY	(Optional) Access entry priority range is 1 to 65535 where the lower value represents higher priority for the sequence number. If no priority is specified, the system automatically assigns it with a priority that is 10 greater than the largest sequence in that access list and places it at the end of the list.

Default

If the priority is not specified, the system assigns it with a priority value 10 or greater than the largest sequence in that access list and it is placed at the end of the list.

If the priority is manually assigned, it is better to have a reserved interval for a future higher priority entry. Otherwise the system attempts to insert an entry with a higher priority.

Command Mode MAC access-list extended configuration

Usage Guideline

The time-range profile must be created before it can be specified in the statement. Otherwise, an error message will be displayed.

Multiple entries can be added to the list; use permit for one entry and use deny for the other entry.

Different permit and deny commands can match different fields available for setting.

The priority can be directly updated by specifying the command with the value for all other parameters except time-range & priority.

All the configurable arguments (time-range and priority are excluded) can be used to differentiate one from another. These arguments are called differentiating arguments. To remove an entry, using the no form of this command, specify the entry with same value of all differentiating arguments specified (includes all optional parameters but time-range and priority are excluded). The time-range option in no form of this command means to remove the time-range association from this entry.

To update the time-range or priority, specify the entry with the same value of all differentiating arguments, which are configured, and the update value for time-range or priority.

The priority value must be unique in the domain of an access-list. If r a priority value is entered that is already present, an error message will be shown.

When the time-range is not specified, the statement will be always effective.

Example

This example shows how to configure access entries in the profile daily-profile to allow two sets of source MAC addresses. Others are denied due to default implicit deny rule.

Switch(config)# mac access-list extended daily-profile
Switch(config-mac-ext-acl)# permit 00:80:33:00:00:00 ff:ff:ff:00:00:00 any
Switch(config-mac-ext-acl)#permit 00:f4:57:00:00:00 ff:ff:ff:00:00:00 any
Switch(config-mac-ext-acl)# exit
Switch(config)# 

Verify the settings by entering the show show access-list command.

ping

Use ping to diagnose basic network connectivity.

ping [OPTIONS] { IP-ADDRESS | IPV6-ADDRESS }

Syntax Description

OPTIONS (Optional) The option can be any combination of the following parameters:

-A

Adapt to return interval of packets. That is to send packets at approximately the rate at which they are received.

-c COUNT

Stop after sending count ECHO_RESPONSE packets.

-i WAIT

Wait WAIT seconds between sending each packet. Default is to wait one second between each packet. This option is incompatible with -A option and it will be ignored when it is along with -A option.

-Q TOS

Set Quality of Service on ICMP data grams.

-s PACKETSIZE

Specifies the number of data bytes to be sent. Default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data. It does not include any VLAN or IEEE802.1Q tag length.

-w N

Stop ping after N seconds.

-W N

When waiting for a response, time out after N seconds. If N is not specified, the default is one second.

IP-ADDRESS IPv4 address in dot notation (a.b.c.d) of the destination host.

IPV6-ADDRESS IPv6 address of the system to discover.

Default -s: 56 bytes

-c: 5 count packets

-i: 1 second

-Q: 0 TOS

-w: 0 (Don't stop)

-W: 1 second

Command Mode

Management interface configuration or User EXEC

Usage Guideline

The ping command sends an echo request packet to an address, and then awaits a reply. Ping output can help to evaluate path-to-host reliability, delays over the path, and whether the host can be reached or is functioning.

Note : The specified "OPTIONS" can be any combination of the parameters but the parameters must be specified in the alphabetical order and the upper case is ahead of the lower case. For example, e the following sequences cannot be used with the specified parameters: "ping -c COUNT -Q TOS -A 10.90.90.90". The correct usage is: "ping -A -Q TOS -c COUNT 10.90.90.90".

Examples This example shows how to ping the host with IP address 172.50.71.123.

Switch# ping 172.50.71.123
PING 172.50.71.123 (172.50.71.123): 56(84) data bytes
64 bytes from 172.50.71.123, icmp_seq=1 ttl=128 time=0.226 ms
64 bytes from 172.50.71.123, icmp_seq=2 ttl=128 time=0.184 ms
--- 172.50.71.123 ping statistics ---
packets transmitted = 2, received = 2, packet loss = 0 (0%)
round trip times min/avg/max/mdev = 0.184/0.205/0.226/0.021 ms
Switch# 

This example shows how to ping the host with IPv6 address 2001:e10:5c00:2::101:150.

Switch# ping 2001:e10:5c00:2::101:150
PING 2001:e10:5c00:2::101:150 (2001:e10:5c00:2::101:150):56(104) data bytes
64 bytes from 2001:e10:5c00:2::101:150, icmp_seq=1 ttl=128 time=92.1 ms
64 bytes from 2001:e10:5c00:2::101:150, icmp_seq=2 ttl=128 time=0.766 ms
64 bytes from 2001:e10:5c00:2::101:150, icmp_seq=3 ttl=128 time=0.781 ms
64 bytes from 2001:e10:5c00:2::101:150, icmp_seq=4 ttl=128 time=0.774 ms
64 bytes from 2001:e10:5c00:2::101:150, icmp_seq=5 ttl=128 time=0.760 ms
--- 2001:e10:5c00:2::101:150 ping statistics ---
packets transmitted=5, received=5, packet loss=0 (0%)
round trip times min/avg/max/mdev= 0.760/19.040/92.120/36.540 ms
Switch# 

police

To configure traffic policing using single rate, use the police command in policy-map class configuration mode. To remove traffic policing from the configuration, use the no form of this command.

police BPS [BURST-NORMAL] [BURST-MAX] exceed-action ACTION [violate-action ACTION]

no police BPS [BURST-NORMAL] [BURST-MAX] exceed-action ACTION [violate-action ACTION]

Valid and default

Syntax Description

BPS Average rate, in bits per second.

min: 64KB max:32G.

BURST-NORMAL (Optional) Normal burst size in bytes.

min:4KB max:16MB default:4KB. Unit is KB

BURST-MAX (Optional) Maximum burst size, in bytes. Valid values are project dependent

min:4KB max:16MB default:4KB. Unit is KB

"police BPS BURST-NORMAL BURST-MAX exceed-action ACTION violate-action ACTION

For the above case, the explicit BURST-NORMAL BURST-MAX values are used.

"police BPS BURST-MAX exceed-action ACTION violate-action ACTION

For the above case, the default BURST-NORMAL and explicit BURST-MAX values are used.

"police BPS exceed-action ACTION violate-action ACTION

For the above case, the default BURST-NORMAL and default BURST-MAX values are used.

"police BPS BURST-NORMAL exceed-action ACTION

For the above case, the explicit BURST-NORMAL and explicit BURST-MAX values are used.

exceed-action Specifies action to take on packets that exceed the rate limit.

violate-action (Optional) Specifies action to take on packets that violate the normal and maximum burst sizes.

Syntax Description

ACTION Action to take on packets. Specifies one of the following keywords:

"drop-Drops the packet."

"set-dscp-transmit value-Sets the IP differentiated services code point (DSCP) value and transmits the packet with the new IP DSCP value.

"transmit-Transmits the packet. The packet is not altered."

Default None

Command Mode Policy-map class configuration

Usage Guideline

Use the police command to drop the packet or mark the packet with different quality of service (QoS) values based on conformance to the service agreement.

As a packet arrives at a port, the packet will be initialized with a color. This color will be used in control of congestion.

If the policer is operated in color blind mode, the packet is re-colored and the actions are taken based on the policer metering result.

If the policer is operated in color aware mode, the packet is re-colored and the actions are taken based on the policer metering result and the initial color of the packet.

The actions configured by the set command for the traffic class will be applied to the conforming packet. They will not be applied to the exceeding packet and the violating packets.

Note: Either one of police command and police cir command can be activated for the refereed traffic class. The latter command will overwrite the previous policer command setting within the same traffic class.

The following example show the precedence between police command and police cir commands: create a policy-map, police-map1 and have a traffic class, class-movie with single rate police (police command).

Switch(config)# policy-map police-map1
Switch(config-pmap)# class class-movie
Switch(config-pmap-c)# police 8000 1000 exceed-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# 

Later it is realized that a two rate police should be applied to class-movie traffic and a two rate police (police cir command) is added. The newer police cir command will overwrite the previous police command setting.

Switch(config)# policy-map police-map1
Switch(config-pmap)# class class-movie
Switch(config-pmap-c)# police cir 8000 pir 1000 exceed-action drop violate-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit 

Specifying Multiple Actions

The police command allows to specify actions for different policing result. When specifying multiple policing actions, contradictory actions, such as violate-action transmit and exceed-action drop, cannot be specified.

Using the Police Command with the Traffic Policing Feature

The Traffic Policing feature works with a token bucket algorithm. Two types of token bucket algorithms are available: a one-token bucket algorithm and a two-token bucket algorithm. A single-token bucket system is used when the violate-action option is not specified, and a two-token bucket system is used when the violate-action option is specified.

The following are explanations of how the token bucket algorithms work.

Token Bucket Algorithm with One Token Bucket

The one-token bucket algorithm is used when the violate-action option is not specified in the police command CLI. The conform bucket is initially set to the full size (the full size is the number of bytes specified as the normal burst size).

When a packet of a given size (for example, "B" bytes) arrives at specific time (time "T"), the following actions occur:

"Tokens are updated in the conform bucket. If the previous arrival of the packet was at T1 and the current time is T, the bucket is updated with (T - T1) worth of bits based on the token arrival rate. The token arrival rate is calculated as follows: (time between packets (which is equal to T - T1) * policer rate)/8 bytes. The policer rate here is average rate (BPS).

"If the number of bytes in the conform bucket is greater than or equal to the packet size, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is completed for the packet."

"If the number of bytes in the conform bucket (minus the packet size to be limited) is fewer than B, the exceed action is taken.

Token Bucket Algorithm with Two Token Buckets

The two-token bucket algorithm is used when the violate-action option is specified in the police command. The conform bucket is initially full (the full size

is the number of bytes specified as the normal burst size). The exceed bucket is initially full (the full exceed bucket size is the number of bytes specified in the maximum burst size). The tokens for both the conform and exceed token buckets are updated based on the token arrival rate, or committed information rate (CIR).

When a packet of given size (for example, "B" bytes) arrives at specific time (time "T") the following actions occur:

"Tokens are updated in the conform bucket. If the previous arrival of the packet was at T1 and the current arrival of the packet is at T, the bucket is updated with T -T1 worth of bits based on the token arrival rate. The refill tokens are placed in the conform bucket. If the tokens overflow the conform bucket, the overflow tokens are placed in the exceed bucket."

The token arrival rate is calculated as follows:

(time between packets (which is equal to T-T1) * policer rate)/8 bytes. The policer rate here is average rate (BPS).

"If the number of bytes in the conform bucket is greater than or equal to B, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is taken. The exceed bucket is unaffected in this scenario."

"If the number of bytes in the conform bucket is less than B, the excess token bucket is checked for bytes by the packet. If the number of bytes in the exceed bucket is greater than or equal to B, the exceed action is taken and B bytes are removed from the exceed token bucket. No bytes are removed from the conform bucket."

"If the number bytes in the exceed bucket is fewer than B, the packet violates the rate and the violate action is taken. The action is complete for the packet."

Example

The following example shows how to define a traffic class (using the class-map command) and associate the policy with the match criteria for the traffic class in a policy map (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.

In this particular example, traffic policing is configured with an average rate at 8000 bits per second and the normal burst size at 1000 bytes for all packets ingress at eth 3.1:

Switch(config)# class-map access-match
Switch(config-cmap)# match access-list acl_rd
Switch(config-cmap)# exit
Switch(config)# policy-map police-setting
Switch(config-pmap)# class access-match
Switch(config-pmap-c)# police 8000 1000 exceed-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface eth3.1
Switch(config-if)# service-policy police-setting

Verify the settings by entering the show policy-map command.

police aggregate

To configure a named aggregate policer as the policy for a traffic class in a policy map, use police aggregate command in the policy map class configuration mode. To delete the name aggregate policer from class policy, use the no form of this command.

police aggregate NAME

no police aggregate NAME

Syntax Description

NAME Specifies a previously defined aggregate policer name as the aggregate policer for a traffic class. Up to 32 characters are allowed.

Default None

Command Mode Policy map class configuration

Usage Guideline

Use the qos aggregate-policer command in global configuration mode to create a named aggregate policer, and then use the police aggregate command in the policy-map class configuration mode to configure the named aggregate policer as the policy for a traffic class. A named aggregate policer cannot be referred from different policy map.

Example

This example shows how to configure a named aggregate policer parameters and apply the policer to multiple classes in a policy map: An aggregate policer with single rate policing named agg_policer1 is created. This policer is configured as the policy for traffic class class1, class2, and class3.

Switch(config)# qos aggregate-policer agg_policer1 64 128 exceed-action drop
Switch(config)# policy-map policy2
Switch(config-pmap)# class class1
Switch(config-pmap-c)# police aggregate agg_policer1
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class2
Switch(config-pmap-c)# police aggregate agg_policer1
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class3
Switch(config-pmap-c)# police aggregate agg_policer1
Switch(config-pmap-c)# exit

Verify the settings by entering the show policy-map command.

police cir

To configure traffic policing using two rates, the committed information rate (CIR) and the peak information rate (PIR), use the police cir command in policy-map class configuration mode. To remove two-rate traffic policing from the configuration, use the no form of this command

police cir CIR [bc CONFORM-BURST] pir PIR [be PEAK-BURST] [exceed-action ACTION [violate-action ACTION]]

no police cir CIR [bc CONFORM-BURST] pir PIR [be PEAK-BURST] [exceed-action ACTION [violate-action ACTION]]

Syntax Description
CIR Specifies the committed information rate in bits per second. The committed packet rate is the first token bucket for the two-rate metering.
	min: 64KB max:32GB
PIR	Specifies the peak information rate in bits per second. The peak information rate is the second token bucket for the two-rate metering.
	min: 64KB max:32GB
CONFORM-BURST Specifies the burst size for the first token bucket in bytes.
	Valid values are project dependent.
	min:4KB max:16MB default:4KB
PEAK-BURST Specifies the burst size for the second token bucket in bytes.
	Valid values are project dependent.
	min:4KB max:16MB default:4KB
exceed-action	(Optional) Specifies the action to take for those packets that conform to PIR but not to CIR. It is referred as yellow color traffic.
violate-action	(Optional) Specifies the action to take for those packets that did not conform to both CIR and PIR. It is referred as red color traffic.

ACTION The actions can be

drop - Packets will be dropped.

set-dscp-transmit VALUE - Sets the IP differentiated services code point (DSCP) value and transmits the packet with the new IP DSCP value.

transmit - Transmits the packet. The packet is not altered.

Default Disabled

exceed-action: drop

violate-action: equals exceed-action

Command Mode Policy map class configuration

Usage Guideline

As a packet arrives at a port, the packet will be initialized with a color. This color will be used in control of congestion.

If the policer is operated in color blind mode, the packet is re-colored and the actions are taken based on the policer metering result.

If the policer is operated in color aware mode, the packet is re-colored and the actions are taken based on the policer metering result and the initial color of the packet.

The actions configured by the set command for the traffic class will be applied to the conforming packet. They will not be applied to the exceeding packet and the violating packet.

Note: Either one of police command and police cir command can be activated for the refereed traffic class. The latter command will overwrite the previous policer command setting within the same traffic class.

The following example show the precedence between police and police cir comands: create a policy-map, police-map1 and have a traffic class class-movie with a two rate policer (police cir command).

Switch(config)# policy-map police-map1
Switch(config-pmap)# class class-movie
Switch(config-pmap-c)# police cir 8000 pir 1000 exceed-action drop violate-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit 

Later it is realized that a single rate policer should be applied to class-movie traffic and singe rate policer (police cir command) is added. The newer police command will overwrite the previous police cir command setting.

Switch(config)# policy-map police-map1
Switch(config-pmap)# class class-movie
Switch(config-pmap-c)# police 8000 1000 exceed-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit

Two-rate traffic policing uses two token buckets-Tc and Tp-for policing traffic at two independent rates. Note the following points about the two token buckets:

"The Tc token bucket is updated at the CIR value. The Tc token bucket can contain up to the confirm burst (Bc) value.

"The Tp token bucket is updated at the PIR value. The Tp token bucket can contain up to the peak burst (Be) value."

Updating Token Buckets

The following scenario illustrates how the token buckets are updated:

A packet of B bytes arrives at time t. The last packet arrived at time t1. The CIR and the PIR token buckets at time t are represented by Tc(t) and Tp(t), respectively. Using these values and in this scenario, the token buckets are updated as follows:

$$ \mathrm{Tc} (\mathrm{t}) = \min (\mathrm{CIR} ^ {*} (\mathrm{t} - \mathrm{t} 1) + \mathrm{Tc} (\mathrm{t} 1), \mathrm{Bc}) $$

$$ \mathrm{Tp} (t) = \min (\mathrm{PIR} ^ {*} (t - t 1) + \mathrm{Tp} (t 1), \mathrm{Be}) $$

Marking Traffic

The two-rate policer marks packets as either conforming, exceeding, or violating a specified rate. The following points (using a packet of B bytes) illustrate how a packet is marked:

"If B > Tp(t), the packet is marked as violating the specified rate.

"If B > Tc(t), the packet is marked as exceeding the specified rate, and the Tp(t) token bucket is updated as Tp(t) = Tp(t) - B.

Otherwise, the packet is marked as conforming to the specified rate, and both token buckets-Tc(t) and Tp(t)-are updated as follows:

$$ \mathrm{Tp} (t) = \mathrm{Tp} (t) - B $$

$$ \mathrm{Tc} (\mathrm{t}) = \mathrm{Tc} (\mathrm{t}) - \mathrm{B} $$

Example

Example In the following example, two-rate traffic policing is configured on a class called police to limit traffic to an average committed rate of 64 kbps and a peak rate of 128 kbps, and the policy map named policy1 is attached to eth3.1.

Switch(config)# class-map police
Switch(config-cmap)# match access-list 101
Switch(config-cmap)# policy-map policy1
Switch(config-pmap)# class police
Switch(config-pmap-c)# police cir 64 bc 128 pir 128 be 256 exceed-action drop violate-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface eth3.1
Switch(config-if)# service-policy policy1
Switch(config-if)# end
Switch# show policy-map policy1
Policy Map policy1
Class police
police tr-tcm cir 64 bc 128 pir 128 be 256
exceed-action : drop
violate-action : drop
Switch# 

Verify the settings by entering the show policy-map command.

policy-map

To enter policy-map configuration mode and create or modify a policy map that can be attached to one or more interfaces as a service policy, use the policy-map command in global configuration mode. To delete a policy map, use the no form of this command.

policy-map NAME

no policy-map NAME

Syntax Description

NAME Name of the policy map. The name can be a maximum of 32 alphanumeric characters

Default None

Command Mode Global configuration

Usage Guideline

Use the policy-map command to specify the name of the policy map to be created, or modified before policies are configured for classes whose match criteria are defined in a class map. The policy-map command enters policy-map configuration mode, in which the user can configure or modify the policy for the traffic class.

The user can configure class policies in a policy map only if the classes have match criteria defined for them. Use the class-map and match commands to configure the match criteria for a class. Because a maximum of 32 class maps is allowed, a policy map cannot contain more than 32 class policies.

A single policy map can be attached to more than one interface concurrently.

Policy maps contain traffic classes. Traffic classes contain one or more match commands that can be used to match packets (and organize them into groups) on the basis of a protocol type or application. Create as many traffic classes as needed.

Example

The following example (on the next page) creates a policy map called policy and configures two class policies in that policy map. The class policy called class1 specifies policy for traffic that matches access control list (ACL) acl_rd. The

second class is the default class, named class-default to which packets that do not satisfy the defined classes are included.

Switch(config)# class-map class1
Switch(config-cmap)# match access-list acl_rd
Switch(config-cmap)# exit
Switch(config)# policy-map policy
Switch(config-pmap)# class class1
Switch(config-pmap-c)# set ip dscp 46
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class-default
Switch(config-pmap-c)# set ip dscp 00
Switch(config-pmap-c)# exit

Verify the settings by entering the show policy-map command

port-channel load-balance

Use port-channel load-balance to configure the load balance algorithm that the switch uses to distribute packets across ports in the same channel. To reset the load distribution to the default settings, use the no from of this command.

port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac}

no port-channel load-balance

Syntax Description

dst-ip Indicates that the switch should examine the IP destination address.

dst-mac Indicates that the switch should examine the MAC destination address.

src-dst-ip Indicates that the switch should examine the IP source address and destination address.

src-dst-mac Indicates that the switch should examine the MAC source and destination address.

src-ip Indicates that the switch should examine the IP source address.

src-mac Indicates that the switch should examine the MAC source address.

Default src-dst-mac

Command Mode Global configuration

Usage Guideline Use this command to specify the load balance algorithm. Only one algorithm can be specified.

Example This example shows how to configure load balance algorithm for src-ip:

Switch# configure terminal
Switch(config)# port-channel load-balance src-ip
Switch(config)# end 

Verify the settings by entering the show channel-group load-balance EXEC command.

power-saving

Use the power-saving command to enable "Power Saving" function in the device. And use the no form of this command to disable "Power Saving" function.

power-saving {phy}

no power-saving {phy}

Default Disabled

Command Mode Global configuration.

Usage Guideline

The "power-saving" command can enable the "Power Saving" function on different hardware components. Currently, one component is supported: phy. Select the option "phy", it will set the PHY into "Power Saving" mode. The "no power-saving" command disables this function.

The "PHY Power Saving" function could be enabled or disabled per-system base. There are two operation modes: "low-power" mode and "normal" mode. When power saving is enabled, the chips automatically enter "low-power" mode if the signal from a copper link partner is lost. They will go to normal mode when a signal is detected.

If "PHY Power Saving" function is disabled, PHY will always be in normal mode no matter that the signal from a link partner is presented or not.

Example

The following example shows how to enable/disable "Power Saving" function.

Switch(config)#power-saving
Switch(config)#
Switch(config)show power-saving

Power-saving status
====================
phy power-saving:Enabled

Switch(config)#no power-saving
Switch(config)#show power-saving

Power-saving status
====================
phy power-saving:Disabled 

pvid VLAN-ID

Use the pvid interface configuration command to specify the native VLAN for the trunk or hybrid interface. Use default interface command to reset to default setting.

pvid VLAN-ID

default pvid

Syntax Description

pvid VLAN-ID	Specifies the PVID for the trunk or hybrid interface.
Default	pvid VLAN-ID: 1 (If the port is set to trunk/hybrid mode)
Command Mode	Interface configuration
Usage Guideline	The valid interfaces for this command are physical port or port-channel.An interface can be specified with only one PVID. The succeeding command overwrites the previous command.This command is used to change PVID of Trunk or Hybrid port. When an interface is Access mode, use theaccessVLAN command to change its PVID instead of this command.This command does not affect the VLAN membership and the port's tag handling mode (Access, Hybrid or Trunk). Use the trunk allowed-VLAN or hybrid VLAN command to add the port to the VLAN by the requirement. The specified VLAN does not need to exist to make the command succeed.
Example	This example shows how to set an interface port 4.1 as a hybrid interface with native VLAN 1000.
Switch(config)# interface eth4.1
Switch(config-if)# hybrid vlan 1000 untagged
Switch(config-if)# pvid 1000

Verify the settings by entering the show vlan command.

qos aggregate-policer

To define a named aggregate policer for use in policy maps, use the qos aggregate-policer command in global configuration mode. To delete a named aggregate policer, use the no form of this command. The qos aggregate-policer command is for single rate policing and the qos aggregate-policer cir command is for two rate policing.

qos aggregate-policer NAME BPS [BURST-NORMAL] [BURST-MAX] exceed-action ACTION [violate-action ACTION]

qos aggregate-policer NAME cir CIR [bc CONFORM-BURST] pir PIR [be PEAK-BURST] [exceed-action ACTION [violate-action ACTION]]

no qos aggregate-policer NAME

Syntax Description

NAME Specifies the name of the aggregate policing rule. The NAME parameter can be up to 32 characters, is case sensitive, and may include a-z, A-Z, 0-9, the dash character (-), the underscore character ( ), and the period character (.).The policer names must start with an alphabetic character (not a digit) and must be unique across all aggregate policers.
BPS Average rate, in bits per second.
min: 64KB max:32GB
BURST-NORMAL (Optional) Normal burst size in bytes.
Valid values are project dependent.
min:4KB max:16MB default:4KB. Unit is KB
BURST-MAX (Optional) Maximum burst size, in bytes.
Valid values are project dependent.
min:4KB max:16MB default:4KB. Unit is KB
CIR Specifies the committed information rate in Kbps. The committed packet rate is the first token bucket for the two-rate metering.
min: 64KB max:32GB
PIR Specifies the peak information rate in Kbps. The peak information rate is the second token bucket for the two-rate metering.
min: 64KB max:32GB
CONFORM-BURST Specifies the burst size for the first token bucket in bytes.
min:4KB max:16MB default:4KB.
Syntax Description
PEAK-BURST	PEAK-BURST Specifies the burst size for the second token bucket in bytes.min: 4KBmax: 16MBdefault :4KB.
exceed-action Specifies action to take on packets that exceed the rate limit.
violation-action	(Optional) Specifies action to take on packets that violate the normal and maximum burst sizes for single rate policing. . Specifies the action to take for those packets that did not conform to both CIR and PIR. For two rates policing.If violate-action is not specified for single rate policer, it will create a single rate two color policer.
ACTION Action to take on packets. Specifies one of the following keywords:"drop-Drops the packet."set-dscp-transmit VALUE - Sets the IP differentiated services code point (DSCP) value and transmits the packet with the new IP DSCP value."transmit-Transmits the packet. The packet is not altered.

Default Not configured

For a two rate policer, the defaults for unspecified options are as follows:

• exceed-action: drop.
  • violate-action equals exceed-action

Command Mode Global configuration

Usage Guideline

An aggregate policer can be shared by different policy map classes and on different interfaces. It cannot be shared by different policy map.

For detailed description regarding how to configure the policer, refers to the usage guideline for police and police cir command.

Note: Either one of qos aggregate-policer NAME command and qos aggregate-policer NAME cir command can be activated for the refereed traffic class. The latter command will overwrite the previous qos aggregate-policer NAME setting once the reference aggregator name are the same.

Example

In the following example, an aggregate policer named agg-policer5 with single rate two colors is configured. This named aggregator policer is applied as the service policy for the class1 and class2 traffic class in the policy2 policy map.

Switch(config)# qos aggregate-policer agg-policer5 10000 128 exceed-action drop
Switch(config)# policy-map policy2
Switch(config-pmap)# class class1
Switch(config-pmap-c)# police aggregate agg-policer5
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class2
Switch(config-pmap-c)# police aggregate agg-policer5
Switch(config-pmap-c)# exit

Verify the settings by entering the show qos aggregate-policer command.

qos bandwidth

To set the received bandwidth limit values for an interface, use the bandwidth ingress command in interface configuration mode. To set the transmit bandwidth limit values on an interface use the bandwidth egress command in interface configuration mode. To disable bandwidth limit, use the no form of this command.

qos bandwidth {egress | ingress} NUMBER-KBPS

no qos bandwidth {egress | ingress}

Syntax Description
NUMBER-KBPS	Specifies the number of kilo bytes per second as the limitation on the bandwidth.min: 0KB to max:10MB per second

Default Disabled

Command Mode Interface configuration

Usage Guideline Only physical ports are valid for this command.

The specified limitation should not exceed the maximum speed of the specified interface.

For ingress bandwidth limitation, the ingress will send pause frame or flow control frame when the received traffic exceeds the limitation.

Example In the following example, bandwidth limitations are configured on eth 2.5. The ingress bandwidth is limited to 128 Kbps and the egress bandwidth is limited to 256 Kbps.

Switch(config)#interface eth2.5
Switch(config-if)#qos bandwidth ingress 128
Switch(config-if)#qos bandwidth egress 256 

Verify the settings by entering the show qos interface bandwidth command.

qos cos

To configure the default class of service (CoS) value of a port, use the qos cos command in interface configuration mode.

qos cos COS-VALUE

Syntax Description
COS-VALUE	Assigns a default CoS value to a port. This CoS will be with the incoming CoS of the untagged packet received by the port.

Default COS-VALUE: 0

Command Mode Interface configuration

Usage Guideline Only physical ports are valid.

Example In the following example, default COS of eth3.1 is set to 3.

Switch(config)# interface eth3.1
switch(config-if)# qos cos 3 

Verify the settings by entering the show qos interface cos command.

qos deficit-round-robin

Use the qos command in interface configuration mode to enable the Deficit Round Robin (DRR)/Weighted Round Robin (WRR) packet scheduling mechanism. To restore the packet scheduling mechanism, use the default form of this command.

qos {deficit-round-robin [COS-QUEUE quantum WEIGHT] | weight-round-robin [COS-QUEUE weight WEIGHT]}

default qos

Syntax Description
deficit-round-robin	deficit-round-robin in interface configuration mode to enable the Deficit Round Robin (DRR) packet scheduling mechanism
weight-round-robin	weight-round-robin in interface configuration mode to enable the weighted Round Robin (WRR) packet scheduling mechanism
COS-QUEUE The transmit priority queue; valid value is from 0 to 7.
quantum WEIGHT	(Optional) Specifies the Deficit Round Robin (DRR) quantum weight from 0 to 255. The final quantum is 16Kbytes * WEIGHT. The number of zero stands for strict priority mode.
weight WEIGHT	(Optional) Specifies the WRR weight. The final weight is number of permitted scheduling packets.The range is 0 ~ 15 and the number of zero stands for strict priority mode.

Default Strict priority mode and DRR mode is disabled.

quantum WEIGHT: 1

wrr-WEIGHT: 1

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this command.

The port CoS queue can be either strict priority mode, deficit round robin (DRR)mode or Weight round robin (WRR) mode. The strict priority scheduler mode provides strict priority access to the egress port across the transmit priority queue from the highest priority index to the lowest. The purpose of the strict priority scheduler is to provide lower latency service to the higher CoS classes of traffic.

DRR operates by serving a mount of backlogged credits into the transmit queue in round robin order. Initially, each queue sets its credit counter to a configurable quantum value. Every time a packet from a CoS queue is sent, the size of the packet is subtracted from the corresponding credit counter. When the credit counter drops below 0, the queue is no longer serviced until its credits are replenished.

All queues are serviced until their credit counter is zero or negative and a packet is transmitted completely. As this condition happens, the credits are replenished. When the credits are replenished, as a quantum of credits are added to each CoS queue credit counter. The quantum for each CoS queue may different based on the user configuration.

To set a CoS in strict priority mode, any higher priority CoS must be in strict priority mode. For example, to set CoS 5 in strict priority mode, CoS 6 and 7 have to be in strict priority mode.

WRR operates by transmitting permitted packets into the transmit queue in round robin order. Initially, each queue sets its weight to a configurable weighting. Every time a packet from a higher priority CoS queue is sent, the number of the packet is subtracted from the corresponding weight. When the credit counter reaches zero, the queue is no longer serviced until its weight is replenished. After this repeats for each queue, the next lower priority CoS queue is serviced in turn.

All queues are serviced until their weight is zero and a packet is transmitted completely. As this condition happens, the weights are replenished. When the weights are replenished, weight is added to each CoS queue credit counter. The weight for each CoS queue may different based on the user configuration.

Examples

In the following example, deficit round robin is configured on eth 3.1. For this case, quantum for queue 0 is set to 32 Kbytes; quantum for queue 1 is set to 32 Kbytes; quantum for queue 2 is set to 64 Kbytes; quantum for queue 3 is set to 64 Kbytes; quantum for queue 4 is set to 128 Kbytes; quantum for queue 5 is set to 128 Kbytes; quantum for queue 6 is set to 32 Kbytes; and quantum for queue 7 remains as 0.

Switch(config)# interface eth3.1
Switch(config-if)# qos deficit-round-robin 0 quantum 2
Switch(config-if)# qos deficit-round-robin 1 quantum 2
Switch(config-if)# qos deficit-round-robin 2 quantum 4
Switch(config-if)# qos deficit-round-robin 3 quantum 4
Switch(config-if)# qos deficit-round-robin 4 quantum 8
Switch(config-if)# qos deficit-round-robin 5 quantum 8
Switch(config-if)# qos deficit-round-robin 6 quantum 2
Switch(config-if)# qos deficit-round-robin 7 quantum 0 

In the following example, Weight round robin is configured on eth 3.1. For this case, queue 5, 6, and 7 are set to strict priority mode; weight for queue 4 is set to 4 packets; weight for queue 2, 1, and 0 are set to 2 packets.

Switch(config)# interface eth3.1
Switch(config-if)# qos weight-round-robin 0 weight 2
Switch(config-if)# qos weight-round-robin 2 weight 2
Switch(config-if)# qos weight-round-robin 3 weight 2
Switch(config-if)# qos weight-round-robin 4 weight 4
Switch(config-if)# qos weight-round-robin 5 weight 0
Switch(config-if)# qos weight-round-robin 6 weight 0
Switch(config-if)# qos weight-round-robin 7 weight 0
Switch(config-if)# qos weight-round-robin 1 weight 2
Switch(config)# 

Verify the settings by entering the show qos interface command.

qos dscp-mutation

To attach an ingress differentiated-services-code-point (DSCP) mutation map to the interface, use the qos dscp-mutation command in interface configuration mode. To remove the ingress DSCP mutation map from the interface, use the no form of this command.

qos dscp-mutation DSCP-MUTATION-TABLE-NAME

no qos dscp-mutation DSCP-MUTATION-TABLE-NAME

Syntax Description
DSCP-MUTATION-TABLE-NAME	Name of the DSCP mutation table. The string of the name is up to 32 characters and no spaces are allowed.

Default Not configured

Command Mode Interface configuration

Usage Guideline	Only Physical port interfaces are supported, portchannel interface and vlan interface are not valid for this command.
	Use this command to attach an ingress DSCP mutation table to a physical port interface. Use the “qos map dscp-mutation” on page 385 to configure an ingress DSCP mutation table.
	The ingress DSCP mutation will mutate the DSCP value right after the packet is received by the physical port interface.

Example This example shows how to map DSCP 30 to mutated DSCP value 8 and then attach the ingress-DSCP mutation map named mutemap1 to eth 3.1:

Switch(config)#qos map dscp-mutation mutemap1 30 to 8
Switch(config)#interface eth 3.1
Switch(config-if)#qos dscp-mutation mutemap1
Switch(config-if)#end 

Verify the settings by entering the show qos interface command.

qos map cos-color

To define the CoS to color map for mapping of a packet's initial color, use the qos map cos-color command in interface configuration mode. To return the map to default setting, use the no form of this command.

qos map cos-color COS-LIST to { green | yellow | red}

no qos map cos-color

Syntax Description

COS-LIST

Specifies the list of COS value to be mapped to a color. The range of COS is 0 to 7. The multiple CoS values in the list can be in the form 1, 2,...etc.. separated by commas, a continuous list such as 2-7, or a mixed form 1, 2, 3-5, etc..

Default COS-LIST: 0-7 set to green

Command Mode Interface configuration

Usage Guideline

Only Physical port interfaces are supported; portchannel interface and vlan interface are not valid for this command.

When a packet entering the ingress port, it will be colored based on either the DSCP to color map (as the port is trust DSP) or CoS to color map (as the port is trust CoS).

Use the qos map cos-color command in interface configuration mode to configure the CoS to color map. If the ingress port is trust CoS, the received packet will be initialized to color based on this map.

Example
The following example defines CoS 1-7 as red color, 0 as green color at eth 3.1.

Switch(config)# interface eth3.1
Swtch (config-if)# qos map cos-color 1-7 to red 

Verify the settings by entering the show qos interface map command

qos map dscp-color

To define the DSCP to color map for mapping of packet's initial color, use the qos map dscp-color command in interface configuration mode. To return the map to the default setting, use the no form of this command.

qos map dscp-color DSCP-LIST to {green | yellow | red}

no qos map dscp-color

Syntax Description
dscp DSCP-LIST	Specifies the list of DSCP code point to be mapped to a color. The range of DSCP is 0 to 63. The multiple DSCP values in the list can be in the form 1, 2, etc. separated by commas, a continuous list such as 2-7, or a mixed form 1, 2, 3-10, 63,etc.

Default DSCP-LIST: 0-63 mapped to green

Command Mode Interface configuration

Usage Guideline Only physical ports are valid for this command.

When a packet enters the ingress port, it will be colored based on either the DSCP to color map (as the port is trust DSP) or CoS to color map (as the port is trust CoS).

Use the qos map dscp-color command in interface configuration mode to configure the DSCP to color map. If the ingress port is set to trust DSCP, the received IP packet will be initialized to a color based on this map. The non-IP packet will be initialized to a color based on the CoS to color map.

Example The following example defines DSCP61\~63 as yellow color, others are green color at eth 3.1.

Switch(config)# interface eth3.1
Swtch (config-if)# qos map dscp-color 61-63 to yellow 

Verify the settings by entering the show qos interface map command.

qos map dscp-cos

To define a differentiated services code point (DSCP)-to-class of service (CoS) map, use the qos map dscp-cos command in global configuration mode. To remove a prior entry, use the no form of this command.

qos map dscp-cos DSCP-LIST to COS-VALUE

no qos map dscp-cos

Syntax Description
dscp-cos DSCP-LIST to COST-VALUE	Specifies the list of DSCP code point to be mapped to a COS value. The range of DSCP is 0 to 63. The series of DSCPs can be separated by comma (,) or hyphen(-). No space is before and after, or -. The COS-VALUE range is 0 ~ 7

Default Below is a table of the default dscp-cos mappings:

DSCP ValueCOS Value
0-7 0
8-15 1
16-23 2
24-31 3
32-39 4
40-47 5
48-55 6
56-63 7

Command Mode Interface Configuration

Usage Guideline

The DSCP to CoS map is used by the DSCP trust port to map the DSCP value to an internal CoS value, which will be in turn be mapped to the CoS queue based on the CoS to queue map configured by the qos map cos command.Only physical ports are valid for this command. All of the DSCP-to-CoS maps are globally defined. The map applies to all ports.

Example This example configures the DSCP to CoS map for mapping DSCP 12, 16, 18 to CoS 1 for eth2.6.

Switch(config)# interface eth2.6

Switch(config-if)# qos map dscp-cos 12,16,18 to 1

Switch(config-if)#end

Use the show qos interface map privileged EXEC command to verify the settings.

qos map dscp-mutation

To define a named differentiated services code point (DSCP) mutation map, use the qos map dscp-mutation command in global configuration mode. To return to the default mapping, use the no form of this command.

qos map dscp-mutation MAP-NAME INPUT-DSCP-LIST to OUTPUT-DSCP

no qos map dscp-mutation MAP-NAME

Syntax Description

MAP-NAME Name of the DSCP mutation map in a string length up to 32 characters (no space is allowed)
INPUT-DSCP-LIST	Specifies the list of DSCP code point to be mutated to another DSCP value. The range of DSCP is 0 to 63. A series of DSCPs can be separated by comma (,) or hyphen(-). No space is before and after, or -.
OUTPUT-DSCP Mutated DSCP value; valid values are from 0 to 63.

Default OUTPUT-DSCP equals the INPUT-DSCP

Command Mode Global configuration

Usage Guideline

When a packet is received by an interface, the incoming DSCP can be mutated to another DSCP right before any QoS operations based on the DSCP mutation map.

The DSCP mutation is helpful to integrate domains with different DSCP assignment.

When configuring a named DSCP mutation map, note the following:

• Multiple commands can be entered to map additional DSCP values to a mutated DSCP value.
• A separate command can be entered for each mutated DSCP value.

Up to 15 ingress-DSCP mutation maps can be configured to mutate the incoming DSCP value before any QoS operation. After the ingress-DSCP mutation map creation, use qos dscp-mutation command to attach the ingress-DSCP mutation map to physical interfaces.

The DSCP-CoS map and DSCP-color map will still base on packet's original DSCP. All the subsequent operations will base on mutated DSCP.

Example This example shows how to map DSCP 30 to mutated DSCP value 8, DSCP 20 to mutated DSCP 10, the mutation map named, mutemap1:

Switch(config)#qos map dscp-mutation mutemap1 30 to 8 Switch(config)#qos map dscp-mutation mutemap1 20 to 10

Use the show qos map privileged EXEC command to verify the settings.

qos trust

To set the trust state of a port, use the qos trust command in interface configuration mode; to trust either the CoS field or the DSCP field of the arriving packet for subsequent QoS operation.

qos trust { cos | dscp }

Syntax Description
cos Specifies that the CoS bits of the arriving packets are trusted for subsequent QoS operations.
dscp	Specifies that the ToS/DSCP bits, if available in the arriving packets, are trusted for subsequent operation. For non-IP packet, L2 CoS information will be trusted for traffic classification.

Default DSCP is trusted.

Command Mode Interface configuration

Usage Guideline

Only physical ports are valid for this command. When the interface is set to trust DSCP, the DSCP of the arriving packet will be trusted for the subsequent QoS operations. First the DSCP will be mapped to an internal CoS value, which will in turn determine the CoS queue. The DSCP to COS map is configured by the qos map dscp-cos command. The CoS to queue map is configured by the qos map cos command. If the arriving packet is a non-IP packet, the CoS is trusted.

When the interface is in trust CoS state, the CoS of the coming packet will be the internal CoS and determine the CoS queue based on the CoS to queue map.

When a packet is received by the ingress port, it will be initialized to a color based on the qos map dscp-color if the receipt port is trust DSCP or qos map cos-color if the receipt port is set to trust CoS.

Example This example shows how to set eth3.1 to trust DSCP mode.

Switch(config)# interface eth3.1
Switch(config-if)# qos trust dscp
Switch(config-if)# end 

Verify the settings by entering the show qos interface command.

reboot

Use this command to reboot a module on the specified slot. The module can be either a control module or a line card control module.

reboot [unit UNIT-ID]

Syntax Description

UNIT-ID Specifies the unit id.

Default None

Command Mode. Privileged EXEC level 15

Usage Guideline This command is only available for privilege level 15 and above.

This command can be used to reboot a module in a specific slot. If no unit ID is specified, all of the modules in the system will be rebooted.

If the CM module is specified to be reboot, then the entire system (all modules) will reboot.

Note:

Example The following example reboots the whole system:

DGS-6600:15#reboot
Warning: This command will cause system reboot.
Do you want to continue (y/n) [n]?y
Save log message before reboot(y/n) [n]?y 

redistribute (OSPF)

Use redistribute to redistribute routes from other routing domain into OSPF routing domain. Use the no form of the command to disable redistribution.

redistribute PROTOCOL [metric METRIC-VALUE] [metric-type TYPE-VALUE]

no redistribute PROTOCOL

Syntax Description
PROTOCOL	The source protocol from which routes are being redistributed from. It can be one of the following keywords: bgp, connected, static, or rip. The static keyword is used to redistribute IP static routes. The connected keyword refers to routes that are established automatically by virtue of having enabled IP on an interface. For routing protocols such as Open Shortest Path First (OSPF), these routes will be redistributed as external to the autonomous system.
metric METRIC-VALUE	(Optional) If a metric is not specified, OSPF puts a default value of 20 as redistributing routes from all other protocols except Border GatewayProtocol (BGP) routes, which get a metric of 1. However when redistributing from one OSPF process to another OSPF process, the metric will be carried through.
metric-type TYPE-VALUE	(Optional) For OSPF, the external link type associated with the route advertised into the OSPF routing domain. It can be one of two values: 1-Type 1 external route 2-Type 2 external route. If a metric-type is not specified, the Switch adopts a Type 2 external route. This is only for OSPF.

Default Disabled

metric-type TYPE-VALUE: Type 2 external route

Command Mode Router configuration

Usage Guideline

A router receiving a link-state protocol with an internal metric will consider the cost of the route from itself to the redistributing router plus the advertised cost to reach the destination. An external metric only considers the advertised metric to reach the destination.

Whenever the redistribute or the default-information originate configuration commands are used to redistribute routes into an OSPF routing domain, the router automatically becomes an ASBR. However, an ASBR does not, by default, generate a default route into the OSPF routing domain.

BGP, RIP, connected, static routes can be redistributed to OSPF.

The redistribute metric is determined by following rules in order:

1. If the redistribute metric is specified, use the user specified value.
2. If the redistribute route is default route, the metric will be 1.

3. If "default metric" is configured, use the specified value.

4. If the "default metric" is not configured, and the route is redistributed from BGP. The metric will be 1.

5. If the "default metric" is not configured, and the route is not redistributed from BGP. the metric will be 20.

BGP, RIP can be redistributed to OSPF.

If a metric is not specified, OSPF puts a default value of 20 and redistributes routes from all other protocols except Border Gateway.

Example This example shows how to BGP routes are redistributed into a OSPF domain:

Switch(config)# router ospf
Switch(config-router)# redistribute bgp 100
Switch(config-router)#end
Switch#

Verify the settings by entering the show ip protocols ospf command.

redistribute (IPv6 OSPF)

Use redistribute to redistribute routes from other routing domains into the IPv6 OSPF routing domain. Use the no form of the command to disable redistribution.

redistribute PROTOCOL [metric METRIC-VALUE] [metric-type TYPE-VALUE]

no redistribute PROTOCOL

Syntax Description
PROTOCOL	Source protocol from which routes are being redistributed. It can be one of the following keywords: connected, static, or rip.
METRIC-VALUE	(Optional) When redistributing from one OSPF process to another OSPF process on the same router, the metric will be carried through from one process to the other if no metric value is specified.
TYPE-VALUE	(Optional) IPv6 OSPF specifies the external link type associated with the default route advertised into the IPv6 OSPF routing domain. It can be one of two values:1: Type 1 external route2: Type 2 external routeIf a metric-type is not specified, the Switch adopts a Type 2 external route. This is only for IPv6 OSPF.

Default Disabled

Command Mode Router configuration

Usage Guideline

Changing or disabling any keyword will not affect the state of other keywords.

A router receiving a link-state protocol with an internal metric will consider the cost of the route from itself to the redistributing router plus the advertised cost to reach the destination. An external metric only considers the advertised metric to reach the destination.

Whenever the redistribute or the default-information originate configuration commands are used to redistribute routes into an IPv6 OSPF routing domain, the router automatically becomes an ASBR. However, an ASBR does not, by default, generate a default route into the IPv6 OSPF routing domain.

When routes are redistributed into IPv6 OSPF from protocols other than IPv6 OSPF, and no metric has been specified with the metric-type keyword and type-value argument, IPv6 OSPF will use 20 as the default metric. When intra-area and inter-area routes are redistributed between IPv6 OSPF processes, the internal OSPF metric from the redistribution source process is advertised as the external metric in the redistribution destination process.

Routes configured with the connected keyword affected by this redistribute command are the routes not specified by the router configuration command.

The default-metric command cannot be used to affect the metric used to advertise connected routes.

Example

In the example, IPv6 OSPF redistributes any prefixes that have been learned through IPv6.

Switch> enable
Switch# configure terminal
Switch(config)# router ipv6 ospf
Switch(config-router)# redistribute rip metric 10

redistribute (RIP)

Use redistribute to redistribute routes from one routing domain into another routing domain. Use the no form of the command to disable redistribution.

redistribute PROTOCOL [metric METRIC-VALUE]

no redistribute PROTOCOL

Syntax Description
PROTOCOL	Source protocol from which routes are being redistributed. It can be one of the following keywords: bgp, connected, ospf, static.The static keyword is used to redistribute IP static routes.The connected keyword refers to routes that are established automatically by virtue of having enabled IP on an interface.For routing protocols such as Open Shortest Path First (OSPF), these routes will be redistributed as external to the autonomous system.
metric METRIC-VALUE	(Optional) Specifies metric value to be used in redistributing information. The range is 0 to 16. Regarding the metric conversion, the following is the rule.If the metric is not specified, the metric for the redistributed route from other protocols to the RIP process will be determined by the value of the "default-metric" command.If the metric is specified as 0, the metric for the redistributed route from other protocols to the RIP process will be 1.

Default Disabled

PROTOCOL: Not configured

METRIC-VALUE: 0

Command Mode Router configuration

Usage Guideline

Routes, configured with the connected keyword, affected by this redistribute command are the routes not specified by the network router configuration command.

If default-metric is not specified either, then the original metric from the redistributed protocol will be transparently carried through.

The default-metric command cannot be used to affect the metric used to advertise connected routes.

The metric value specified in the redistribute command supersedes the metric value specified using the default-metric command.

Examples This example shows OSPF routes are redistributed into a RIP domain:

Switch(config)# router rip
Switch(config-router)# redistribute ospf
Switch(config-router)# end
Switch#

The following example causes the specified OSPF routes to be redistributed into an RIP domain. The OSPF-derived metric will be remapped to 11.

Switch(config)# router rip
Switch(config-router)# redistribute ospf metric 11
Switch(config-router)# end
Switch#

Verify the settings by entering the show ip protocols rip command.

redistribute (RIP IPv6)

Use redistribute to redistribute routes from one routing domain into another routing domain. Use no command to disable redistribution.

redistribute PROTOCOL [metric METRIC-VALUE]

no redistribute PROTOCOL

Syntax Description
PROTOCOL	Source protocol from which routes are being redistributed. It can be one of the following keywords: connected, ospf, and static.
METRIC-VALUE	(Optional) Specifies metric value to be used in redistributing information. The range is 0 to 16.

Default Disabled

PROTOCOL: Not configured

METRIC-VALUE: 1.

Command Mode Router configuration

Usage Guideline

Routes configured with the connected keyword affected by this redistribute command are the routes not specified by the network router configuration command.

Regarding the metric conversion, the following is the rule.

If the metric option is not specified, the following rules are applied:

1. If the metric is not specified, or is specified as 0, the metric for the redistributed static route or connected route will be 1.
2. If the metric is not specified, the metric for the redistributed route from other protocols to RIP process will be determined by the value of the "default-metric" command.
3. If the metric is specified as 0, the metric for the redistributed route from other protocols to RIP process will be 1.

Also, if the default-metric is not specified, then the original metric from the redistributed protocol will be transparently carried through.

1. The default-metric command cannot be used to affect the metric used to advertise connected routes.
2. The metric value specified in the redistribute command supersedes the metric value specified using the default-metric command.

Example

The following example causes the specified OSPF process routes to be redistributed into an RIPng domain. The metric will be remapped to 10.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 rip
Switch (config-router) # redistribute ospf metric 10 

resequence access-list

Use this command to re-sequence the priority of the access-list entries in an access-list (mac, ip or ipv6 access list).

resequence access-list NAME STARTING-SEQUENCE-NUMBER INCREMENT

Syntax Description
NAME	The name of the MAC, IP or IPv6 access-list to be configured. It can accept up to 32 characters. The syntax is a general string that does not allow space.
STARTING-SEQUENCE-NUMBER	Access list entries will be resequenced using this initial value. The default value is 10. The range of possible sequence numbers is 1 through 65535.
INCREMENT The number by which the sequence numbers change. The default value is 10.For example, if the increment value is 5 and the beginning sequence number is 20, the subsequent sequence numbers are 25, 30, 25, 40, and so on. The range of INCREMENT is 1 through 65535.

Default Disabled

Command Mode Global configuration

Usage Guideline

This feature allows the permit and deny entries of a specified access list to be re-sequenced with an initial priority value determined by the STARTING-SEQUENCE-NUMBER argument, and continuing in increments determined by the INCREMENT argument. If the highest priority exceeds the maximum possible sequence number, then no sequencing occurs.If entries with no priority are applied, the first entry is assigned a priority of 10, and successive entries are incremented by 10.If the user enters an entry without a priority, it is assigned a priority that is 10 greater than the largest priority value (with least priority) in that access list and is placed at the end of the list.

Example

This example shows how to re-sequence the priority of IP access-list, named R&D

Switch(config)# show access-list ip R&D
10 permit tcp any 10.20.0.0 255.255.0.0
20 permit tcp any host 10.100.1.2
30 permit icmp any any
Switch(config)# resequence access-list R&D 1 2
Switch(config)# show access-list ip R&D
1 permit tcp any 10.20.0.0 255.255.0.0
3 permit tcp any host 10.100.1.2
5 permit icmp any any 

revision

To set the revision number for the MST configuration, use the revision command. To return to the default settings, use the no form of this command.

revision REVISION

no revision

Syntax Description

REVISION

When a switch using the same given name but with a different revision level than another switch, then the two switches are considered members of different MST regions. The range is 0 to 65535.

Default REVISION: 0

Command Mode MST configuration

Usage Guideline

If Two DGS-6604 series Ethernet switches have the same configuration but with different revision numbers, then they are considered to be part of two different regions.

Caution: Be careful when using the revision command to set the revision number of the MST configuration because a mistake can put the switch in a different region.

Example

This example shows how to configure the revision level of MSTP configuration to 2.

Swtich(config)# spanning-tree mst configuration
Switch(config-mst)#revision 2

Verify the settings by entering the show spanning-tree mst configuration command.

rmon statistics

Use the rmon collection stats interface configuration command to collect Ethernet group statistics, Use the no form of this command to return to disable RMON entry.

rmon statistics ENTRY-NUMBER [owner NAME]

no rmon statistics ENTRY-NUMBER

Syntax Description

ENTRY-NUMBER Remote Network Monitoring (RMON) table index. The range is 1 to 65535.
owner NAME	(Optional) Name of the owner that configured this entry and is using its assigned resources. The length of the name can be from 1 to 255 characters.

Default Disabled

Command Mode Interface configuration

Usage Guideline

This command allows the administrator to enable or disable RMON on Ethernet interfaces of the device. If the administrator enables the RMON mechanism on the specific interface, the device will automatically collect statistical information about the traffic for the interface. The administrator can also perform operations on the supported MIB RMON groups.

Examples

This example shows how to create two RMON entries on Ethernet interface 3.2.

Switch# configure terminal
Switch(config)#interface eth3.2
Switch(config-if)#rmon statistics 3 owner monitor
Switch(config-if)#rmon statistics 4 

This example shows how to disable the RMON entry on Ethernet interface 3.2.

Switch#configure terminal
Switch(config)#interface eth3.2
Switch(config-if)#no rmon statistics 3

route-map

Use route-map to add the policy routing entry. Use the no form of the command to remove a policy routing entry.

route-map MAP-NAME { permit | deny } SEQUENCE-NUM

no route-map MAP-NAME [ permit SEQUENCE-NUM | deny SEQUENCE-NUM ]

Syntax Description
MAP-NAME A meaningful name for the route map. Multiple route maps may share the same map tag name
permit	(Optional) If the match criteria is met for this route map, and the permit keyword is specified, the route is redistributed as controlled by the set actions. In the case of policy routing, the packet is policy routed.If the match criteria is not met, and the permit keyword is specified, then the next route map with the same map tag will be tested. If a route passes none of the match criteria for the set of route maps sharing the same name, it will not be redistributed by that set.
deny (Optional) If the match criteria is met for the route map and the deny keyword is specified, then the route will not be redistributed. In the case of policy routing, the packet will not be policy routed, and no further route maps sharing the same map tag name will be examined. If the packet is not policy routed, then the normal forwarding algorithm will be used.
SEQUENCE-NUM	(Optional) A number that indicates the position a new route map will have in the list of route maps already configured with the same name. When used with the no form of this command, the position of the route map will be deleted.

Default permit

Command Mode Global configuration

Usage Guideline Use the route-map command to enter route-map configuration mode.

The route map can be used in route redistribution, route filtering, and policy route application.

A route map could be defined by multiple route map statements. These route map statements share the same map name. The statement with a lower sequence number has higher priority. Within the same route map, multiple match statements and multiple set statements can be defined. To meet a specific route map statement, all of the match statements must be met. When a route map statement is met, all of the set statements defined in this route map statement will be performed. Subsequent route map statements for the same route map will not be searched.

If the no route-map MAP-TAG command is specified (with no SEQUENCE-NUM argument), the entire route map is deleted.

Example

This example shows how to add the policy routing entry with name "myPolicy":

Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# match community Mycommunity
Switch(config-route-map)# set weight 1000
Switch(config-route-map)# end
Switch# 

Verify the settings by entering the show running-config command.

router bgp

Use this command to enable (configure) BGP routing process. Use the no form of the command to remove a BGP routing process.

router bgp AS-NUMBER

no router bgp AS-NUMBER

Syntax Description

AS-NUMBER Specifies the number of an autonomous system that identifies the router to other BGP routers. The range for 2-byte numbers is 1 to 65535. The range for 4-byte numbers is 65536 to 4294967295 or 1.0 to 65535.65535.

Default Disabled

Command Mode Global configuration

Usage Guideline

Each public autonomous system that directly connects to the Internet is assigned a unique number that identifies both the BGP routing process and the autonomous system (a number from 1 to 64511). Private autonomous system numbers are in the range from 64512 to 65534 (65535 is reserved for special use).

The AS Number size is defined as 2 bytes in RFC1771 and RFC4271.

Private autonomous system numbers can be used for internal routing domains but must be translated for traffic that is routed out to the Internet. BGP should not be configured to advertise private autonomous system numbers to external networks.

Use this command to enter router configuration mode for the specified routing process.

Example

This example shows how to configure a BGP process for autonomous system 1.65534:

Switch(config)# router bgp 1.65534

Switch(config-router)#

router-id

Use this command to specify a router ID for the OSPF process. Use the no form of the command to revert to the automatic determination of router-id.

router-id IP-ADDRESS

no router-id

Syntax Description

IP-ADDRESS Specifies the router ID in IPv4 address format.

Default

The router-id is automatically chosen based on the highest IP address present on the router.

Command Mode Router configuration

Usage Guideline

Router ID is a 32-bit number assigned to each router running the OSPF protocol. This number uniquely identifies the router within an Autonomous System. Each router must be configured with a unique router-id.

If this command is used on an active OSPF router process (already has neighbors), the new router-ID will not take effect immediately. It will be used at the next reload or at a manual OSPF process restart.

Example This example shows how to configure router id to 10.10.10.60

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)# router-id 10.10.10.60

Verify the settings by entering the show ip protocols ospf command.

router-id (IPv6)

To assign a fixed router ID, use the router-id command in router configuration mode, and force IPv6 OSPF routing process with the previous IPv6 OSPF router ID. To disable this function, use the no form of this command.

router-id IP-ADDRESS

no router-id

Syntax Description

IP-ADDRESS Router ID in IPv4 address format.

Default

The router-id is automatically chosen based on the highest IP address present on the router.

Command Mode Router configuration

Usage Guideline

Router ID is a 32-bit number assigned to each router running the IPv6 OSPF protocol. This number uniquely identifies the router within an Autonomous System. Each router must be configured with a unique router-id.

If this command is used on an active IPv6 OSPF router process (already has neighbors), the new router ID will not take effect immediately. It is used at the next reload or at a manual restart of IPv6 OSPF process.

Example The following example specifies a fixed router ID.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf
Switch (config-router) # router-id 10.1.1.1 

router ipv6 rip

To configure an IPv6 RIP routing process, use the router ipv6 rip command in global configuration mode. To remove a routing process, use the no form of this command.

router ipv6 rip

no router ipv6 rip

Syntax None

Default Not configured

Command Mode Global configuration

Usage Guideline

The router ipv6 rip command is similar to the router rip command, except that it is IPv6-specific. Use this command to enable an IPv6 RIP routing process globally. Using this command places the router in router configuration mode for the IPv6 RIP routing process. The router prompt changes to Switch(config-router)#.

Example

The following example configures the IPv6 RIP routing process and places the router into router configuration mode for the IPv6 RIP routing process.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 rip
Switch(config-router)# end 

router ipv6 ospf

To enable the IPv6 OSPF routing process, use the router ipv6 ospf command in global configuration mode. To disable this function, use the no form of this command.

router ipv6 ospf [PROCESS-ID]

no router ipv6 ospf [PROCESS-ID]

Syntax Description

PROCESS-ID

(Optional) Internally used identification parameter for an OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each OSPF routing process.

Default Not configured

PROCESS-ID: null

Command Mode Global configuration

Usage Guideline

Use this command to enter the router configuration mode of IPv6 OSPF. In this mode, there are other settings of IPv6 OSPF that can be configured.

Example The following example enables router OSPF for IPv6 configuration mode.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 ospf 0
Switch (config-router) # 

router ospf

To configure an Open Shortest Path First (OSPF) routing process, use the router ospf command in global configuration mode. To terminate an OSPF routing process, use the no form of this command.

router ospf

no router ospf

Syntax None

Default Not configured

Command Mode Global configuration

Usage Guideline

This command is used to enable OSPF routing processes and enter into router configuration mode then other OSPF-related settings can be configured.

Example

This example shows how to enable ospf and enter the ospf router configuration mode.

Switch# configure terminal
Switch(config)# router ospf
Switch(config-router)#

Verify the settings by entering the show ip protocols ospf command.

router rip

Use the command to configure the RIP routing process. To turn off the RIP routing process, use the no form of this command.

router rip

no router rip

Syntax None

Default Not configured

Command Mode Global configuration

Usage Guideline

This command is used to enable the RIP function and enter the Router configuration mode of RIP protocol.

Executing the no form of the command, will remove the configuration in the router mode.

Example The following example shows how to begin the RIP routing process:

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# end

Verify the settings by entering the show ip protocols rip command.

send-lifetime

To set the time period during which an authentication key on a key chain is valid to be sent, use the send-lifetime command in key chain key configuration mode.

send-lifetime START-TIME {infinite | END-TIME | duration SECONDS}

Syntax Description
START-TIME The beginning time that the key specified, by the key command, is valid to be received. The syntax can be either of the following:
	HH:MM:SS MONTH DATE YEAR
	HH:MM:SS DATE MONTH YEAR
	HH-hours MM-minutes SS-seconds MONTH-first three letters of the month DATE-date (1-31) YEAR-year (four digits)
	The default start time and the earliest acceptable date is January 1, 1993.
infinite Key is valid to be sent from the start-time value on and will not expire.
END-TIME	Key is valid to be sent from the start-time value until the end-time value.The syntax is the same as that for the START-TIME. The end-time value must be after the start-time value. The default end time is an infinite time period.
duration SECONDS	Length of time (in seconds) that the key is valid to be sent. The range is from 1 to 2147483647 (signed long).

Default infinite

Command Mode Key-chain key configuration

Usage Guideline

Specify a start-time value and one of the following values: infinite, end-time, or duration seconds.

if lifetimes are to be configured on keys, then it is recommended to use Network Time Protocol (NTP) or another similar time synchronization method.

When there are multiple keys that are valid at a time, the first valid key will be used. If there are no valid keys during a specific period of time, then no authentication will be performed.

Example

The following example configures a key chain named chain1. Key 1 named "forkey1string" will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. Key3 named "forkey3string" will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m.

Switch(config)# interface vlan1
Switch(config-if)# ip rip authentication key-chain chain1
Switch(config-if)# ip rip authentication mode text
Switch(config-if)# exit
Switch(config)# router rip
Switch(config-router)# network 172.19.0.0/8
Switch(config-router)# version 2
Switch(config-router)# exit
Switch(config)# key chain chain1
Switch(config-keychain)# key 1
Switch(config-keychain-key)# key-string forkey1string
Switch(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 14:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# key 3
Switch(config-keychain-key)# key-string forkey3string
Switch(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 2009 duration 7200
Switch(config-keychain-key)# send-lifetime 15:00:00 Jan 25 2009 duration 3600
Switch(config-keychain-key)# exit
Switch(config-keychain)# exit 

Verify the settings by entering the show ip key-chain command.

server

Set up a server for different types of methods. Use the no form of this command to delete a server.

server {tacacs | xtacacs} IP-ADDRESS [auth-port PORT-NUMBER] [timeout SECONDS] [retransmit COUNT]

server tacacs+ IP-ADDRESS [auth-port PORT-NUMBER] {key KEY-STRING | no-encrypt}

server radius IP-ADDRESS [auth-port PORT-NUMBER] {key KEY-STRING | no-encrypt} [timeout SECONDS] [retransmit COUNT]

no server {tacacs | xtacacs | tacacs+ | radius} IP-ADDRESS

Syntax Description
tacacs Specifies tacacs authentication.
xtacacs Specifies xtacacs authentication.
tacacs+ Specifies tacacs+ authentication.
radius Specifies radius authentication.
IP-ADDRESS Specifies the IP address of the authentication sever.
auth-port	(Optional) Specifies theTCP or UDP destination port for authentication requests. The port-number argument specifies the port number for authentication requests.
PORT-NUMBER
key KEY-STRING	The key for TACACS+ or RADIUS authentication. This argument is only present for TACACS+ and RADIUS. The key can be from 1 to 32 characters. The syntax is a general string that does not allow space.
no-encrypt No encryption for TACACS+ and RADIUS authentication. This argument is only present for TACACS+ and RADIUS.
timeout SECONDS	The time in seconds for waiting server reply. The range of timeout is 1 - 255 seconds.
retransmit COUNT	Specifies the number of switch system resend an authentication request to the server when no response is received. The value is from 0 to 3, and 0 to disable the retransmit.

Default

radius auth-port PORT-NUMBER: 1812

tacacs/xtacacs/tacacs+ auth-port PORT-NUMBER: 49

timeout: 5 seconds

retransmit: 2

Command Mode aaa group server configuration

Usage Guideline

Enable TACACS, XTACACS, TACACS+, or RADIUS authentication method for login and enable access to the switch. The first created authentication method will be the primary one. The maximum number of entries in the list is project

dependent. However it is recommended to be 3 and use them as a backup server scheme.

The encryption key is used to encrypt and authenticate all communication between the TACACS+/RADIUS client and server. The same key must be configured on the client and the server.

Example

The following example shows the network access server configured to recognize two RADIUS host entries. The second host entry configured acts as fail-over backup to the first one (the RADIUS host entries are tried in the order in which they are configured).

Switch(config)#aaa group server group1
Switch(config-aaa-group-server)# server radius 172.19.10.100 auth-port 1500 key 12345678
Switch(config-aaa-group-server)# server radius 172.19.10.100 auth-port 1600 key 12345678
Switch(config-aaa-group-server)# end
Switch(config)# 

Verify the settings by entering the show aaa group server command.

service dhcp

Use this command to enable a Dynamic Host Configuration Protocol (DHCP) server features on the switch. Use the no form of this command to disable DHCP server features.

service dhcp

no service dhcp

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

Use this command to enable DHCP server function. The DHCP server function is disabled by default.

Example Enable DHCP server function:

switch > enable
switch# configure terminal
switch(config)# service dhcp 

service-policy

To attach a policy map to an input interface use the service-policy command in the interface configuration mode. To remove a service policy from an input interface, use the no form of this command.

service-policy NAME

no service-policy NAME

Syntax Description

NAME The name of a service policy map (created using the policy-map command) to be attached. The name can be a maximum of 32 alphanumeric characters.

Default None

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this command.

Use the service-policy command to attach a single policy map to input interfaces. This policy is attached to the interface for aggregate and controls the number or rate of packets. The packet arriving at a port will be treated based on the service policy attached to the interface.

A policy map needs to be created before it is specified in this command.

A policy map without a configured class policy can not be attached.

Examples

In the following example shown on the next page, two policy maps are defined-cust1-classes, and cust2-classes.

For cust1-classes, gold is configured to use CoS Queue 6 and policed by a single rate policer with an average rate set to 64 Kbits per second and a normal burst size set to 128 Kbytes. Silver is configured to use CoS queue 5 and policed by a single rate policer with an average rate set to 64 Kbits per second and the normal burst size set to 128 Kbytes. Bronze is configured to use CoS queue 0 and policed by a single rate policer with an average rate set to 64 Kbits per second and a normal burst size set to 128K bytes.

For cust2-classes, gold is configured to use CoS Queue 6 and policed by a single rate policer with an average rate set to 128 Kbits per second and the normal burst size set to 256 Kbytes. Silver is policed by a single rate policer with an average rate set to 128 Kbits per second and the normal burst size set to 256 Kbytes. Bronze is policed by a single rate policer with an average rate set to 128 Kbits per second and the normal burst size set to 256 Kbytes.

The cust1-classes policy map is configured and then attached to eth3.1 and eth3.2 by the following commands.

Switch(config)# class-map gold
Switch(config-cmap)# match cos 6
Switch(config-cmap)# exit
Switch(config)# class-map silver
Switch(config-cmap)# match cos 5
Switch(config-cmap)# exit
Switch(config)# class-map bronze
Switch(config-cmap)# match cos 0
Switch(config-cmap)# exit
Switch(config)# policy-map cust1-classes
Switch(config-pmap)# class gold
Switch(config-pmap-c)# police 64 128 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# class silver
Switch(config-pmap-c)# police 64 128 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# class bronze
Switch(config-pmap-c)# police 64 128 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface eth3.1
Switch(config-if)# service-policy cust1-classes
Switch(config-if)# exit
Switch(config)# interface eth3.2
Switch(config-if)# service-policy cust1-classes
Switch(config-if)# exit

The cust2-classes policy map is configured and then attached to eth4.1 by the following commands.:

Switch(config)# policy-map cust2-classes
Switch(config-pmap)# class gold
Switch(config-pmap-c)# police 128 256 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# class silver
Switch(config-pmap-c)# police 128 256 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# class bronze
Switch(config-pmap-c)# police 128 256 exceed-action set-dscp-transmit 0
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface eth4.1
Switch(config-if)# service-policy cust2-classes
Switch(config-if)# exit

Verify the settings by entering the show qos interface command.

set

Use the set command in policy map class configuration mode to set the new precedence field, DSCP field, and CoS field of the out-going packet. The user can also directly specify the CoS queue for the packet.

set { [ip] precedence PRECEDENCE | [ip] dscp DSCP | cos COS | internal-cos COS}

no set { [ip] precedence PRECEDENCE | [ip] dscp DSCP | cos COS | internal-cos COS}

Syntax Description
precedence PRECEDENCE	Specifies a new precedence for the packet. The range is 0 to 7.If the optional keyword ip is specified, then the IPv4 precedence will be marked.Note that setting of precedence will not affect the CoS queue selection.
dscp DSCP	Specifies a new DSCP for the packet. The range is 0 to 63.The optional keyword ip is specified, then the IPv4 DSCP will be marked.Note that setting of DSCP will not affect the CoS queue selection.
cos COS	Assigns a new cos value to the packet. The range is 0 to 7.Note that setting of CoS will not affect the CoS queue selection.
internal-cos COS	Assigns the CoS queue to the packet. This overwrite the original CoS queue selection.

Default Not configured

Command Mode Policy-map class configuration

Usage Guideline	Use the set command to set the DSCP field, COS field, or precedence field of the matched packet to a new value. Use set internal-cos command to directly assign the CoS queue to the matched packet.
	Configure multiple set commands for a class if they are not conflicting. For example, precedence and dscp cannot be set at the same time.
	The set dscp command will not affect the CoS queue selection. The set internal-cos command will not alter the CoS field of the outgoing packet.
	If the policer is applied as the policy for the traffic class, the set actions configured by this command will be applied to the conforming packets. They will not be applied to the exceeding packet and the violating packet.
Example	In the following example, the policy map policy1 is configured with the policy for the class1 class. The packets that are included in the class1 class will be set to a

DSCP of 10 and policed by a single rate policer with an average rate set to 128 Kbits per second and the normal burst size set to 256 Kbytes.

Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# set ip dscp 10
Switch(config-pmap-c)# police 128 256 exceed-action set-dscp-transmit 3
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit

Verify the settings by entering the show policy-map command.

set as-path

Use this command to modify an autonomous system path for BGP routes. To delete an entry, use the no form of this command.

set as-path prepend AS-NUMBER-LIST

no set as-path prepend AS-NUMBER-LIST

Syntax Description

AS-NUMBER-LIST Appends the string following the keyword prepended to the autonomous systempath of the route, that is matched by the route map. Applies to inbound and outbound BGP route maps.It can specify an AS number or a list of AS number. AS number <1-4294967295>or <1.0-65535.65535>

Default Disabled

Command Mode Route-map configuration

Usage Guideline

The only global BGP metric available to influence the best path selection is the autonomous system path length. By varying the length of the autonomous system path, a BGP speaker can influence the best path selection to a peer further away.

The set as-path prepend variation allows an arbitrary autonomous system path string to be prepended to BGP routes. Usually the local autonomous system number is prepended multiple times, increasing the autonomous system path length.

When as-path is not modified by the route map, by default, the local AS will be prepended in the access list.

Example

This example shows how to set the as-path list 1, 10, 100, 200 with route map entry myPolicy:

Switch(config)# route-map myPolicy permit 1 Switch(config-route-map)#set as-path prepend 1 10 100 200

Verify the settings by entering the show route-map command.

set community

Use this command to set the BGP communities attribute, to delete an entry, use the no form of this command.

set community { COMMUNITY-NUMBER [additive] | WELL-KNOWN-COMMUNITY [additive] | none }

no set community {COMMUNITY-NUMBER [additive] | WELL-KNOWN-COMMUNITY [additive]}

Syntax Description
COMMUNITY-NUMBER	The community number value. It is presented in a “AA:NN” format, and the AA and the NN both are numbers from 0 to 65535.
WELL-KNOWN-COMMUNITY	(Optional) Well known communities can be specified by using the following keywords:internet: Specifies routes not to be advertised to the Internet.local-AS: Specifies routes not to be advertised peers outside of the AS including sub-AS.no-advertise: Specifies routes not to be advertised to other BGP peers.no-export: Specifies routes not to be advertised outside of Autonomous System boundary.
additive	(Optional) Adds the community to the already existing communities.
none Removes the community attribute from the prefixes that pass the route map.

Default Disabled

Command Mode Route-map configuration

Usage Guideline

BGP community exchange is not enabled by default. It is enabled on a per-neighbor basis with the neighbor send-community command.

The community will be sent out in the BGP packet only when set community is specified in the route map, and if all match criteria are met, all set actions are performed.

If additive is not specified, the user-defined communities in the route will be replaced.

User-defined community is transitive, Well-known community is not-transitive.

This command is useful for routes received from EBGP and to be transmitted to IBGP.

Example

This example shows how to set a community (0:1) to the route map entry with name myPolicy:

Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# set community 0:1
Switch(config-route-map)# 

Verify the settings by entering the show route-map command

set origin

To set the BGP origin code, use the set origin command in route-map configuration mode. To delete an entry, use the no form of this command.

set origin {igp | egp | incomplete}

no set origin {igp | egp | incomplete}

Syntax None

Default Disabled

origin: based on the route in the main IP routing table.

Command Mode Route-map configuration

Usage Guideline

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match—the conditions under which redistribution is allowed for the current route-map command. The set—the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met. When all match criteria are met, all set actions are performed. The origin code (ORIGIN) is a well-known mandatory attribute that indicates the origin of the prefix or, rather, the way in which the prefix was injected into BGP. There are three origin codes, listed in order of preference:

• IGP, signifying that the prefix was originated from information learned from an interior gateway protocol.
• EGP, signifying that the prefix originated from the EGP protocol, which BGP replaced.
• INCOMPLETE, meaning the prefix originated from some unknown source.

Example

This example shows how to set the origin of routes, that pass the route map named myPolicy, to EGP.

Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# match as-path PATH_ACL
Switch(config-route-map)# set origin egp 

Verify the settings by entering the show route-map command.

set weight

To specify the BGP weight for the routing table, use the set weight command in route-map configuration mode. To delete an entry, use the no form of this command.

set weight NUMBER

no set weight NUMBER

Syntax Description

NUMBER Weight value. It can be an integer ranging from 0 to 65535.

Default Disabled

Command Mode Route-map configuration

Usage Guideline

The implemented weight is based on the first matched autonomous system path. Weights indicated when an autonomous system path is matched override the weights assigned by global neighbor commands. In other words, the weights assigned with the set weight route-map configuration command override the weights assigned using the neighbor weight command.

Example

This example shows how to add the policy routing entry with name myPolicy and set the weight to 30 when it match the as-path access list with PATH_ACL:

Switch(config)# route-map myPolicy permit 1
Switch(config-route-map)# match as-path PATH_ACL
Switch(config-route-map)# set weight 30 

Verify the settings by entering the show route-map command

show aaa

Use show aaa to display the login/enable method list for all applications.

show aaa [login | enable] [console | telnet | http | ssh] [brief]

Syntax Description
login (Optional) Displays the login authentication information
enable (Optional) Displays the enable authentication information.
console (Optional) Displays the console authentication information.
telnet (Optional) Displays the telnet authentication information.
http (Optional) Displays the http authentication information.
ssh (Optional) Displays the ssh authentication information.
brief	(Optional) Displays the brief format of the authentication type (skip information about the detailed server list of the associating method list).

Default None

Command Mode Privilege EXEC or any configuration mode at privilege level 15

Usage Guideline Display the login/enable method list for all applications. If the brief option is specified, the detailed server list of the associating method list will be skipped,

Examples This example shows how to display the login/enable method list for all applications.

DGS-6604:15#show aaa

Console Session:

Login authentication:
Local Authentication: yes
Enable authentication:
Group Name: serverlist1
Local Authentication: no 

IP Address	Protocol	Port	Timeout	Retransmit	Key
122.248.150.251	RADIUS	1812	5	2	**********

Telnet Session:

Login authentication:
Group Name: serverlist1
Local Authentication: no 

IP Address	Protocol	Port	Timeout	Retransmit	Key
122.248.150.251	RADIUS	1812	5	2	**********

Enable authentication:
Local Authentication: yes 

Ssh Session:

Login authentication:
Group Name: serverlist1
Local Authentication: n 

IP Address	Protocol	Port	Timeout	Retransmit	Key
122.248.150.251	RADIUS	1812	5	2	**********

Enable authentication:
Local Authentication: yes 

Http Session:

Login authentication:
Local Authentication: yes
Enable authentication:
Local Authentication: yes 

DGS-6604:15#

The following example displays brief information for authentication:

DGS-6604:15#show aaa brief
Application	Method	Server group	Local
console	login		yes
console	enable	serverlist1	no
telnet	login	serverlist1	no
telnet	enable		yes
ssh	login	serverlist1	no
ssh	enable		yes
http	login		yes
http	enable		yes
DGS-6604:15#

The following example displays brief information for enable authentication:

DGS-6604:15#show aaa enable brief
Application	Method	Server group	Local
console	enable	serverlist1	no
telnet	enable		yes
ssh	enable		yes
http	enable		yes

The following example displays brief information for enable authentication and the telnet application:

DGS-6604:15#show aaa enable telnet brief
Application	Method	Server group	Local
telnet	enable		yes
DGS-6604:15#

The following example displays brief information for authentication and the console application:

DGS-6604:15#show aaa console brief
Application	Method	Server group	Local
console	login		yes
console	enable	serverlist1	no
DGS-6604:15#

show aaa group server

Use this command show aaa group server to display the authentication servers by group name or the authentication servers for all groups.

show aaa group server [GROUP-NAME]

Syntax Description

GROUP-NAME

(Optional) Specifies the name of the server method list to be displayed. The valid length for server-group is 1 to 32.

Default

None

Command Mode Privilege EXEC or any configuration mode at privilege level 15

Usage Guideline

Use this command to display the authentication servers by specifying the name (GROUP-NAME) of the group server list.

To see the servers for all groups, do not specify GROUP-NAME.

Examples This example shows how to display all the authentication server groups:

Switch:15#show aaa group server

Group Name	IP Address	Protocol	Port	Timeout	Retransmit	Key
serverlist1	122.248.150.251	RADIUS	1812	5	2	**********
serverlist1	122.248.150.100	RADIUS	1812	5	2	**********
serverlist1	122.248.150.11	RADIUS	1812	5	2	no-encrypt
serverlist2	100.1.1.1	TACACS	49	5	2
serverlist2	100.1.1.2	TACACS	49	5	2
serverlist2	100.1.1.12	TACACS	49	5	2
Switch:15#

This example shows how to display an authentication server group named authserv:

Switch:15#show aaa group server authserv
Group Name	IP Address	Protocol	Port	Timeout	Retransmit	Key
authserv	10.1.1.1	XTACACS	49	5	2
authserv	20.1.1.1	RADIUS	1812	5	2	**********
authserv	20.1.1.2	RADIUS	1812	5	2	no-encrypt
Switch:15#

show access-group

Use this command to display how the mac, ip and ipv6 access-lists are applied to interfaces.

show access-group [interface INTERFACE-ID] [ip [NAME] | mac [NAME] | ipv6 [NAME]]

Syntax Description
interfaceINTERFACE-ID	(Optional) Specifies the interface to be displayed. If not specified, the access-groups for all interfaces will be displayed.
ip	(Optional) Specifies that only the ip access group on the specified interface(s) will be displayed.
mac (Optional) Specifies that only the mac access group on the specified interface(s) will be displayed.
ipv6 Optional) Specifies that only the ipv6 access group on the specified interface(s) will be displayed.
NAME (Optional) The name of the access-list (mac, ip, ipv6) to be displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Since there is both an ip extended access-list and an ip access-list, use the access-list NAME to distinguish them.

Example This example shows how the IP access-list is applied to all of the interfaces.

Switch# show access-group
eth3.1
Inbound mac access-list : simple-mac-acl
Inbound ip access-list : simple-ip-acl
Inbound ipv6 access-list : ip6-control
eth3.2
Inbound mac access-list : rd-mac-acl
Inbound ip access-list : rd-ip-acl
Inbound ipv6 access-list : N/A 

show access-list

Use this command to display the access-list configuration.

show access-list [ ip NAME | mac NAME | ipv6 NAME]

Syntax Description
ip (Optional) Specifies to display a listing for all ip access-lists.
mac (Optional) Specifies to display a listing for all mac access-lists.
ipv6 (Optional) Specifies to display a listing for all ipv6 access-lists.
NAME	Specifies to display the content of the access-list identified by this NAME string.Up to 32 characters are allowed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline The detailed content for an access list is only shown for a specific access-list by using the NAME argument to identify it.

Examples This example provides a listing for all access lists.

Switch#show access-list
access-list name access-list type
rd-mac-acl mac ext-acl
simple-ip-aclip ip acl
rd-ip-acl ip acl
simple-rd-aclip ip ext-acl
ip6-acl ipv6 ext-acl
Total Entries : 5
Switch# 

This example shows the content for IP access-list R&D.

Switch# show access-list ip R&D
10 permit tcp any 10.20.0.0 255.255.0.0
20 permit tcp any host 10.100.1.2
30 permit icmp any any 

show arp

Use the show arp command to display the Address Resolution Protocol (ARP) cache.

show arp [ARP-MODE] [IP-ADDRESS [/MASK]] [INTERFACE-ID]

Syntax Description
ARP-MODE (Optional)	Displays the entries that are in a specific ARP mode. This argument can be replaced by one of the following keywords:dynamic—Displays only dynamic ARP entries. A dynamic ARP entry is learned through an ARP request and completed with the MAC address of the external host.static—Displays only static ARP entries. A static ARP entry is a statically configured (permanent) ARP.
IP-ADDRESS [/MASK]	(Optional) Displays the entries associated with a specific host or network entry that is associated with an external host.
INTERFACE-ID	(Optional) Displays only the ARP table entries associated with this interface such as, for example, a VLAN interface such as vlan100.

Default None

Command Mode User EXEC mode or any configuration mode

Usage Guideline

ARP establishes correspondences between network addresses (an IP address, for example) and LAN hardware addresses (Ethernet addresses). A dynamic record of each correspondence is kept in a cache for a predetermined amount of time and then discarded. The predetermined amount of time can be changed using the arp timeout command. If no arp mode argument is specified, then all of the arp entries are displayed.

The user can select to display a specific ARP entry, all ARP entries, dynamic entries, static entries, or entries associated with an IP interface.

Example This example shows how to display the ARP cache. The field of IP Interface is indicated with the Interface ID.

Switch#show arp
Address	Hardware Addr	IP Interface	Type
10.108.42.112	00-00-a7-10-4b-af	vlan100	Static
10.108.42.114	00-00-a7-10-85-9b	vlan200	Dynamic
10.108.42.121	00-00-a7-10-68-cd	vlan300	Dynamic
Total Entries: 3
Switch#

show boot

Use this command to display which is the next boot configuration and which is the next boot image file.

show boot

Syntax None

Default None

Command Mode User EXEC

Usage Guideline None

Example The following example shows the display information for the system boot information:

Switch# show boot
Boot loader version 1.00.004
Boot image: flash:\switch-image1.had, flash:\switch-image2.had
Boot config: flash:\switch-config
Switch# 

show channel-group

Use this command to display the information of channel groups.

show channel-group [ [channel [CHANNEL-NO] [ detail | neighbor | protocol]] | load-balance | sys-id ]

Syntax Description
CHANNEL-NO Channel group ID.
channel (Optional) Display information for specified port-channels.
detail (Optional) Display detailed channel group information.
neighbor (Optional) Display neighbor information.
protocol	(Optional) Display the protocol (static or LACP) that is being used in the channel group.
load-balance (Optional) Display the load balance information.
sys-id (Optional) Display the system identifier that is being used by LACP.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the keyword channel to display the port-channel information. If the arguments: detail, neighbor or protocol are not specified, then the switch will display detailed information for the specified port-channels.

If the port-channel number is not specified, then all port-channels will be displayed.

If the arguments: channel, load-balance and sys-id are specified for the show channel-group command, only summary channel-group information will be shown.

Examples

This example shows how to display the neighbor information for port-channel 3.

Switch> show channel-group channel 3 neighbor
S - Device is requesting Slow LACPDUs, F - Device is requesting Fast LACPDUs, A - Device is in Active mode, P - Device is in Passive mode,
Partner		Partner	Partner	Partner
Port	System ID		PortNo	Flags	Port_Pri.
eth3.1	32768,00-07-eb-49-5e-80		12	SP	32768
eth3.2	32768,00-07-eb-49-5e-80		13	SP	32768
Switch>

This example shows how to display the detailed information of all port-channels.

Switch> show channel-group channel detail
S - Device is sending Slow LACPDUs    F - Device is sending fast LACPDU
A - Device is in active mode.    P - Device is in passive mode.

LACP state:
bndl: Port is attached to an aggregator and bundled with other ports.
hot-sby: Port is in a hot-standby state.
indep: Port is in an independent state (not bundled but able to switch data traffic)
down: Port is down.

Channel Group 1
Member Ports: 2, Maxports = 16, Protocol: LACP
Port    Flags    LACP    Port    Port
      State    Priority    Number

eth3.10    SA    bndl    32768    10
eth3.11    SA    bndl    32768    11

Channel Group 2
Member Ports: 2, Maxports = 8, Protocol: Static
LACP
Port    State

eth3.8    bndl

eth3.9    down

Switch> 

This example shows how to display the protocol information for all port-channels.

Switch> show channel-group channel protocol

Group Protocol
1 LACP
2 Static
Total Entries: 2
Switch> 

This example shows how to display the load balance information for all channel groups.

Switch> show channel-group load-balance load-balance algorithm: src-dst-mac Switch> 

This example shows how to display the system identifier information

Switch> show channel-group sys-id
32765,00-02-4b-29-3a-00
Switch> 

This example shows how to display the information of all the port-channels in brief format.

Switch> show channel-group

Group Protocol 

1 LACP 

2 Static 

Total Entries: 2

load-balance algorithm: src-dst-mac 

system-ID: 32765,00-02-4b-29-3a-00 

show class-map

Use this command to display the class map configuration.

show class-map [NAME]

Syntax Description

NAME (Optional) Name of the class map. The class map name can be a maximum of 32 alphanumeric characters.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The user can use the show class-map command to display all class maps and their matching criteria. If the optional NAME argument is entered, the specified class map and its matching criteria will be displayed.

Example

In the following example, two class maps are defined. Packets that match access list acl_home_user belong to class c3, IP packets belong to class c2. The output from the show class-map command shows the default class, class-default and two defined class maps.

Switch# show class-map
Class Map match-any c2
match protocol ip
Class Map match-any c3
match access-list acl_home_user
Total Entries: 2
Switch# 

show clock

Use this command to display the time and date information.

show clock

Syntax None

Default None

Command Mode EXEC mode or any configuration mode

Usage Guideline

This command will also indicate the clock source. The clock source can be one of "No Time Source", "RTC, or "SNTP".

Example The following example shows how to display the current time:

Switch> show clock
Current Time Source : No Time Source
Current Time : 19:14:16, 2010-12-06
Time Zone : UTC -08:00
Daylight Saving Time : Disable
Offset in Minutes : 60
From : Apr 2nd Tue 15:00
To : Oct 2nd Wed 15:30
Switch> 

show dos\_prevention

Use this command to show DoS prevention status and related drop counters.

show dos_prevention

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Displays information about DoS prevention.

Example

The following is an example of a DoS configuration. The user has enabled DoS for the attacking types "Land" and Blat. The actions "Drop", "Mirror", and "Log" are enabled. The action "Drop" is enabled by default.

The original received attacking packets of "Land Attack", "Blat Attack" will be dropped and mirrored to send one copy to interface eth4.1. Each packet dropped by the DoS module will cause "Frame Count" to be increased by 1. Every five minutes, the DoS module will add one log to the system log if any attacking packet is received during this interval.

Switch# Switch# show dos_prevention
DoS Prevention Information
Action: Drop Mirror Log
Mirror Dst Port: eth4.1
Frame Counts: 12345678
DoS Type	State
Land Attack	Enabled
Blat Attack	Enabled
Smurf Attack	Disabled
TCP Null	Disabled
TCP Xmas	Disabled
TCP SYNFIN	Disabled
TCP SYN SrcPort Less Than 1024	Disabled

show dot1v

Use the show dot1v command to display the setting for the configuration of VLAN protocols.

show dot1v { protocol-group [ GROUP-ID [, | - ] ] | interface [ INTERFACE-ID [, | - ] ] }

Syntax Description

protocol-group Show the protocol VLAN table entry information.

GROUP-ID Specifies the dot1v protocol table entry number.

interface Show the protocol VLAN group binding information of the ports.

INTERFACE-ID Specifies the interface to display.

, (Optional) Specifies a series of interfaces or GROUP-ID, or separate a range of interfaces from a previous range. No space before and after the comma.

- (Optional) Specifies a range of interfaces or GROUP-ID. No space before and after the hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline	Use the show dot1v command to display the current protocol VLAN status.Show the protocol VLAN group list table using the show dot1v protocol-group command. Show the protocol VLAN binding of the ports using the show dot1v interface command.
Example	This example shows how to display protocol VLAN binding of interface ports 3.1 to 3.3.

Switch# show dot1v interface eth3.1-3.3
Interface	dot1v Group ID/Binding-VLAN
eth3.1	1/1
eth3.2	10/3000, 11/3001, 12/3002
eth3.3	2/100
Switch#

show dot1x

Use this command to display information about the: 802.1X state, configuration, statistics, diagnostics, session statistics, or authentication client.

show dot1x [interface INTERFACE-ID] {auth-state | auth-configuration | statistics | diagnostics | session-statistics}

Syntax Description
interfaceINTERFACE-ID	(Optional) Specifies a port to display the authentication state, configuration, statistics, diagnostics, or session statistics. This option is only valid for a physical port interface.
auth-state Display information of 802.1X state.
auth-configuration Display information of 802.1X configuration.
statistics Display information of 802.1X statistics.
diagnostics Display information of 802.1X diagnostics.
session-statistics Display information of 802.1X session statistics.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline If a port is not specified, then information for all ports will be displayed.

Examples This example shows how to display the authentication configuration for port eth4.1.

Switch#show dot1x interface eth4.1 auth-configuration
System Auth Control: Enabled
Authentication Protocol: Local
eth4.1
PAE: Authenticator
Control Direction: Both
Port Control: Auto
Quiet Period: 60
Tx Period: 30
Supp Timeout: 30
Server Timeout: 30
Max-req: 2
Reauth Period: 3600
Re-authentication: Disabled
Authentication Mode: Host-based
Guest VLAN: Disabled
Forward 1x PDU: Disabled
Total Entries: 1 

This example shows how to display the authentication statistics for port eth4.1.

Switch#show dot1x interface eth4.1 statistics
eth4.1
EAPOL Frames RX: 0
EAPOL Frames TX: 0
EAPOL-Start Frames RX: 0
EAPOL-Logoff Frames RX: 0
EAPOL-Resp/Id Frames RX: 0
EAPOL-Resp Frames RX: 0
EAPOL-Req/Id Frames TX: 0
EAPOL-Req Frames TX: 0
Invalid EAPOL Frames RX: 0
EAP-Length Error Frames RX: 0
Last EAPOL Frame Version: 0
Last EAPOL Frame Source: 00-00-00-00-00-00
Total Entries: 1 

This example shows how to display the authentication diagnostics for port eth4.1.

Switch#show dot1x interface eth4.1 diagnostics
eth4.1
EntersConnecting: 0
EAP-LogoffsWhileConnecting: 0
EntersAuthenticating: 0
SuccessesWhileAuthenticating: 0
TimeoutsWhileAuthenticating: 0
FailsWhileAuthenticating: 0
ReauthsWhileAuthenticating: 0
EAP-StartsWhileAuthenticating: 0
EAP-LogoffsWhileAuthenticating: 0
ReauthsWhileAuthenticated: 0
EAP-StartsWhileAuthenticated: 0
EAP-LogoffsWhileAuthenticated: 0
BackendResponses: 0
BackendAccessChallenges: 0
BackendNonNakResponsesFromSupplicant: 0
BackendAuthSuccesses: 0
BackendAuthFails: 0

Total Entries: 1 

This example shows how to display the authentication session statistics for port eth4.1.

Switch#show dot1x interface eth4.1 session-statistics
eth4.1
SessionOctetsRX: 0
SessionOctetsTX: 0
SessionFramesRX: 0
SessionFramesTX: 0
SessionId:
SessionAuthenticationMethod:
SessionTime: 0
SessionTerminateCause: PortAdminDisabled
SessionUserName:
Total Entries: 1 

show dot1x user

Use this command to show the local accounts for 802.1x authentication.

show dot1x user

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example This example shows the output of this command.

Switch#show dot1x user

Username

Password

yourname1

yourpass1

yourname2

yourpass2

Total Entries: 2

show enable password

Use this command to display the password of the privilege enable function

show enable password [privilege LEVEL]

Syntax Description

privilege LEVEL

(Optional) Specifies the privilege level.

Default None

Command Mode Privileged EXEC at privilege level 15 or any configuration mode at privilege level 15

Usage Guideline Issuing this command will display the password of the privilege enable function for either or both privilege level 12 or 15.

Example This example shows how to display all of the enable passwords.

Switch# show enable password
Password Encryption : Disabled 

Access Level Password 

12 mypassword (Plain Text)
15 *@&cRDtpNCeBiq15KOQsKVyrA0sAiCIZQwq (Encrypted) 

Total Entries: 2
Switch# 

show environment

Use the show environment command to display fan, temperature, redundant power system (RPS) availability, and power information for the switch.

show environment [ fan | power | temperature ]

Syntax Description
fan	(Optional) Display the detail and status of the switch fans.
power	(Optional) Display the detail and status of the switch power.
temperature	(Optional) Display the detail and status of the switch temperature.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline If a specific environment type is not specified, then all types of environment information will be displayed.

Example

The example shows how to display the H/W environmental information. This example includes the thermal sensor status, the operation temperature range, fan operation speed, fan status, and power status.

Switch#show environment

Environmental Status

Slot	Inlet temperature			Center temperature			Outlet temperature
	current/operation range			current/operation range			current/operation range
1	35	C/0	~75	C	35	C/0	~75	C	N/A
2	42	C/0	~70	C	38	C/0	~80	C	38 C/0 ~80 C
3	37	C/0	~76	C	36	C/0	~77	C	43 C/0 ~75 C
4	42	C/0	~76	C	36	C/0	~77	C	38 C/0 ~75 C

Status code: * temperature is out of operation range

Fans are operation in normal speed

Failed Fans: None

Power module	#1	#2	#3	#4
Power status	in-operation	empty	empty	empty
Max power	850 W	-	-	-
Used power	203 W	-	-	-

Switch#show environment power

Environmental Status

Power module	#1	#2	#3	#4
Power status	in-operation	empty	empty	empty
Max power	850	W	-	-
Used power	203	W	-	-

Switch#

The table below describes the significant fields shown in the display for the power module

Field	Description
Max power	The configured maximum power for the unit.
Used power	The allocated power for the unit
Power status	In-operation: The power rectifier is in normal operation mode. failed: The power rectifier can't work normally. empty: The power rectifier is not installed.

show gvrp configuration

Use the show gvrp command to display the settings for gvrp.

show gvrp configuration [ interface INTERFACE-ID [, | - ] ]

Syntax Description

interface Display the gvrp settings of the interface

INTERFACE-ID (Optional) Specifies the interface to display.

, (Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range.

- (Optional) Specifies a range of interfaces.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline It only displays GVRP related configuration information.

Example This example shows how to display gvrp configuration.

Switch# show gvrp configuration
Global GVRP State : Enabled
Dynamic Vlan Creation : Disabled
Switch# 

This example shows how to display the GVRP configuration for port's eth3.5 to eth3.6.

Switch# show gvrp configuration interface eth3.5-6

Port	GVRP Status	Join	Leave	Leave-All (1/100 Secs)
eth3.5	Enabled	20	60	1000
eth3.6	Enabled	20	60	1000

Total Entries: 2

Port based Forbidden VLAN Configuration:

Port Forbidden VLANs

eth3.5 3,5

eth3.6 5-8

Port based Advertising VLAN Configuration:

Port Advertising VLANs:

eth3.5 1,3

eth3.6 1,9

Switch#

show gvrp statistics

Use the show gvrp statistics command to display the statistics for gvrp ports.

show gvrp statistics [ interface INTERFACE-ID [, | - ] ]

Syntax Description
INTERFACE-ID	(Optional) Specifies the interface to display. If no interface is specified, the statistics on all interfaces will be shown.
,(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range.
-(Optional) Specifies a range of interfaces.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline It only displays the ports which have the gvrp state enabled.

Example This example shows how to display statistics for a range of gvrp ports.

Switch# show gvrp statistics interface eth3.5-3.6
Port		JoinEmpty	JoinIn	LeaveEmpty	LeaveIn	Empty
eth3.5	RX	0	0	0	0	0
	TX	4294967296	4294967296	4294967296	4294967296	4294967296
eth3.6	RX	0	0	0	0	0
	TX	0	0	0	0	0
Total Entries: 2

show history

To list the commands that have been entered in the current EXEC session, use the show history command.

show history

Syntax None

Command Mode User EXEC or any configuration mode

Usage Guideline

The switch saves a record of the commands that the user entered. The recorded commands can be recalled to the screen prompt by pressing the following key. CTRL+P or Up Arrow key. They will both recall the commands in a backward sequence. CTRL+N or Down Arrow key will recall the commands in a forward sequence.

The history buffer size is fixed at 20 commands.

Example This example shows how to show the command history.

Switch#show history
1 help
2 history
Switch# 

show interface

Use this command to display information about a specified interface or all interfaces.

show interface [INTERFACE-ID [- | , ] ]

Syntax Description

INTERFACE-ID The interface can be a physical port, port-channel and VLAN.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline If no interface is specified, the system will display all existing interfaces.

Examples This example shows sample information output for interface port eth4.1.

DGS-6600:15#show interface eth4.1

eth4.1 is up, line protocol is up (connected)
Hardware is Ethernet, address is 00-01-02-03-04-00 (bia 00-01-02-03-04-00)
Description: connection to alpha 10.0.0.0 network
Auto-full, 1000Mb/s
Send flow-control is off, receive flow-control is off
max-rcv-frame-size:1536bytes
MTU:1500bytes
RX rate: 3213 bytes/sec, TX rate: 627 bytes/sec
RX Bytes: 1245924311, TX Bytes: 2197375
RX rate: 40 packets/sec, TX rate: 8 packets/sec
RX Frames: 6789084, TX Frames: 23388
RX Unicast: 964397, RX Multicast: 1922294
RX Broadcast: 3902393
64: 4459506, 65-127: 673129, 128-255: 249915
256-511: 212212, 512-1023: 1153749, 1024-1518: 63961
RX CRC Error: 0, RX Undersize: 0
RX Oversize: 0, RX Fragment: 0
RX Jabber: 0, RX Dropped Pkts: 0
RX MTU Exceeded: 0
TX CRC Error: 0, TX Excessive Deferral: 0
TX Single Collision: 0, TX Excessive Collision: 0
TX Late Collision: 0, TX Collision: 0 

This example is a sample output of information for interface port channel 1.

Switch#show interface port-channel1
port-channel1 is down, line protocol is down (notconnect)
Hardware is Ethernet, address is 00-00-00-00-00-00 (bia 00-00-00-00-00-00)
Description:
Members in this channel: 2
Member 0 : eth4.3 down
Member 1 : eth4.4 down 

This example shows sample information output for interface VLAN 1

Switch#show interface vlan1
vlan1 is up, line protocol is up (connected)
Hardware is VLAN, address is 08-01-02-38-00-01 (bia 08-01-02-38-00-01)
Description:
IP MTU:1500bytes 

show ip as-path access-list

To display configured as-path access-lists, use the show ip as-path access-list command.

show ip as-path access-list [ACCESS-LIST-NAME]

Syntax Description

ACCESS-LIST-NAME (Optional) Specifies the access list to be displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command can be used without any arguments. If no arguments are specified, this command will display all as-path access-lists. However, the as-path ACCESS-LIST-NAME can be specified when entering the show ip as-path access-list command. This optionn is useful for filtering the output of this command and verifying a single named as-path access-list.

Example

This example shows how to display the content of IP AS path access-list

Switch>Show ip as-path access-list
AS path access list A1
    permit .* 
AS path access list A2
    permit .* 

show ip bgp

To display entries in the Border Gateway Protocol (BGP) routing table, use the show ip bgp command in user EXEC or privileged EXEC mode.

show ip bgp [IP-ADDRESS[/MASK-LENGTH[ longer-prefixes] ] | route-map NAME ]

Syntax Description
IP-ADDRESS	(Optional) An IP address entered to filter the output to display only a particular host or network in the BGP routing table.
/MASK-LENGTH	(Optional) Mask length to filter or match hosts that are part of the specified network. It can be in decimal format (i.e. 8).
longer-prefixes	(Optional) Displays the specified route and all other specific routes.
route-map NAME	(Optional) Filters the output based on the specified route map.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline The show ip bgp command is used to display the contents of the BGP routing table.

Examples The following example output shows the BGP routing table:

Switch> show ip bgp
BGP table version: 13, local router ID: 10.1.1.99
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 10.1.1.0/24 0.0.0.0 0 32768 i
*> 172.17.1.0/24 192.168.1.1 0 0 45000 i
Total Entries: 2 entries, 2 routes
Switch> 

The following is example output from the show ip bgp command entered with the route-map keyword:

Switch(config)#show ip bgp route-map RMAS1
BGP table version is 845, local router ID is 11.0.9.254
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete 

Network Next Hop Metric LocPrf Weight Path
*> 201.0.1.0/24 11.0.9.1 0 0 1701 i
* 201.0.2.0/24 11.0.9.1 0 0 1701 i
*> 11.0.9.2 0 0 101 i
*> 201.0.3.0/24 11.0.9.1 0 0 1701 i
*> 201.0.4.0/24 11.0.9.1 0 0 1701 i 

Total Entries: 4 entries, 5 routes
Switch(config)# 

The following is example output from the show ip bgp command entered with the IP-ADDRESS argument:

Switch(config)#show ip bgp 121.0.2.0/24
BGP routing table entry for 121.0.2.0/24
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Advertised to peer-groups:
G1
101
10.50.71.200 from 10.50.71.200 (10.50.71.200)
Origin IGP, localpref 100, valid, external, best
Last update: 19:47:01, 2010-09-29
Switch(config)# 

show ip bgp community-list

To display configured community lists, use the show ip community-list command.

show ip bgp community-list COMMUNITY-LIST-NAME [exact-match]

Syntax Description

COMMUNITY-LIST-NAME

The configured name of the Community list.

exact-match (Optional) Displays only routes that have an exact match.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command requires the COMMUNITY-LIST-NAME to be specified when issued. The exact-match keyword is optional.

Example

The following is sample output of the show ip bgp community-list command:

Switch>show ip bgp community-list MarketingCoommunity
BGP table version is 716977, local router ID is 192.168.32.1
Status codes: s suppressed, * valid, > best, i - internal
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* i10.3.0.0 10.0.22.1 0 100 0 1800 1239 ?
*>i 10.0.16.1 0 100 0 1800 1239 ?
* i10.6.0.0 10.0.22.1 0 100 0 1800 690 568 ?
*>i 10.0.16.1 0 100 0 1800 690 568 ?
* i10.7.0.0 10.0.22.1 0 100 0 1800 701 35 ?
*>i 10.0.16.1 0 100 0 1800 701 35 ?
* i10.8.0.0 10.0.22.1 0 100 0 1878 704 701 35 ?
*>i 10.0.16.1 0 100 0 1800 690 560 ?
* i10.13.0.0 10.0.22.1 0 100 0 1878 704 701 560 ?
*>i 10.0.16.1 0 100 0 1878 690 200 ?
* i10.15.0.0 10.0.22.1 0 100 0 1878 704 701 200 ?
*>i 10.0.16.1 0 100 0 1878 74 ?
* i10.16.0.0 10.0.22.1 0 100 0 1878 74 ?
*>i 10.0.16.1 0 100 0 1878 74 i
* i10.7.24
Total Entries: 7 entries, 18 routes 

Field Description
BGP table version	Internal version number of the table. This number is incremented whenever the table changes.
local router ID IP address of the router.
Status codes	Status of the table entry. The status is displayed at the beginning of each line in the table. It can be one of the following values:s-The table entry is suppressed.S- The table entry is stale.*-The table entry is valid.>-The table entry is the best entry to use for that network.i-The table entry was learned via an internal BGP (iBGP) session.
Origin codes Origin of the entry. The origin code is placed at the end of each line in the table.It can be one of the following values:i-Entry originated from an Interior Gateway Protocol (IGP) and was advertised with a network router configuration command.e-Entry originated from an Exterior Gateway Protocol (EGP).?-Origin of the path is not clear. Usually, this is a router that is redistributed into BGP from an IGP.
Network IP address of a network entity.
Next Hop IP address of the next system that is used when forwarding a packet to the destination network. An entry of 0.0.0.0 indicates that the router has some non-BGP routes to this network.
Metric If shown, this is the value of the inter-autonomous system metric. This field is frequently not used.
LocPrf	Local preference value as set with the set local-preference route-map configuration command. The default value is 100.
Weight Weight of the route as set through autonomous system filters.
Path Autonomous system paths to the destination network. There can be only one entry in this field for each autonomous system in the path.

show ip bgp filter-list

To display routes that conform to a specified filter list, use the show ip bgp filter-list command.

show ip bgp filter-list ACCESS-LIST-NAME

Syntax Description

ACCESS-LIST-NAME

Specifies the AS path access list name and only the routes that match the access list are displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example

This example shows how to display the content of access-list, as-ACL_HQ.

Switch> show ip bgp filter-list as-ACL_HQ
BGP table version is 1738, local router ID is 172.16.72.24
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
	Network	Next Hop	Metric	LocPrf	Weight	Path
*	172.16.0.0	172.16.72.30	0	109	108	?
*	172.16.1.0	172.16.72.30	0	109	108	?
*	172.16.11.0	172.16.72.30	0	109	108	?
*	172.16.14.0	172.16.72.30	0	109	108	?
*	172.16.15.0	172.16.72.30	0	109	108	?
*	172.16.16.0	172.16.72.30	0	109	108	?
*	172.16.17.0	172.16.72.30	0	109	108	?
*	172.16.18.0	172.16.72.30	0	109	108	?
*	172.16.19.0	172.16.72.30	0	109	108	?
*	172.16.24.0	172.16.72.30	0	109	108	?
*	172.16.29.0	172.16.72.30	0	109	108	?
*	172.16.30.0	172.16.72.30	0	109	108	?
*	172.16.33.0	172.16.72.30	0	109	108	?
*	172.16.35.0	172.16.72.30	0	109	108	?
*	172.16.36.0	172.16.72.30	0	109	108	?
*	172.16.37.0	172.16.72.30	0	109	108	?
*	172.16.38.0	172.16.72.30	0	109	108	?
*	172.16.39.0	172.16.72.30	0	109	108	?

Total Entries: 18 entries, 18 routes

show ip bgp neighbors

Use this command to display information about the TCP and Border Gateway Protocol (BGP) connections to neighbors.

show ip bgp [ipv4 { unicast }] neighbors [ IP-ADDRESS [ advertised-routes | routes] ]

Syntax Description
ipv4	(Optional) Specifies the address family. The type of address family determines the routing table that is displayed.
unicast Specifies a IPv4 unicast address family. This is the default option.
IP-ADDRESS	(Optional) IP address of a neighbor. If this argument is omitted, all neighbors are displayed.
advertised-routes (Optional) Displays the routes advertised to a BGP neighbor.
routes (Optional) Displays all accepted routes learned from neighbors.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the show ip bgp neighbors command to display BGP and TCP connection information for neighbor sessions. For BGP, this includes detailed neighbor attributes, capability, path, and prefix information. For TCP, this includes statistics related to BGP neighbor session establishment and maintenance.

When BGP neighbors use multiple levels of peer templates, it can be difficult to determine which policies are applied to the neighbor.

The output of this command displays all address family information if the keyword ipv4 is not specified. Specify the IP address of a neighbor to display information about the specific neighbor.

Examples

The example on the next page shows how to display the 10.108.50.2 neighbor. This neighbor is an internal BGP (iBGP) peer. This neighbor supports the route refresh and graceful restart capabilities.

Switch# show ip bgp neighbors 10.50.71.253
BGP neighbor is 10.50.71.253, remote AS 8001, local AS 8001, internal link
Member of peer-group G1 for session parameters
BGP version 4, remote router ID 51.50.71.253
BGP state = Established, up for ODT0H39M28S
Last read ODT0H39M28S, hold time is 180, keepalive interval is 60 seconds
Neighbor capabilities:
Route refresh: advertised and received (old and new)
4-Byte AS number: advertised and received
AS TRANS:
Address family IPv4 Unicast: advertised and received
Received 0 in queue
Sent 0 in queue 

Sent Received
Opens: 1 0
Notifications: 1 0
Updates: 2 2
Keepalives: 47 45
Route Refresh: 0 0
Dynamic Capability: 0 0
Total: 51 47
Connect retry time is 120 seconds
In update elapsed time is 2367 seconds
Minimum time between advertisement runs is 5 seconds
Minimum time between as origination runs is 15 seconds
Default weight 300
For address family: IPv4 Unicast
BGP table version 41, neighbor version 41
Index 4, Offset 0, Mask 0x10
G1 peer-group member
AF-dependant capabilities:
Graceful restart: advertised, received
2 accepted prefixes
3 announced prefixes
Connections established 1; dropped 0 

Graceful-restart Status:
Remote restart-time is 120 sec
Local host: 10.50.71.254, Local port: 179
Foreign host: 10.50.71.253, Foreign port: 49952
Nexthop: 10.50.71.254
Last Reset: 0DT0H39M28S, due to BGP Notification sent
Notification Error Message: (Cease/Unspecified Error Subcode.)
Switch> 

The following example displays routes advertised for only the 172.16.232.178 neighbor:

Switch> show ip bgp neighbors 172.16.232.178 advertised-routes
BGP table version: 27, local router ID: 172.16.232.181
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete 

Network Next Hop Metric LocPrf Weight Path
*>i10.0.0.0 172.16.232.179 0 100 0 ?
*> 10.20.2.0 10.0.0.0 0 32768 i 

Total Entries: 2 entries, 2 routes 

Swtich> 

show ip community-list

To display configured community lists, use the show ip community-list command.

show ip community-list [COMMUNITY-LIST-NAME]

Syntax Description
COMMUNITY-LIST-NAME	(Optional) Community list name. The community list name can be standard or expanded.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline This command can be used without any arguments or keywords. If no arguments are specified, this command will display all community lists. However, the community list name can be specified when entering the show ip community-list command. This option can be useful for filtering the output of this command and verifying a single named community list.

Example This example shows how to display the content of all community lists.

Switch(config)#show ip community-list
Named Community standard list C1
permit internet
Named Community standard list C2
permit 3:2
Switch(config)# 

show ip dhcp binding

To display the current status of address bindings on the DHCP Server.

show ip dhcp binding [pool NAME] [ADDRESS]

Syntax Description
ADDRESS	(Optional) Specifies the IP address of the DHCP client for which the bindings will be displayed. If no IP address is specified, all bound IP addresses are applied for this command.
pool NAME	(Optional) Specifies the pool name for the conflict IP address. If no pool name is specified, all of the pools are applied for this command.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

If the address is not specified, all address bindings are shown. Otherwise, only the binding for the specified client is displayed. The IP address, hardware address, Lease expiration and assigned type will be included in the displayed format.

Examples The following example shows the binding status of all bound IP addresses.

switch# show ip dhcp bindingPool Name: pool1
IP address	Hardware address	Lease start	Lease expiration
10.1.1.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
Pool Name: pool2
IP address	Hardware address	Lease start	Lease expiration
10.1.1.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
10.1.9.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
10.1.11.10	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
Switch#

The following example shows the binding status of the entire address pool2,

switch# show ip dhcp binding pool pool2
IP address	Hardware address	Lease start	Lease expiration
10.1.1.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
10.1.9.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1
10.1.11.10	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1

The following example shows the binding status of IP address 10.1.1.1 in DHCP address pool, pool1.

switch# show ip dhcp binding pool pool1 10.1.1.1
IP address	Hardware address	Lease start	Lease expiration
10.1.1.1	00b8.3493.32b5	18:38:56, 2010-09-30	18:38:56, 2010-10-1

show ip dhcp conflict

To display the conflict IP addresses while a DHCP Server attempts to assign the IP addresses for a client.

show ip dhcp conflict [pool NAME][ADDRESS]

Syntax Description
ADDRESS	(Optional) Specifies the conflict IP address. If no conflict IP address is specified, all conflict IP addresses are applied.
pool NAME	(Optional) Specifies the pool name for the conflict IP address. If no pool name is specified, all pools are applied for this command.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The DHCP server detects the conflict by the ping operation. If a conflict address is found, then the IP address found will be removed from address pool and marked as conflict and will not be assigned until a network administrator clears this conflict. If the address is not specified, all conflict addresses are shown. Otherwise, only the conflict address for the specified address is displayed. The IP address, Detection Method and Detection Time will be included in the displayed format. If a duplicate IP address is detected by the DHCP server, the Detection Method will be marked as "ping" and if the duplicate IP address is detected by the DHCP client, the Detection Method will be marked as "Gratuitous ARP".
Example The following example shows the conflict status of IP address 10.1.1.1.

switch# show ip dhcp conflict 10.1.1.1
Pool name: pool2
IP address	Detected Method	Detection time
10.1.1.1	Ping	18:38:56, 2010-09-30

The following example shows the conflict status of all DHCP IP address pools.

switch# show ip dhcp conflict
Pool name: pool2
IP address	Detected Method	Detection time
10.1.1.1	Ping	18:38:56, 2010-09-30
Pool name: pool3
IP address	Detected Method	Detection time
172.1.1.1	Gratuitous ARP	18:38:56, 2010-09-30

show ip dhcp pool

To display information about the Dynamic Host Configuration Protocol (DHCP) address pools,

show ip dhcp pool [NAME]

Syntax Description
NAME	(Optional) Displays information about a specific address pool. If not specified, displays information about all address pools.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use this command to examine the current utilization level and configuration setting of the address pool. If the NAME argument is not used then the information for all the pools will be displayed.

Example The following example shows DHCP address pool information for an On-

Demand Address Pool (ODAP), pool 1. The table below describes the significant fields in the display.

switch# show ip dhcp pool2
Pool name: pool2
Accept client ID: Yes
Accept relay Agent: No
Boot file: boot.bin
Default router: 10.1.2.1
DNS server: 10.1.2.1
Domain name: alphanetworks.com
Lease: 3600 seconds
NetBIOS node type: hybrid
NetBIOS scpoe ID: alpha
Next server: 10.1.2.1
Subnet:255.255.0.0
Based-on mac-address:00:01:02:03:04:05-00:01:02:03:04:FF
Based-on mac-address:00:08:02:03:04:05
Based-on mac-address:00:09:02:03:04:05
Based-on client ID: 0x01000102030405
Based-on C-VID: 2
Based-on C-VID: 10-20
Based-on S-VID: 100
Based-on S-VID: 300-400
Based-on interface ip-address: 10.0.3.1
Based-on relay-ip-address: 10.5.3.1
Based-on vendor-class: Alpha
Based-on user-class: MSFT

IP addresses: total 511
10.0.0.1
10.0.1.1-10.0.1.255
10.0.3.1-10.0.3.255
Number of leased address: 100
Number of conflict addresses: 2
switch# 

Display Field Descriptions

Descriptions of the significant fields in the previous example.

Field Description

Pool	The name of the pool.
Field	Description
Subnet The bit combination with the address of the DHCP address pool
Lease The duration of the lease for an IP address
Accept client ID	To validate the DHCP Client Identifier value sent by the client or not
Accept relay agent	Accept DHCP packet contains option82 or not.This control can be one of the following configurations:Remote-ID & Circuit-ID,Remote IDCircuit-IDNo.
Domain name	The domain name for DHCP clientBoot fileThe name of the default boot image for a Dynamic Host Configuration Protocol (DHCP) client
Next server The configured IP addresses of next-server
Default router The default router list for a DHCP client
DNS server The IP address list of DNS server available to DHCP clients.
NetBIOS node type the NetBIOS node type
NetBIOS scpoe ID the NetBIOS scope id
WINS server The IP address of WINS server
Based-on mac-address The address binding rule based on MAC
Based-on client ID The address binding rule based on Client ID
Based-on C-VID The address binding rule based on customer vlan id
Based-on S-VID The address binding rule based on service provider vlan id
Based-on interface-ip-address	The address binding rule based on ingress interface IP
Based-on relay-ip-address	The address binding rule based on IP address of relay agent
Based-on vendor-class	The address binding rule based on vendor class (option60)
Based-on user-class	The address binding rule based on user class (option77)
Number of leased address	The number of addresses has been leased .
Number of conflict addresses	The number of addresses are conflict with other clients.

show ip dhcp relay

Display the IP DHCP relay agent configuration.

show ip dhcp relay

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Display the DHCP relay agent configuration

Example

This example shows how to display the DHCP relay agent configuration.

Switch# show ip dhcp relay
DHCP Relay : Enabled
Relay Hop Count : 4
DHCP Relay Information Option : Enabled
DHCP Relay Information Policy : keep
DHCP Relay Information Check Reply : Enabled
DHCP Relay Information Trusted : Enabled
VLAN100 Relay IP Addresses
10.1.1.1, 10.1.1.2, 10.1.1.3
List of Trusted sources of relay agent information option:
VLAN100 VLAN200 VLAN300 VLAN400
Switch# 

show ip dhcp relay information trusted-sources

Use the show ip dhcp relay information trusted-sources command to display all interfaces configured to be a trusted source for the Dynamic Host Configuration Protocol (DHCP) relay information option, .

show ip dhcp relay information trusted-sources

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Display the DHCP relay agent configuration.

Example

The following is sample output when the ip dhcp relay information trusted command is configured. Note that the display output lists the interfaces that are configured to be trusted sources.

Switch# show ip dhcp relay information trusted-sources
List of trusted sources of relay agent information option:
VLAN100 VLAN200 VLAN300 VLAN400 VLAN500
Total Entries: 5
Switch# 

show ip dhcp server

This command displays the current status of DHCP server

show ip dhcp server

Syntax None

Default None

Command Mode Privileged EXEC

Usage Guideline Display the DHCP server status and user configured pool.

Example This example shows how to display the status of DHCP server.

Switch# show ip dhcp server
DHCP server: Disable
Ping packets number: 3
Ping timeout: 500 ms

List of DHCP server configured address pool
pool1    pool2    pool3    pool4
pool5    pool6    pool7    pool8
pool9    pool10    pool11    pool12 

show ip dhcp server statistics

To display Dynamic Host Configuration Protocol (DHCP) server statistics.

show ip dhcp server statistics

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The show ip dhcp server statistics command displays the DHCP counters. All counters are cumulative.

Example The following example resets all DHCP counters to zero. The table below describes the significant fields in the display.

switch# show ip dhcp server statistics
Address pools	2
Malformed messages	0
Renew messages	0
Message	Received
BOOTREQUEST	12
DHCPDISCOVER	200
DHCPREQUEST	178
DHCPDECLINE	0
DHCPRELEASE	0
DHCPINFORM	0
Message	Sent
BOOTREPLY	12
DHCPOFFER	190
DHCPACK	172
DHCPNAK	6
switch#

Display Field Descriptions

Significant field descriptions for command show ip dhcp server statistics

Field Description

Address pools	The number of configured address pools in the DHCP database.
Malformed messages	The number of truncated or corrupted messages that were received by the DHCP server.
Field Description
Renew messages	The number of renew messages for a DHCP lease. The counter is incremented when a new renew message has arrived after the first renew message.
Message The DHCP message type that was received by the DHCP server.
Received	The number of DHCP messages that were received by the DHCP server.
Sent	The number of DHCP messages that were sent by the DHCP server.

show ip dvmrp interface

This command is used to display dvrmp configuration information on interface.

show ip dvmrp interface [INTERFACE-ID [,|-]]

Syntax Description
INTERFACE-ID [ , | - ]	(Optional) Specifies a single interface, a range of interfaces separated by a hyphen, or a series of interfaces separated by a comma. If no interface is specified, the switch displays DVRMP information on all interfaces at which DVMRP is enabled (That is for all of DVMRP enabled interfaces).Only VLAN interface are allowed to be specified for this command.
,	(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space is allowed before and after the comma.
- (Optional) Specifies a range of interfaces. No space is allowed before and after the hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline This command displays interface related information about Distance Vector Multicast Routing Protocol (DVMRP).

Example This example shows how to display the DVMRP configuration information about interface VLAN 1000.

Switch#show ip dvmrp interface vlan1000
Interface	Address	Metric	Generation ID
vlan1000	10.0.0.254	1	1234567890
Total Entries: 1
Switch#

show ip dvmrp neighbor

Use this command to show DVMRP neighbor information.

show ip dvmrp neighbor [ INTERFACE-ID | IP-ADDRESS ] [ detail ]

Syntax Description

INTERFACE-ID (Optional) Specifies the interface ID

IP-ADDRESS (Optional) The IP address of the neighbor

detail (Optional) Show the neighbor information in detail.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Use this command to display DVMRP neighbor information. If neither INTERFACE-ID nor IP-ADDRESS is specified, then the information of all neighbors will be displayed. If the keyword of detail is not specified, then only brief information for the neighbors will be displayed.

Examples This example shows how to display neighbor information.

Switch>show ip dvmrp neighbor
Interface	Neighbor Address	Generation ID	ExpTime
vlan1	10.10.10.11	0035ef6d	ODTOHOM29S
Total Entries: 1

Display Field Descriptions

Description of the significant display fields.

Display Field Description
Interface The interface refers to the routing interface which is mapped to a VLAN interface.
Neighbor Address Once a system has received a Probe from a neighbor that contains the system's address in the neighbor list, then the system has established a two-way neighbor adjacency with this router.
Generation ID	If a DVMRP router is restarted, it will not be aware of any previous prunes that it had sent or received. In order for the neighbor to detect that the router has restarted, a non-decreasing number is placed in the periodic probe message called the generation ID. When a change in the generation ID is detected, any prune information received from the router is no longer valid and should be flushed.

ExpTime The neighbor time-out interval, which SHOULD be set to 35 seconds.

This setting allows early detection of a lost neighbor yet provides tolerance for busy multicast routers.

These time-out values MUST be coordinated between all DVMRP routers of a particular physical network segment.

The expire time shown here is the amount of time remaining before reaching the neighbor time-out interval setting.

This example shows how to display neighbor detail information.

Switch>show ip dvmrp neighbor detail
Capability Flags: N-Network, S-SNMP,M-MTRACE, G-GENID, P-PRUNE, L-LEAF
Neighbor address: 10.10.10.11
Interface: vlan1
UpTime: 0DT0H23M49S
ExpTime: 0DT0H0M30S
Generation ID: 0035ef6d
Major Version: 3
Minor Version: 255
Capabilities: e (Flags: M,G,P)
Number of bad routes Received: 0
Number of routes Received: 0
Number of PROBE Received: 144
Number of REPORT Received: 1
Number of PRUNE Received: 0
Number of GRAFT Received: 0
Number of GRAFTACK Recvd: 0 

Display Field Descriptions

Description of the significant display fields.

Display Field Description

Capability Flags LEAF - Whether this neighbor router is a leaf router.

PRUNE - This neighbor router understands pruning.

GENID- This neighbor router sends Generation Id's.

MTRACE - This neighbor router handles Mtrace requests.

SNMP - This neighbor router supports the DVMRP MIB.

Network - This neighbor will accept a network mask.

UpTime The total time elapsed since the neighbor was discovered until now.

ExpTime The time remaining until the entry is removed from the DVMRP neighbor table.

Generation ID If a DVMRP router is restarted, it will not be aware of any previous prunes that it had sent or received. In order for the neighbor to detect that the router has restarted, a non-decreasing number is placed in the periodic probe message called the generation ID. When a change in the generation ID is detected, any prune information received from the router is no longer valid and should be flushed.

show ip dvmrp prune

Use this command to display DVMRP upstream prune state information.

show ip dvmrp prune

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Display DVMRP upstream Prune state information.

Example This example shows how to displays prune information.

DGS-6600:15#show ip dvmrp pruneFlags: P=Pruned, D=Holddown, N=NegMFC
Source Network	Group Address	State	ExpTime	Prune/Graft ReTransmit-Time
10.0.7.101/32	239.255.255.250	P..	0DT1H45M44S	Off
10.0.7.131/32	239.255.255.250	P..	0DT1H47M30S	Off
10.1.52.99/32	229.55.150.208	P.N	0DT1H44M36S	0DT0H3M50S
Total Entries: 3

Display Field Descriptions

Description of significant display fields.

Display Field Description
Source Network The address of the source IP address or source network.
Group Address The IP group address.
State P: The upstream state is in Prune state.
	D: The entry is in Hold-Down state. In this state, a negative multicast forwarding cache (ip mroute) entry will be added.
	N: Negative Multicast forwarding cache (ip mroute) is installed.
ExpTime The amount of time remaining before this prune will expire.
Prune/Graft ReTransmit Time	The ramaining time before retransmitting a Prune or Graft. When "P" flag is set in the "State" field, this timer would represent the Prune retransmit timer, otherwise, it would represent the Graft retransmit timer.

show ip dvmrp route

Use this command to display DVMRP route information.

show ip dvmrp route [ NETWORK-ADDRESS ]

Syntax Description

NETWORK-ADDRESS

(Optional) Specifies the source network address and mask length be displayed. If NETWORK-ADDRESS is not specified, all DVMRP routes will be displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Display DVMRP route information.

Example This example shows how to display route information.

DGS-6600:15#show ip dvmrp route
State: H = Hold-down
Source Network Upstream Neighbor Metric Learned Interface State ExpTime
10.0.0.0/8 10.78.62.51 1 Local vlan99 -
Total Entries: 1
DGS-6600:15# 

Display Field Descriptions

Description of significant display fields.

Display Field Description
Source Network The address of the source IP address or source network.
Upstream neighbor The Next hop router to the source network.
	0.0.0.0: This route is a local interface entry, and therefore it does not enable DVMRP.
	If the interface is a local entry, then the upstream neighbor displays its own interface IP address.
Learned Indicates this route entry is a local interface. The other condition is dynamically learned.
Interface The local Interface used to connect to the source network.
State	Route state displays "H" if the DVMRP route is in "Hold-down" state.
ExpTime	The time remaining until the entry is removed from the DVMRP routing table. A dash note indicates this entry is not going to be removed (because it is a local interface).

show ip igmp group

Used to display IGMP group information on an interface

show ip igmp group [IP-ADDRESS | interface INTERFACE-ID] [detail]

Syntax Description

IP-ADDRESS (Optional) Specifies the Group IP address to display. If no IP address is specified, all IGMP group information will be displayed.
interface	(Optional) Specifies the interface to display. If no interface is specified, IGMP group information of all interfaces where IGMP is enabled will be displayed.
INTERFACE-ID
detail (Optional) Specifies to show the additional information (Uptime, Expires, Group mode and Last reporter).

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

User can display IGMP group information by using this command. The following examples cover different versions of IGMP. The uptime means the time elapsed since the entry is created. The expire time means the time that the entry will be removed if there is no refresh of the entry,

Examples

This example shows how to display IGMP group information for interface VLAN 1000.

Switch#show ip igmp group interface vlan1000
Interface	Group Address	Uptime	Expires	Last Reporter
vlan1000	224.0.1.149	0DT0H0M9S	0DT0H4M15S	10.10.0.91
Total Entries : 1 entries, 2 records
Switch#

Display Field Descriptions

show ip igmp group Field Descriptions.

Field Description

entries The number of the igmp group table display.

records The number of the group records and source records in the igmp group table.

This example shows how to display IGMP group detailed information for group 224.1.1.1. If the interface is operated at v3, the group source list will be displayed. If the interface is not operated at v3, the group source list will not be displayed.

Switch# show ip igmp group 224.1.1.1 detail

Interface : vlan1000
Group : 224.1.1.1
Uptime : 0DT0H0M42S
Expires : stopped
Group mode : Include, dynamic
Last reporter : 192.168.50.111 

Group source list:

Source Address Uptime v3 Exp Forward
192.168.55.55 0DT0H0M42S 0DT0H3M38S Yes
192.168.10.55 0DT0H0M10S 0DT0H3M38S Yes 

Interface : vlan2000

Group : 224.1.1.1
Uptime : 0DT0H0M42S
Expires : 0DT0H3M38S
Group mode : Exclude, dynamic
Last reporter : 192.168.51.111
Source list is empty 

Display Field Descriptions

Description of significant display fields.

Display Field Description

Uptime The time elapsed since the entry has been created in the format of [n]DT[n]H[n]M[n]S.

Expires The time that the entry will be removed if there is no refresh on the entry in the format of [n]DT[n]H[n]M[n]S.stoppedindicates that timing out of this entry is not determined by this expire timer. If the router is in Include mode for a group, then the whole group entry times out after the last source entry has timed out (unless the mode is changed to Exclude mode before it times out).

Group mode Include or Exclude: The group mode is based on the type of membership reports that are received on the interface for the group.dynamic:If this port (or port-channel) interface receives a host's IGMP membership report for the group.

Last reporter Last host to report being a member of the multicast group.

Forward Status of whether the router is forwarding multicast traffic due to this entry.

show ip igmp interface

Used to display IGMP configuration information on interface

show ip igmp interface [INTERFACE-ID [, | - ]]

Syntax Description
INTERFACE-ID [,|-]	(Optional) Specifies a single interface, a range of interfaces separated by a hyphen, or a series of interface separated by a comma. If no interface is specified, the switch displays IGMP information for all interfaces where IGMP is enabled (that is for all of IGMP enabled interfaces). Note, only a VLAN interface type is allowed for this command.
,(Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space is allowed before and after the comma.
-(Optional) Specifies a range of interfaces. No space is allowed before and after the hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline User can display Interface IGMP configuration information by this command.

If the specified VLAN interface has IGMP disabled, all of the IGMP related configuration shown as if IGMP is enabled with the exception that the IGMP state is disabled. When no VLAN interface is specified, only IGMP enabled VLANs are displayed for this command. While a VLAN interface list may incorporate IGMP disabled VLANs, all of the listed VLAN's IGMP configuration information is displayed.

Example This example shows how to display IGMP configure information about interface VLAN 1000.

Switch#show ip igmp interface vlan1000
vlan1000
IP Address/Netmask : 10.50.95.90/8
IGMP State : Enabled
Access Group : igmp_fileter
Version : 3
Query Interval : 125 seconds
Query Maximum Response Time : 10 seconds
Robustness Value : 2
Last Member Query Interval : 1000 milliseconds
Querier : 10.50.95.90
Querier Timer countdown value : -
Configured Query Interval : 5
Configured Maximum response time : 15
Configured Robustness : 2 

show ip igmp snooping

Use this command to display IGMP Snooping information on the switch.

show ip igmp snooping [VLAN VLAN-ID]

Syntax Description

VLAN VLAN-ID	(Optional) Specifies a VLAN. The VLAN ID range is 1 to 4094.
	If no VLAN is specified, then this command shows IGMP Snooping Information for all VLANs where IGMP Snooping is enabled (i.e. all IGMP Snooping enabled VLAN interfaces).

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The IGMP Snooping information can be displayed using this command. If the specified VLAN does not exist or IGMP Snooping is disabled at the VLAN, an error message will be displayed.

Example This example shows how to display IGMP Snooping configurations.

Switch> show ip igmp snooping
IGMP Snooping is enabled in the following VLANs
Codes- v3:IGMP v3 host compatibility mode, v2: IGMP v2 host compatibility mode
v1:IGMP v1 host compatibility mode
Vlan Querier state Querier Router Immediate Timer State
---- ---- ---- Leave ----
(v3)1 Enabled Active Enabled -
(v2)2 Disabled - Disabled 0DT0H4M10S
(v3)3 Enabled Non-active Enabled 0DT0H3M12S
Total number of VLANs = 3
Switch> 

Display Field Descriptions

The following table shows the field information for the above example.

Display Field Parameter Description
Querier state Enabled IGMP Snooping querier is enabled.
	Disabled IGMP Snooping querier is disabled.
Querier Router Active This VLAN interface of the switch works as an IGMP snooping querier.
	Non-active This VLAN interface does not function as an IGMP snooping querier.
	- This field can be disregarded when the IGMP snooping querier state is disabled.
Immediate Leave Enable IGMP Snooping immediate leave response function is enabled which means the member port of the VLAN interface will receive any IGMP leave message from a port, the system will immediately remove the port from the multicast group membership.
	Disable IGMP Snooping immediate leave response function is disabled which means the member port of the VLAN interface will receive the IGMP leave message, the system will not remove the port from the multicast group membership, instead the system will follow IGMP interaction process to confirm the multicast membership.
Host Compatibility Mode	IGMPv1	The current compatibility state of this interface. This state is dependent on the version of general queries received from the interface. IGMPv3 is the default value. If any lower version is received, the version will go back to the lowest version for backward compatibility.
	IGMPv2
	IGMPv3
Timer State	- The timer stops counting down.
	[n]DT[n]H[n]M[n]S	Timer starts to count down, and its initial count is set to the value got from the Older Version Querier Present Timeout in the IGMP control packet.

show ip igmp snooping group

Use this command to display IGMP Snooping group information learned by the switch.

show ip igmp snooping group [IP-ADDRESS | VLAN VLAN-ID] [detail]

Syntax Description
IP-ADDRESS (Optional)	Specifies the Group IP address to display. If no IP address is specified, all IGMP Snooping group information will be displayed.
VLAN VLAN-ID	(Optional) Specifies the VLAN interface to display. If no VLAN is specified, the command shows IGMP snooping group information about all VLANs where IGMP Snooping is enabled.
detail (Optional)	Specifies to show the additional information (Uptime, Expires, Group mode and Last reporter).

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

User can display IGMP Snooping group information by this command. The following examples cover different versions of the IGMP.

If the specified VLAN does not exist or IGMP Snooping is disabled at the VLAN, an error message will be displayed instead.

Examples This example shows how to display IGMP Snooping group information.

Switch# show ip igmp snooping group
IGMP Snooping Connected Group Membership: ((s)- static configuration)
Group address	Source address	Interface	Port
224.0.1.149	10.2.2.18	vlan1	eth3.12
224.0.1.145	10.1.1.2	vlan1	eth3.15
224.0.2.123(s)	10.3.3.128	vlan2	eth3.1
Total Entries : 3 entries, 6 records

Display Field Descriptions

show ip igmp snooping group Field Descriptions.

Field Description

entries The number of the igmp snooping group table display.

records The number of the group records and source records in the igmp snooping group table.

This example shows how to display the IGMP snooping group detailed information of group 224.1.1.1. If the interface is operated at v3, the group source list will be displayed. If the interface is not operated at v3, the group source list will not be displayed.

Switch# show ip igmp snooping group 224.1.1.1 detail
IGMP version: V3
Interface: vlan1000
Group: 224.1.1.1
Port: eth3.12
Uptime : 0DTOH0M42S
Expires : stopped
Group mode : Include, dynamic
Last reporter: 192.168.50.111 

Source Address Uptime v3 Exp Forward
192.168.55.55 0DT0H0M42S 0DT0H3M38S yes
192.168.55.66 0DT0H0M42S 0DT0H3M38S no
IGMP version: V2
Interface : vlan2000
Group : 224.1.1.1
Port : eth3.2
Uptime : 0DT0H0M42S
Expires : 0DT0H3M38S
Group mode : Exclude, dynamic
Last reporter: 192.168.51.111
Source list is empty
Switch# 

Display Field Descriptions

The following table shows the display field information for the example on the previous page.

Display Field Description

IGMP version The version of IGMP. The version of IGMP that the multicast group has reported.

Interface Interface ID of VLAN in which the multicast IP address is reported.

Uptime The time elapsed since the entry has been created in the format of [n]DT[n]H[n]M[n]S

Expires The time that the entry will be removed if there is no refresh on the entry in the format of [n]DT[n]H[n]M[n]S."never" indicates that the entry will not be time out, because a local receiver is on the router for this entry."stopped" indicates that the time-out of this entry is not determined by this expire timer. If the router is set toInclude modefor a group, then the whole group entry times out after the last source entry has timed out (unless the mode is changed toExclude modebefore it times out).

Group mode Include or Exclude: The group mode is based on the type of membership reports that are received on the interface for the group.static: If this group is configured statically on the port (or port-channel) interface.dynamic: If this port (or port-channel) interface receives a host's IGMP membership report for the group.

Last reporter Last host to report being a member of the multicast group.

Forward Status of whether the router is forwarding multicast traffic due to this entry.

show ip igmp snooping mrouter

Use this command to display IGMP Snooping mrouter information learned and configured on the switch.

show ip igmp snooping mrouter [vlan VLAN-ID] [designate | auto | not-allowed]

Syntax Description
vlan VLAN-ID	(Optional) Specifies a VLAN. The VLAN ID range is 1 to 4094. If no VLAN is specified, this command shows IGMP snooping information on all VLANs where IGMP snooping is enabled.
designate (Optional) Display the router ports which are statically configured.
auto (Optional) Display the router ports which are dynamically learned.
not-allowed	(Optional) Display the router ports which are configured as forbidden to be router ports.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command is used to display information on dynamically learned and manually configured multicast router interfaces. When IGMP snooping is enabled, the switch automatically learns the interface to which a multicast router is connected. These are dynamically learned interfaces. If no option is specified, all of designate, auto, and not-allowed interfaces are displayed.

When the specified VLAN does not exist or the specified VLAN is without IGMP snooping enabled, a warning message will appear indicating this.

Example This example shows how to display IGMP snooping mrouter information.

Switch# show ip igmp snooping mrouter
vlan1
Designate : eth3.4,
Auto : eth4.2,
Not-allowed: -
vlan2
Designate : eth4.4,
Auto : eth3.2,
Not-allowed: -
Total Entries: 2 

show ip interface

Use this command to display the information of ip interfaces.

show ip interface [INTERFAC E-ID] [brief]

Syntax Description
INTERFACE-ID	(Optional) Interface type and number. It refers to an IP interface, that is VLAN interfaces only.
brief (Optional) Displays a summary of the usability status information for each interface.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

An IP interface can be in either the down state or up state. When an interface is in the up state, it can send and receive packets. If an interface is in the down state, the directly connected routing entry is removed from the routing table. Removing the entry allows the switch to use dynamic routing protocols to determine backup routes to the network.

If an optional interface type is specified, then information for that specific interface is displayed. This command only supports VLAN interface types.

If no optional arguments are specified, then information for all the interfaces is displayed.

If the interface hardware is usable, the interface is marked "up." For an interface to be usable, both the interface hardware and line protocol must be up.

Example

This example shows how to display the brief format of the show ip interface command.

Switch> show ip interface brief
Interface	IP-Address	Status	Protocol
vlan1	10.90.90.90	up	up
vlan2	20.1.1.1	up	up
Total Entires: 2
Switch>

This example shows how to display the ip interface information for VLAN 1

Switch> show ip interface vlan1
vlan1 is up,
Internet address is 100.0.0.1/24
Internet address is 110.0.0.1/24 (secondary)
MAC Address is 08-01-02-24-00-01
ARP timeout is 14400 seconds
IP MTU is 1500 bytes 

show ip key-chain

Use this command to display the settings of the configured key chains.

show ip key-chain [NAME-OF-KEY]

Syntax Description

NAME-OF-KEY (Optional) Specifies the name of a key chain to display.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Specify the name of key-chain (NAME-OF-KEY) to get the information of specific key-chain. If no NAME-OF-KEY is specified, information of all key-chains will be shown.

Example The following example shows the sample output of show ip key-chain:

Switch# show ip key-chain
Key-Chain tree
Key 1 -- text "stringforkey1"
accept lifetime (13:30:00 Jan 25 2008) - (15:29:59 Jan 25 2008)
send lifetime (14:30:00 Jan 25 2008) - (16:29:59 Jan 25 2008)
Key 2 -- text "stringforkey2"
accept lifetime (14:30:00 Jan 25 2008) - (always valid)
Send-lifetime 14:30:00 Jan 25 2008 duration 3600
Key-Chain ifall
Key 1 -- text "admin123"
accept lifetime (13:30:00 Feb 25 2008) - (15:29:59 Feb 25 2008)
send lifetime (14:30:00 Feb 25 2008) - (16:29:59 Feb 25 2008)
Key 2 -- text "guestabc"
accept lifetime (13:30:00 Feb 25 2008) - (15:29:59 Feb 25 2008)
send lifetime (14:30:00 Feb 25 2008) - (16:29:59 Feb 25 2008)
Switch# 

show ip mroute

Use this command to display the content of the IP multicast routing table.

show ip mroute [ { [group-addr GROUP-ADDRESS] [source-addr NETWORK-ADDRESS] [summary] } |static]

Syntax Description
group-addr	(Optional) Specifies the Group IP address.
GROUP-ADDRESS
source-addr	(Optional) Specifies the Source IP network address.
NETWORK-ADDRESS
summary (Optional) Displays a one-line, abbreviated summary of each entry in the IP multicast routing table.
static (Optional) Displays the multicast static routes

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Displays the content of the IP multicast table.

The “Uptime” timer describes the time elapsed since the entry was created.

The “Expires” timer is a keep-alive timer for the multicast data stream. The Expires timer value is based on either the PIM Sparse and Dense Mode RFCs (RFC 4601 and RFC 3973) or DVMRP. If the multicast data continues to arrive at the device, the timer will renew itself.

If network address is specified, the switch displays the entries with source addresses that match the specified address.

Example This example shows how to display the IP multicast route table summary:

Switch> show ip mroute summary
IP Multicast Routing Table: 1 entry
Flags: D - PIM-DM, S - PIM-SM, V - DVMRP
Timers: Uptime/Expires

(10.10.1.52, 224.0.1.3), vlan1, 0DT0H1M32S/0DT0H3M20S, Flags: D 

The following is sample output from the show ip mroute command.

Switch> show ip mroute
IP Multicast Routing Table - 1 entry
Flags: D - PIM-DM, S - PIM-SM, V - DVMRP
Timers: Uptime/Expires

(10.10.1.52, 224.0.1.3), uptime 0DT5H29M15S, expires 0DT0H2M59S, flags: D
Incoming interface: vlan1
Outgoing interface list:
vlan2
vlan3 

The following is a sample output from the show ip mroute static command.

Switch> show ip mroute static
Mroute: 192.168.6.0/24, RPF neighbor: 10.1.1.1, distance: 0
Mroute: 192.168.7.0/24, RPF neighbor: 10.1.1.1, distance: 100
Mroute: 192.168.8.0/24, interface: Null, distance: 0
Total Entries: 3 

show ip ospf

Use this command to display general information about the OSPF routing process.

show ip ospf

Syntax None

Default None

Command Mode User EXEC

Usage Guideline

Display general OSPF protocol information. It provides system-wide statistics and per area statistics for OSPF. The LSDB database overflow limit is the capacity for the LSA table size. It is project dependent.

Example

On the following page is a sample output from the show ip ospf command.

Switch#show ip ospf
Operational Router ID 10.47.65.160
Process uptime is ODT0H12M33S
Conforms to RFC2328, and RFC1583Compatibility flag is disabled
This router is an ABR, ABR Type is Standard (RFC2328)
This router is an ASBR (injecting external routing information)
This router is a BR
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of external LSA 1240. Checksum 0x26DB197
Number of router LSA 17
Number of network LSA 10
Number of non-default summary LSA 109
Number of asbr summary LSA 38
Number of non-default external LSA 1240
Number of LSA originated 138
Number of LSA received 1441
Number of current LSA 1426
LSDB database overflow limit is 24576
Number of areas attached to this router: 5
Area 0.0.0.0 (BACKBONE)
Number of interfaces in this area is 5 active interface number is 5
Number of fully adjacent neighbors in this area is 5
SPF algorithm last executed ODT0H9M46S ago
SPF algorithm executed 9 times
Number of LSA 66
Network 47.65.49.0/24
Summarize range 3.0.0.0/8 advertise cost 1 (auto)
Area 0.0.0.1
Number of interfaces in this area is 2 active interface number is 2
Number of fully adjacent neighbors in this area is 2
Number of fully adjacent virtual neighbors through this area is 2
SPF algorithm last executed ODT0H9M46S ago
SPF algorithm executed 7 times
Number of LSA 32
Network 47.65.51.0/29
Network 47.65.52.0/29

Switch# 

show ip ospf border-routers

Use this command to display the ABRs and ASBRs for the OSPF instance.

show ip ospf border-routers

Syntax None

Default None

Command Mode User EXEC

Usage Guideline Use this command to display the ABRs and ASBRs information.

Example This is a sample output from the show ip ospf border-routers command

Switch#show ip ospf border-routers

OSPF process internal Routing Table

Codes: i - Intra-area route, I - Inter-area route

i 10.47.65.181 [1] via 47.65.51.2, vlan51, ABR, ASBR, TransitArea 0.0.0.1
i 10.47.65.182 [1] via 47.65.52.2, vlan52, ABR, ASBR, TransitArea 0.0.0.1
i 10.47.65.183 [1] via 47.65.53.2, vlan53, ABR, ASBR, TransitArea 0.0.0.2
i 10.47.65.184 [1] via 47.65.54.2, vlan54, ABR, ASBR, TransitArea 0.0.0.2
i 47.65.131.111 [2] via 47.65.52.2, vlan52, ASBR, TransitArea 0.0.0.1
i 47.65.151.111 [2] via 47.65.53.2, vlan53, ASBR, TransitArea 0.0.0.2
Total Entries: 6 

Switch#

show ip ospf database

Use this command to display a database summary for OSPF information.

show ip ospf database

Syntax None

Default None

Command Mode User EXEC

Usage Guideline

Display information about the database summary for OSPF information.

Example

The following page shows a sample output from the show ip ospf database command:

Switch#show ip ospf database
	Router Link States (Area 0.0.0.0)
Link ID	ADV Router	Age	Seq#	CkSum	Link count
10.47.65.160	10.47.65.160	1765	0x8000000e	0x107f	6
	Net Link States (Area 0.0.0.0)
Link ID	ADV Router	Age	Seq#	CkSum
47.65.49.111	47.65.49.111	1819	0x80000001	0x33da
	Summary Link States (Area 0.0.0.0)
Link ID	ADV Router	Age	Seq#	CkSum	Route
2.1.1.0	10.47.65.160	57	0x80000002	0xe15a	2.1.1.0/24
	ASBR-Summary Link States (Area 0.0.0.0)
Link ID	ADV Router	Age	Seq#	CkSum
10.47.65.160	10.47.65.181	1786	0x80000003	0xb756
	Router Link States (Area 0.0.0.61 [NSSA])
Link ID	ADV Router	Age	Seq#	CkSum	Link count
10.47.65.160	10.47.65.160	77	0x80000004	0x24bb	1
	Summary Link States (Area 0.0.0.61 [NSSA])
Link ID	ADV Router	Age	Seq#	CkSum	Route
2.1.1.0	10.47.65.160	57	0x80000002	0xff3e	2.1.1.0/24
	NSSA-external Link States (Area 0.0.0.61 [NSSA])
Link ID	ADV Router	Age	Seq#	CkSum	Route
1.0.0.0	10.47.65.160	117	0x80000002	0x80e7	N2 1.0.0.0/24
	AS External Link States
Link ID	ADV Router	Age	Seq#	CkSum	Route
1.0.0.0	10.47.65.160	107	0x80000002	0x15e5	E2 1.0.0.0/24
Total Entries: 8

show ip ospf database asbr-summary

Use this command to display information about the Autonomous System Boundary Router (ASBR) summary LSAs.

show ip ospf database asbr-summary [LINK-STATE-ID] [self-originate] [

adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline	Displays information about the Autonomous System Boundary Router (ASBR) summary LSAs.
Example	The following page shows a sample output from the show ip ospf database asbr-summary command.

Switch#show ip ospf database asbr-summary
ASBR-Summary Link States (Area 0.0.0.0)
LS age: 893
Options: 0x2 (*|−|−|−|−|−|E|−)
LS Type: ASBR-summary-LSA
Link State ID: 10.47.65.160 (AS Boundary Router address)
Advertising Router: 10.47.65.181
LS Seq Number: 80000003
Checksum: 0xb756
Length: 28
Network Mask: /0
TOS: 0 Metric: 1
ASBR-Summary Link States (Area 0.0.0.1)
LS age: 927
Options: 0x2 (*|−|−|−|−|−|E|−)
LS Type: ASBR-summary-LSA
Link State ID: 10.47.65.183 (AS Boundary Router address)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0x53ba
Length: 28
Network Mask: /0
TOS: 0 Metric: 1
Total Entries: 2
Switch# 

show ip ospf database external

Use this command to display information about the external LSAs.

show ip ospf database external [LINK-STATE-ID] [self-originate] [adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate

Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline Display information about the Autonomous System Boundary Router (ASBR) external LSAs.

Example The below is a sample output from the show ip ospf database external command.

Switch#show ip ospf database external
AS External Link States
LS age: 1056
Options: 0x2 (*|-|-|-|-|-|-|E|-)
LS Type: AS-external-LSA
Link State ID: 1.0.0.0 (External Network Number)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0x17e4
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 47.65.52.2
External Route Tag: 0
Total Entries: 1
Switch# 

show ip ospf database network

Use this command to display information about the network LSAs.

show ip ospf database network [LINK-STATE-ID] [self-originate] [adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline Display information about the network LSAs.

Example

This is a sample output (on the next page) from the show ip ospf database network command

Switch#show ip ospf database network
Net Link States (Area 0.0.0.0)
LS age: 1034
Options: 0x0 (*|-|-|-|-|-|-|-)
LS Type: network-LSA
Link State ID: 47.65.49.111 (address of Designated Router)
Advertising Router: 47.65.49.111
LS Seq Number: 80000001
Checksum: 0x33da
Length: 32
Network Mask: /24
Attached Router: 47.65.49.111
Attached Router: 10.47.65.160
Net Link States (Area 0.0.0.1)
LS age: 1015
Options: 0x2 (*|-|-|-|-|-|-|E|-)
LS Type: network-LSA
Link State ID: 47.65.51.2 (address of Designated Router)
Advertising Router: 10.47.65.181
LS Seq Number: 80000001
Checksum: 0x9ea1
Length: 32
Network Mask: /29
Attached Router: 10.47.65.181
Attached Router: 10.47.65.160
Total Entries: 2
Switch# 

show ip ospf database nssa-external

Use this command to display information about the nssa-external LSAs.

show ip ospf database nssa-external [LINK-STATE-ID] [self-originate] [adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline Display information about the nssa-external LSAs.

Example This is a sample output (on the next page) from the show ip ospf database nssa-external command.

Switch#show ip ospf database nssa-external
NSSA-external Link States (Area 0.0.0.61 [NSSA])
LS age: 1161
Options: 0x0 (*|−|−|−|−|−|−|−)
LS Type: AS-NSSA-LSA
Link State ID: 1.0.0.0 (External Network Number For NSSA)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0x82e6
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
NSSA: Forward Address: 110.201.0.1
External Route Tag: 0
LS age: 1097
Options: 0x0 (*|−|−|−|−|−|−|−)
LS Type: AS-NSSA-LSA
Link State ID: 47.65.55.0 (External Network Number For NSSA)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0xbb07
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
NSSA: Forward Address: 110.201.0.1
External Route Tag: 0
Total Entries: 2
Switch# 

show ip ospf database router

Use this command to display information about the router LSAs.

show ip ospf database router [LINK-STATE-ID] [self-originate] [adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline Display information about the router LSAs.

Example

The following pages shows a sample output from the show ip ospf database router command.

Switch#show ip ospf database router
Router Link States (Area 0.0.0.0)

LS age: 1056
Options: 0x2 (*|−|−|−|−|−|E|−)
Flags: 0x3 : ABR ASBR
LS Type: router-LSA
Link State ID: 10.47.65.160
Advertising Router: 10.47.65.160
LS Seq Number: 8000000e
Checksum: 0x107f
Length: 96
Number of Links: 6 

Link connected to: a Transit Network
(Link ID) Designated Router address: 47.65.49.111
(Link Data) Router Interface address: 47.65.49.1
Number of TOS metrics: 0
TOS 0 Metric: 1 

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.181
(Link Data) Router Interface address: 47.65.51.1
Number of TOS metrics: 0
TOS 0 Metric: 1 

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.182
(Link Data) Router Interface address: 47.65.52.1
Number of TOS metrics: 0
TOS 0 Metric: 1 

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.183
(Link Data) Router Interface address: 47.65.53.1
Number of TOS metrics: 0
TOS 0 Metric: 1 

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.184
(Link Data) Router Interface address: 47.65.54.1
Number of TOS metrics: 0
TOS 0 Metric:

Link connected to: Stub Network
(Link ID) Network/subnet number: 47.65.49.112
(Link Data) Network Mask: 255.255.255.255
Number of TOS metrics: 0
TOS 0 Metric: 0

LS age: 1063
Options: 0x2 (*|−|−|−|−|−|E|−)
Flags: 0x3 : ABR ASBR
LS Type: router-LSA
Link State ID: 10.47.65.181
Advertising Router: 10.47.65.181
LS Seq Number: 80000006
Checksum: 0xb55d
Length: 48
Number of Links: 2

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.160
(Link Data) Router Interface address: 47.65.51.2
Number of TOS metrics: 0
TOS 0 Metric: 1

Link connected to: a Virtual Link
(Link ID) Neighboring Router ID: 10.47.65.184
(Link Data) Router Interface address: 47.65.84.2
Number of TOS metrics: 0
TOS 0 Metric: 10

Total Entries: 2

Switch# 

show ip ospf database summary

Use this command to display information about the summary LSAs.

show ip ospf database summary [LINK-STATE-ID] [self-originate] [adv-router IP-ADDRESS]

Syntax Description

LINK-STATE-ID Link State ID (as an IP address).

self-originate Self-originated link states.

adv-router Displays all the LSAs of the specified router.

IP-ADDRESS Advertise router IP address.

Default None

Command Mode User EXEC

Usage Guideline Display information about the summary LSAs.

Example

The following page shows a sample output from the show ip ospf database summary command.

Switch#show ip ospf database summary
Summary Link States (Area 0.0.0.0)
LS age: 1225
Options: 0x2 (*|-|-|-|-|-|-|E|-)
LS Type: summary-LSA
Link State ID: 2.1.1.0 (summary Network Number)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0xe359
Length: 28
Network Mask: /24
TOS: 0 Metric: 1
LS age: 1225
Options: 0x2 (*|-|-|-|-|-|-|E|-)
LS Type: summary-LSA
Link State ID: 2.1.2.0 (summary Network Number)
Advertising Router: 10.47.65.160
LS Seq Number: 80000001
Checksum: 0xd863
Length: 28
Network Mask: /24
TOS: 0 Metric: 1
Total Entries: 2
Switch# 

show ip ospf host-route

Use this command to display host-route information for OSPF.

show ip ospf host-route

Syntax None.

Default None

Command Mode User EXEC

Usage Guideline Use this command to display host route information for OSPF.

Example The following is a sample output of this command:

Switch# show ip ospf host-route
Host IP	AreaID	Cost
10.3.3.3	0.0.0.5	2
10.3.3.4	0.0.0.1	3
20.3.3.3	0.0.0.25	58
Total Entries: 3

show ip ospf interface

Use this command to display interface information for OSPF.

show ip ospf interface [ IFNAME ]

Syntax Description

IFNAME (Optional) Specifies the interface type of the interfaces to display the OSPF information for.

Default None

Command Mode User EXEC

Usage Guideline

Use this command to display interface information for OSPF. If no interface type/number is specified the OSPF information for all interfaces will be displayed.

Example The following example on the next page is a sample output of this command:

Switch#show ip ospf interface
vlan49 is up, line protocol is up
Internet Address 47.65.49.1/24, Area 0.0.0.0, MTU 1500
Router ID 10.47.65.160, Network Type BROADCAST, Cost: 1
Transmit Delay is 1000 sec, State BDR, Priority 1
Designated Router (ID) 47.65.49.111, Interface Address 47.65.49.111
Backup Designated Router (ID) 10.47.65.160, Interface Address 47.65.49.1
Timer intervals configured, Hello 20, Dead 80, Retransmit 10
Hello due in ODTOHOM9S
Neighbor Count is 1, Adjacent neighbor count is 1
Hello received 39 sent 39, DD received 25 sent 14
LS-Req received 0 sent 1, LS-Upd received 2 sent 947
LS-Ack received 588 sent 3, Discarded 0
Current Authentication Type: none
vlan51 is up, line protocol is up
Internet Address 47.65.51.1/29, Area 0.0.0.1, MTU 1500
Router ID 10.47.65.160, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State BDR, Priority 2
Designated Router (ID) 10.47.65.181, Interface Address 47.65.51.2
Backup Designated Router (ID) 10.47.65.160, Interface Address 47.65.51.1
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM5S
Neighbor Count is 1, Adjacent neighbor count is 1
Hello received 68 sent 69, DD received 26 sent 22
LS-Req received 0 sent 0, LS-Upd received 11 sent 9
LS-Ack received 5 sent 11, Discarded 0
Current Authentication Type: md5
Authentication Key Configuration
Authentication type: md5
message-digest-key 254 md5 80008001
Switch# 

show ip ospf neighbor

Use this command to display information about the OSPF neighbors.

show ip ospf neighbor [ IFNAME | NEIGHBOR-ID] [detail]

Syntax Description

IFNAME	(Optional) Specifies the type of the interface to display the neighbor information for.
NEIGHBOR-ID (Optional) Neighbor ID.
detail (Optional) Detail of neighbors.

Default None

Command Mode User EXEC

Usage Guideline

Displays information about the OSPF neighbors. If no interface type/number is specified the OSPF neighbor information for all interfaces will be displayed.

Example

The following is sample output from the show ip ospf neighbor.

Switch#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
47.65.49.111 2 Full/DR 0DT0H1M11S 47.65.49.111 vlan49
Total Entries: 1
Switch#
Switch#
Switch#show ip ospf neighbor detail
Neighbor 47.65.49.111, interface address 47.65.49.111
In the area 0.0.0.0 via interface vlan49
Neighbor priority is 2, State is Full, 6 state changes
DR is 47.65.49.111, BDR is 47.65.49.1
Options is 0x02 (*|-|-|-|-|-|E|-)
Dead timer due in 0DT0H1M13S
Neighbor is up for 0DT0H13M51S
Crypt Sequence Number is 0
Total Entries: 1
Switch# 

show ip ospf virtual-links

Use this command to display virtual link information.

show ip ospf virtual-links

Syntax None

Default None

Command Mode User EXEC

Usage Guideline Use this command to display virtual link information.

Example

The following pages show sample outputs from the show ip ospf neighbor.

Switch#show ip ospf virtual-links
Virtual Link to router 10.47.65.181 is up
Transit area 0.0.0.1 via interface vlan51
Local address 47.65.51.1/32
Remote address 47.65.51.2/32
Transmit Delay is 1 sec, State Point-To-Point,
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM9S
Adjacency state Full
Current Authentication Type: none
Virtual Link to router 10.47.65.182 is up
Transit area 0.0.0.1 via interface vlan52
Local address 47.65.52.1/32
Remote address 47.65.52.2/32
Transmit Delay is 1 sec, State Point-To-Point,
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM3S
Adjacency state Full
Current Authentication Type: simple text
Authentication Key Configuration
Authentication type: simple text
Authentication-key: 12345678
Virtual Link to router 10.47.65.183 is up
Transit area 0.0.0.2 via interface vlan53
Local address 47.65.53.1/32
Remote address 47.65.53.2/32
Transmit Delay is 1 sec, State Point-To-Point,
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM10S
Adjacency state Full
Current Authentication Type: none
Virtual Link to router 10.47.65.184 is up
Transit area 0.0.0.2 via interface vlan54
Local address 47.65.54.1/32
Remote address 47.65.54.2/32
Transmit Delay is 1 sec, State Point-To-Point,
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM5S
Adjacency state Full
Current Authentication Type: md5
Authentication Key Configuration
Authentication type: md5
message-digest-key 255 md5 1234567890123456 

show ip pim

Use this command to show the PIM global information.

show ip pim

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Use this command to display the global information of PIM.

Example The following example displays PIM global information.

Switch##show ip pim
PIM Configurations:
Register Checksum Include Data: Disabled, group-list: (None)
Register Suppression Time : 60 seconds
Accept Register Group list : pim-acp-reg

RP Address
90.1.1.1, group-list: static-rp

RP Candidate
vlan100, group-list: rp-cand, interval: 60, priority: 192

BSR Candidate
vlan100, hash-mask-length: 30, priority: 1 

show ip pim bsr

Use this command to show the bootstrap router (BSR) information.

show ip pim bsr

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use this command to display the elected BSR information and information about the locally configured for the candidate rendezvous point (RP) advertisement.

Examples

The following example displays the BSR information on a BSR router with the Candidate RP information on the router's interface, vlan100.

Switch# show ip pim bsr
PIMv2 Bootstrap information
This system is the Bootstrap Router (BSR)
    BSR address: 90.1.1.3
    Uptime: 0DT0H18M50S, BSR Priority: 3, Hash mask length: 30
    Next bootstrap message in 0DT0H0M21S

Candidate RP: 90.1.1.3(vlan100) Group acl:5
Next Cand_RP_advertisement in 0DT0H0M13S 

The following example displays the BSR information on a non-BSR router with Candidate RP information on the router's interface

Switch# show ip pim bsr
PIMv2 Bootstrap information
BSR address: 90.1.1.3
Uptime: ODT0H0M38S, BSR Priority: 3, Hash mask length: 30
Expires: ODT0H1M32S
Switch# 

show ip pim interface

Use this command to show the interface information.

show ip pim interface [INTERFACE-ID] [detail]

Syntax Description

INTERFACE-ID

(Optional) Specifies the interface to display the interface information for. Only VLAN interface IDs are applicable.

detail (Optional) Use to display the interface information in detail.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use this command to display interface related information. If no interface is specified, the PIM information on all applicable interfaces will be shown.

Examples The following example displays interface information.

switch #show ip pim interface
Address	Interface	Mode	Neighbor Count	DR Priority	DR	Generation ID
90.1.1.1	vlan100	Sparse	1	1	90.1.1.1	164598300
30.1.1.1	vlan200	Dense	1	0	0.0.0.0	375693
Total Entries: 2

On the following page is an example which displays the interface information in detail.

switch#show ip pim interface detail
vlan100
Address : 90.1.1.1 Mode : Sparse Neighbor Count : 1 DR : 90.1.1.1 DR Priotity : 1 DR Priority Enabled : Enabled Generation ID : 164598300 Hello Interval : 30 seconds Triggered Hello Interval : 5 seconds Hello Hold time : 105 seconds Join Prune Interval : 60 seconds Join Prune Hold Time : 210 seconds Stub Interface : False Lan Delay Enabled : Enabled Propagation Delay : 1000 milliseconds Override Interval : 3000 milliseconds Effect Propag Delay : 1000 milliseconds Effect Override Interval : 3000 milliseconds Join Suppression Enabled : Enabled Bidir Capable : False

vlan200
Address : 50.111.111.111 Mode : Dense Neighbor Count : 1 DR : 0.0.0.0 Generation ID : 375693 Hello Interval : 30 seconds Triggered Hello Interval : 5 seconds Hello Hold time : 105 seconds Stub Interface : False Lan Delay Enabled : Enabled Propagation Delay : 500 milliseconds Override Interval : 2500 milliseconds Effect Propag Delay : 500 milliseconds Effect Override Interval : 2500 milliseconds Prune Limit Interval : 60 seconds Graft Retry Interval : 3 seconds State Refresh Priority Enabled : Enabled State Refresh Origination Interval: 60 seconds

show ip pim mroute

This command displays the PIM IP multicast routing table

show ip pim mroute

Syntax None Description

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Use this command to display all entries in the IP multicast routing table.

The switch populates the multicast routing table by creating source, group (S,G) entries from star, group (*,G) entries. The star (*) refers to all source addresses, the "S" refers to a single source address, and the "G" is the destination multicast group address. When creating (S,G) entries, the software uses the best path to that destination group which is found in the unicast routing table (that is, through Reverse Path Forwarding [RPF]).

Example The following page shows a sample output from the command show ip pim mroute.

Switch#show ip pim mroute
PT - Prune Timer, PPT - Prune Pending Timer, ET - Expiry Timer,
PLT - Prune Limit Timer, GRT - Graft Retry Timer,
AT - Assert Timer, KAT - Keep Alive Timer, OT - Override Timer,
SAT - Source Active Timer, SRT - State Refresh Timer 

Flags: D - Dense, S - Sparse, T - SPT-bit set 

(*,239.1.1.1) Uptime: 0DT0H31M15S, flags: S
RP: 70.1.1.3, RPF neighbor:30.1.1.3, RPF Interface: vlan1
Upstream Interface:
Join State: Joined, Join Timer: 39 secs
Downstream Interface List:
Vlan2:
JP State: No Info, ET:Off, PPT: Off
Assert State: No Info, AT: Off,
Assert Winer: 0.0.0.0, Metric: 0, Pref: 0, 

(70.233.235.100, 239.1.1.1) Uptime: 0DT0H3M8S, flags: ST RPF neighbor: None, RPF Interface: None
Register State: Pruned, Register Stop Timer: 20 secs
Upstream Interface:
Join State: Joined, Join Timer: off, KAT: 22 secs,
Downstream Interface List:
Vlan2
JP State: No Info, ET: 20 secs, PPT: Off
Assert State: No Info, AT: Off,
Assert Winer: 0.0.0.0, Metric: 0, Pref: 0 

(70.233.235.100, 239.1.1.1, rpt) Uptime: ODT0H3M8S, flags: S RP: 70.1.1.3, RPF neighbor: None, RPF interface: None Upstream Interface:
Prune State: RPT Not Joined, Override Timer: Off
Downstream Interface List:
vlan2
Prune State: No Info, ET: Off, PPT: Off 

(90.233.235.100, 239.1.1.100) Uptime: ODTOH1M8S, flags: D State-Refresh Originator State: Originator
SAT: 200 secs, SRT: 30 secs
Upstream Interface:
vlan100, Prune State: No Info, Assert State: No Info
GRT: off, OT: off, PLT: off Downstream Interface List:
vlan200
JP State: No Info, PT: Off, PPT: off
Assert State: No Info, AT: Off,
Assert Winer: 0.0.0.0, Metric: 0, Pref: 0 

show ip pim neighbor

Use this command to show the PIM-SM neighbor information.

show ip pim neighbor [INTERFACE-ID]

Syntax Description

INTERFACE-ID

(Optional) Specifies the interface to display the PIM-SM neighbor information for. If INTERFACE-ID is not specified, the information on all interfaces will be displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Use this command to determine which routers on the LAN are configured for PIM.

Example The following example displays the PIM neighbor information for all interfaces.

Switch# show ip pim neighbor
Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority,
S - State Refresh Capable
Neighbor Interface Uptime/Expires Ver DR Pri/Mode
---
10.10.0.9 vlan1 0DT0H55M33S/0DT0H1M44S v2 1 /
10.10.0.136 vlan1 0DT0H55M20S/0DT0H1M25S v2 1 /
10.10.0.172 vlan1 0DT0H55M33S/0DT0H1M32S v2 1 / DR
192.168.0.100 vlan2 0DT0H55M30S/0DT0H1M20S v2 N
Total Entries: 4
Switch# 

Display Field Descriptions The following table describes the ip pim neighbor fields.

Field Descriptions

DR Pri/Mode Priority and mode of the designated router (DR).

Priority: "N" indicates the neighbor does not support DR Priority Option in the Hello message otherwise the DR priority value will be displayed.

Mode: Describes the capability of the neighbor. The meaning of codes is as follows:

Field Descriptions

DR Pri/Mode B: bidirectional mode, neighbor is using the Bidirectional-PIM Capable option.

DR: indicates the neighbor is the Designated Neighbor. If an empty string is displayed it indicates the neighbor is not a DR.

S: State Refresh Capable. The neighbor is using the State Refresh Capable option. This option is used only by PIM-DM.

show ip pim rp mapping

Use this command to show group-to-RP (rendezvous point) mappings, and the RP set.

show ip pim rp mapping

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use this command to display active rendezvous points (RPs) that are cached with associated multicast routing entries.

This command is used to display the RP mapping information viewed by the router

Example

The following is sample output from the show ip pim rp mapping command with the group address 239.1.1.1 specified:

Switch#show ip pim rp mapping
PIM Group-to-RP Mappings
Group(s): 224.0.0.0/4
RP: 90.1.1.3
Info source: 90.1.1.3, via bootstrap, priority 0
Uptime: 0DT16H52M39S, expires: 0DT0H2M50S 

Display Field Descriptions

The table below shows the ip pim rp mapping detailed field descriptions.

Field Descriptions

RP Address of the RP for the group specified.

Info source Indicates from which system the router learned this RP information. RP was selected by the bootstrap mechanism. In this case, the BSR is also the RP.

Via bootstrap The RP mapping information is learned from RP.

Priority The RP priority

Uptime Length of time that the router has known about this RP.

Expires Time after which the information about this RP expires. If the router does not receive any refresh messages in this time, it will discard information about this RP.

show ip pim rp-hash

Use this command to display the rendezvous point (RP) to be chosen based on the group selected.

show ip pim rp-hash GROUP-ADDRESS

Syntax Description

GROUP-ADDRESS Specifies the Group Address to display the selected RP of the group for.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command displays which RP was selected for the group specified. It also shows whether this RP was selected by Auto-RP or the PIM Version 2 bootstrap mechanism.

Example

The following is sample output from the show ip pim rp-hash command with the group address 239.1.1.1 specified:

Switch#show ip pim rp-hash 239.1.1.1
RP: 172.16.24.12
Info source: 172.16.24.12, via bootstrap
Uptime: ODT1H42M15S, expires: ODT0H2M16S 

Please refer to the table in the description of command show ip pim rp mapping for the field descriptions.

show ip protocols

Use this command to display the state of the dynamic routing process.

show ip protocols [rip] [ospf] [bgp]

Syntax Description

rip (Optional) RIP protocol information is displayed.

ospf (Optional) Display OSPF global settings which are related to the overall IP routing function.

bgp (Optional) Display entries in the Border Gateway Protocol (BGP) routing table.Specifies the autonomous system to be displayed. .

Default

If no option is specified, the summary of all running routing protocols is displayed.

Command Mode User EXEC or any configuration mode

Usage Guideline

The information displayed by the show ip protocols command is useful when debugging routing operations. The output can help identify a router suspected of delivering faulty routing information.

Examples The following example shows how to output the state of the RIP protocol:

Switch# show ip protocols rip
Routing Protocol is "rip"
Sending updates every 30 +/- (0 to 5) seconds, next due in 19 seconds
Timeout after 180 seconds, garbage collect after 120 seconds
Default redistribution metric is 1
Redistributing:
type    metric
----
Default version control: send version 2, receive version 2
Interface    Send    Recv    V2-broadcast    Key-chain
vlan141    2    2    Off
Routing for Networks:
vlan141 (10.253.41.2/24)
Routing Information Sources:
Gateway    Distance   Last Update   Bad Packets   Bad Routes
10.253.41.1    120    0DT0H0M11S    0    1
the maximum number of RIP routes allowed: 12288
Number of routes (excluding connected): 3
Distance: (default is 120)
Switch# 

The table below describes the show ip protocols Field Descriptions for a RIP Process:

Field	Description
Routing Protocol is "rip"	Specifies the routing protocol used.
Sending updates every 30 seconds	Specifies the time between sending updates.
next due in 2 seconds	Precisely when the next update is due to be sent.
Invalid after 180 seconds	Specifies the value of the invalid parameter.
garbage collect after 120	Specifies the time (in seconds) after which the individual routing information will be thrown (flushed) out.
Default version control:	Specifies the version of RIP packets that are sent and received.
Redistributing Lists the protocol that is being redistributed.
Routing Specifies the networks for which the routing process is currently injecting routes.
Routing Information Sources	Lists all the routing sources the operating system software is using to build its routing table. For each source, the following will be displayed:IP addressAdministrative distanceTime the last update was received from this source

The following example shows how to output the state of OSPF protocol:

Switch# show ip protocols ospf
Routing Protocol is "ospf"
Configured Router ID: 10.253.41.2
Redistribute route default metric:auto
Auto-cost Reference-bandwidth:100
Distance: (default is 110)
Do not originate type 5 default route
Redistributing:
type    metric    mtric_type
--------
rip    20    2

Switch# 

show ip rip database

To display summary address entries in the Routing Information Protocol (RIP) routing database entries, use the show ip rip database command.

show ip rip database

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

show ip rip database will display route information, such as: network, next hop, metric, from, if, time.

Examples The following output shows a summary address.

Switch# Show ip rip database
Codes: R - RIP, Rc - RIP connected, Rs - RIP static, K - Kernel,
C - Connected, S - Static, O - OSPF, I - IS-IS, B - BGP, A - Auto-summary
Network Next Hop Metric From If Time
Rc 10.0.0.0/8 1 vlan1
Rc 20.0.0.0/8 1 vlan2
R 30.0.0.0/8 20.33.24.1 2 20.33.24.1 vlan2 0DT0H2M44S
40.33.24.8 5 40.33.24.2 vlan3 0DT0H2M30S
RA 40.0.0.0/8 10.33.24.1 2 10.33.24.1 vlan1 0DT0H0M59S
Total Entries: 4 entries, 5 routes
Switch# 

Display Field Descriptions

Description of significant display fields.

Display Field Description

RA 40.0.0.0/8 Summary address entry.

Rc 20.0.0.0/8 Directly connected entry to vlan2.

R 30.0.0.0/8 via ,etc. The destination 30.0.0.0/8 is learned via RIP. There are two sources advertising it. One is 20.33.24.1 via vlan2 and it was updated 16 seconds ago. The other source is 40.33.24.8 via vlan3, and it was updated 30 seconds ago.

show ip rip interface

Display interface specific information for RIP.

show ip rip interface [INTERFACE-ID]

Syntax Description

interfaceINTERFACE-ID

(Optional) Specifies the interface ID to display the RIP information for. If no INTERFACE-ID is specified, the RIP information on all interfaces will be shown.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

show ip rip interface will display interface specific information, such as: authentication, send version, receive version, and v2 broadcast mode.

Example

The following output shows the show ip rip interface command:

Switch# Show ip rip interface

vlan1 is up, line protocol is up
Routing Protocol: RIP
Receive RIP packets
Send RIP packets
Send v2-broadcast: Disabled
Authentication Mode: text
Passive interface: Disabled
Split horizon: Enabled with Poisoned Reversed
IP interface address:
10.72.63.80/8

vlan2 is up, line protocol is up
Routing Protocol: RIP
Receive RIP packets
Send RIP packets
Send v2-broadcast: Disabled
Authentication Mode: text
Passive interface: Disabled
Split horizon: Enabled with Poisoned Reversed
IP interface address:
20.72.63.80/8 

show ip route

To display the current state of the routing table, use the show ip route command.

show ip route [IP-ADDRESS [MASK] | [database] [PROTOCOL | connected | static]]

Syntax Description
IP-ADDRESS (Optional) Address about which routing information should be displayed.
MASK (Optional) Argument specifying a subnet mask.
PROTOCOL	(Optional) The name of a routing protocol, specifying a routing protocol, use one of the following keywords: bgp, ospf, and rip.
database	(Optional) Specifies that the routing database is to be shown and the active routes populated in the forwarding database is prefixed with an asterisk.
connected (Optional) Display all connected local interface routes.
static (Optional) Display all static routes.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The show ip route database static command displays, for example, all static routes with name and distance information, including active and inactive entries. Display all active static routes with both the show ip route and show ip route static commands.

Examples

The following examples show the standard routing tables displayed by the show ip route command. Use the codes displayed at the beginning of each report and the information in the following table to understand the types of routes.

Field

Description

O Indicates the protocol that derived the route. It can be one of the following values:

K - kernel route

R - Routing Information Protocol (RIP) derived

- Open Shortest Path First (OSPF) derived

C - connected

i - IS-IS

ia - IS-IS-inter area

* - candidate default

S - static

B - Border Gateway Protocol (BGP) derived

E2 Type of route. It can be one of the following values:

* - Indicates the last path used when a packet was forwarded. It pertains only to the nonfast-switched packets. However, it does not indicate which path will be used next when forwarding a nonfast-switched packet, except when the paths are equal cost.

IA - OSPF interarea route

E1 - OSPF external type 1 route

E2 - OSPF external type 2 route

L1 - IS-IS Level 1 route

L2 - IS-IS Level 2 route

N1 - OSPF not-so-stubby area (NSSA) external type 1 route

N2 - OSPF NSSA external type 2 route

P - stale route info

* The route entry of RIB is populated in FIB.

The selected route of multiple route entries.

10.110.0.0 Indicates the address of the remote network.

Field	Description
[160/5]	The first number in the brackets is the administrative distance of the information source; the second number is the metric for the route.
via 10.119.254.6	Specifies the address of the next router to the remote network.
0DT0H0M44S	Specifies the last time the route was updated.
Vlan2	Specifies the interface through which the specified network can be reached.
Total Entries : Displays the total number of entries, and the total number of routes.

The following is sample output from the show ip route command when entered without an address:

Switch# show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
C 10.0.0.0/8 is directly connected, vlan10
O 10.50.71.253/32 [110/0] is a summary, Null, ODT1H5M46S
C 11.0.0.0/8 is directly connected, vlan110
O E1 11.0.1.0/24 [110/1] via 11.50.71.200, vlan110, ODT1H4M47S
C 12.0.0.0/8 is directly connected, vlan111
C 20.0.0.0/8 is directly connected, vlan111
O E1 20.0.1.0/24 [110/1] via 11.50.71.200, vlan110, ODT1H4M47S
O IA 50.0.0.0/8 [110/2] via 10.50.71.253, vlan10, ODT1H3M58S
B 121.0.0.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H5M35S
B 121.0.1.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H5M35S
B 121.0.2.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H5M35S
S 160.0.0.0/8 [1/0] via 10.50.71.200, vlan10
Total Entries: 12 entries, 12 routes 

The following example shows output of the show ip route database command.

Switch#show ip route database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
> - selected route, * - FIB route, p - stale info

C    * > 10.0.0.0/8 is directly connected, vlan10
O    * > 10.50.71.253/32 [110/0] is a summary, Null, ODT1H7M18S
C    * > 11.0.0.0/8 is directly connected, vlan110
O E1    * > 11.0.1.0/24 [110/1] via 11.50.71.200, vlan110, ODT1H6M19S
C    * > 12.0.0.0/8 is directly connected, vlan111
C    * > 20.0.0.0/8 is directly connected, vlan111
O E1    * > 20.0.1.0/24 [110/1] via 11.50.71.200, vlan110, ODT1H6M19S
B    50.0.0.0/8 [200/0] via 10.50.71.253, ODT1H5M21S
O IA    * > 50.0.0.0/8 [110/2] via 10.50.71.253, vlan10, ODT1H5M30S
B    * > 121.0.0.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H7M7S
B    * > 121.0.1.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H7M7S
B    * > 121.0.2.0/24 [20/0] via 10.50.71.200, vlan10, ODT1H7M7S
S    * > 160.0.0.0/8 [1/0] via 10.50.71.200, vlan10

Total Entries: 13 entries, 13 routes 

show ip route summary

To display the current state of the routing table, use the show ip route summary command.

show ip route summary

Syntax None

Description

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example The following is sample output from the show ip route summary command:

Switch#show ip route summary
IP routing table name is Default-IP-Routing-Table(0)
IP routing table multi-paths state is enabled
IP routing table configured maximum-paths is 6
IP routing table maximum-paths is 6
Route Source Networks
connected 2
rip 1
bgp 2
Total 5
FIB 3
multi-path 0 

show ip ssh

Use this command to display the user SSH configuration setting.

show ip ssh

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the show ip ssh command to view the status of configured options such as retries and timeouts. This command displays if SSH is enabled or disabled.

Example This example shows how to display the SSH configuration settings.

Switch# show ip ssh
SSH : Enabled
SSH server mode : V2
Service port : 22
Authentication timeout : 120
Authentication retries : 3
Switch# 

show ip trusted-host

Use this command to display the trusted host information on the device.

show ip trusted-host [ snmp | http | https | telnet | ssh ]

Syntax Description

[ snmp | http | https | telnet | ssh ]

(Optional) Specifies which access interface which is to be displayed. If no access interface is specified, the trusted hosts at all access interfaces will be displayed.

Default None

Command Mode Privileged EXEC or any configuration mode at privilege level 15

Usage Guideline This command displays the trusted host information.

Example This example shows how to display trusted hosts information for all access interfaces.

Switch# show ip trusted-host
Hosts    Valid to Access
10.48.93.100    all access interfaces
10.51.17.1    snmp
10.52.95.90    http
Total Entries : 3
Switch# 

show ipv6 dhcp

This command is used to display DHCPv6 client configuration running information of interface(s).

show ipv6 dhcp [ interface [INTERFACE-NAME ] ]

Syntax Description
interface	Specifies to show the interface DHCPv6 Client configuration and running information. Ifinterfaceis not entered, the command will show the device DUID.
INTERFACE-NAME	Specifies the identifier of the interface on the device to show the DHCPv6 client configuration and running information. IfINTERFACE-NAMEis not entered, the command output will be for all IPv6 interfaces.

Default None

Command Mode User EXEC

Usage Guideline

The show ipv6 dhcp command shows the DHCP for IPv6 client configuration and running information of the specified interface. If the interface argument is not presented, the DHCPv6 Client DUID will be showed.

Examples The following example shows the DHCPv6 client's DUID:

Switch > enable
Switch # show ipv6 dhcp
This device's DHCPv6 unique identifier (DUID):
0001000111A8040D001FC6D1D47B. 

The following example shows the DHCPv6 client for interface vlan1, when vlan1 is DHCPv6 client disabled:

Switch > enable
Switch # show ipv6 dhcp interface vlan1
Switch # 

The following example shows the DHCPv6 client for interface vlan1, when vlan1 is in the REQUEST state:

Switch > enable
Switch # show ipv6 dhcp interface vlan1
Interface vlan1 is in DHCPv6 client mode.
General prefix: aaa
State: REQUEST
Server IP: N/A
Server DUID: N/A
Preference: 0
Event expire: 10
IA is not acquired. 

The following example shows the DHCPv6 client for interface vlan1, when vlan1 is in the ACTIVE state:

Switch > enable
Switch # show ipv6 dhcp interface vlan1
Interface vlan1 is in DHCPv6 client mode.
General prefix: aaa
State: ACTIVE
Server IP: fe80::21d:92ff:fe2b:af48%vlan1
Server DUID: 0001000611D6EE73001D922BAF48
Preference: 87
IA Type: PD
IA ID: 0003
T1: 300
T2: 800
Prefer Lifetime: 3600
Valid Lifetime: 7200
Prefix: 3000:1:2::/48
IA expire: 299
Addr expire: 7199 

The following example shows the DHCPv6 client for interface vlan1, when vlan1 is in the RENEW state:

Switch > enable
Switch # show ipv6 dhcp interface vlan1
Interface vlan1 is in DHCPv6 client mode.
General prefix: aaa
State: RENEW
Server IP: fe80::21d:92ff:fe2b:af48%eth0
Server DUID: 0001000611D6EE73001D922BAF48
Preference: 87
Event expire: 17
IA Type: PD
IA ID: 0003
T1: 300
T2: 800
Prefer Lifetime: 3600
Valid Lifetime: 7200
Prefix: 3000:1:2::/48
IA expire: 219
Addr expire: 5119 

The following example shows the DHCPv6 client for interface vlan1, when vlan1 is in the REBIND state:

Switch > enable
Switch # show ipv6 dhcp interface vlan1
Interface vlan1 is in DHCPv6 client mode.
General prefix: aaa
State: REBIND
Server IP: fe80::21d:92ff:fe2b:af48%eth0
Server DUID: 0001000611D6EE73001D922BAF48
Preference: 87
Event expire: 26
IA Type: PD
IA ID: 0003
T1: 300
T2: 800
Prefer Lifetime: 3600
Valid Lifetime: 7200
Prefix: 3000:1:2::/48
Addr expire: 3192 

show ipv6 dhcp relay interface

These commands are used to display DHCP relay information.

show ipv6 dhcp relay interface VLAN-interface

Syntax Description

VLAN-interface Specific VLAN interface name.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The show ipv6 dhcp relay command shows the DHCP for IPv6 relay configuration and running information of the specified VLAN interface.

Example

The following example shows the DHCPv6 client for interface vlan1, when vlan1 DHCPv6 relay enabled

Switch > enable
Switch # show ipv6 dhcp relay interface vlan1
Listen interface name: vlan1
Sever Addsess FE80::2:3
Destination interface name: vlan2 

show ipv6 general-prefix

This command is used to display IPv6 general prefix information. It is used the show ipv6 general-prefix command.

show ipv6 general-prefix [PREFIX-NAME]

Syntax Description
PREFIX-NAME	The name of the general prefix to be showed. If the general prefix name is not specified, then all general prefixes on the system will be showed. The general prefix name can be 1-16 characters.

Default None

Command Mode User EXEC

Usage Guideline Use the show ipv6 general-prefix command to view information on IPv6 general prefixes. Examples The following example shows how to display all IPv6 general prefixes on the swtch:

Switch > enable
Switch # show ipv6 general-prefix
IPv6 prefix dhcp-prefix
    Acquired via DHCP Client:
    vlan1
    Apply to interface:
    vlan3
    ::3:3:3:3:3/64
    vlan2
    ::4:4:4:4:4/64
    ::2:2:2:2:2/64
IPv6 prefix my-prefix
    Acquired via Manual configuration:
    3ffe:1:1::/48
    Apply to interface:
    vlan2
    ::1:1:1:1:1/64 

The following example shows how to display information for a specified general prefix named my-prefix:

Switch > enable
Switch # show ipv6 general-prefix my-prefix
IPv6 prefix my-prefix
Acquired via Manual configuration:
3ffe:1:1::/48
Apply to interface:
vlan2
::1:1:1:1:1/64 

show ipv6 interface

This command is used to display the IPv6 interface information.

show ipv6 interface [IFNAME]

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example This example shows how to display IPv6 interfaceinformation for vlan1.

Switch > enable
Switch # show ipv6 interface vlan1
vlan1 is down,
IPv6 is disable
link-local address is :
fe80::a01:2ff:fe39:1
global unicast address is :
3ffe:501:ffff:100:a01:2ff:fe39:1/64
MAC Address is 08-01-02-39-00-01
IP MTU is 1500 bytes
IPv6 Hop Limit is 64
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds
ND advertised is sending
ND advertised reachable time is 604151836 milliseconds
ND advertised retransmit interval is 257243264 milliseconds
ND router advertisements are sent between 604143192 to 5 seconds
ND router advertisements live for 54212 seconds
Hosts use stateless autoconfig for addresses.
Switch # 

show ipv6 interface brief

This command is used to display the IPv6 interface summary information.

show ipv6 interface IFNAME brief

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

An IPv6 interface can be in either the down state or up state. When an interface is in the up state, it can send and receive packets. If an interface is in the down state, the directly connected routing entry is removed from the routing table. Removing the entry allows the switch to use dynamic routing protocols to determine backup routes to the network.

If an optional interface type is specified, information for that specific interface is displayed. The supporting interface type is VLAN.

If no optional arguments are specified, information is displayed for all the interfaces.

If the interface hardware is usable, the interface is marked to the "up." state. For an interface to be usable, both the interface hardware and line protocol must be in the up state.

Example

This example shows how to display the IPv6 interface brief instance summary information.

Switch > enable
Switch #show ipv6 interface brief
lo    [up/up]
    unassigned
vlan1    [up/up]
    2010:312::1
    fe80::a01:2ff:fe39:1
vlan2    [up/up]
    2010:311::1
Switch # 

show ipv6 neighbors

This command is used to display the IPv6 neighbor information.

show ipv6 neighbors

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example The example shows how to display IPv6 neighbor information.

Switch > enable
Switch # show ipv6 neighbors
IPv6 Address MAC Address Interface Type
Status
fe80::250:baff:fef9:b512 0050.baf9.b512 vlan1 DYNM
STALE 

Display Field Descriptions

Description of significant display fields.

Display Field Description

Type DYNM - Dynamic learning entry.

STATIC - Static neighbor entry (for example, user configuration)

LOCAL - Local interface entry.

Status REACH (Reachable) - Positive confirmation was received within the last

ReachableTime, in milliseconds, that the forward path to the neighbor was properly functioning. While in the REACH state, the device takes no special action as packets are sent.

STALE - More than the ReachableTime, in milliseconds, has elapsed since the last positive confirmation was received that the forward path was properly functioning. While in the STALE state, the device takes no action until a packet is sent.

DELAY - More than ReachableTime, in milliseconds, has elapsed since the last positive confirmation was received that the forward path was properly functioning. A packet was sent within the last DELAY_FIRST_PROBE_TIME seconds. If no reachability confirmation is received within the DELAY_FIRST_PROBE_TIME in seconds of entering the DELAY state, send a neighbor solicitation message and change the state to PROBE.

PROBE - A reachability confirmation is actively sought by resending neighbor solicitation messages every RetransTimer, in milliseconds.

show ipv6 ospf

To display general information about OSPF routing processes, use the show ipv6 ospf command.

show ipv6 ospf [PROCESS-ID]

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.

Default If the PROCESS-ID is not specified, display all IPv6 OSPF processes.

Default PROCESS-ID: null

Command Mode User EXEC

Usage Guideline The information displayed by the show ipv6 ospf command is useful in debugging OSPF routing operations.

Example The following is sample output from the show ipv6 ospf command.

Switch > enable
Switch # show ipv6 ospf 

The output after executing this command is as follows on the next page.

Routing Process "OSPFv3 null" with Operational Router 10.76.37.30
Process uptime is ODT0H13M51S.
Conforms to RFC 2740
This router is an ABR; ABR Type is Standard (OSPFv3).
This router is an ASBR (injecting external routing information).
This router is a BR.
SPF schedule delay 5 secs, Hold time between SPFs 10 secs
Number of router LSA 5. Checksum Sum 0x22263
Number of network LSA 1. Checksum Sum 0xE8A7
Number of inter-area prefix LSA 16. Checksum Sum 0x92112
Number of inter-area router LSA 1. Checksum Sum 0x26DD
Number of external LSA 0. Checksum Sum 0x0000
Number of link LSA 3. Checksum Sum 0x15A79
Number of intra-area prefix LSA 5. Checksum Sum 0x34475
Number of LSA originated 18
Number of LSA received 13
Number of current LSA 31
LSDB database overflow limit is 12288
Number of areas in this router is 3
Area 0.0.0.0 (BACKBONE) (active)
Number of interfaces in this area is 1 active interface number is 1
Number of fully adjacent virtual neighbors through this area is 0
SPF algorithm last executed ODT0H12M39S
SPF algorithm executed 4 times
Number of LSA 13. Checksum Sum 0x616B2
Area 0.0.0.1 (active)
Number of interfaces in this area is 1 active interface number is 1
Number of fully adjacent virtual neighbors through this area is 1
SPF algorithm last executed ODT0H12M39S
SPF algorithm executed 5 times
Number of LSA 8. Checksum Sum 0x4E6DD
Area 0.0.0.3 (active)
Number of interfaces in this area is 1 active interface number is 1
Number of fully adjacent virtual neighbors through this area is 0
SPF algorithm last executed ODT0H13M29S
SPF algorithm executed 2 times
Number of LSA 7. Checksum Sum 0x499DF 

show ipv6 ospf border-routers

To display the ABRs and ASBRs for the IPv6 OSPF process, use the show ipv6 ospf border-routers command.

show ipv6 ospf [PROCESS-ID] border-routers

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.

Default None

Command Mode User EXEC

Usage Guideline Use this command to display the ABRs and ASBRs information.

If PROCESS-ID is not specified, display all IPv6 OSPF processes.

Example This is a sample output from the show ipv6 ospf border-routers command.

Switch > enable
Switch # show ipv6 ospf border-routers 

The result after executing this command is as follows.

OSPFv3 Routing Table (Process null)
Codes: i - Intra-area route, I - Inter-area route
i 47.65.49.111 [1] is directly connected, vlan49, ABR, Area 0.0.0.0
Total Entries: 1 

show ipv6 ospf database

Display the database summary of the OSPF routing processes, use the show ipv6 ospf database command.

show ipv6 ospf [PROCESS-ID] database [router | network | inter-prefix | inter-router | external | link | intra-prefix] [adv-router [ self-originate | ROUTER-ID] ]

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process
ROUTER-ID	(Optional) Router ID can be specified as either a decimal value or as an IPv4 address.

Default None

Command Mode User EXEC

Usage Guideline

A router's collection of LSA data is stored in a link-state database. The contents of the database, when subjected to the Dijkstra algorithm, result in the creation of the OSPF routing table.

Both of these keywords can be appended to all other keywords used with the show ipv6 ospf database command to provide more detailed information.

If the PROCESS-ID argument is not specified, display all IPv6 OSPF processes.

Example

The following is sample output from the show ipv6 ospf database command when no arguments or keywords are used.

Switch > enable
Switch # show ipv6 ospf database
OSPFv3 Router with ID (20.0.1.10) (Process null)
Link-LSA (Interface vlan1)
ADV Router    Age Seq#    CkSum    LinkCnt
20.0.1.10    1053 0x80000001 0xaf9f    1
Router-LSA (Area 0.0.0.0) (BACKBONE)
ADV Router    Age Seq#    CkSum    LinkCnt
20.0.1.10    1013 0x80000002 0x34dd    0 

show ipv6 ospf interface

To display OSPF-related interface information, use the show ipv6 ospf interface command.

show ipv6 ospf interface [IFNAME]

Syntax Description

IFNAME (Optional) Interface type and number. If no option is specified, applying the command displays the entire IPv6 OSPF process.

Default None

Command Mode User EXEC

Usage Guideline None.

Example show ipv6 ospf interface Standard Output Example: The following is sample output from the show ipv6 ospf interface command.

Switch > enable
Switch # show ipv6 ospf interface 

The result after executing this command is as follows.

vlan2 is up, line protocol is up
Interface ID 1026
IPv6 Prefixes
    fe80::a01:2ff:fe36:2/64 (Link-Local Address)
    3ffe:4::30/64
OSPFv3 Process (null), Area 0.0.0.1 (active)
MTU 1500, Instance ID 0
    Router ID 10.76.37.30, Network Type BROADCAST, Cost: 1 (default)
    Transmit Delay is 1 sec, State BDR, Priority 1
    Designated Router (ID) 10.76.37.3
    Interface Address fe80::219:5bff:fef5:2cc1
    Backup Designated Router (ID) 10.76.37.30
    Interface Address fe80::a01:2ff:fe36:2
    Timer intervals configured, Hello 10, Dead 40, Retransmit 5
    Hello due in ODTOHOM5S
Neighbor Count is 1, Adjacent neighbor count is 1
Hello received 48 sent 46, DD received 5 sent 3
LS-Req received 1 sent 1, LS-Upd received 11 sent 10
LS-Ack received 8 sent 6, Discarded 00 

show ipv6 ospf neighbor

To display IPv6 OSPF neighbor information on a per interface basis, use the show ipv6 ospf neighbor command.

show ipv6 ospf [PROCESS-ID] neighbor [IFNAME | NEIGHBOR-ID] [detail]

Syntax Description
PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.
IFNAME (Optional) Interface type and number. If no option is specified, the command applies to the entire IPv6 OSPF process.
NEIGHBOR-ID	(Optional) Neighbor ID. It can be specified as either a decimal value or as an IPv4 address.
detail (Optional) Displays all neighbors in detail; lists all neighbors.

Default None

Command Mode User EXEC

Usage Guideline The keywords can be appended to all other keywords used with the show ipv6 ospf neighbor command to display the information desired. Example The following is sample output from the show ipv6 ospf neighbor command with the detail keyword.

Switch > enable
Switch # show ipv6 ospf neighbor 

The result after executing this command is as follows.

The result after executing this command is as follows.
OSPFv3 Process (null)
Neighbor ID	Pri	State	Dead Time	Interface	Instance ID
10.76.37.3	1	Full/DR	ODTOHOM33S	vlan2	0
10.76.37.3	1	Full/ -	ODTOHOM38S	VLINK1	0
Total Entries: 2

show ipv6 ospf route

To display the current contents of the IPv6 OSPF routing table, use the show ipv6 ospf route command.

show ipv6 ospf [PROCESS-ID] route

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.

Default None

Command Mode User EXEC

Usage Guideline

The information displayed by the show ipv6 ospf route command is useful in debugging OSPF routing operations.

If PROCESS-ID is not specified, the command will display all IPv6 OSPF processes.

Example

The following is sample output from the show ipv6 ospf route command.

Switch > enable
Switch # show ipv6 ospf route
OSPFv3 Process (null)
Codes: C - connected, D - Discard, O - OSPF, IA - OSPF inter area
E1 - OSPF external type 1, E2 - OSPF external type 2
Destination Metric
Next-hop
O 3ffe:1::/64 11
via fe80::219:5bff:fef5:2cc1, vlan2, TransitArea 0.0.0.1
O 3ffe:2::/64 1
directly connected, vlan2, TransitArea 0.0.0.1
O 3ffe:2::10/128 1
via fe80::219:5bff:fef5:2cc1, vlan2, TransitArea 0.0.0.1
C 3ffe:3::/64 1
directly connected, vlan3, Area 0.0.0.3
C 3ffe:4::/64 1
directly connected, vlan2, TransitArea 0.0.0.1
C 3ffe:4::30/128 0
directly connected, vlan2, TransitArea 0.0.0.1
Total Entries: 6 entries, 6 routes 

show ipv6 ospf virtual-links

To display parameters and the current state of IPv6 OSPF virtual links, use the show ipv6 ospf virtual-links command.

show ipv6 ospf [PROCESS-ID] virtual-links

Syntax Description

PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.

Default None

Command Mode User EXEC

Usage Guideline

The information displayed by the show ipv6 ospf virtual-links command is useful in debugging OSPF routing operations.

If PROCESS-ID is not specified, the command will display all IPv6 OSPF processes.

Example

The following is sample output from the show ipv6 ospf virtual-links command.

Switch > enable
Switch # show ipv6 ospf virtual-links
Virtual Link VLINK1 to router 10.76.37.3 is up
Transit area 0.0.0.1 via interface vlan2, instance ID 0
Local address 3ffe:4::30/128
Remote address 3ffe:2::10/128
Transmit Delay is 1 sec, State Point-To-Point,
Timer intervals configured, Hello 10, Dead 40, Retransmit 5
Hello due in ODTOHOM2S
Adajcency state Full 

show ipv6 protocols

Use this command to display the parameters and current state of the active IPv6 OSPF or RIP routing protocol processes.

show ipv6 protocols [PROCESS-ID] [ospf | rip ]

Syntax Description
PROCESS-ID (Optional) Internally used identification parameter for an IPv6 OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each IPv6 OSPF routing process.
ospf	(Optional) Display OSPFv3 global settings which are related to the overall IP routing function.
rip (Optional) Display RIPng global settings which are related to the overall IP routing function.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The information displayed by the show ipv6 protocols command is useful in debugging routing operations. The output can help to identify a router suspected of delivering faulty routing information.The information displayed by the show ipv6 protocols rip command is useful in debugging routing operations.If no option is specified, the summary of all of running routing protocols will be displayed .

Examples The following is sample output from the show ipv6 protocols ospf command.

Switch > enable
Switch # show ipv6 protocols ospf
Routing Protocol is "ospfv3 null"
Configured Router ID : auto
Redistribute route default metric: auto
Auto-cost Reference-bandwidth: 100
Distance: (default is 110)
Don't originate type 5 default route
Redistributing:
type metric metric_type

connected 20 2
static 20 2
rip 20 2 

The following is sample output from the show ipv6 protocols rip command.

switch#show ipv6 protocols rip
Routing Protocol is "ripng"
Sending updates every 30 seconds with +/-50%, next due in 1 seconds
Timeout after 180 seconds, garbage collect after 120 seconds
Default redistribute metric is 1
Redistributing:
type    metric
----
Interface:
vlan2
vlan3

Routing for Networks:
vlan2 : 3ffe:4::30/64
vlan3 : 3ffe:3::30/64
max. no. of IPv6 RIP routes allowed: 6144
no. of IPv6 RIP routes excluding connected: 2

Distance:
distance (default)120 

show ipv6 rip database

To display information about current IPv6 RIP processes, use the show ipv6 rip database command.

show ipv6 rip database

Syntax Description
database	If specified the command displays the details of the entries in the specified RIP IPv6 routing table.

Default None

Command Mode User EXEC

Usage Guideline The information displayed by the show ipv6 rip database command is useful when debugging RIPng routing operations.

Examples The following is sample output from the show ipv6 rip database command.

Switch > enable
Switch # show ipv6 rip database 

The result after executing this command is as follows.

Codes: R - RIP, Rc - RIP connected, Rs - RIP static, K - Kernel, C - Connected, S - Static, O - OSPF, I - IS-IS, B - BGP
Network	Next Hop	If	Met	Time
R 3ffe:1::/64	fe80::219:5bff:fef5:2cc1		vlan2	2
ODTOH2M31S
R 3ffe:2::/64	fe80::219:5bff:fef5:2cc1		vlan2	2
ODTOH2M31S
Rc 3ffe:3::/64	::		vlan3	1
Rc 3ffe:4::/64	::		vlan2	1
Total Entries: 4 entries, 4 routes

show ipv6 rip interface

To display the usability status of interfaces configured for IPv6 RIP, use the show ipv6 rip interface command.

show ipv6 rip interface [IFNAME]

Syntax Description

IFNAME The specified interface type and interface number

Default None

Command Mode User EXEC

Privileged EXEC Usage Guideline mode

Use the show ipv6 rip interface command to validate the IPv6 RIP status of an interface and its configured addresses. The show ipv6 rip interface command also displays the parameters that IPv6 RIP is using on this interface including any configured features.

If the argument IFNAME is not used then all IPv6 RIP interfaces are displayed.

Example The following is sample output in vlan1 from the show ipv6 rip interface command.

Switch > enable
Switch # show ipv6 rip interface vlan1
vlan1 is up, line protocol is up
Routing Protocol: RIPng
Passive interface: Disabled
Split horizon: Enabled with Poisoned Reversed
IPv6 interface address:
fe80::a01:2ff:fe36:1/64 

show ipv6 route

Use this command show ipv6 route to display the active IPv6 routes in the system.

show ipv6 route [ IPV6-ADDRESS [ INTERFACE-TYPE INTERFACE-NUMBER | NEXT-HOP-ADDRESS ] | NETWORK-PREFIX / PREFIX-LENGTH [ INTERFACE-TYPE INTERFACE-NUMBER | NEXT-HOP-ADDRESS ] | [ database ] PROTOCOL | [ database ] connected | [ database ] static ]

Syntax Description

NETWORK-PREFIX The IPv6 network that is the destination of the static route.
PREFIX-LENGTH	The length of the IPv6 prefix. A decimal value that indicates how many of the high-order contiguous bits of the address comprise the prefix (the network portion of the address). A slash mark must precede the decimal value.
IPV6-ADDRESS Displays routing information for a specific IPv6 address.
PROTOCOL	(Optional) The name of a routing protocol, specify a routing protocol, use one of the following keywords: ospf and rip.
INTERFACE-TYPE	(Optional) Interface type. For more information about supported interface types, use the question mark (?) to access the online help function.
INTERFACE-NUMBER	(Optional) Interface number. For more information about the numbering syntax for supported interface types, use the question mark (?) to access the online help function.
database (Optional) the routing database is shown and the active route populated in the forwarding database is prefixed with an asterisk.
connected (Optional) All connected local interface routes.
static	(Optional) All static routes.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

When the system provides forwarding services for IPv6 traffic, it is very important and helpful to check the forwarding/routing table to understand what the current traffic path is in the network.

Example

Use the show ipv6 route command to check what are the active routing entries for IPv6.

Switch > enable
Switch # show ipv6 route
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP
S ::/0 [1/0] via 192:0:7:2::2
C 20:50:71:1::/64 is directly connected, vlan10
O 115:50:70::/64 [110/2] via fe80::a00:1ff:fe02:6, vlan10, 0DT0H0M7S
O 150::/64 [110/20] via fe80::a00:1ff:fe02:6, vlan10, 0DT0H0M7S
C 192:0:7:2::/64 is directly connected, vlan111
S 192:0:123:2::/64 [1/0] via 20:50:71:1::2
[1/0] via 192:0:7:2::2
S 192:0:244:2::/64 [1/0] via 20:50:71:1::2
S a100::/64 [1/0] via fe80::250:baff:fe91:bb28, vlan111
[1/0] via fe80::a00:1ff:fe02:6, vlan10
Total Entries: 8 entries, 10 routes
Switch # 

Use the show ipv6 route database command to check which routing database entries for IPv6 are currently working.

Switch > enable
Switch # show ipv6 route database
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
    I - IS-IS, B - BGP
    > - selected route, * - FIB route, p - stale info

S*> ::/0 [1/0] via 192:0:7:2::2
O 20:50:71:1::/64 [110/1] vlan10, 0DT0H8M36S
C*> 20:50:71:1::/64 is directly connected, vlan10
O*> 115:50:70::/64 [110/2] via fe80::a00:1ff:fe02:6, vlan10, 0DT0H1M5S
O*> 150::/64 [110/20] via fe80::a00:1ff:fe02:6, vlan10, 0DT0H1M5S
O 192:0:7:2::/64 [110/1] vlan111, 0DT0H8M36S
C*> 192:0:7:2::/64 is directly connected, vlan111
S*> 192:0:123:2::/64 [1/0] via 20:50:71:1::2
*> [1/0] via 192:0:7:2::2
S*> 192:0:244:2::/64 [1/0] via 20:50:71:1::2
S*> a100::/64 [1/0] via fe80::250:baff:fe91:bb28, vlan111
*> [1/0] via fe80::a00:1ff:fe02:6, vlan10

Total Entries: 10 entries, 12 routes 

show ipv6 route summary

To display the current state of the IPv6 routing table, use the show ipv6 route summary command.

show ipv6 route summary

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example The following is sample output from the show ipv6 route summary command:

Switch#show ipv6 route summary
IPv6 routing table name is Default-IPv6-Routing-Table(0)
IPv6 routing table maximum-paths state is enabled
IPv6 routing table configured maximum-paths is 6
IPv6 routing table maximum-paths is 6
Route Source Networks
connected 4
static 1
rip 34
Total 39
FIB 34
multi-path 0 

show logging

Use show logging to display the state of the system logging process and the contents of the standard system logging buffer.

show logging [ host | buffer [ START-INDEX [ STOP-INDEX ] |

+ VALUE | - VALUE]]

Syntax Description
host (Optional) Displays the logging hosts.
buffer (Optional) Only display the content of system logging buffer.
START-INDEX (Optional) The logging index number to start the display from.
STOP-INDEX (Optional) The logging index number to stop the display at.
	If both the START-INDEX and STOP-INDEX are not specified, all logs in the system logging buffer will be displayed.
	If only START-INDEX is specified, the logs after the start index number (included) will be displayed.
+ VALUE	(Optional) Using this argument paired with the number of messages (VALUE a positive integer) will display the indicated number of first messages in the buffer.
- VALUE	(Optional) Using this argument paired with the number of messages (VALUE a positive integer) will display the indicated number of last messages in the buffer.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline	Use this command to check the current settings of the system logging process and view the logs in the system logging buffer.
	If the keywords,hostorbufferare not specified, then the switch only displays general information about the state of system logging and the logging host table.
Examples	The following page shows an example of the commandshow loggingwith the keywordhost:

DGS-6600:15(config)#show logging host

Host	Severity	Facility	Port
30.65.45.34	informational	local7	514
35.4.56.2	critical	local4	1300
DGS-6600:15(config)#show logging
logging on :enabled
logging buffer severity:notice
Host	Severity	Facility	Port
30.65.45.34	informational	local7	514
35.4.56.2	critical	local4	1300

Below is an example of using the + VALUE and - VALUE arguments with the show logging buffer command:

DGS-6600:15#show logging buffer + 3
Total logs:401

Index	Date	Log Text
3	12:12:04, 2010-08-14	Interface eth4.47 is up
2	12:12:04, 2010-08-14	Interface vlan99 is up
1	12:11:47, 2010-08-14	System is cold started
DGS-6600:15#show logging buffer - 3
Total logs:401
Index	Date	Log Text
401	06:26:45, 1993-01-03	Successfully login to the system by user anonymous,
IP 0.0.0.0, via console at privilege level 2
400	06:26:35, 1993-01-03	System is cold started
399	14:05:03, 2010-12-13	System is rebooted by user admin, IP 0.0.0.0, via co
nsole

Below is an example of using the START-INDEX and STOP-INDEX arguments with the show logging buffer command.

DGS-6600:15(mgmt-if)# show logging buffer 250 260
Total logs:402
Index Date	Log Text
--
260	08:53:15, 2010-09-20	Interface vlan1 is down
259	08:53:14, 2010-09-20	Interface eth4.47 is up
258	08:53:14, 2010-09-20	Interface vlan1 is up
257	08:45:08, 2010-09-20	eth4.1 state change from LRN to FWD for MSTID 0
256	08:45:08, 2010-09-20	eth4.1 state change from BLK to LRN for MSTID 0
255	08:45:07, 2010-09-20	eth4.43 state change from LRN to FWD for MSTID 0
254	08:45:07, 2010-09-20	eth4.43 state change from BLK to LRN for MSTID 0
253	08:45:05, 2010-09-20	Interface eth4.1 is up
252	08:45:05, 2010-09-20	Interface vlan99 is up
251	08:45:04, 2010-09-20	Interface eth4.43 is up
250	08:45:04, 2010-09-20	Interface vlan20 is up
DGS-6600:15(mgmt-if)#

show mac address-table

Use the show mac address-table command to display: a specific MAC address, static entries, dynamic entries or the MAC address table of static and dynamic entries for a specific physical interface, port-channel or VLAN.

show mac address-table [ dynamic | static ] [ address MAC-ADDR | interface [ INTERFACE-ID [, | - ] | vlan VLAN-ID ]

Syntax Description
dynamic (Optional) Displays dynamic MAC address table entries only.
static (Optional) Displays static MAC address table entries only.
address MAC-ADDR	Specifies the 48-bit MAC address; the valid format is XX:XX:XX:XX:XX:XX
interface INTERFACE-ID	Display information for a specific interface. Valid interfaces include physical ports and port-channels.
vlan VLAN-ID	(Optional) Specifies the VLAN ID; valid values are from 1 to 4094.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Examples This is an example of output from the show mac address-table address command:

Switch# show mac address-table address 00:02:4B:28:C4:82

VLAN MAC Address Type Ports

1 00-02-4b-28-c4-82 Static CPU

Total Entries: 1

This is an example of output from the show mac address-table static command:

Switch> show mac address-table static
Vlan	Mac Address	Type	Ports
1	01-00-0c-cc-cc-cc	Static	CPU
1	01-80-c2-00-00-00	Static	CPU
1	01-00-0c-cc.cc-cd	Static	CPU
1	01-80-c2-00.00-01	Static	CPU
1	01-80-c2-00.00-04	Static	CPU
1	01-80-c2-00.00-05	Static	CPU
4	00-01-00-02.00-04	Static	eth3.2
6	00-01-00-02.00-07	Static	eth3.1
Total Entries : 8
Switch#

This is an example of output from the show mac address-table address on interface VLAN 1:

Switch# show mac address-table vlan 1

Vlan Mac Address Type Ports

---- ---- ----

1 00-02-4B-28-C4-82 Static CPU

1 00-03-40-11-22-33 Dynamic eth3.2

show mac address-table aging destination-hit

Use the show mac address-table aging destination-hit command to display the status of destination MAC address triggered update function.

show mac address-table aging destination-hit

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Examples

This is an example of output from the show mac address-table aging destination-hit command:

Switch> show mac address-table aging destination-hit Mac address-table aging destination-hit is enabled

show mac address-table aging-time

Use the show mac address-table aging-time command to display the aging time.

show mac address-table aging-time

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example

This is an example of output from the show mac address-table aging-time command:

Switch> show mac address-table aging-time Aging Time is 300 seconds.

show mgmt-if

Use this command to show the status of the management port, including user settings and link status.

show mgmt-if

Syntax None

Description

Default None

Command Mode User EXEC, management interface mode or any configuration mode

Usage Guideline None

Example This example shows how to display the status of the management port.

Switch (mgmt-if) #show mgmt-if
Management Interface 

Admin Status : Up
IPv4 Address : 10.90.90.90/8
Default Gateway : 0.0.0.0
IPv6 Address : ::/0
IPv6 Default Gateway : ::
IP MTU : 1500
Link Status : Down 

show monitor session

Use this command to show all or a specific port mirroring session.

show monitor session [ SESSION-NUMBER ]

Syntax Description

SESSION-NUMBER (Optional) Specifies the session number to display.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

If the command is entered without specifying a session number, all port mirroring sessions are displayed.

Examples

This example shows how to display a created port mirroring session with session number 1.

Switch# show monitor session 1
Destination Port : eth3.1
Source Ports :
Both : eth3.2-3.4
RX : eth3.5
TX : eth3.7 

This example shows how to display all the created port mirroring sessions.

Switch# show monitor session
Session 1
Destination Port : eth3.1
Source Ports :
Both : eth3.2-3.4
RX : eth3.5
TX : eth3.7
Session 2
Destination Port : eth4.1
Source Ports :
Both : eth4.2-4.4
RX : eth4.5
TX : eth4.7 

show multicast filtering-mode

Use the show multicast filtering-mode command to display the filtering mode for handling the multicast packets received on the interface.

show multicast filtering-mode [interface INTERFACE-ID]

Syntax Description

INTERFACE-ID

(Optional) Specifies the interface to display the filtering mode on (only VLAN interfaces are supported).

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Only VLAN interfaces support multicast filtering-mode configuration.

Examples This is an example of output from the show multicast filtering-mode for all vlan interfaces.:

Switch> show multicast filtering-mode
Interface	Multicast Filtering Mode
----	----
VLAN1	filter-unregistered
VLAN2	filter-unregistered
VLAN3	filter-unregistered
VLAN4	filter-unregistered
VLAN5	forward-unregistered
VLAN6	forward-unregistered
VLAM7	forward-unregistered
VLAN8	forward-unregistered
VLAN9	forward-unregistered
VLAN10	forward-unregistered
Total Entries: 10
Switch>

This is an example of output from the show multicast filtering-mode for the vlan 1 interface:

Switch> show multicast filtering-mode interface vlan1
Interface	Multicast Filtering Mode
----	----
VLAN1	filter-unregistered
Total Entries: 1

show policy-map

Use this command to display the policy map configuration.

show policy-map [POLICY-NAME | interface INTERFACE-ID]

Syntax Description
INTERFACE-ID (Optional) Module and port number.
POLICY-NAME	(Optional) Specifies the name of the policy map. If not specified, all policy maps will be displayed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline The show policy-map command displays the class policies configured for the policy map. Use the show policy-map command to display all class policy configurations comprising any existing service policy map.

The command show policy-map INTERFACE-ID displays the policy map configuration if the service policy has been attached to the specified interface.

Examples The following is sample output from the show policy-map command. As shown below, in the policy map called policy1, two-rate traffic policing has been configured for the class called police. Two-rate traffic policing has been configured to limit traffic to an average committed rate of 500 Mbps and a peak rate of 1 Gbps.

Switch(config)#class-map police
Switch(config-cmap)#match access-list acl_rd
Switch(config-cmap)#policy-map policy1
Switch(config-pmap)#class police
Switch(config-pmap-c)#police cir 500000 bc 10000 pir 1000000 be 10000 exceed-action set-dscp-transmit 2 violate-action drop
Switch(config-pmap-c)#exit
Switch(config-pmap)#exit
Switch(config)#interface eth3.1
Router(config-if)#service-policy policy1
Router(config-if)#end

The following sample output shows the contents of the policy map called policy1:

Switch# show policy-map policy1
Policy Map policy1
Class police
police tr-tcm cir 500000 bc 10000 pir 1000000 be 10000 exceed-action : set-dscp-transmit 2
    violate-action : drop
Total Entries : 1 

The following sample output shows all policy maps configured at eth3.1:

Switch# show policy-map interface eth3.1
Policy Map: policy1
Class police
police tr-tcm cir 500000 bc 10000 pir 1000000 be 10000 exceed-action : set-dscp-transmit 2
    violate-action : drop
Total Entries : 1 

show port-security

Use this command to display the current port security setting.

show port-security [interface INTERFACE-ID [, | -] ] [address]

Syntax Description

INTEFACE-ID (Optional) Specifies the ID of interfaces to display.

, (Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space before and after the comma.

- (Optional) Specifies a range of interfaces. No space before and after the hyphen.

address (Optional) Display all the secure MAC addresses including both of configured and learned entries.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline	If no interface ID is specified, the show port-security command will display the port security setting of all existing port interfaces.
	If the mac-address address option is specified, the configured and learned secure MAC address entries will be displayed.
	If no optional keyword is specified with show port-security command, all of the port-security information is displayed.
Examples	This example shows how to display the port security setting of interface port eth4.1.

DGS-6600:15#show port-security interface eth4.1
Interface	Max No.	Current No.	Violation	Secure Type	State
eth4.1	1	0	Shutdown	Delete-on-Timeout	Disabled
Total Entries: 1

This example shows how to display the learned MAC addresses on interface eth3.1.

Switch# show port-security interface eth3.1 address
Interface VLAN ID MAC Address Type
eth3.1 1 00-00-12-34-56-78 Delete-on-Timeout
eth3.1 2 00-00-22-33-44-55 Delete-on-Timeout
eth3.1 2 00-00-22-33-44-66 ManuallyConfured
Total Entries: 3 

show power-saving

Use this command to display the power saving information.

show power-saving

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example The following example shows how to display power-saving information.

DGS-6600:2#show power-saving
Power-saving status
====================
phy power-saving:Enabled 

show qos aggregate-policer

Use this command to display the configured aggregated policer.

show qos aggregate-policer [NAME]

Syntax Description

NAME (Optional) Specifies the name of the aggregate policer.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example This example shows how to display the aggregate policer.

Switch> show qos aggregate-policer
QoS policy aggregate : agg-policer5
rate:64 burst-normal: 128
exceed-action : drop
QoS policy aggregate : agg-policer6
tr-tcm cir 64 bc 128 pir 256 be 512
exceed-action : set-dscp-transmit 2
violate-action : drop
Total Entries:2 

show qos interface

Use this command to display the port level QoS configurations.

show qos interface INTERFACE-ID [,|-] { cos | deficit-round-robin | trust | bandwidth | dscp-mutation | map {dscp-color | cos-color | dscp-cos} }

Syntax Description
interfaceINTERFACE-ID[,|-]	Specifies the interface ID to display. Specify multiple interface IDs, which are separated by a comma (,) or hyphen (-). No space is before or after the comma or hyphen.
cos Displays the port default CoS.
deficit-round-robin Displays the DRR configuration.
trust Displays the port trust state.
bandwidth Displays the bandwidth limitation configured for the port.
dscp-mutation Displays the DSCP mutation map attached to the interface.
map dscp-color Displays the DSCP to color map.
map cos-color Displays the CoS to color map.
map dscp-cos Displays the mapping of DSCP to CoS.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline If no keywords are specified after show qos, then the summary of QoS settings will be shown.

Examples This example displays the default CoS for ports eth3.2 - eth3.5.

Switch> show qos interface eth3.2-3.5 cos
Interface CoS
----
eth3.2 3
eth3.3 4
eth3.4 4
eth3.5 3
Total Entries: 4 

This example displays the port trust state for ports eth3.2 - eth3.5.

Switch> show qos interface eth3.2-3.5 trust
Interface Trust State
----
eth3.2 trust DSCP
eth3.3 trust CoS
eth3.4 trust DSCP
eth3.5 trust CoS

Total Entries: 4
Switch> 

The following example displays the deficit round robin configuration for ports eth3.1-eth3.2:

Switch> show qos interface eth3.1-3.2 deficit-round-robin
eth3.2

CoS Quantum (Kbytes)

0 16
1 32
2 16
3 32
4 16
5 64
6 64
7 strict priority

eth3.2

DRR is disabled.

Switch> 

This example displays the DSCP mutation maps attached to ports eth3.1 to 3.2.

Switch> show qos interface eth3.1-3.2 dscp-mutation
Interface DSCP Mutation Map
---- ----
eth3.1    Mutate Map 1
eth3.2    Mutate Map 2
Total Entries: 2 

The following example displays the CoS bandwidth allocation for ports eth3.1-3.2:

Switch> show qos interface eth3.1-3.2 bandwidth
Bandwidth Control Table
Interface Ingress Rate (Kbps) Egress Rate (Kbps)
eth3.1 1000
eth3.2 1000
- 2000 

This example displays the DSCP to color map for ports eth3.1 to eth3.2.

Switch> show qos interface eth3.1-3.2 map dscp-color
eth3.1

DSCP 0-7,44-63 are mapped to Green
DSCP 41-43 are mapped to Yellow
DSCP 8-40 are mapped to Red
eth3.2

DSCP 0-63 are mapped to Green

Total Entries: 2 

This example displays the CoS to color map for ports eth3.3 to eth3.4.

Switch> show qos interface eth3.3-3.4 map cos-color
eth3.3
CoS 0-2,5,7 are mapped to Green
CoS 3-4 are mapped to Yellow
CoS 6 are mapped to Red
eth3.4
CoS 0-7 are mapped to Green
Total Entries: 2 

The following example displays the DSCP to CoS map for ports eth3.1.

Switch> show qos interface eth3.1 map dscp-cos eth3.1
0 1 2 3 4 5 6 7 8 9
----
00 00 00 00 00 00 00 00 00 01 01
10 01 01 01 01 01 01 02 02 02 02
20 02 02 02 02 03 03 03 03 03 01
30 03 03 04 04 04 04 04 04 04 04
40 05 05 05 05 05 05 05 05 06 06
50 06 06 06 06 06 06 07 07 07 07
60 07 07 07 07 

show qos map

Use this command to display the QoS DSCP mutation map configuration.

show qos map dscp-mutation [MAP-NAME]

Syntax Description

MAP-NAME (Optional) Specifies the name of the DSCP mutation map to display.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline If no name is specified after show qos map dscp-mutation, all maps will be displayed.

Example The following example displays the global DSCP mutation map.

Switch> show qos map dscp-mutation
DSCP Mutation: mutemap1
Attaching interface:
eth2.1, eth2.2, eth2.3, eth2.4, eth2.5, eth3.1, eth3.2, eth3.3, eth3.4, eth3.5, eth3.6, eth3.7, eth3.8, eth3.9, eth3.10
0 1 2 3 4 5 6 7 8 9
----
00 00 01 02 03 04 05 06 07 08 09
10 10 11 12 13 14 15 16 17 18 19
20 20 21 22 23 24 25 26 27 28 29
30 30 31 32 33 34 35 36 37 38 39
40 40 41 42 43 44 45 46 47 48 49
50 50 51 52 53 54 55 56 57 58 59
60 60 61 62 63 

show route-map

Use this command to display static route maps,

show route-map [MAP-NAME]

Syntax Description

MAP-NAME (Optional) Name of a specific route map.

Default None

Command Mode Privileged EXEC

Usage Guideline

The command displays all the ACL-specific information that pertains to the route map in the same display without having to execute a show route-map command to display each ACL that is associated with the route map.

Example

This example shows how to display static route maps for the entry "myPolicy"

Switch# show route-map myPolicy
route-map myPolicy, permit, sequence 10
Match clauses:
as-path R1
Set clauses:
weight 120
Switch# 

show running-config

Use this command to display the contents of the current running configuration file.

show running-config

Syntax None

Default None

Command Mode Privilege EXEC at level 15

Usage Guideline

The show running-config command output for the current running system configuration.

Example

The following example shows how to display the contents of the current running configuration file:

Switch:15(config)#show running-config
Building configuration...
Current configuration:
version 1.00.001

#Slot Module-Type Model
#----
<h1 id="1-management-control-module-cmu-card">1 Management Control Module CMU-Card</h1>
<h1 id="2">2 -</h1>
<h1 id="3">3 -</h1>
<h1 id="4-48-ports-1000base-t-48t-iocard">4 48 ports 1000Base-T 48T-IOCard</h1>
!
!
! 

show snmp

Use this command to display the SNMP information of the device.

show snmp { community | host | view | group | engineID }

Syntax Description

community Display SNMP community information.

host Display SNMP trap recipient information.

view Display SNMP view information.

group Display SNMP group information.

engineID Display SNMP local engine ID information.

Default None

Command Mode Privileged EXEC or any configuration mode

Usage Guideline This command displays the SNMP information.

Examples This example shows how to display SNMP community information.

Switch# show snmp community
Codes: ro - read only, rw - ReadWrite
(rw)System
(ro)public
(ro)Develop
(rw)private
Total Entries: 4 

This example is sample output from the command show snmp host.

Switch# show snmp host
Host IP Address	SNMP Version	Community Name	SNMPv3 User Name
10.48.76.100	v3 noauth		initial
10.51.17.1	v2c	public
Total Entries: 2
Switch#

This example is sample output from the command show snmp view.

Switch# show snmp view
View Name	Subtree	View Type
restricted	1.3.6.1.2.1.1	Included
restricted	1.3.6.1.2.1.11	Included
restricted	1.3.6.1.6.3.10.2.1	Included
restricted	1.3.6.1.6.3.11.2.1	Included
restricted	1.3.6.1.6.3.15.1.1	Included
CommunityView	1	Included
CommunityView	1.3.6.1.6.3	Excluded
CommunityView	1.3.6.1.6.3.1	Included
Total Entries: 8
Switch#

This example is sample output from the command show snmp group.

Switch# show snmp group
groupname: ILMI	security model:v1
readview :*ilmi	writeview: *ilmi
notifyview: <no notifyview specified>
row status: active
groupname: ILMI	security model:v2c
readview : *ilmi	writeview: *ilmi
notifyview: <no notifyview specified>
row status: active
groupname: public	security model:v1
readview : <no readview specified>	writeview: <no writeview specified>
notifyview: *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F
row status: active
groupname: public	security model:v2c
readview : <no readview specified>	writeview: <no writeview specified>
notifyview: *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F
row status: active
Total Entries: 4
Switch#

This example is sample output from the command show snmp engineID.

Switch# show snmp engineID
Local SNMP engineID: 00000009020000000C025808
Switch# 

show snmp-server

Use this command to display configuration information about the SNMP server.

show snmp-server [traps]

Syntax Description

traps (Optional) Display the control for all trap notifications.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use this command to display the global configuration about the SNMP server without using the keyword traps. When the keyword traps is specified, the state control for all trap notifications will be shown.

Examples This example shows how to display the SNMP server configuration

Switch# show snmp-server
SNMP Server : Enabled
System Name : DGS-XXXXS Stackable Switch
Location : HQ 15F
Contact : MIS Department II 

This example shows how to display the state control for all traps notification

Switch# show snmp-server traps
Global Trap State : Enabled
SNMP
Authentication : Enabled
linkup : Enabled
linkdown : Enabled
coldstart : Enabled
warmstart : Disabled
bridge : Enabled
rmon : Disabled
entity : Disabled
vrrp : Enabled
ping : Disabled
traceroute : Disabled
equipment : Disabled
agent : Enabled
mstp : Disabled
pkt-storm-ctrl : Disabled
safe-guard : Disabled
single-ip : Disabled
mac-violation : Disabled
mac-notificaiton : Disabled 

show snmp user

Use this command to display information about the configured characteristics of an SNMP user.

[ USER-NAME ]

Syntax Description

USER-NAME (Optional) Name of a specific user or users about which to display SNMP information.

Default None

Command Mode Privileged EXEC or global configuration

Usage Guideline

An SNMP user must be part of an SNMP group, as configured using the snmp-server user USER-NAME GROUP-NAME command. When the username argument is not entered, the show snmp user command displays information about all configured users.

Example This example shows how to display the SNMP user authuser's information.

Switch# show snmp user authuser
User Name: authuser
Engine ID: 00000009020000000C025808
Authentication Protocol: MD5
Privacy Protocol: DES
Group Name: VacmGroupName
Total Entries: 1 

Display Field Descriptions

Description of significant display fields.

Display Field Description

User Name A string identifying the name of the SNMP user.

Engine ID Per snmp user's engineID is copied from the local system engineID.

Authentication Protocol Identifies which authentication protocol is used. Options are message digest algorithm 5 (MD5), Secure Hash Algorithm (SHA) packet authentication, or None

Privacy protocol Indicates whether Data Encryption Standard (DES) packet encryption is enabled.

Group Name Indicates the SNMP group the user is a part of.

• SNMP groups are defined in the context of a View-based Access Control Model (VACM).

show sntp

Use this command to show information about the SNTP server.

show sntp

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example The following example shows how to display the SNTP information:

Switch> show sntp
SNTP server	Version	Last Receive
171.69.118.9	5	00:01:02
172.21.28.34	4	00:00:36	Synced
Total Entries: 2.
Switch>

show spanning-tree

This command is used to show the information about the STP module. This command is only for STP & RSTP.

show spanning-tree [ interface [INTERFACE-ID [, | - ] ]

Syntax Description
interfaceINTERFACE-ID	Specifies the INTERFACE-ID which to display information for.
, (Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space before and after the comma.
- (Optional) Specifies a range of interfaces. No spaces before and after the hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Show the Spanning-Tree Configuration for the single spanning tree when in RSTP/ STP-compatible mode.

Issuing the command without any argument displays all the spanning-tree protocol information.

An error message will appear when the operating mode is MSTP.

Examples The example on the next page shows how to display the spanning information.

DGS-6600:15(config)#show spanning-tree

Spanning tree : Enabled, mode : RSTP
Root ID    Priority : 12288
Address : 00-1c-f0-26-f4-c0
Root Path Cost : 2500
Hello Time : 2 sec, Max Age : 20 sec, Forward Delay : 15 sec 

Bridge ID Priority : 32768
Address : 06-0b-00-18-00-00
Hello Time : 2 sec, Max Age : 19 sec, Forward Delay : 14 sec
TX Hold Count : 6 

Topology Changes Count : 47 

codes - F : Fast forwarding is configured as enabled Configured link type : A - Auto, P - point to point, S - shared

Interface Role State Cost Priority .Port Link Type Edge
A eth2.1 NonStp Forwarding 200000 128.65 P2P None-Edge
A eth2.15 Designated Forwarding 200000 128.79 P2P Edge
A eth2.16 Designated Forwarding 200000 128.80 P2P Edge
A eth2.17 Designated Forwarding 200000 128.81 P2P Edge
A eth2.18 Designated Forwarding 200000 128.82 P2P Edge
A eth2.47 Designated Forwarding 200000 128.111 P2P Edge
A eth3.41 NonStp Forwarding 20000 128.169 P2P None-Edge
A eth4.33 NonStp Forwarding 200000 128.225 P2P None-Edge
A eth4.34 NonStp Forwarding 200000 128.226 P2P None-Edge
A eth4.35 NonStp Forwarding 200000 128.227 P2P None-Edge
A eth4.36 NonStp Forwarding 200000 128.228 P2P None-Edge
A eth4.37 NonStp Forwarding 200000 128.229 P2P None-Edge
A eth4.38 NonStp Forwarding 200000 128.230 P2P None-Edge
A eth4.39 NonStp Forwarding 200000 128.231 P2P None-Edge
A eth4.40 NonStp Forwarding 200000 128.232 P2P None-Edge
A eth4.41 NonStp Forwarding 200000 128.233 P2P None-Edge
A eth4.42 NonStp Forwarding 200000 128.234 P2P None-Edge
A eth4.43 NonStp Forwarding 200000 128.235 P2P None-Edge
A eth4.44 NonStp Forwarding 200000 128.236 P2P None-Edge
A eth4.45 NonStp Forwarding 200000 128.237 P2P None-Edge
A eth4.46 NonStp Forwarding 200000 128.238 P2P None-Edge
A eth4.47 NonStp Forwarding 200000 128.239 P2P None-Edge
A eth4.48 NonStp Forwarding 200000 128.240 P2P None-Edge
A port-channel1 Alternate Discarding 300000 128.641 P2P None-Edge
A port-channel164 Root Forwarding 2500 128.704 P2P None-Edge
A port-channel110 Alternative Discarding 5000 128.740 P2P None-Edge
A port-channel1128 Alternate Discarding 5000 128.768 P2P None-Edge 

Total Entries: 27

This example shows how to display spanning configuration information for a specific interface.

Switch#show spanning-tree interface eth4.7
eth4.7
STP : Enabled
Priority : 128
Port role : Root
Port state : Forwarding
Configured Fast-Forwarding: Auto, Operation status: non-dege port (non fast-forwarding)
Configured link type : Auto, operation status: P2P
Configured path cost : Auto, operation result: 200000
Guard root : Disabled
TCN filtering : Disabled
Switch# 

show spanning-tree mst

Use this command to display the MSTP specific information.

show spanning-tree mst [configuration [digest]]

show spanning-tree mst [instance INSTANCE-ID [, | -] ]

show spanning-tree mst [instance INSTANCE-ID [, | - ] interface INTERFACE-ID [, | - ]]

Syntax Description
configuration Specifies to display a table of the mapping relationship between VLANs and MSTP Instances.
digest Specifies to display the MD5 digest included in the current MST configuration identifier (MSTCI).
instance INSTANCE-ID[ , | -]	Specifies to show the MSTP information for the designated instance only. Multiple instances can be defined. Use ',' to specify a series of instances, or separate a range of instances from a previous range. Or use '-' to specify a range of instances. No space before and after the comma or hyphen.
interfaceINTERFACE-ID[ , | - ]	Show the MSTP information for the specified interface. Multiple interfaces can be defined. Use ',' to specify a series of interfaces, or separate a range of interfaces from a previous range. Or use '-' to specify a range of interface. No space before and after the comma or hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline MSTP-specific information is only displayed by this command, and this command is applicable only when the MSTP mode is enabled.

Issuing the command without any argument will show all the MSTP specific information.

An error message will appear if the operating mode is STP or RSTP.

Examples This example shows how to display the MSTP summary information.

Switch# show spanning-tree mst
Spanning tree: Enabled, protocol:MSTP
Operation status: Forward delay 15 sec, Max age 20 sec
Configured : Forward delay 15 sec, Max age 20 sec,
max hops 20, transmit hold count 6

>>>MST0 vlans mapped: 1,4-4094
Bridge Address: 00-12-85-26-05-00, priority: 32768 (32768 sysid 0)
Designated Root Address: 00-54-85-26-05-00, Priority: 4096 (4096 sysid 0)
Regional Root: this switch
Designated Bridge: this switch

codes - F: Fast forwarding is configured as enabled,
Configured Link type: A - Auto, S- Shared,P- Point to point
Priority Link
Interface Role State Cost .Port# Type Edge
FA eth3.3 designated forwarding 20000 128.3 p2p edge
FA eth3.5 backup blocking 200000 128.5 p2p non-edge
A eth3.6 backup blocking 200000 128.6 shared edge
A eth3.7 root forwarding 2000 128.9 p2p edge

>>>MST02 vlans mapped: 2-3
Bridge address:00-12-d9-87-47-00 , priority: 32770 (32768 sysid 2)
Designated Root : this switch for MST2
Regional Root: MST02
Designated Bridge: MST02
Priority Link
Interface Role State Cost .Port# Type Edge
FA eth3.9 designated forwarding 20000 128.9 p2p edge
P eth3.10 backup blocking 200000 128.10 p2p non-edge
A eth3.11 cackup blocking 200000 128.11 shared edge
A eth3.12 root forwarding 2000 128.12 p2p edge
Switch# 

This example shows how to display the MSTP MD5 digest information.

Switch#show spanning-tree mst digest
Name : [region1]
Revision : 2, Instances configured: 3
Digest : 3C60DBF24B03EBF09C5922F456D18A03
Switch# 

show ssh

Use this command to display the status of Secure Shell (SSH) server connections.

show ssh

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the show ssh command to display the status of the SSH connections on the switch. This command does not display any SSH configuration data; use the show ip ssh command to display SSH configuration information such as timeouts and retries.

Example This example shows how to display SSH connections information.

Switch# show ssh
SID	Ver. Cipher		Userid	Host
0	V2	aes256-cbc/hmac-sha1	admin	126.100.51.22
Switch#

Display Field Descriptions

Description of significant display fields.

Display Field Description

SID A unique number that identifies the SSH session.

Ver Indicates the SSH version of this session.

Cipher The crypto / Hashed Message Authentication Code (HMAC) algorithm that the SSH client is using.

Userid The login username that has been authenticated for the session.

Host The IP address of the system running an SSH client.

show startup-config

Use this command to display the content of the startup configuration file.

show startup-config

Syntax None

Default None

Command Mode Privilege EXEC at level 15

Usage Guideline

Use show startup-config command to display the system configuration contents of the file which is specified with the boot config command. If no boot config command is applied, the factory default system configuration content is displayed.

Example

The following example shows how to display the content of the startup system configuration file:

Switch:15(config)#show startup-config
#Boot configuration file=flash:\configurations\def_usr.conf
#Switch Chassis-based High-Speed Switch
#Firmware Version:1.00.001 

show storm-control

Use this command to show the current storm control settings.

show storm-control [interface [INTERFACE-ID] [, / -] [broadcast | multicast | unicast]]

Syntax Description

INTERFACE-ID Interface name/id.
broadcast Displays the current Broadcast storm setting
multicast Displays the current Multicast storm setting
unicast	Displays the current Unicast (DLF) storm setting

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

If the INTERFACE-ID is specified, the storm control settings of the specified interface will appear on the screen.

If no INTERFACE-ID is specified, then the configurations of all interfaces will appear.

If no traffic type is specified, then all types of storm control settings will appear.

If there is no configuration on the interface specified, the interface will not be displayed,

Examples This example shows the current Broadcast storm control setting.

Switch# show storm-control interface broadcast

Interface	Storm	Action	Type	Threshold
eth3.1	Broadcast	Drop	pps	500
eth3.2	Broadcast	Shutdown	percentage	80
eth3.3	Broadcast	Shutdown	percentage	80

Total Entries:3

This example shows all the interface settings.

Switch# show storm-control interface

Interface	Storm	Action	Type	Threshold
eth3.1	Broadcast	Drop	pps	500
eth3.1	Multicast	Drop	percentage	80
eth3.1	Unicast	Drop	percentage	80
eth3.2	Broadcast	Shutdown	percentage	90
eth3.2	Multicast	Drop	percentage	80
eth3.3	Broadcast	Shutdown	percentage	85

Total Entries: 6

This example shows the interface settings for the range from port eth3.1 to eth3.2.

Switch# show storm-control interface eth3.1-3.2

Interface	Storm	Action	Type	Threshold
eth3.1	Broadcast	Drop	pps	500
eth3.1	Multicast	Drop	percentage	80
eth3.1	Unicast	Drop	percentage	80
eth3.2	Broadcast	Shutdown	percentage	90
eth3.2	Multicast	Drop	percentage	80

Total Entries: 5

This example shows the global settings.

Switch# show storm-control

Time Interval	: 15 seconds
Countdown Timer	: 180 seconds
Auto Recover Time	: 300 seconds

show system

Use this command to display information about the Switch system.

show system [cpu] [protocol-state]

Syntax Description

cpu (Optional) Shows the information about the CPU utilization of the management control unit.

protocol-state (Optional) Shows the information about supporting protocols.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command displays information about the overall Switch system. Use keyword of protocol-state to show the information about the administrative and operational state of the supported protocols.

Example

This example on the following page shows how to display the Switch information

Switch>show system

Device Type : Chassis-based High-Speed Switch
First MAC Address : 06:B0:00:17:00:00
Number of MAC Address(es) : 4096 

Slot: 1

Hardware Version :0A1G
Bootloader Version :1.00.002
Firmware Version :1.00.018
S/N :QT0X1AC000001
Model Name :DGS-6600-CMI
First MAC Address :06:60:0c:10:00:20
Number of MAC Address(es) :1 

Slot: 2

Hardware Version :0A0-2
Bootloader Version :1.00.002
Firmware Version :1.00.018
S/N :QT101AC000001
Model Name :DGS-6600-48P
First MAC Address :08:03:04:37:00:00
Number of MAC Address(es) :48 

Slot: 3

Hardware Version :0A0-1
Bootloader Version :1.00.002
Firmware Version :1.00.018
S/N :QT111AC000001
Model Name :DGS-6600-48TS
First MAC Address :08:03:05:21:00:00
Number of MAC Address(es) :48 

Slot: 4

Hardware Version :0A1G
Bootloader Version :1.00.002
Firmware Version :1.00.018
S/N :QT0Z1AC000001
Model Name :DGS-6600-48S
First MAC Address :06:48:c0:14:00:00
Number of MAC Address(es) :48 

The following shows the output for the command show system protocol-state command:

DGS-6600:15#show system protocol-state
Password Encryption :Disabled
SNMP Server :Disabled
Sys Logging :Enabled
TELNETv4 :Enabled(TCP:23)
TELNETv6 :Enabled(TCP:23)
WEB :Enabled(TCP:80)
SSH :Disabled(TCP:22)
IP Domain Lookup :N.A
RMON :Disabled
Spanning Tree Version :Enabled(MSTP)
LACP :Enabled
802.1x :Disabled
GVRP :Disabled
RIP :Enabled
OSPF :Enabled
BGP :Disabled
Multicast Routing :Disabled
DVMRP :Enabled
PIM-DM :Enabled
PIM-SM :Enabled
IGMP Snooping :Enabled
IGMP :Enabled
DHCPv4 Relay :Disabled
DHCPv4 Client :Enabled
DHCPv4 Server :Disabled
AAA Authorization :Disabled
Vlan Tunnel :Disabled
RIPng :Disabled
OSPFv3 :Disabled
IPv6 DHCP Relay :Disabled
IPv6 DHCP Client :Disabled
VRRP :Enabled
DGS-6600:15# 

show time-range

Use this command to display the time range profile configuration.

show time-range [NAME]

Syntax Description
NAME	(Optional) The name of the time-range profile to be displayed. If no NAME argument is specified, all time-range profiles will be displayed. Up to 32 characters are allowed.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline None

Example This example shows how to display the content of the configured time range profile, named trange1.

Switch(config)#show time-range trangel
time range name : trangel
09:00 ~ 12:00, every day
00:00 ~ 23:59, every Sat
00:00 ~ 23:59, every Sun
19:00 (the 1st day) ~ 17:00 (the 2nd day) every month 

show traffic-segmentation

Use this command to show the traffic segmentation for some ports or all ports.

show traffic-segmentation [ interface INTERFACE-ID [, | - ] ]

Syntax Description

interfaceINTERFACE-ID	(Optional) Specifies the ID of an interface. The allowable interfaces are either physical ports or port channels.
, (Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space before and after the comma.
- (Optional) Specifies a range of interfaces. No space before and after the hyphen.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

The allowable interface types for this command are either physical ports or port channels.

If entering show traffic-segmentation without any keywords, then the traffic segmentation configuration for all ports is displayed. Otherwise, only the specified interface's traffic-segmentation is shown.

Example

This example shows the configuration of traffic segmentation for eth3.1

Switch# show traffic-segmentation interface eth3.1
Interface Forwardinge Interface(s)
----
eth3.1 eth3.1, eth3.4, eth3.5, eth3.6
Total Entries: 1 

show unit

Use this command to display information about the system's modules.

show unit [ UNIT-ID ]

Syntax Description

UNIT-ID

(Optional) Slot ID to indicate which slot (module) the information is going to be displayed for.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command displays information about the system's modules. If no option is specified, then all of the slots (modules) information are displayed.

Example

This example shows how to display the information about the system's modules:

Note: The display text and format may differ depending on the SW release.

Slot	Model		Status	Up-Time
1	DGS-6600-CM		ok	0DT0H2M49S
2	-		-	-
3	-		-	-
4	DGS-6600-8XG		ok	0DT0H2M17S
Slot	Model		Description
1	DGS-6600-CM		CPU/Fabric Management Module
2	-		-
3	-		-
4	DGS-6600-8XG		8-port 10GE XFP Module
	DRAM			FLASH
Slot	Total	Used	Free	Total	Used	Free
1	2074160k	1183436k	890724k	994952k	125656k	869296k
2	-	-	-	-	-	-
3	-	-	-	-	-	-
4	516012k	476924k	39088k	-	-	-

Display Field Descriptions

Description of significant display fields.

Display Field Description

up time The operating time since system power-up.

show username

Use this command to display the username and password pair database.

show username [NAME]

Syntax Description

NAME (Optional) A specified name of a user account. Only one word is allowed for the name argument. If no NAME is specified, all user accounts will be displayed.

Default None

Command Mode Privileged EXEC or any configuration mode; both at privilege level 15

Usage Guideline This command displays user accounts that have been created.

An error message will appear if the specified user does not exist.

Examples This example shows how to display all of the usernames configured in the switch.

Switch# show usernamePassword Encryption : Disabled
Username	Access Level	Password	Encrypted
Admin	15	mypassword
dlink	15	*@&cRDtpNCeBiq15KOQsKVyrA0sAiCIZQwq	*
Total Entries: 2Switch#

The table below describes the significant fields shown in the display.

Field	Description
Encrypted	'*' denotes the entry's password is encrypted. If there is no '*' next to the entry it indicates the password is 'Plain Text'.

show user-session

Use this command to display information about the active lines on the switch.

show user-session [console | telnet | ssh | http | https]

Syntax Description

console (Optional) displays the information of the current console users.

telnet (Optional) displays the information of the current telnet users.

ssh (Optional) displays the information of the current ssh users.

http (Optional) displays the information of the current http users.

https (Optional) displays the information of the current https users.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

This command displays the line number, connection name, hosts (including virtual access interfaces), idle time, and terminal location. An asterisk (*) indicates the current terminal session.

When no option specified, users accessing all interfaces will be displayed.

Example This example shows how to display all session information.

Switch# show user-session

UI Codes: co - console, h - http, hs - https, s - ssh, te -telnet

ID Login Time From UI Level Username

* 0 01:12:23, 2008-05-13 0.0.0.0 co 15 12345678901234567890 1 01:00:28, 2008-05-13 172.171.160.100 te 15 admin

Total Entries: 2

show version

To display version information about software, hardware, etc., use the show version command.

show version

Syntax None

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline This command displays the software and hardware information about the Switch.

Example This example shows how to display the software and hardware versions on a DGS-6604 switch:

Switch#show version
GS-6604 System Version

Backplane H/W version:0A1G serial#:P4YZ1A9000001

Slot Module Type Versions

--
1 DGS-6600-CM Serial#: P4Z21A9000001
H/W: 0A1G
Bootloader: 1.00.001
Runtime: 1.00.021
CPLD: ver-0

2 - -
3 - -
4 DGS-6600-48S Serial#: P4Z31A9000002
H/W: 0A1G
Bootloader: 1.00.001
Runtime: 1.00.021
CPLD: ver-4 

show vlan

Use the show VLAN command to display the parameters for all configured VLANs or one VLAN (if the VLAN id or name is specified) on the switch.

Use the command show vlan subnet-base or show vlan mac-base to display a subnet-based VLAN or MAC-based VLAN respectively.

Use the command show vlan [subnet|mac] to display a subnet-based VLAN or a MAC-based VLAN respectively.

show vlan [ VLAN-ID [, | -] interface [ INTERFACE-ID [, | -] ] ] [dynamic | detail]

show vlan [ subnet-base | mac-base ]

Syntax Description
VLAN-ID (Optional) Display information about a single VLAN identified by VLAN id number. The VLAN id range is 1 to 4094. Separate non-consecutive VLAN-IDs with a comma; use a hyphen to designate a range of VLAN-ID.
interface	(Optional) Displays the interface port's PVID, ingress checking, acceptable frame type information.
INTERFACE-ID Specifies the port to display.
,(Optional) Specifies a series of ports, or separate a range of ports from a previous range. No space before and after the comma.
-(Optional) Specifies a range of ports. No space before and after the hyphen.
[ detail | dynamic]	(Optional) Specifies what kind of information to be displayed. The optional keywords are:detail: display detailed information including static and dynamic information about the specified VLAN(s)dynamic: display dynamic membership which is learned by GVRP for the specified VLAN(s).If neither detail nor dynamic is specified, only the static configuration will be shown.
subnet-base (Optional) display subnet-based VLAN related configuration.
mac-base (Optional) display mac-based VLAN related configuration.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the show vlan command to display the current VLAN status. Show the VLAN list table using show vlan command. Show a specific VLAN entry using show vlan VLAN-ID. Use show vlan interface command to show port-oriented VLAN information, such as, port PVID, ingress checking, and acceptable frame type information.

The following are the causes for an interface to become an untagged member port of a VLAN.

1. Configuration using an access VLAN command.
2. VLAN assignment from a RADIUS server.

Use the command show vlan [ subnet-base | mac-base ] to display a Subnet-based VLAN or MAC-based VLAN respectively.

If no optional key word is specified all of VLAN configurations are displayed.

Examples This example shows how to display all current VLAN entries.

Switch# show vlan

VLAN 1:
Name: default
GVRP advertisement: yes
Static Tag Member Ports:
None
Static Untag Member Ports:
eth4.2, eth4.3, eth4.4, eth4.5, eth4.6,
eth4.7, eth4.8, eth4.9, eth4.10, eth4.11,
eth4.12, eth4.13, eth4.14, eth4.15, eth4.16,
eth4.17, eth4.18, eth4.19, eth4.20, eth4.21,
eth4.22, eth4.23, eth4.24, eth4.25, eth4.26,
eth4.27, eth4.28, eth4.29, eth4.30, eth4.31,
eth4.32, eth4.33, eth4.34, eth4.35, eth4.36,
eth4.37, eth4.38, eth4.39, eth4.40, eth4.41,
eth4.42, eth4.44, eth4.45, eth4.46, eth4.48,
port-channel1,
GVRP Advertise Ports:
eth4.1-eth4.48, port-channel1
Forbidden Ports:
None 

VLAN 20:

Name: VLAN0020
GVRP advertisement: yes
Static Tag Member Ports:
    eth4.47,
Static Untag Member Ports:
    eth4.43,
GVRP Advertise Ports:
    eth4.1-eth4.48, port-channel1
Forbidden Ports:
None 

This example shows how to display information for interface ports eth4.1 to eth4.3. Information such as ingress checking and the acceptable frame type is displayed.

Switch# show vlan interface eth4.1-4.3
eth4.1
PVID : 99
GVRP State : Disabled
Ingress checked : Enabled
Access VLAN : 99
Advertise VLAN : 1-4094
Forbidden VLAN :
Acceptable frame types : admit-all
eth4.2
PVID : 1
GVRP State : Disabled
Ingress checked : Enabled
Access VLAN : 1
Advertise VLAN : 1-4094
Forbidden VLAN :
Acceptable frame types : admit-all
eth4.3
PVID : 1
GVRP State : Disabled
Ingress checked : Enabled
Access VLAN : 1
Advertise VLAN : 1-4094
Forbidden VLAN :
Acceptable frame types : admit-all
Switch# 

This example shows how to display the MAC-base VLAN table.

Switch(config)#show vlan mac-base
MAC Address    VLAN ID
00-80-cc-00-00-11    100
00-80-cc-00-00-21    100
00-80-cc-00-00-12    200
00-80-cc-00-00-31    300
00-80-cc-00-00-33    300
Total Entries: 5
Switch(config)# 

This example shows how to display the subnet-base VLAN table.

Switch(config)#show vlan subnet-base
Subnet VLAN ID
----
20.0.1.0/8 100
192.0.1.0/8 100
20.0.2.0/8 200
20.0.3.0/8 300
Total Entries: 4
Switch(config)# 

show vlan-tunnel

Use this command to display the VLAN tunnel related settings.

show vlan-tunnel [INTERFACE-ID [, | - ]]

Syntax Description
[ INTERFACE-ID[ , | - ]]	(Optional) Multiple interfaces can be specified to be displayed. The multiple interface numbers are separated by comma, or hyphen. No spaces before and after the comma or hyphen. If no INTERFACE-ID is specified, VLAN tunnel settings on all interfaces are displayed. If no argument is specified only the status of VLAN tunnel mode will be shown.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Specify that the information displayed is about a specific interface(s) in the VLAN translation table. If no argument is specified only the status of VLAN tunnel mode will be shown.

Examples This example shows how to display the status of VLAN tunnel mode.

Switch# show vlan-tunnel
VLAN tunneling: enabled

eth4.1:UNI port, CoS remarking: 5, ingress-checking: disabled, remove-inner-tag: disabled
VLAN S-VID C-VID CoS
---- ---- ---- ----
encapsulation 1001 2002 5
2003 5
2004 5
encapsulation 1002 1002 5
2003 5
3004 6
remarking 2 102 4
remarking 3 103 5
remarking 4 104 5

eth4.2:NNI port, TPID:0x88a8

eth4.3:UNI port, CoS remarking: disabled, ingress-checking: enabled, remove-inner-tag: disabled

VLAN S-VID C-VID CoS
---- ---- ---- ----
encapsulation 1001 2002 trusted
2003 trusted
2004 trusted
encapsulation 1002 1002 4
2003 5
3004 6
remarking 2 102 4
remarking 3 103 trusted
remarking 4 104 7 

Display Field Descriptions

The following table shows the detailed description for the above fields.

Field

Description

VLAN tunneling The state of the VLAN tunneling function.

UNI port Indicates that the port is either a UNI port or NNI port.

Field	Description
CoS remarking	Indicates the CoS remarking status at the port. It could be either disabled or an integer from 0~7 (indicating the remarking CoS Value).
VLAN Shows the VLAN encapsulation and remarking pairs.
S-VID/C-VID Indicates the service provider VLAN ID and customer VLAN ID of the VLAN tunneling pair.
CoS The CoS remarking setting for the VLAN tunneling pair.

This example shows how to display the VLAN tunnel settings for eth4.1.

Switch# show vlan-tunnel eth4.1
VLAN tunneling: disabled

eth4.1:UNI port, CoS remarking:5, ingress-checking: disabled, remove-inner-tag: disabled

VLAN S-VID CVID CoS

---- ---- ---- ----

encapsulation 1001 2002 5
2003 5
2004 5

encapsulation 1002 1002 5
2003 5
3004 6

remarking 2 102 4
remarking 3 103 5
remarking 4 104 5

Switch# 

show vlan-tunnel ctag-mapping

This command is used to display the state of the dynamically learned customer VLAN tag mechanism and the static customer VLAN tag mappings.

show vlan-tunnel ctag-mapping { dynamic state | static }

Syntax Description

dynamic state Display the state of dynamic learned customer VLAN tag mechanism.

static Display all static customer VLAN tag mappings.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline

Use the show vlan-tunnel ctag-mapping dynamic state command to display the state of dynamically learned customer VLAN tag mechanism.

Use the show vlan-tunnel ctag-mapping static command to show each static customer VLAN tag mapping entries that user configured.

Examples

This example shows how to display the state of dynamic learned customer VLAN tag mechanism.

Switch# show vlan-tunnel ctag-mapping dynamic state
Dynamic ctag-mapping for IPv4 : Disable
Dynamic ctag-mapping for IPv6 : Disable
Switch# 

This example shows how to display the VLAN tunnel static customer VLAN tag mapping entries.

Switch# show vlan-tunnel ctag-mapping static
Destination IP C-VID
192.168.10.0/24 233
192.168.20.0/24 155
2011:254::/64 850
Total Entries: 3
Switch# 

show vrrp

This command is used to view the VRRP status.

show vrrp [interface INTERFACE-ID [ VRID ] ]

Syntax Description
INTERFACE-ID (Optional) The interface name of a configured IP interface. When the INTERFACE-ID is specified, the VRRP information that is related to the interface will be displayed.
VRID	(Optional) A configured virtual router identifier .When both INTERFACE-ID and VRID are specified, the VRRP information that is related to it will be displayed.The virtual router identifier is configured with the vrrp ip command.Range is 1 to 255.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline Use this command to view the VRRP information.

Examples

On the following page is an example from show vrrp. There are 2 VRID, 7 and 8, configured in the interface vlan1, a VRID 5 configured in interface vlan2 and a VRID 1 configured in interface vlan3.

Switch#show vrrp
vlan1 - VRID 7
State is Master
Virtual IP address is 20.0.1.1
Virtual MAC address is 00-00-5e-00-01-07
Advertisement interval is 1 sec
Preemption enabled
Priority is 255
Critical IP address is 0.0.0.0
Master router is 20.0.1.1 (local)
Master Down interval is 3.003 sec

vlan1 - VRID 8
State is Master
Virtual IP address is 20.1.1.2
Virtual MAC address is 00-00-5e-00-01-08
Advertisement interval is 1 sec
Preemption disabled
Priority is 200
Critical IP address is 0.0.0.0
Master router is 20.0.1.1 (local)
Master Down interval is 3.218 sec

vlan2 - VRID 5
State is Initialize
Virtual IP address is 30.1.1.254
Virtual MAC address is 00-00-5e-00-01-05
Advertisement interval is 1 sec
Preemption enable
Priority is 100
Critical IP address is 70.5.1.1
Master router is unknown
Master Down interval is 3.609 sec

vlan3 - VRID 1
State is Backup
Virtual IP address is 50.1.1.254
Virtual MAC address is 00-00-5e-00-01-01
Advertisement interval is 1 sec
Preemption enabled
Priority is 80
Critical IP address is 0.0.0.0
Master router is 50.0.1.2
Master Down interval is 3.687 sec (expires in 3.550 sec) 

The following example shows how to view VRRP information of interface vlan1 and VRID 8.

Switch#show vrrp interface vlan1 8
vlan1 - VRID 8
State is Master
Virtual IP address is 20.1.1.2
Virtual MAC address is 00-00-5e-00-01-08
Advertisement interval is 1 sec
Preemption disabled
Priority is 200
Critical IP address is 0.0.0.0
Master router is 20.0.1.1
Master Down interval is 3.218 sec 

show vrrp brief

This command is used to view the VRRP brief status.

show vrrp brief [ all ]

Syntax Description
all	(Optional) Displays all information for all virtual routers, including virtual routers in a shutdown state.

Default None

Command Mode User EXEC or any configuration mode

Usage Guideline When using the show vrrp brief command the status and parameter information for the configured VRRPs is displaced in tabular format.

Example Below is the output of using the show vrrp brief command to view the brief VRRP information.

Switch#show vrrp brief
Interface	VRID	Prio	Time	Own	Pre	State	Master Addr
vlan1	7	255	3.003	Y	Y	Master	20.0.1.1
vlan1	8	200	3.218		Y	Master	20.0.1.1
vlan2	5	100	3.609		Y	Init	0.0.0.0
vlan3	1	80	3.687		Y	Backup	50.0.1.2

The following table describes the fields in the show vrrp brief command output.

Field Description
Interface Interface name
VRID Virtual router identifier
Prio VRRP priority value
Time Master down interval in seconds
Own Indicates whether the virtual router is the IP address owner. "Y" indicates it is IP address owner.
Pre	Indicates preempt mode is enabled or not. "Y" indicates preempt mode is enabled.
State	State of the virtual router
Master Address	IP address of the master virtual router.
VRouter Address	IP address of the virtual router.

shutdown (interface)

Use this command to disable the port interface. Use the no form of the command to enable the port interface.

shutdown

no shutdown

Syntax None

Default Enabled

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this configuration.

The command will change the state of a port to be disabled. In the disabled state, the port will not be able to receive or transmit any packets. Using the no shutdown command, the port will set the port to the enabled state. When a port is shutdown (disabled), the link status will also be off.

Examples

Below demonstrates using the shutdown command to set interface port eth3.1 to the disabled state

Switch(config)# interface eth3.1
Switch(config-if)# shutdown

shutdown (Management Port)

Use this command to disable the management port. Use the no form of the command to turn the management port back to the enabled state.

shutdown

no shutdown

Syntax None

Default Enabled

Command Mode Management interface

Usage Guideline

This command will disable the management port. Users cannot access or manage the system using the management port until the no shutdown command is executed.

Example

Use the shutdown command to disable the Management Port.

Switch (config) #mgmt-if
Switch (mgmt-if) #shutdown
Switch (mgmt-if) #end 

Verify the settings by entering the show mgmt-if command.

snmp-server

To enable the Simple Network Management Protocol (SNMP) agent, use the snmp-server command. To disable the SNMP agent, use the no form of this command.

snmp-server

no snmp-server

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

The remote SNMP manager sends SNMP requests to agents and receives SNMP responses and notifications from agents. When the SNMP agent is enabled, the remote SNMP manager can query SNMP agents and send SNMP traps.

Examples This example shows how to enable the SNMP server.

Switch(config)# snmp-server 

This example shows how to disable the SNMP server.

Switch(config)# no snmp-server 

Verify the settings by entering the show snmp-server command.

snmp-server community

Use this command to set up the community access string to provide access to SNMP. Use the no form of the command to remove the specified community string.

snmp-server community COMMUNITY-STRING [ view VIEW-NAME ] [ro | rw]

no snmp-server community COMMUNITY-STRING

Syntax Description
COMMUNITY-STRING	Defines the community string that consists of from 1 to 32 alphanumeric characters and functions much like a password, permitting access to the SNMP protocol. The syntax is a general string that does not allow space.
view VIEW-NAME	(Optional) Name of a previously defined view. The view defines the objects available to the SNMP community.
ro	(Optional) Specifies read-only access. Authorized management stations are only able to retrieve MIB objects.
rw	(Optional) Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects.

Default There are two communities set in the default as shown below:

Community View Name Access right

private CommunityView Read/Write

public CommunityView Read Only

ro/rw: is set as read only (ro) if no [ro|rw] option is specified.

Command Mode Global configuration at privilege level 15

Usage Guideline This command creates a community entry in the community table.

This command provides a more user-friendly method to create a community string for V1/V2 management.

If the view name specified by the command, does not exist (i.e it was not created prior), then a new view will be created.

A community string is unable to be deleted if it has been associated with a snmp-server host.

Examples

This example shows how to set the read/write community string to comaccess in the mib2 view.

Switch(config)# snmp-server view mib2 1.3.6.1.2.1 included
Switch(config)# snmp-server community comaccess view mib2 rw 

This example shows how to remove the community comaccess.

Switch(config)# no snmp-server community comaccess

Verify the settings by entering the show snmp community command.

snmp-server contact

Use this command to configure the system's snmp contact information. Use the no form of this command to remove the configuration of system contact information.

snmp-server contact TEXT

no snmp-server contact

Syntax Description
contact TEXT	String that describes the system contact information. The maximum length is 255 characters (please refer to RFC1213 for the maximum length in detail). The syntax is a general string that allows space.

Default None

Command Mode Global configuration

Usage Guideline Configures the system's snmp contact information on the switch.

Example This example shows how to set the system's snmp contact information as the string MIS Department II.

Switch(config)# snmp-server contact MIS Department II

Verify the settings by entering the show snmp-server command.

snmp-server enable traps

To enable all Simple Network Management Protocol (SNMP) notification types that are available on the switch, use the snmp-server enable traps command. To disable all available SNMP notifications, use the no form of this command.

snmp-server enable traps

no snmp-server enable traps

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests for the specified notification types. To specify whether the notifications should be sent as traps or informs, use the snmp-server host traps command.

To configure the router to send these SNMP notifications, enter at least one snmp-server enable traps command. When entering the command with no keywords, all notification types are enabled. When entering the command with a keyword, only the notification type related to that keyword is enabled - see "snmp-server enable traps snmp" on page 633. To enable multiple types of notifications, issue a separate snmp-server enable traps command for each notification type and notification option.

The snmp-server enable traps command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send notifications, configure at least one snmp-server host command.

Example This example shows how to enable the SNMP traps.

Switch(config)# snmp-server enable traps
Switch(config)# 

snmp-server enable traps snmp

To enable the sending of RFC 1157 Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps snmp command. Use the no form of this command to disable RFC 1157 SNMP notifications,.

snmp-server enable traps snmp [authentication] [linkup] [linkdown] [coldstart] [warmstart]

no snmp-server enable traps snmp [authentication] [linkup] [linkdown] [coldstart] [warmstart]

Syntax Description
authentication	(Optional) Controls the sending of SNMP authentication failure notifications. An authenticationFailure(4) trap signifies that the sending device is the addressee of a protocol message, that is not properly authenticated. The authentication method depends on the version of SNMP being used. For SNMPv1 or SNMPv2c, authentication failure occurs for packets with an incorrect community string. For SNMPv3, authentication failure occurs for packets with an incorrect SHA/MD5 authentication key or for a packet that is outside of the authoritative SNMP engine's window (for example, falls outside of configured access lists or time ranges).
linkup (Optional) Controls the sending of SNMP linkUp notifications. A linkup(3) trap signifies that the sending device recognizes that one of the communication links, represented in the agent's configuration, has come up.
linkdown (Optional) Controls the sending of SNMP linkDown notifications. A linkDown(2) trap signifies that the sending device recognizes a failure in one of the communication links, represented in the agent's configuration.
coldstart (Optional) Controls the sending of SNMP coldStart notifications. A coldStart(0) trap signifies that the sending device is reinitializing itself such that, the agent's configuration or the protocol entity implementation may be altered.
warmstart	(Optional) Controls the sending of SNMP warmStart notifications. A warmStart(1) trap signifies that the sending device is reinitializing itself such that, neither the agent configuration nor the protocol entity implementation is altered.

Default All SNMP notifications are enabled by default. When issuing this command with none of the optional keywords, all RFC 1157 SNMP notifications are enabled (or disabled, if using the no form).

Command Mode Global configuration

Usage Guideline When issuing this command with no keywords, all notification types are enabled. If the command is entered with a keyword, only the notification type related to that keyword is enabled.

The snmp-server enable traps snmp command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. In order to send notifications, configure at least one snmp-server host command. For a host to receive a notification controlled by this command, both the snmp-server enable traps

command and the snmp-server host command for that host must be set to enabled.

The snmp-server enable traps snmp [linkup] [linkdown] form of this command globally enables SNMP linkUp and linkDown traps. After enabling either of these traps globally, disable these traps on specific interfaces using the no snmp trap link-status command in interface configuration mode. Note that in the interface level, linkUp and linkDown traps are enabled by default. This indicated that it is not necessary to enable these notifications on a per-interface basis.

Examples

The following example shows how to enable the router to send all traps to the host 10.9.18.100

Switch(config)# snmp-server enable traps snmp
Switch(config)# snmp-server host 10.9.18.100 

The following example shows how to enable the switch to send all trap notifications to the host 10.9.18.100 using the community string defined as public:

Switch(config)# snmp-server enable traps snmp
Switch(config)# snmp-server host 10.9.18.100 traps version 2c public 

The following example shows the enabling all SNMP trap types, then the disabling of only the linkUp and linkDown trap:

Switch> enable
Switch# configure terminal
Switch(config)# snmp-server enable traps snmp
Swtich(config)# end
Switch# show running-config | include traps snmpsnp-server enable traps snmp authentication linkup linkdown coldstart warmstart
Switch# configure terminal
Switch(config)# no snmp-server enable traps snmp linkup linkdown
Swtich(config)# end
Switch# show running-config | include traps snmpsnp-server enable traps snmp authentication coldstart warmstart 

This example shows how to enable the SNMP authentication traps.

Switch(config)# snmp-server enable traps snmp authentication 

Verify the settings by entering the show snmp-server traps command.

snmp-server engineID local

Use this command to specify the SNMP engine ID on the switch. Use the no form of the command to remove a configured SNMP engine ID and return the engine ID setting to the original default value.

snmp-server engineID local ENGINEID-STRING

no snmp-server engineID local

Syntax Description

ENGINEID-STRING String length from 10 to 24 characters that identifies the engine ID.

Default

An SNMP engine ID is generated automatically but is not displayed or stored in the running configuration.

Command Mode Global configuration

Usage Guideline

The SNMP engine ID is a unique string used to identify the switch for administration purposes. It is not necessary to specify an engine ID for the switch. For further details on the SNMP engine ID, see RFC 3411.

To specify a manually configured ID, note that it is not necessary to specify the entire 24-character engine ID if the ID specified contains trailing zeros. Specify only the portion of the Engine ID up until the point where only zeros remain in the value. For example, to configure an engine ID of 123456789A000000000000000, specify an snmp-server engineID local as 123456789A.

For a single SNMP engine system, changing the SNMP engine ID will overwrite the old SNMP local engine ID setting.

Display the default or configured engine ID by using the show snmp engineID command.

Note: If the SNMP engine ID is set to the default value then the no form of the command will fail when it is executed.

Example

This example shows how to configure the SNMP engine ID to 123456789A00000000000000.

Switch(config)# snmp-server engineID local 123456789A

Verify the settings by entering the show snmp engineID command.

snmp-server group

Use this command to configure a new SNMP group or a table that maps SNMP users to SNMP views. Use the no form of the command to remove a specified SNMP group.

snmp-server group GROUP-NAME {v1 | v2c | v3 {auth | noauth | priv}} [ read READ-VIEW] [ write WRITE-VIEW] [notify NOTIFY-VIEW]

no snmp-server group GROUP-NAME

Syntax Description
GROUP-NAME	Specifies the name of the group. The valid length for GROUP-NAME is 1 to 32 characters. The syntax is a general string that does not allow space.
v1	Specifies that SNMPv1 (the least secure of the possible SNMP security models) should be used for the group.
v2c	Specifies that SNMPv2c should be used for the group.
v3	Specifies that SNMPv3 should be used for the group.SMNPv3 is the most secure of the supported security models, as it allow explicit configuration of the authentication characteristics.
auth	Specifies authentication of a packet without encrypting it.
noauth	Specifies no authentication of a packet.
priv	Specifies authentication of a packet with encryption.
read READ-VIEW	(Optional) Specifies a read view for the SNMP group. The read-view argument represents a string that is the name of the view that enables the display to show only the contents of the agent.
write WRITE-VIEW	(Optional) Specifies a write view for the SNMP group. The write-view argument represents a string that is the name of the view that enables data entry to configure the contents of the agent.
notify NOTIFY-VIEW	(Optional) Specifies a notify view for the SNMP group.The notify-view argument represents a string that is the name of the view that enables a trap to be specified.

Default The default settings of SNMP group are as shown below:

Group

Name Version Security Level Read View Name Write View Name Notify View Name

initial	SNMPv3	noauth	restricted	None	restricted
ReadGroup	SNMPv1	noauth	CommunityView None	CommunityView
ReadGroup	SNMPv2c	noauth	CommunityView None	CommunityView
WriteGroup	SNMPv1	noauth	CommunityView	CommunityView	CommunityView
WriteGroup	SNMPv2c	noauth	CommunityView	CommunityView	CommunityView

Command Mode Global configuration

Usage Guideline

An SNMP group defines the access method, the read view, the write view, and the notification view.

For the access method, it means that when the user who belongs to this group must use the version and access method (for V3) to access the SNMP agent.

For the read view, it means that the user who belongs to this group can only read objects that are part of this view. For the write view, it means that the user who belongs to this group can only write objects that are part of this view. Accessing objects that are not part of the view will generate error messages.

For the notification view, it means that the system will check whether the trap manager owns the view to the binding objects that are associated with the notification packet. If the trap manager does not own the notification view to the binding objects, then the notification will not be sent to a trap manager.

Examples

This example shows how to create the SNMP server group public with SNMP v3.

Switch# configure terminal
Switch(config)#snmp-server group public v3 noauth
Switch(config)#

This example shows how to remove the SNMP server group public from the configuration.

Switch# configure terminal
Switch(config)# no snmp-server group public
Switch(config)# end 

This example shows how to set a MIB view called interfacesMibView and create a group called guestgroup to SNMPv3 authentication-read mode associated with the MIB view.

Switch(config)# snmp-server view interfacesMibView 1.3.6.1.2.1.2 included
Switch(config)# snmp-server group guestgroup v3 auth read interfacesMibView
Switch(config)# 

Verify the settings by entering the show snmp group command.

snmp-server host

Use this command to specify the recipient of an SNMP notification operation. Use the no form of the command to remove the recipient.

snmp-server host { IP-ADDRESS } [version { 1| 2c | 3 {auth | noauth | priv} } ] WORD

no snmp-server host {IP-ADDRESS}

Syntax Description

IP-ADDRESS	Name, IPv4 address of the SNMP notification host.
version (Optional)	Version of SNMP used to send the traps. The default is 1. If the version keyword is specified, one of the following keywords must be specified:1 - SNMP v 1.2 c - SNMP v 2 C.3 - SNMPv3. The most secure model, because it allows packet encryption with the priv keyword.One of the following three optional security level keywords can follow the 3 keywords:auth - Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication.noauth - Specifies that the noAuthNoPriv security level applies to this host. This is the default security level for SNMPv3.priv - Enables Data Encryption Standard (DES) packet encryption (also called "privacy").
WORD Password-like community string is sent with the notification operation. If the SNMP version is 3, the COMMUNITY-STRING is used as the UserName defined by the snmp-sever user command. The community string consists from 1 to 32 characters. The syntax is a general string that does not allow spaces.

Default

If no version is specified the default is version 1.

Command Mode Global configuration at privilege level 15

Usage Guideline

SNMP notifications are sent as trap packets. If an snmp-server host command is not entered, then no notifications are sent. In order to configure the switch to send SNMP notifications, create at least one recipient of an SNMP notification by snmp-server host command.

To create an SNMP host where the notification will be sent to, specify the version of notification packet. For V1 and V2 SNMP, the notification will be sent in the trap protocol data unit (PDU). For V3 SNMP, the notification will be sent in the SNMPv2-TRAP-PDU with the SNMPv3 header.

If it is specified to send the notification in V3 format, it can be further specified whether to perform authentication and encryption of the packet. The switch will use the community string specified for this command as the user name and look up in the user table to get the password for the authentication and encryption.

For both V1/V2 and V3 SNMP, the switch will find out the notification view for the group associated with this SNMP host. If the binding variables associated with this notification are out of this notification view, then this notification will not send to this host.

For the V3 SNMP host, the argument of WORD refers to a user created by the command "snmp-server user" on page 641. For V1/V2 SNMP host, the community string can only be created by the command "snmp-server community" on page 629. If the host version is not specified, the default value (SNMP v1) will be adopted and the WORD option must be a community string. There will be a error message displayed if user input a user name as WORD option. To create an SNMP host, the community string (or user) must be created first. An error message will be generated to indicate if it is not created.

If the host version is different from the group version defined for this host (from the access control list option in the command "snmp-server group" on page 636), it will fail because the version is not matched. If the community is created, the system will create a V1/V2 group implicitly.

Example

This example shows how to setup the trap recipient as 163.10.50.126 using version3 with security level MD5 (and/or SHA packet authentication) and the SNMPv3 user: authuser.

Switch(config)# snmp-server user authuser authgroup v3 auth md5 1234
Switch(config)# snmp-server host 163.10.50.126 version 3 auth authuser 

Verify the settings by entering the show snmp host command.

snmp-server location

Use this command to configure the system location information. Use the no snmp-server location command to set the system location information to empty.

snmp-server location TEXT

no snmp-server location

Syntax Description
location TEXT	A string that describes the system location information. The maximum length is 128 characters (please refer to RFC1213 for the maximum length in detail). The syntax is a general string that allows spaces.

Default Not configured

Command Mode Global configuration with privilege level 15

Usage Guideline Configure the system location information on the switch.

Example This example shows how to set up the system location information with string HQ 15F.

Switch(config)# snmp-server location HQ 15F

Verify the settings by entering the show snmp-server command.

snmp-server user

Use this command to configure a new Simple Network Management Protocol (SNMP) user. Use the no snmp-server user command to remove a user.

snmp-server user USER-NAME GROUP-NAME v3 [encrypted] [auth {md5 | sha} AUTH-PASSWORD [priv PRIV-PASSWORD]]

no snmp-server user USER-NAME

Syntax Description
USER-NAME	The name of the user on the host that connects to the agent. The valid length is 1 to 32 characters. The syntax is a general string that does not allow spaces.
GROUP-NAME	The name of the group to which the user belongs. The valid length is 1 to 32 characters. The syntax is a general string that does not allow spaces.
v3 Specifies that the SNMPv3 security model should be used. Allows the use of the encrypted and or auth keywords.
encrypted	(Optional) Specifies whether the password appears in encrypted format (a series of digits, masking the true characters of the string).
auth (Optional) Specifies which authentication level should be used.
md5 The HMAC-MD5-96 authentication level.
sha The HMAC-SHA-96 authentication level.
AUTH-PASSWORD The password used for authentication.
	For plain-text form, the password can be from 1 to 64 characters. The syntax is a general string that does not allow spaces. According to authentication level, the authentication key will be generated.
	For encrypted form, the length is fixed to 16 octets for MD5 or 20 octets for SHA. The format is hex value, such as aa:bb:cc:dd.
PRIV-PASSWORD The password used for privacy.
	For plain-text form, the password can be from 1 to 64 characters. The syntax is a general string that does not allow spaces. According to the authentication level, the private key will be generated by this string.
	If keyword enceypted is specified, the private key is specified by user, the format is hex value, such as aa:bb:cc:dd and the length is16 octets.

Default There is one preconfigured user:

USER-NAME: initial

GROUP-NAME: initial

Command Mode Global configuration with privilege level 15

Usage Guideline

Use this command to create an SNMP user. The group to which this user belongs must be created first. If this user belongs to a V3 group and also specifies authentication or encryption, then the password used for authentication and encryption needs to be defined.

An snmp user is unable to be deleted if it has been associated with an snmp-server host. An error message will appear to indicate this case.

The snmp user will not be able to manage the device if a password should be present but it is not present.

No default values exist for authentication or privacy algorithms when the command is configured. Also, no default passwords exist. The minimum length for a password is one character, although it is recommended to use at least eight characters for security. If a password is forgotten, it cannot be recovered and it and will need to manually reconfigured. Either a plain-text password or a localized message digest 5 (MD5) digest can be specified.

When using a localized MD5 or SHA digest, the string can be specified instead of the plain-text password. The digest should be formatted as aa:bb:cc:dd where aa, bb, and cc are hex values.

Examples

In the following example, the plain-text password "hb123" is configured for the user "abcd" in the SNMPv3 group "public".

Switch(config)# snmp-server user abcd public v3 auth md5 hb123

In the following example, the MD5 digest string is used instead of the plain text password.

Switch(config)# snmp-server user abcd public v3 encrypted auth md5 00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF

Verify the settings by entering the show snmp user command.

snmp-server view

Use this command to create or update a view entry for SNMP. And use the no snmp-server view command to remove a specified SNMP view entry.

snmp-server view VIEW-NAME OID-TREE { included | excluded }

no snmp-server view VIEW-NAME

Syntax Description
VIEW-NAME	Label for the view record that being updating or created. The name is used to reference the record. The valid length for VIEW-NAME is 1 to 32 characters. The syntax is a general string that does not allow space.
OID-TREE	Object identifier of the ASN.1 subtree to be included or excluded from the view. To identify the subtree, specify a text string consisting of numbers, such as 1.3.6.2.4.
included	(Optional) Configures the OID (and subtree OIDs) specified in the OID-TREE argument to be included in the SNMP view.
excluded	(Optional) Configures the OID (and subtree OIDs) specified in OID-TREE argument to be explicitly excluded from the SNMP view.

Default There are two VIEWs set as shown below:

VIEW-NAME OID-TREE View Type

restricted 1.3.6.1.2.1.1 Included

restricted 1.3.6.1.2.1.11 Included

restricted 1.3.6.1.6.3.10.2.1 Included

restricted 1.3.6.1.6.3.11.2.1 Included

restricted 1.3.6.1.6.3.15.1.1 Included

CommunityView 1 Included

CommunityView 1.3.6.1.6.3 Excluded

CommunityView 1.3.6.1.6.3.1 Include

Command Mode Global configuration at privilege level 15

Usage Guideline Use this command to create a view for the MIB object trees.

The view needs to be specified when the snmp-server group command is used to define a user group.

Example

This example shows how to create a view that includes all objects in the MIB-II subtree.

Switch(config)# snmp-server view mib2 1.3.6.1.2.1 included 

This example shows how to set a MIB view to interfacesMibView.

Switch(config)#snmp-server view interfacesMibView 1.3.6.1.2.1.2 included
Switch(config)# 

This example shows how to set the access rights for a group called guestgroup to SNMPv3 authentication-read mode.

Switch(config)#snmp-server group guestgroup v3 auth read interfacesMibView
Switch(config)# 

Verify the settings by entering the show snmp view command.

sntp server

Use this command to allow the system clock to be synchronized with the SNTP time server. To remove a server from the list of SNTP servers, use the no form of this command.

sntp server IP-ADDRESS

no sntp server [ IP-ADDRESS ]

Syntax Description

IP-ADDRESS

IP address of the time server which provides the clock synchronization.

Default Not configured

Command Mode Global configuration

Usage Guideline

When using no sntp server without any option, the Switch will delete all configured SNTP servers and synchronization with the SNTP server will be disabled.

SNTP is a compact, client-only version of the NTP. SNTP can only receive the time from NTP servers; it cannot be used to provide time services to other systems.

SNTP typically provides time within 100 milliseconds of a precise time source, but it does not provide the complex filtering and statistical mechanisms of NTP. In addition, SNTP does not authenticate traffic, although it can be configured with extended access lists to provide some protection.

Enter this command once for each NTP server.

The switch must be configured with this global configuration command in order to enable SNTP.

Create multiple SNTP servers by entering this command multiple times with different SNTP server IP addresses.

The time obtained from the SNTP server refers to the UTC time.

Example

The following example shows how to configure a switch to allow its software clock to be synchronized with the clock by the SNTP server at IP address 192.168.22.44:

Switch# configure terminal
Switch(config)# sntp server 192.168.22.44
Switch(config)# end 

Verify the settings by entering the show sntp server command.

spanning-tree ( Global configuration )

Use this command to enable STP mode. Use the no form of the command to disable STP.

spanning-tree

no spanning-tree

Syntax None

Default Enabled

Command Mode Global configuration

Usage Guideline

When the no spanning-tree command is used globally to disable STP, an STP BPDU will be treated as a normal multicast packet and it will be flooded to the other VLAN member ports.

Example This example shows how to enable STP and MSTP mode as the default mode.

Switch(config)# spanning-tree
Switch(config)#

Verify the settings by entering the show spanning-tree command.

spanning-tree ( Interface configuration )

This setting is used to configure the STP function on the specified port. Use the no form of the command to disable the function.

spanning-tree

no spanning-tree

Syntax None

Default Enabled

Command Mode Interface configuration

Usage Guideline

When setting the interface with the no spanning-tree command, the interface will not participate in the spanning tree topology port state calculation.

If the global spanning-tree state is disabled (no matter STP is disabled/enabled at the interface), then STP BPDU is treated as a normal multicast packet and will be flooded to the other VLAN member ports.

If the global spanning-tree state is enabled, then the STP state at the interface must be enabled, then the interface can participate in the STP calculation.

Both physical ports and channel group are valid interfaces for this command.

Example

This example shows how to configure the STP state for interface port eth3.7.

Switch(config)# interface eth3.7
Switch(config-if)# spanning-tree 

Verify the settings by entering the show spanning-tree interface command.

spanning-tree (timers)

Use this command to set the value of Spanning-Tree Timers. It is only used for RSTP and STP version.

spanning-tree [ hello-time SECONDS | forward-time SECONDS | max-age SECONDS ]

Syntax Description
hello-time SECONDS	Specifies the time interval to send one BPDU at the Designated Port. The range is 1 to 10 seconds.
forward-time SECONDS	Specifies the time interval to determine if a BPDU is valid. The range is 4 to 30 seconds.
max-age SECONDS	Specifies the maximum delay time for one BPDU to be transmitted by a bridge and received from another bridge. The range is 6 to 40 seconds.

Default hello-time:2

forward-time: 15

max-age: 20

Command Mode Global configuration

Usage Guideline There are some constraints on the relationship of the three timers Please refer to the following formulas :

2 × (Bridge_Forward_Delay - 1.0 seconds) >= Bridge_Max_Age

Bridge_Max_Age >= 2 × (Bridge_Hello_Time + 1.0 seconds)

An error message will be returned if the equation is not satisfied.

This configuration will take effect on STP version and RSTP version only. In MSTP mode, Use the command spanning-tree mst (timers) to configure the MSTP timers.

Example This example shows how to configure the STP timers.

Switch(config)# spanning-tree hello-time 1
Switch(config)# spanning-tree forward-time 16
Switch(config)# spanning-tree max-age 21 

Verify the settings by entering the show spanning-tree command.

spanning-tree cost

This setting is used to configure the value of port path-cost on the specified port.

spanning-tree cost COST

no spanning-tree cost

Syntax Description

COST Specifies the path cost for the port. The range is 1 to 200000000.

Default The path cost is computed from the bandwidth setting of the interface.

Command Mode Interface configuration

Usage Guideline

Both physical port and port-channel interfaces are valid for this command,.

In RSTP / STP-Compatible mode, the administrative path cost is used by the single spanning-tree when accumulating the path cost to reach the Root.

In MSTP mode, the administrative path cost is used by the CIST regional root when accumulating the path cost to reach the CIST root.

Example This example shows how to configure the port cost to 20000 for eth3.7.

Switch(config)#interface eth3.7
Switch(config-if)#spanning-tree cost 20000

Verify the settings by entering the show spanning-tree interface command.

spanning-tree fast-forwarding

To enable fast forwarding mode, use the spanning-tree fast-forwarding command. When fast forwarding is enabled the interface will be immediately put into the forwarding state upon linkup without waiting for the timer to expire

spanning-tree fast-forwarding

no spanning-tree fast-forwarding

Syntax None

Default

Default fast forwarding is automatically derived from an IEEE Std 802.1D-2004 Bridge Detection state machine.

Command Mode Interface configuration (physical and port-channel interfaces)

Usage Guideline

Use this command only with interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data-packet loop and disrupt the switch and network operations.

During linkup, when an interface, with fast-forwarding mode enabled, is moved directly to the spanning-tree forwarding state, then it is not necessary to wait for the standard forward-time delay.

This command has two states:

• spanning-tree fast-forwarding -This command enables fast forwarding state unconditionally on the given port.
• no spanning-tree fast-forwarding -The fast-forwarding state for the given port is returned to the default settings

This configuration will take effect on all the spanning-tree modes.

Example This example shows how to configure the fast-forwarding state at eth3.7.

Switch(config)#interface eth3.7
Switch(config-if)#spanning-tree fast-forwarding 

Verify the settings by entering the show spanning-tree interface command.

spanning-tree guard root

To enable the guard mode, use the spanning-tree guard command. To return to the default settings, use the no form of this command.

spanning-tree guard root

no spanning-tree guard

Syntax None

Default Disabled

Command Mode Interface configuration (physical port and port-channel interfaces)

Usage Guideline

This feature is used in a service-provider environment where the network administrator needs to prevent a low speed port becoming a root port for the local bridge networks. This configuration will take effect on all the spanning-tree versions.

Example

This example shows how to configure eth3.1 to prevent if from becoming a root port.

Switch(config)#interface eth3.1
Switch(config-if)# spanning-tree guard root

Verify the settings by entering the show spanning-tree interface command.

spanning-tree link-type

To configure a link type for a port, use the spanning-tree link-type command. To return to the default settings, use the no form of this command.

spanning-tree link-type { point-to-point | shared }

no spanning-tree link-type

Syntax Description

point-to-point Specifies that the port's link type is point-to-point.

shared Specifies that the port's link type is a shared media connection.

Default

Link type is automatically derived from the duplex setting unless the link-type is explicitly configured.

Command Mode

Interface configuration (available for both physical port and port-channel)

Usage Guideline

A full-duplex port is considered to have a point-to-point connection; whereas opposedly, a half-duplex port is considered to have a shared connection. The port cannot transit into forwarding state rapidly by setting the link type to shared-media. Hence, auto-determination of the link-type by the STP module is recommended.

This configuration will take effect on all the spanning-tree modes.

Example
This example shows how to configure the link type to point-to-point for eth3.7.

Switch(config)# interface eth3.7
Switch(config-if)# spanning-tree link-type point-to-point 

Verify the settings by entering the show spanning-tree interface command.

spanning-tree mode

Use this command to decide the STP mode. To return to the default settings, use the no form of this command.

spanning-tree mode { mstp | rstp |stp }

no spanning-tree mode

Syntax Description

mstp Multiple Spanning Tree Protocol (MSTP).

rstp Rapid Spanning Tree Protocol (RSTP).

stp Spanning Tree Protocol ( IEEE 802.1D-Compatible)

Default mstp

Command Mode Global configuration

Usage Guideline	If the spanning-tree mode is configured as STP or RSTP, all currently running MSTP instances will be cancelled automatically.
	If the newly configured spanning-tree mode is changed from the previous one, the spanning-tree state machine will restart again, therefore all of the stable spanning-tree port states will transit into discarding states.
	Caution: Be careful when using the spanning-tree mode command to switch between STP, RSTP, and MSTP modes. When entering the command, all spanning-tree instances are stopped for the previous mode and are restarted in the new mode. Using this command may cause disruption of the user traffic.
Example	This example shows how to configure the running version of STP module to RSTP.

Switch(config)# spanning-tree mode rstp

Verify the settings by entering the show spanning-tree command.

spanning-tree mst (cost | port-priority)

To set the path cost and port-priority parameters for any MST instance (including the CIST with instance ID 0), use the spanning-tree mst command. To return to the default settings, use the no form of this command.

spanning-tree mst INSTANCE-ID {cost COST | port-priority PRIORITY}

no spanning-tree mst INSTANCE-ID {cost | port-priority}

Syntax Description
INSTANCE-ID	MSTP instance identifier; valid values are from 0 to 63, the number of supported MSTP instances is project dependent. Instance 0 represents the default instance, CIST.
cost COST	(Optional) Path cost for an instance; valid values are from 1 to 200000000.
port-priorityPRIORITY	(Optional) Port priority for an instance; valid values are from 0 to 240 in increments of 16.

Default

COST: depends on the port speed; a faster interface speeds indicate smaller costs. MST always uses long path costs.

PRIORITY: 128

Command Mode Interface configuration

Usage Guideline

Higher COST cost values indicate higher costs. When entering the cost, do not include a comma in the entry; for example, enter 1000, not 1,000.

Smaller port-priority PRIORITY values indicate higher priorities.

Examples This example shows how to set the interface path cost:.

Switch(config)#interface eht3.1
Switch(config-if)# spanning-tree mst 0 cost 17031970 

This example shows how to set the interface path cost:

Switch(config)#interface portchannel1
Switch(config-if)# spanning-tree mst 0 port-priority 64

spanning-tree mst (forward | max-age | max-hops)

Use this command to configure the Protocol Timers used by the STP module in MSTP mode.

spanning-tree mst { forward-time SECONDS | max-age SECONDS | max-hops HOP-COUNT }

Syntax Description
forward-time SECONDS	The maximum delay time in seconds for one BPDU to be transmitted by a bridge and received from another bridge. The range is 4 to 30 seconds.
max-age SECONDS	Used to determine if a BPDU is valid. The range is 6 to 40 seconds.
max-hops	Used to restrict the forwarded times of one BPDU. The range is 1 to 20 hops.
HOP-COUNT

Default forward-time:15 seconds

max-age: 20 seconds

max-hops: 20 hops

Command Mode Global configuration

Usage Guideline There are some constraints on the relationship of the three timers. Please refer to the following formulas:

2 × (Bridge_Forward_Delay - 1.0 seconds) >= Bridge_Max_Age

Bridge_Max_Age >= 2 × (Bridge_Hello_Time + 1.0 seconds)

Example This example shows how to configure bridge timers for MSTP version.

Switch# configure terminal
Switch(config)#spanning-tree mst forward-time 14
Switch(config)#spanning-tree mst max-age 19
Switch(config)#spanning-tree mst max-hops 19
Switch(config)# end

spanning-tree mst configuration

To enter MST-configuration submode, use the spanning-tree mst configuration command. To return to the default settings, use the no form of this command.

spanning-tree mst configuration

no spanning-tree mst configuration

Syntax None

Default

The default value for the MST configuration is the default value for all its parameters:

• No VLANs are mapped to any MST instance (all VLANs are mapped to the CIST instance).
• The region name is the Bridge MAC Address.

Command Mode Global configuration

Usage Guideline The MST configuration consists of three main parameters:

• Instance VLAN mapping-See the instance command
• Region name-See the name (MST configuration submode) command
• Configuration revision number-See the revision command

The exit command is used to leave MST configuration submode.

Changing an MST-configuration submode parameter can cause connectivity loss. To reduce service disruptions, when entering the MST-configuration submode, make changes first to a copy of the current MST configuration before applying them at the submode.

.Examples This example shows how to enter MST-configuration submode:

Switch(config)# spanning-tree mst configuration
Switch(config-mst)#

This example shows how to reset the MST configuration to the default settings:

Switch(config)# no spanning-tree mst configuration
Switch(config)#

spanning-tree mst hello-time

Use this command to configure the per port hello time used in MSTP version.

spanning-tree mst hello-time SECONDS

Syntax Description

SECONDS Used to determine the time interval to send one BPDU at the

Designated Port. The range is 1 to 10.

Default SECONDS: 2

Command Mode Interface configuration

Usage Guideline The MSTP hello-time is only referenced in MSTP mode.

Both physical ports and port-channel interfaces are valid for this command.

Example This example shows how to configure the port hello-time to 1 for eth3.1.

Switch(config)#interface eth3.1
Switch(config-if)#spanning-tree mst hello-time 1 

Verify the settings by entering the show spanning-tree mst interface command.

spanning-tree mst priority

Use this command to configure the bridge priority value for the selected MSTP instance. Use the no form of the command to return the setting to the default setting.

spanning-tree mst INSTANCE-ID priority PRIORITY

no spanning-tree mst INSTANCE-ID priority

Syntax Description

INSTANCE-ID Specifies the MSTP instance identifier. Valid values are from 0 to 63. The number of supported MSTP instances is project dependent. Instance 0 represents the default instance, CIST.
PRIORITY	Specifies the bridge priority. The priority value must be divisible by 4096 and the range is from 0 to 61440.

Default PRIORITY: 32768

Command Mode Global configuration

Usage Guideline The number of supported MSTP instances is project dependent.

This priority has same definition as the "spanning-tree priority" on page 660 within the STP command set, but it can specify different priorities for each distinct MSTP instance.

Example

This example shows how to configure bridge priority for the MSTP instance 2.

Switch# configure terminal
Switch(config)#spanning-tree mst 2 priority 0
Switch(config)# end

Verify the settings by entering the show spanning-tree mst command.

spanning-tree port-priority

This setting is used to configure the value of the STP port priority on a specified port. It is only used for RSTP and STP version. Use the no form of this command to reset to the default priority.

spanning-tree port-priority PRIORITY

no spanning-tree port-priority

Syntax Description

PRIORITY Specifies the port priority; valid values are from 0 to 240.

Default PRIORITY: 128

Command Mode Interface configuration

Usage Guideline

The port priority and the port number together form the Port Identifier. It will be used in the computation of the port's role. This parameter is used only in RSTP / STP-Compatible mode only. A lower priority value (number) represents a higher priority.

This command is valid for physical ports or port-channel interfaces configuration modes.

An error message will be returned if the priority is not a valid value.

Example This example shows how to configure the port priority to 0 for eth3.7.

Switch(config)#interface eth3.7
Switch(config-if)#spanning-tree port-priority 0 

Verify the settings by entering the show spanning-tree interface command.

spanning-tree priority

This command configures the bridge priority and is only used for RSTP and STP versions. Use the no form of this command to restore to default setting.

spanning-tree priority PRIORITY

no spanning-tree priority

Syntax Description

PRIORITY The bridge priority and bridge MAC Address together form the Spanning-Tree Bridge-ID, which is an important factor in the Spanning-Tree Topology. The range is 0 to 61440.

Default PRIORITY: 32768

Command Mode Global configuration

Usage Guideline

Bridge Priority is one of the two parameters used to select the Root Bridge. The other parameter is the system's MAC address.

The bridge priority value must be divisible by 4096, and a lower priority value (number) represents a higher priority.

This configuration will take effect only when using STP version and RSTP mode. In MSTP mode, use the command "spanning-tree mst priority" on page 658 to configure the priority for an MSTP instance.

Example This example shows how to configure the STP bridge priority to 4096.

Switch(config)# spanning-tree priority 4096

Verify the settings by entering the show spanning-tree command

spanning-tree tcnfilter

To enable Topology Change Notification (TCN) filtering at the specific interface, use spanning-tree tcnfilter command at the interface mode. Use the no form of this command to disable TCN filtering.

spanning-tree tcnfilter

no spanning-tree tcnfilter

Syntax None

Default Disabled

Command Mode Interface configuration

Usage Guideline

Both physical ports and port-channel interfaces are valid for this command.

TCN filtering can be set to enabled or disabled. If set to enabled, it stops the port from propagating received topology change notifications and topology changes to other ports. This configuration takes effect on any spanning-tree mode types.

Example This example shows how to configure TCN filtering on eth3.7.

Switch(config)#interface eth3.7
Switch(config-if)#spanning-tree tcnfilter

Verify the settings by entering the show spanning-tree interface command.

spanning-tree transmit hold-count

This setting is used to limit the maximum BPDU transmission rate for every port.

spanning-tree transmit-hold-count VALUE

Syntax Description
VALUE	Specifies the value to restrict the numbers of BPDU transmitted on a port within the Hello Time period. The range is 1 to 10.

Default VALUE: 6

Command Mode Global configuration

Usage Guideline

The transmission of BPDU on a port is controlled by a counter. The counter is incremented on every BPDU transmission, and decremented once each second. The transmissions are paused for one second, if the counter reaches the transmit hold count. This parameter will be is used in common by STP, RSTP, and MSTP.Changing this parameter to a higher value may have a significant impact on CPU utilization, especially in MSTP mode. Lowering this parameter could slow convergence in some scenarios. We recommend that to not change the value from the default setting.

Example

This example shows how to configure the transmit-hold-count value.

Switch(config)# spanning-tree transmit-hold-count 5

Verify the settings by entering the show spanning-tree command.

speed

Use this command to configure the physical port interface speed/duplex setting.

speed {10|100|1000[master|slave]|auto}

Syntax Description
10 Specifies to set the port speed to transmit at 10 Mbps.
100 Specifies to set the port speed to transmit at 100 Mbps.
1000 Specifies to set the port speed to transmit at 1000 Mbps.copper port: If the speed is set to 1000 Mbps, then the port must be manually set as either a master or a slave port.fiber port (1000SX/LX): no-negotiation should be configured (i.e. auto-negotiation disable).
master	(1000 only) Manually sets a copper port to be the master port.
slave	(1000 only) Manually sets a copper port to be the slave port.
auto	Specifies to determine the speed through auto-negotiation with its linked partner.copper port: Specify to determine the speed via auto-negotiation with its linked partner.fiber port(1000SX/LX): auto-negotiation enable,auto-negotiation will be started to negotiate the clock and flow control.

Default It will be auto for 100TX and 1000TX.

It will be fixed to 1000 for 1000SX/LX.

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this configuration.

If the specified speed is not supported by the hardware, error messages will be returned.

1000SX/LX is always fixed to 1000 and full duplex.

For 1000SX/LX module, duplex command will not take effect.

Auto-negotiation will be enabled whether the speed is set to auto or duplex is set to auto. If the speed is set to auto, and duplex is set to fixed mode, then only the speed will be negotiated. The advertised capability will be the configured duplex mode combined with all possible speeds. If speed is to set to a fixed speed and duplex is set to auto, then only duplex mode is negotiated. The advertised capability will consist of both the full and half duplex mode combined with the configured speeds.

Before adding ports to a Port-Channel, verify that all settings are the same on these ports. Otherwise the ports in a Port-Channel with different settings will operate in an indeterminate manner.

In IEEE 802.3 (Clause 40) 1000BASE-T standard, Auto-Negotiation is defined as necessary. Although we still provide a command to disable auto-negotiation for 1000BASE-T, setting it to enabled is recommended to prevent an unexpected link status.

Example

This example shows how to configure interface eth3.24 to force the settings to a speed of 100Mbits and auto-negotiate to the duplex mode:

Switch(config)# interface eth3.24
Switch(config-if)# speed 100
Switch(config-if)# duplex auto

Verify the settings by entering the show interface command.

storm-control (Interface)

Use this command to configure the device to prevent storm attacks on a LAN. There are three traffic types, broadcast, multicast, and unicast (DLF). Use the no form of the command to disable the storm-control function.

storm-control {broadcast | multicast | unicast}

no storm-control {broadcast | multicast | unicast}

Syntax Description

broadcast Set Broadcast rate limiting

multicast Set Multicast rate limiting

unicast Set Unicast(DLF) rate limiting

Default Disabled (all storm types)

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this command.

Enter the "storm-control" command to enable Storm Control for a specific traffic type on the interface.

All packets are passed in default without storm control enabled. After enabling traffic storm control, if the storm-control action is to drop, then packets exceeding the level will be dropped. If the storm-control action is set to shutdown, then the interface will be shutdown whenever the packets exceed the threshold.

Examples

This example shows how to enable Broadcast storm control on interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# storm-control broadcast
Switch(config-if)# show storm-control interface broadcast
Interface Storm Action Type Threshold
eth3.1 Broadcast Drop pps 131072 

This example shows how to disable Broadcast storm control. on interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# no storm-control broadcast

Verify the settings by entering the show storm-control interface command.

storm-control action (Interface)

This command configures the action type for the Storm Control function. It is only used for two traffic types, broadcast and multicast. Use the no form of the command to return to the default settings.

storm-control {broadcast | multicast} action {drop | shutdown}

no storm-control {broadcast | multicast} action

Syntax Description

Broadcast Set Broadcast rate limiting

Multicast Set Multicast rate limiting

action drop To drop traffic on the port when a storm occurs.

action shutdown To shutdown the port when a storm occurs.

Default action drop

Command Mode Interface configuration

Usage Guideline Only physical port interfaces are valid for this command.

All packets are passed by default. After enabling traffic storm control, if storm-control action is drop, packets exceeding the level will be dropped. However if the storm-control action is set to shutdown, then the interface will be shutdown upon packets exceeding the level setting.

The Shutdown action is only available for broadcast and multicast storm control.

For unicast storm control, the software level is unable to identify unknown unicast (DLF) storm events due to the hardware chip being unable to support this function. Therefore, if unknown unicast packets exceed the set level, they will always be dropped.

Examples

This example shows how to configure Broadcast storm control action by setting a shutdown action on interface eth3.1. In this situation, the threshold level is not specified and the default threshold is 131072 PPS.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# storm-control broadcast action shutdown
Switch(config-if)# show storm-control interface broadcast
Interface    Storm    Action    Type    Threshold
eth3.1    Broadcast    shutdown    pps    131072 

This example shows how to configure Broadcast storm control action and level. It assigns the shutdown action and rising threshold to 900 pps for interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# storm-control broadcast action shutdown
Switch(config-if)# storm-control broadcast level pps 900
Switch(config-if)# show storm-control interface broadcast
Interface    Storm    Action    Type    Threshold
eth3.1    Broadcast    shutdown    pps    900 

This example shows how to return to the default setting for Broadcast storm control action on interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# no storm-control broadcast action 

Verify the settings by entering the show storm-control interface command.

storm-control level (Interface)

This command configures the rising threshold for Storm Control function. Use no command to return the default settings.

storm-control {broadcast | multicast | unicast} level {LEVEL | pps PPS}

no storm-control {broadcast | multicast | unicast} level

Syntax Description
Broadcast Set Broadcast rate limiting
Multicast Set Multicast rate limiting
Unicast Set Unicast(DLF) rate limiting
level LEVEL	Specifies the rising threshold as a percentage (0 to 100) of total bandwidth of the port.
level pps PPS	Specifies the rising threshold as a rate in packets per second at which traffic is received on the port. The range of PPS is from 1 to 148810 (for 100 Mbps). For 1000 Mbps, the range is 1 to 1488100 and so on.

Default level pps PPS: 131072 packets per second

Command Mode Interface configuration

Usage Guideline Only a physical port interface is valid for this command.

The precise suppression level, as a percentage (0 to 100) of total bandwidth of specific port interface, is not able to be calculated exactly. That is, the current calculation formula assumes that the packet size of all incoming packets is 1512 bytes.

Examples This example shows how to configure Broadcast storm control LEVEL by pps mode. It assigns the pps threshold level of interface eth3.1 for incoming broadcast packets to 500 and drops the packets that exceed the threshold.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# storm-control broadcast level pps 500
Switch# show storm-control interface broadcast
Interface    Storm    Action    Type    Threshold
eth3.1    Broadcast    Drop    pps    500 

This example shows how to configure the Broadcast storm control LEVEL by percentage mode. It assigns the percentage threshold level of interface eth3.1 for incoming broadcast packets to 90 and drops the packets that exceed the threshold.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# storm-control broadcast level 90
Switch(config-if)# show storm-control interface broadcast
Interface Storm Action Type Threshold
eth3.1 Broadcast Drop percentage 90 

This example shows how to return to the default setting for Broadcast storm control level on interface eth3.1.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# no storm-control broadcast level
Switch(config-if)# show storm-control interface broadcast
Interface Storm Action Type Threshold
eth3.1 Broadcast Drop pps 131072 

Verify the settings by entering the show storm-control interface command

storm-control timer (Global)

Use this command to configure the timer options. The timers are used to implement a storm control shutdown action. Use the no form of the command to return the default settings.

storm-control { time-interval SECONDS | countdown SECONDS | auto-recover-time SECONDS }

no storm-control { time-interval | countdown | auto-recover-time}

Syntax Description
time-interval SECONDS	Software will monitor the counter of received broadcast or multicast packets periodically based on this user defined interval. The range of the checking interval (SECONDS) is from 5 to 30 seconds.
countdown SECONDS	If a port is in shutdown mode and this timer runs out, the port will be placed in shutdown forever mode. If the value is '0' the function of shutdown forever is disabled.The valid range for this setting is 0, 180 - 1800 seconds.
auto-recover-time SECONDS	Specifies the time that a port is in shutdown forever mode, from which it can be automatically recovered. When the value is set to '0' a port cannot recover from forever shutdown.The valid range for this setting is 0, 300 - 1800 seconds.

Default time-interval SECONDS: 5 seconds

countdown time SECONDSr: 0 seconds

auto-recover-time SECONDS: 0 seconds

Command Mode Global configuration

Usage Guideline

If the action option is set to shutdown, the port will enter shutdown mode (i.e. the port is blocked) when the threshold is exceeded. If the traffic rate has been higher than the threshold for a configurable period (countdown timer), the port will enter into shutdown forever mode (i.e. the port is disabled and the status is link-down).

When a port is in "shutdown mode", before the port enters into shutdown forever mode it can recover and the port will exit the shutdown mode. if the receiving rate is higher than the falling threshold (80% of the threshold), and lower than the threshold, the port will exit the shutdown mode after a period of time and the timer will then be half of the countdown timer.

Furthermore, if the receiving rate is lower than the falling threshold the port will be recovered immediately.

If the auto_recover_time value is non-zero, the port will be automatically recovered to the normal situation after the recovery time. Otherwise, the port will

not be automatically recovered but it can be manually recovered by using the "no shutdown" command.

Examples

This example shows how to configure the time-interval. The count of received broadcast or multicast packets is monitored every 15 seconds.

Switch# configure terminal
Switch(config)# storm-control time-interval 15
Switch(config)#

This example shows how to configure the countdown timer. When the threshold is exceeded, the port will enter into the shutdown mode. If the traffic rate has been higher than the threshold during the count of 180 seconds, then the port will be changed to shutdown forever mode.

Switch# configure terminal
Switch(config)# storm-control time-interval 15
Switch(config)# storm-control countdown 180
Switch(config)#

This example shows how to configure the auto-recovery-timer. When a port is in shutdown forever mode, it will be automatically recovered to normal operation after 300 seconds.

Switch# configure terminal
Switch(config)# storm-control time-interval 15
Switch(config)# storm-control countdown 180
Switch(config)# storm-control auto-recover-time 300
Switch(config)#

Verify the settings by entering the show storm-control command

subnet-base ( VLAN )

Use the subnet command to specify a subnet-based VLAN ID assignment for un-tagged incoming packets. Use the no form of this command to remove a subnet-based VLAN ID entry setting.

subnet-base { NETWORK-PREFIX NETWORK-MASK | NETWORK-PREFIX / PREFIX-LENGTH }

no subnet-base { NETWORK-PREFIX NETWORK-MASK | NETWORK-PREFIX / PREFIX-LENGTH }

Syntax Description
NETWORK-PREFIX NETWORK-MASK	The network prefix and the network mask specify the destination network in the form of A.B.C.D xxx.xxx.xxx.xxx.
NETWORK-PREFIX/PREFIX-LENGTH	The network prefix and the prefix length specify the destination network in the form of A.B.C.D/x.

Default Not configured

Command Mode VLAN configuration

Usage Guideline

A subnet VLAN entry is an IP subnet-based VLAN classification rule. If an untagged or priority-tagged IP packet is received on a port, its source IP address will be used to match the subnet VLAN entries. If the source IP matches the subnet of an entry, the packet will be classified to the VLAN of this entry. The number of subnet-based VLAN entries is project dependent.

Example This example shows how to create a subnet-based VLAN entry.

Switch(config)#vlan 100
Switch(config-vlan)#subnet-base 20.0.1.0/8
Switch(config-vlan)#subnet-base 192.0.1.0/8
Switch(config-vlan)#end 

Verify the settings by entering the show vlan command.

subnet-mask

Use this command to configure the subnet mask for a DHCP address pool of the DHCP Server. Use the no form of this command to restore the configuration of a subnet mask to the default mask 255.255.255.0.

subnet-mask MASK

no subnet-mask

Syntax Description

MASK The bit combination of the addresses, in the DHCP address pool, determines which part of the address refers to the network or subnet and which part refers to the host. It is in the format of xxx.xxx.xxx.xxx in which xxx is the number range from 0 to 255 where all of its binary bits must be continuous.

Default MASK: 255.255.255.0

Command Mode DHCP pool configuration

Usage Guideline This command configures the subnet mask that the DHCP server is uses to assign to DHCP clients. It is valid for the associated DHCP address pools only.

Examples The following is an example of configuring 255.0.0.0 as the DHCP pool's subnet mask.

switch#configure terminal
switch(config)#ip dhcp pool pool1
switch(config-dhcp)#subnet-mask 255.0.0.0
switch(config-dhcp)# 

switchport port-security

Use this command to configure port security setting of a specified port interface to restrict the allowable number of users that can gain access to the port.

Use the no form of the command to disable the port security, or delete user-defined secure MAC address.

switchport port-security [maximum VALUE | violation {protect | shutdown} | mode {permanent | delete-on-timeout}]

no switchport port-security

Syntax Description
maximum VALUE	(Optional) Specifies the maximum allowable number of secure MAC addresses (users) The range for the VALUE is project dependent.
violation {protect | shutdown}	(Optional) Specifies the action to be taken when a security violation is detected:protect:Drops all the packets from the insecure hosts at the port-security process level but does not increment the security-violation count.shutdown: Shutdown the port if there is a security violation.
mode { permanent | delete-on-timeout }	Specifies the port security mode:The different option keywords are described below:permanent: This mode defines that all learnt MAC addresses will not be purged unless a user deletes those entries manually.delete-on-timeout: Setting this mode defines that all learnt MAC addresses will be purged when an entry is aged-out or a user deletes these entries manually.

Default Disabled

maximum VALUE: 1

mode: delete-on-timeout

violation: shutdown

Command Mode Interface configuration at Privilege level 15

Global configuration with Privilege level 15 (only for a no port-security command).

Usage Guideline The valid interface for this configuration is a physical port.

The VLAN does not need to exist for the command to succeed.

When the mode is permanent, the learned entries will be stored automatically and restored after a reboot.

If a port-security command is issued without specifying any arguments, then the port security feature will be enabled with the default settings for the maximum and mode parameters.

As the port-security state is changed from disabled to enabled or vice versa, the auto-learned MAC entries are cleared,

If no arguments are specified when issuing the no port-security command, then the port security feature will be disabled.

If the no port-security command, without any options, is applied in global configuration mode, then it will set the port-security to disabled for all ports.

When the mode setting is changed, the addresses, both originally learned and configured entries on the port, will be cleared.

When the maximum setting is changed, the learned address will remain unchanged when the maximum number increases; the learned address will be cleared when the number is decreased.

A port-security enabled port has the following restrictions.

- The port security function cannot be enabled simultaneously with dot1x which provides more advanced secure capability.

- A port which is in private-vlan mode can not enable port-security.

- If a port is specified as the destination port for the mirroring feature, then the port-security function can not be enabled.

- If a port is the member port of a channel group, then it cannot be enabled with the port-security function.

The system will periodically check whether the secured count is changed within 1 minute intervals.

When a security violation is detected, one of the following actions occurs:

- Protect - When the number of port-secure addresses reaches the maximum limit that is allowed on the port, the packets with unknown source addresses are dropped until they have a sufficient number of secure MAC addresses manually removed.

- Shutdown - The interface is error disabled when a security violation occurs

The security-violation count is accumulated and based on the different number of MAC addresses which violate the secured port.

Note- When a secure port is in the error-disabled state, it can be manually re-enabled by entering no shutdown commands in interface-configuration mode

The no form of the command can be used in global configuration so that one command can use then disable port-security at all ports.

Examples

This example shows how to configure port security in permanent mode with maximum number 5.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# switchport port-security mode permanent
Switch(config-if)# switchport port-security maximum 5
Switch(config-if-range)# end 

This example shows how to set the action to be taken when a security violation is detected:

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# switchport port-security violation restrict
Switch(config-if-range)# end 

Verify the settings by entering the show port-security command

synchronization

To enable the synchronization between Border Gateway Protocol (BGP) and an external Interior Gateway Protocol (IGP) system, use the synchronization command. To advertise a network route without waiting for the IGP, use the no form of this command.

synchronization

no synchronization

Syntax None

Default Disabled

Command Mode Router configuration

Address family configuration

Usage Guideline

Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. By default, synchronization between BGP and an IGP is disabled to allow the switch to advertise a network route without waiting for route validation from the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems.

Use the synchronization command if the other routers in an autonomous system do not speak BGP.

Example This example shows how to enable synchronization in AS 65121.

Switch(config)# router bgp 65121
Switch(config-router)# synchronization
Switch(config-router)# 

system-name

Use this command to configure the system name information. Use the no system-name command to set the system name to a null string.

system-name TEXT

no system-name

Syntax Description

TEXT Specifies the string that describes the system name information. The maximum length is 128 characters. The syntax is a general string that allows space.

Default Not configured

Command Mode Global configuration

Usage Guideline Configure the system name information on the switch.

Example

This example shows how to set up the system name information with the string DGS-6604 Chassis Switch.

Switch(config)# system-name DGS-6604 Chassis Switch

Verify the settings by entering the show snmp-server command.

telnet

The telnet command is used to login in another device that supports the TELNET protocol.

telnet {IP-ADDRESS | IPV6-ADDRESS} [TCP-PORT]

Syntax Description

IP-ADDRESS IPv4 address of the host.

IPV6-ADDRESS IPv6 address of the host.

TCP-PORT Specifies the The TCP port number that telnet should use. TCP ports are numbered between 1 and 65535. The "well-known" TCP port for the TELNET protocol is 23.

Default TCP-PORT: 23

Command Mode Management interface or User EXEC

Usage Guideline

This command starts the telnet client function and can be used to communicate with another device using the TELNET protocol. The telnet command is allowed under both management interface modes and User EXEC mode. For User EXEC mode, the outgoing physical interfaces does not include the management interface. To use telnet in order to login to a device which can be reached only through the management port, use the telnet command under management interface mode by entering the mgmt-if command first.

The Telnet software supports special Telnet commands in the form of Telnet sequences that map generic terminal control functions to operating system-specific functions. To issue a special Telnet command, enter the escape sequence and then a command character. The default escape sequence is Ctrl-_ (press and hold the Ctrl and Shift keys and the '-' key, the underscore). The special Telnet commands will be displayed as follows:

Supported commands are:

e - terminate the current Telnet session

If any other key is pressed, the terminal will return to the original active Telnet session.

Use the lowercase letter, 'e' to exit from the telnet software.

Several concurrent Telnet sessions can be opened on the switch system and each open Telnet session can have its own telnet client software concurrently supported.

Use "ctrl-c" to stop the connection if telnet is connecting but before the session connection is made.

Examples

The following example shows how to telnet to the IP address 20.74.19.200 with default port 23 (optional port parameter is provided). The IP address of 20.74.19.200 is the management interface which allows users to log in.

Switch#telnet 20.74.19.200
Connecting to 20.74.19.200 ...
Connected to 20.74.19.200.
Escape character is 'Ctrl-_'.
Telnet connecting ...
Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch> 

The following example first shows a telnet session connecting to IP address 20.74.19.200 with default port 23, but the connection fails. The example then retries using TCP port 3500 instead at the same IPAddress 20.74.19.200 which is the management interface and logs in successfully.

Switch#telnet 20.74.19.200
Connecting to 20.74.19.200 ...
Could not open connection to the host, on port 23: Connection refused
Switch#
Switch#telnet 20.74.19.200 3500
Connecting to 20.74.19.200 ...
Connected to 20.74.19.200.
Escape character is 'Ctrl-_'.
Telnet connecting ...
Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch> 

The following example shows a telnet session attempting to connect to IP address 10.74.19.2, but the IP adress is not reachable.

Switch#telnet 10.74.19.2
Connecting to 10.74.19.2 ...
Could not open connection to the host, on port 23: Network is unreachable
Switch# 

The following example shows how to enter the management interface mode and telnet to the IP address 20.74.19.200 with default port 23. Then the example shows how to exit the telnet session by entering the escape sequence : Ctrl-_ and then followed by the 'e' key.

Switch#configure terminal
Switch(config)#mgmt-if
Switch(mgmt-if)#telnet 20.74.19.200
Connecting to 20.74.19.200 ...
Connected to 20.74.19.200.
Escape character is 'Ctrl-_'.
Telnet connecting ...
Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch>
Supported commands are:
e - terminate the current Telnet session
If other key is pressed, the terminal will return to the original active Telnet session.
The telnet is disconnected.
Switch(mgmt-if) 

The following example show how to telnet to the IP address 20.74.19.200 with default port 23, then enter the escape sequence : Ctrl-_ and press any other key returning to the telnet session.

Switch#telnet 20.74.19.200
Connecting to 20.74.19.200 ...
Connected to 20.74.19.200.
Escape character is 'Ctrl-_'.

Telnet connecting ...
Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.0029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch>
Supported commands are:
e - terminate the current Telnet session
If other key is pressed, the terminal will return to the original active Telnet session.

continuing...
Switch> 

The following example show how to telnet to the IPv6 address

2001:e10:5c00:2::101:253 using default port 23, then enter the escape sequence

: Ctrl-_ and press any other key returning to the telnet session.

Switch#telnet 2001:e10:5c00:2::101:253
Connecting to 2001:e10:5c00:2::101:253 ...
Connected to Telnet connecting ...
Escape character is 'Ctrl-_'.

Telnet connecting ...

Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch>
Supported commands are:
e - terminate the current Telnet session
If other key is pressed, the terminal will return to the original active Telnet session.

continuing...
Switch> 

The following example show how to telnet to the IPv6 address 2001:e10:5c00:2::101:253 with specific port 3500.

Switch#telnet 2001:e10:5c00:2::101:253 3500
Connecting to 2001:e10:5c00:2::101:253 ...
Connected to Telnet connecting ...
Escape character is 'Ctrl-_'.
Telnet connecting ...
Chassis-based High-Speed Switch
Command Line Interface
Firmware: 1.00.029
Copyright (c) 2010 D-Link Corporation. All rights reserved.
Switch> 

terminal length

This command configures the number of lines to be displayed in the monitor output. The terminal length command will only affect the current session. If option default is specified, the display length will be applied to all sessions.

terminal length LINES [default]

no terminal length

Syntax Description
LINES	Number of lines to display on the screen; valid values are from 0 to 512.
default (Optional) Sets the number of lines in the terminal display for the current administration session and all other sessions subsequently opened (Privileged EXEC only).

Default LINES: 24

Command Mode User EXEC

Usage Guideline	When the terminal length is specified to 0, the display will not stop until it reaches the end of the display.
	If terminal length is specified to a value other than 0, for example 50, then the display will stop for every 50 lines. Terminal length is to set the number of lines displayed on the current terminal screen. This command also takes effect tfor both Telnet and SSH sessions automatically. .
	Output from a single command that overflows a single display screen is followed by the --More-- prompt. At the --More-- prompt, press Ctrl-C, q, or Q to interrupt the output and return to the prompt, press the Spacebar to display an additional screen of output, or press Return to display one more line of output.
	Setting theterminal lengthto 0 turns off the scrolling stop feature and causes the entire output to display at once (continuously).
	Unless thedefaultkeyword is specified, changing the terminal length value applies only to the current session. When changing the value in a session, the value applies only to that session. When using the no form of this command, the number of lines in the terminal display is reset to the default of 24.
	Thedefaultkeyword is available in Privileged EXEC mode only.
Example	This example shows how to change the lines to be displayed in a screen to 60.

Switch# terminal length 60

terminal timeout

Use this command to setup a timeout value, which upon its expiry, will auto-logout the terminal session.

terminal timeout {never| 2_minutes| 5_minutes| 10_minutes| 15_minutes}

Syntax Description
never Specifies that the terminal session will never timeout.(the default setting).
2_minutes	Specifies that when the session is idle over 2 minutes, the terminal will auto logout.
5_minutes	Specifies that when the session is idle over 5 minutes, the terminal will auto logout.
10_minutes	Specifies that when the session is idle over 10 minutes, the terminal will auto logout.
15_minutes	Specifies that when the session is idle over 15 minutes, the terminal will auto logout.

Default never

Command Mode Privilege EXEC

Usage Guideline This timer specifies the length of the session idle time allowed. After this idle timer expires then the terminal session will be auto-logged out. The timer operates regardless of whether the session is established by direct serial connection, telnet connection, or SSH connection.

Examples This example shows how to setup the terminal session to never timeout.

Switch# terminal timeout never

Verify the settings by entering the show running-config command.

terminal width

This command sets the number of character columns on the terminal screen for the current lines displayed in a session. The terminal width command will only affect the current session. If option default is specified, the display length will be applied to all subsequent sessions and will be stored in the system configuration (start-up config) to retain the setting for the next system restart.

terminal width CHARACTERS [default]

no terminal width

Syntax Description
CHARACTERS	Specifies the number of characters to display on the screen; valid values are from 80 to 255.
Default	default (Optional) Sets the number of columns in the terminal display screen for the current administration session and all other subsequent sessions. This setting can be saved into the system configuration file (start-up config) and retained for the next system restart (Privileged EXEC only).

Default CHARACTERS: 80 characters

Command Mode User EXEC

Usage Guideline

By default, the switch system terminal provides a screen display width of 80 characters. Reset this value for the current session if it does not meet the needs of required for the terminal display.

Unless the default keyword is used, a change to the terminal width value applies only to the current session. When the value in a session is changed, the value applies only to that session. When the no form of this command is used, then the number of lines in the terminal display screen is reset to the default of 80 characters.

For a remote CLI session access such as Telnet, the auto negotiation result of terminal width will take precedence over the global configuration if the negotiation is successful. Otherwise, the global configuration takes effect. After that, adjust the line and width for the current session (this change will not be saved in the system configuration for the next system restart). This will not affect other sessions or the global configuration.

When exiting from the current session, the values of the terminal line and width is reset back to the system configuration values (it may not be same as the default setting, 80 characters; it is dependant on the current system configuration setting).

Examples

The following example shows how to adjust the current session terminal width to 120 characters. The system terminal setting is not affected by the change. That is because the adjustment is only applied to the current session.

Switch#terminal width 120

The following example shows how to adjust the terminal session width to 120 as the system configuration setting for terminal width. This setting will affect all subsequently opened terminal sessions.

Switch#terminal width 120 default

timers

Use this command to configure the RIP network timers. To restore the default timers use the default form of this command.

timers {update SECONDS | invalid SECONDS | flush SECONDS}

default timers {update | invalid | flush}

Syntax Description
update SECONDS	Specifies the rate (in seconds) at which updates are sent. This is the fundamental timing parameter of the RIP routing protocol. The default is 30 seconds. The range is 5 to 2147483647 (signed long).
invalid SECONDS	Specifies the Interval of time (in seconds) after which a route is declared invalid. It should be at least three times the value of the update argument. A route becomes invalid when there is an absence of updates that refresh the route. The route is marked inaccessible and advertised as unreachable. However, the route is still used for forwarding packets. The default is 180 seconds. The range is 5 to 2147483647.
flush SECONDS	Specifies the amount of time (in seconds) that must pass before the route is removed from the routing table. The default is 120 seconds. The range is 5 to 2147483647.

Default update SECONDS: 30

invalid SECONDS: 180

flush time SECONDS: 120

Command Mode Router configuration

Usage Guideline The basic timing parameters for RIP are adjustable. RIP executes a distributed, asynchronous routing algorithm, therefore these timers must be the same for all routers and access servers in the network.

Example The following example shows how to configure the update timer to 60 seconds:

Switch# configure terminal
Switch(config)# router rip
Switch(config-router)# timer update 60 

Verify the settings by entering the show ip protocols command.

timers basic

To configure update, timeout, and garbage-collection timers for an IPv6 RIP routing process, use the timers basic command. To return the timers to their default values, use the no form of this command.

timers basic {update / timeout | garbage-collection}

no timers basic

Syntax Description
update	Specifies the interval of time in seconds at which updates are sent. This is the fundamental timing parameter of the RIP IPv6 routing protocol. The value is from 5 to 2147483647.
timeout	Specifies the interval of time in seconds after which a route is declared invalid. The route becomes invalid when there is an absence of updates that refresh the route. However, the route is still used for forwarding packets. The value is from 5 to 2147483647.
garbage-collection	Specifies the amount of time in seconds that must pass from when a route becomes invalid until the route is removed from the routing table. The value is from 5 to 2147483647.

Default update SECONDS: 30

timeout SECONDS: 180

garbage-collection SECONDS: 120

Command Mode Router configuration

Usage Guideline	The timers basic command is similar to the command "timers" on page 688.
	Use the update argument to set the time interval between RIP routing updates. If no route update is received for the time interval specified by the timeout argument, the route is considered unreachable. The use of a timeout interval is not recommended for RIP because it can introduce long delays in convergence.
	Use the garbage-collection argument to specify the time interval between a route being considered invalid and the route being purged from the routing table.
	The basic timing parameters for IPv6 RIP are adjustable. IPv6 RIP is executing a distributed, asynchronous routing algorithm, therefore it is important that these timers be the same for all routers and access servers in the network.
Examples	The following example (on the next page) sets updates every 5 seconds. If a route is not heard from in 15 seconds, the route is declared invalid. Assuming no updates, the route is flushed from the routing table 30 seconds after the end of the hold-down period.

Switch > enable
Switch # configure terminal
Switch (config) # router ipv6 rip
Switch (config-router)# timers basic 5 15 30 

timers bgp

Use this command to adjust BGP network timers. Use the no form of this command to restore the timers to the default value.

timers bgp KEEP-ALIVE [ HOLD-TIME ]

no timers bgp

Syntax Description
KEEP-ALIVE	Specifies the frequency, in seconds, with which the switch sends KEEPALIVE messages to its BGP peer. The range is from 0 to 65535.
HOLD-TIME	(Optional) Specifies the interval, in seconds, after not receiving a KEEPALIVE message that the switch declares a BGP peer dead. The range is from 0 to 65535.

Default KEEP-ALIVE: 60 seconds

HOLD-TIME: 180 seconds

Command Mode Router configuration.

Usage Guideline

The suggested default value for the KEEPALIVE is one third (1/3) of the HOLDTIME. The timers configured for a specific neighbor or peer group (by the command "neighbor timers" on page 333) overrides the timers configured for all BGP neighbors using thetimers bgpcommand.When the minimum acceptable HOLD-TIME is configured on a BGP router, a remote BGP peer session is established only if the remote peer is advertising a HOLD-TIME that is equal to, or greater than, the minimum acceptable HOLD-TIME interval. If the minimum acceptable HOLD-TIME interval is greater than the configured HOLD-TIME, the next time the remote session tries to establish, it will fail and the local router will send a notification stating unacceptable hold time.

Example This example shows how to change the KEEP-ALIVE timer to 50 seconds and the HOLD-TIME timer to 150 seconds:

Switch(config)# router bgp 65100 Switch(config-router)# timer bgp 50 150

time-range

Use this command to enter the time range configuration mode to define a time range. Use the no form of the command to delete a time range.

time-range NAME

no time-range NAME

Syntax Description
NAME	Specifies the name of the time-range profile to be configured. It can accept up to 32 characters. The syntax is a general string that does not allow space.

Default None

Command Mode Global configuration

Usage Guideline	Use this command to enter the time range configuration mode before using the command "periodic" on page 348 to specify the time period.
	If time-range is used by access-list rules, it cannot be deleted and an error message will be shown as below:Warning! The time-range can not be deleted because it is in use
Examples	This example shows how to enter the time range configuration mode for the time-range profile, namedtrange1.

Switch(config)# time-range trangel

This example shows how to remove time-range profile, named oftime, which has been associated to an IP access-list, Sales.

Switch(config)# no time-range of time Warning! The time-range can not be deleted because it is in use.

Verify the settings by entering the show time-range command.

traceroute

To display a hop-by-hop path through an IP network from the switch to a specific destination host, use the traceroute command.

traceroute [OPTIONS] { IP-ADDRESS | IPV6-ADDRESS}

Syntax Description

OPTIONS (Optional) the option can be any combination of the following parameters:

-w WAIT_TIME

Optionally used to specify the amount of time (in seconds) that traceroute will wait for an ICMP response message. The allowed range for WAIT_TIME is from 1 to 300 seconds.

-i INITIAL_TTL

Optional setting that causes traceroute to send ICMP datagrams with a TTL value equal to INITIAL_TTL instead of the default TTL of 1. This option causes traceroute to skip processing for hosts that are less than INITIAL_TTL hops away.

-m MAX_TTL

Optional setting used to specify the maximum TTL value for outgoing ICMP datagrams. The allowed range for MAX_TTL is from 1 to 255.

-p DEST_PORT

Optionally used to specify the base UDP destination port number used in traceroute datagrams. This value is incremented each time a datagram is sent. The allowed range for DEST_PORT is from 1 to 65535. Use this option in the unlikely event that the destination host is listening to a port in the default traceroute port range.

-q NQUERIES

Optionally used to specify the number of datagrams to send for each TTL value. The allowed range for NQUERIES is from 1 to 1000.

-s PACKET_SIZE

Optionally used to specify the number of bytes in addition to the default of 40 bytes, of the outgoing datagrams. The allowed range is from 0 to 1420.

-t TOS

Optionally used to specify the ToS to be set in the IP header of the outgoing datagrams. The allowed range for TOS is from 0 to 255.

IP-ADDRESS

IP address in dot notation (a.b.c.d) of the destination host.

IPV6-ADDRESS IPv6 address of the system to discover.

Default

Entering the traceroute HOST command without options sends three 40-byte ICMP datagrams with an initial TTL of 1, a maximum TTL of 30, a timeout period of 5 seconds, and a ToS specification of 0 to the destination UDP port number 33434. For each host in the processed path, the initial TTL for each host and the destination UDP port number for each packet sent are incremented by one.

Command Mode Management interface mode or User EXEC

Usage Guideline

To interrupt traceroute after the command has been issued, press Ctrl-C.

The traceroute command uses the TTL field in the IP header to cause routers and servers to generate specific return messages. traceroute starts by sending a UDP datagram to the destination host with the TTL field set to 1. If a router finds a TTL value of 1 or 0, it drops the datagram and sends back an ICMP time-exceeded message to the sender. The traceroute facility determines the address of the first hop by examining the source address field of the ICMP time-exceeded message.

To identify the next hop, traceroute again sends a UDP packet but this time with a TTL value of 2. The first router decrements the TTL field by 1 and sends the datagram to the next router. The second router sees a TTL value of 1, discards the datagram, and returns the time-exceeded message to the source. This process continues until the TTL is incremented to a value large enough for the datagram to reach the destination host (or until the maximum TTL is reached).

To determine when a datagram has reached its destination, traceroute sets the UDP destination port in the datagram to a very large value that the destination host is unlikely to be using. When a host receives a datagram with an unrecognized port number, it sends an ICMP port unreachable error to the source. This message indicates to the traceroute facility that it has reached the destination.

Use the TOS option to see if different types of service cause routes to change.

Note : The specified OPTIONS can be any combination of each parameters. However, the parameters must be specified in the alphabetical order and upper case options are ahead of lower case options (similar to the PING command).

Examples

This example shows how to traceroute the host with IP address "172.50.71.123".

Switch# traceroute 172.50.71.123
traceroute to 172.50.71.123 (172.50.71.123), 30 hops max, 40 byte packets
1 172.50.71.123 (172.50.71.123) 0.847 ms 0.344 ms 0.376 ms 

Switch# 

Display Field Descriptions

The following table describes the fields in the traceroute command output.

Display Field Description

1 Indicates the sequence number of the router in the path to the host.
172.50.71.123 Host name of this router.
(172.50.71.123) Internet address of this router.
30 hops max, 40 byte packets	Maximum TTL value and the size of the ICMP datagrams being sent.
0.847 ms 0.344 ms 0.376 ms	Total time (in milliseconds) for each ICMP datagram (three ICMP probes per TTL for this case) to reach the router or host plus the time it took for the ICMP time-exceeded message to return to the host.

This example shows how to traceroute the host with IPv6 address "2001:238:f8a:77:7c10:41c0:6ddd:ecab".

Switch# traceroute 2001:238:f8a:77:7c10:41c0:6ddd:ecab
traceroute to 2001:238:f8a:77:7c10:41c0:6ddd:ecab
(2001:238:f8a:77:7c10:41c0:6ddd:ecab), 30 hops max, 40 byte packets
1 2001:238:f8a:77:7c10:41c0:6ddd:ecab
(2001:238:f8a:77:7c10:41c0:6ddd:ecab) 0.847 ms 0.344 ms 0.376 ms
Switch# 

traffic-segmentation forward

Use this command to segment or restrict the flooding domain of a port to a set of specified ports. Use the no form of this command to remove some ports from the forwarding domain.

traffic-segmentation forward interface INTERFACE-ID [, | -]

no traffic-segmentation [ forward [ interface INTERFACE-ID [, | -] ] ]

Syntax Description
forward Specifies the list of egress ports as the forwarding domain.
interfaceINTERFACE-ID	Specifies the ID of an interface as the allowable interfaces to go to. The allowed interfaces include physical ports and port channels.
, (Optional) Specifies a series of interfaces, or separate a range of interfaces from a previous range. No space before and after the comma.
- (Optional) Specifies a range of interfaces. No space before and after the hyphen.

Default No segmentation configured. All ports are in the forwarding domain.

Command Mode Interface configuration

Usage Guideline

Only physical ports and port channel interfaces are valid for this configuration.

Traffic segmentation allows a VLAN to be further divided into smaller groups of ports to provide increased security support. The flooding domain for this feature is determined by both the VLAN domain and traffic segmentation domains. This means the outgoing ports of the flooding member should be concurrently part of the VLAN and traffic segmentation.

The command traffic-segmentation forward interface can be entered multiple times. The interfaces will be appended into the flowing domain. Similarly, this occurs when using the no traffic-segmentation forward interface command. The no form of the command will remove the specified interface from the traffic-segmentation forward member list.

The traffic segmentation member list can be comprised of different interface types., for example eth3.1 can be with a port-channel in the same traffic segmentation list. If the forwarding interfaces specified by the command include a port-channel, all the member ports of this port-channel will be the forwarding interface in operation. If the specified port of the traffic-segmentation command is a member of a port-channel, the command will return an error message because of the different interface types.

Since a port channel is an allowed interface in the member list, traffic segmentation is on the top link aggregation module. When any traffic segment member (physical interface) is configured to be a potential aggregated link port, it should be marked as an inactive interface and it will be treated as not existing in the forward interface list. Vice versa, if any port is removed from link aggregation, the removed port should be reset back to its default factory setting.

When entering no traffic-segmentation without any keywords, then all ports will become the forwarding port. When entering no traffic-segmentation forward without the interface keyword, then all ports in forwarding port list will be removed. That is, the forwarding domain of the configured interface is empty.

Examples This example shows how to configure traffic segmentation. It restricts the flooding domain of eth3.1 to a set of ports, which are eth4.1 - 4.6.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# traffic-segmentation forward interface eth4.1-4.6
Switch(config-if)# exit 

This example shows how to remove some ports from the forwarding port list. eth4.2-3 from the forwarding port list.

Switch# configure terminal
Switch(config)# interface eth3.1
Switch(config-if)# no traffic-segmentation forward interface eth4.2-4.3
Switch(config-if)# exit 

Verify the settings by entering the show traffic-segmentation command.

trunk allowed-vlan

Use the trunk allowed-VLAN configuration command to set the VLAN characteristic. It sets the allowable VLANs that can receive and send traffic on the interface in tagged format. Use the no trunk allowed-VLAN command to remove a tagged member port from a specified VLAN.

trunk allowed-vlan VLAN-ID [, | - ]

no trunk allowed-vlan [ VLAN-ID [, | - ] ]

Syntax Description

VLAN-ID Specifies the VLAN to add or remove tagging members to/from it.

, (Optional) Specifies a series of VLANs, or separate a range of VLANs from a previous range. No space before and after the comma.

- (Optional) Specifies a range of VLANs. No space before and after the hyphen.

Default Not configured

Command Mode interface configuration

Usage Guideline	The valid interfaces for this command can be either physical ports or port-channels.
	By setting the trunk allowed-vlan command multiple times, a port can become a tagged member port of multiple VLANs.
	If the VLAN does not exist, an error message will return to indicate it.
	When this command is applied, the port will change to trunk mode. If the mode is changed, the setting for the previous mode will disappear.
	When using the no trunk allowed-vlan command without specifying a VLAN-ID, then the port will have its tagging memberships removed from all VLANs.
Example	This example shows how to set an interface eth3.1 to a tagged member of VLAN 1000.

Switch(config)# interface eth3.1
Switch(config-if)# trunk allowed-vlan 1000 

Verify the settings with the show vlan interface command.

tunnel destination

Use the tunnel destination configuration command to add the destination IPv4 address for the tunnel interface. Use the no tunnel destination configuration command to remove it.

tunnel destination { IPv4-ADDRESS }

no tunnel destination

Syntax Description

IPv4-ADDRESS Specifies the IPv4 address as the destination address for the tunnel.

Default None

Command Mode Interface configuration

Usage Guideline

Use these commands to configure the destination IPv4 address for a tunnel interface.

Tunnel interfaces are valid for this command. Only manually configured tunnels need to set the tunnel destination.

Examples

This example shows how to add the destination IPv4 address for the tunnel interface 2

Switch(config)# interface tunne 2
Switch(config-if)#tunnel destination 10.0.0.1
Switch(config-if)#

This example shows how to remove the destination IPv4 address for the tunnel interface 2

Switch(config)# interface tunne 2
Switch(config-if)# no tunnel destination
Switch(config-if)#

Verify the settings by entering the show interface command.

tunnel mode

Use the tunnel mode ipv6ip configuration command to manually specify an IPv6 configured tunnel. The optional parameter 6to4 or isatap means that tunnel type is 6to4 or ISATAP. Use the no form of the command to remove the IPv6 specification.

tunnel mode ipv6ip [6to4 | isatap]

no tunnel mode

Syntax Description

6to4 Specifies the IPv6 tunnel is a 6to4 tunnel type.

isatap Specifies the IPv6 tunnel type is a ISATAP tunnel type.

Default None

Command Mode Interface configuration

Usage Guideline Tunnel interfaces are valid for this command.

In automatic 6to4 and ISATAP tunnels, routers are not configured in pairs. If a tunnel interface has the tunnel destination address configured, then it will not be able to configure the tunnel type to 6to4 or ISATAP tunnel mode.

In the 6to4 tunnel, the IPv4 address embedded in the IPv6 address is used to locate the far end of the automatic tunnel. The IPv4 address of the border router is extracted from the IPv6 address that, as an example, starts with the prefix 2002::/16, where the format is 2002::IPv4-address:/48.

The ISATAP tunnel uses a unicast address that includes a 64-bit IPv6 prefix and a 64-bit interface identifier. The IPv4 address is encoded in the last 32 bits of the interface identifier. When the IPv4 address is known to be globally unique, the first 32 bits of the interface identifier is 0000:5EFE; otherwise it is 0200:5EFE. The interface identifier is created in modified EUI-64 format.

Examples

This example shows how to specify an IPv6 manually configured tunnel.

Switch(config)# interface tunnel 2
Switch(config-if)#tunnel mode ipv6ip
Switch(config-if)# 

tunnel source

Use the tunnel source configuration command to add the source IPv4 address for the tunnel interface. Use the no tunnel source configuration command to remove it.

tunnel source { IPv4-ADDRESS }

no tunnel source

Syntax Description

IPv4-ADDRESS IPv4 address.

Default None

Command Mode Interface configuration

Usage Guideline Use this command to configure the source IPv4 address for a tunnel interface.

Tunnel interfaces are valid for this command.

Examples This example shows how to add the source IPv4 address for the tunnel interface 2

Switch(config)# interface tunne 2
Switch(config-if)#tunnel source 10.0.0.1
Switch(config-if)#

This example shows how to remove the source IPv4 address for the tunnel interface 2

Switch(config)# interface tunne 2
Switch(config-if)# no tunnel source
Switch(config-if)# 

Verify the settings by entering the show interface command.

username

Use the username command to create a user account, and use the no form of the command to delete the user account. For the no command, when a username is specified, a specific account is deleted.

username NAME [privilege LEVEL] password {plain-text| encrypted} PASSWORD

no username NAME

Syntax Description
NAME Specifies the Username. Only one word can be used for the name argument.The length is 1 to 32 characters.
privilege LEVEL	(Optional) Sets the privilege level for the user. The privilege level is between 0 and 15. The default value is 15 if it is not specified
plain-text	Specifies the password the user must enter to gain access to the switch. The password must be from 6 to 32 characters (the length of password in plain-text form is project dependant), can contain embedded spaces and is case-sensitive. The syntax is a general string that allows spaces.
PASSWORD
encrypted	Specifies the password in the encrypted form based on SHA-I. For the encrypted form password, the length is fixed to 35 bytes long. The password is case-sensitive.
PASSWORD	When using the show username or the show enable password command, an encrypted password can be copied and pasted to this command option.

Default Not configured

privilege LEVEL: 15

Command Mode Global configuration at privilege level 15

Usage Guideline This command creates user accounts with different access levels.

The command only accepts LEVEL 1, 2, 12, & 15. If the user specifies any other level, an error message will be displayed.

When the user logs in with level 1 and 2, the user will in the User EXEC mode. The user needs to further use the enable command to enter the Privileged EXEC mode. However, in level 1 User EXEC mode it is not allowed to directly enter the Privileged EXEC mode.

When the user logs in with a level higher than or equal to 12, the user will directly enter the Privileged EXEC mode. The Privileged EXEC mode can be either level 12 or 15.

The user can specify the password in encrypted form or in plain-text form. If it is in plain-text form, but password encryption is enabled, then the password will be converted to encrypted form.

The factory default setting sets the user account to an empty string. When the user account is empty, the any access will be logged in directly in the User Exec mode at the power user level. The user can further enter the Privileged Exec mode using the enable password. If the enable password is not set then the user only needs to use the command "enable" on page 142.

Examples

This example shows how to create a username and password pair. It assigns a username of admin with the password mypassword.

Switch(config)# username admin password plain-text mypassword

This example shows how to remove a user account with the username admin.

Switch(config)# no username admin

Verify the settings by entering the show username command.

version

Use this command to specify the RIP version to send and receive.

version { 1 | 2 }

Syntax Description
1	Only RIP Version 1 packets are received and transmitted.
2	Only RIP Version 2 packets are received and transmitted.

Default Version 2

Command Mode Router configuration

Usage Guideline

This command defines the default RIP version. This version will be overridden if the version is explicitly specified for the interface (for example, interface command "ip rip receive version" on page 234).

Example The following example shows how to configure the RIP version to version 2.:

Switch# configure terminal
Switch(config)#router rip
Switch(config-router)#version 2
Switch(config-router)#exit
Switch(config)#

Verify the settings by entering the show ip protocols rip command.

vlan

Use the vlan configuration command to add VLANs and to enter the config-vlan mode. Use the no vlan configuration command to remove VLANs. The default VLAN with the VLAN ID 1, cannot be removed.

vlan VLAN-ID [, | - ]

no vlan VLAN-ID [, | - ]

Syntax Description

VLAN-ID Specifies the ID of the VLAN to be added, removed or configured. The valid VLAN ID range is 1 to 4094.The default VLAN with VLAN id 1 cannot be removed.

,(Optional) Specifies a series of VLANs, or separate a range of VLANs from a previous range. No space before and after the comma.

-(Optional) Specifies a range of VLANs. No space before and after the hyphen.

Default System has a default VLAN entry with VLAN ID 1.

Command Mode Global configuration

Usage Guideline

Use the vlan global configuration command to add VLANs. The valid VLAN ID range is 1 to 4094. Entering the vlan command with a VLAN ID enters the config-VLAN mode. When entering the VLAN ID of an existing VLAN, a new VLAN is not created, but the VLAN parameters can be modified for that VLAN. When entering the VLAN ID of a new VLAN, the VLAN will be automatically created. A VLAN in a management domain remains unused until it is assigned one or more switch ports to the VLAN. Create a new VLAN first and then specify the module and ports later.

The no vlan global configuration command must be used to remove VLANs. When removing a non-existing VLAN, an error message will be sent. Default VLAN with VLAN ID 1 cannot be removed. Removing a VLAN will automatically remove all port memberships that belong to the VLAN. However if a VLAN is being associated to a port's access VLAN through the access VLAN command, it can not be deleted.

Examples This example shows how to add a new VLAN. It assigns the new VLAN with VLAN id 1000 to 1005.

Switch(config)# vlan 1000-1005
Switch(config-vlan)# 

This example shows how to remove an existent VLAN with VLAN id 1000 to 1005.

Switch(config)# no vlan 1000-1005
Switch(config)# 

Verify the settings by entering the show vlan command.

vlan encapsulation

Use this command to encapsulate the original packet with an outer VLAN tag through from UNI to NNI. Use the no form of this command to delete the related VLAN encapsulation pairs.

vlan encapsulation S-VID C-VID [, | -]

no vlan encapsulation C-VID [, | -]

Syntax Description

C-VID [, | -]	The VLAN ID list specified here refers to the inner-VID list (i.e. customer VLAN ID, C-VID list).
S-VID The VLAN ID specified here refers to the outer-VIDs (i.e. service provider VLAN ID, S-VID).

Default No VLAN encapsulation pair is created.

Once a VLAN encapsulation pair is created, the CoS setting is set to customer CoS trusted in default.

Command Mode

Interface configuration (only available for User-to-Network interface).

Usage Guideline

C-VID [, | -] is a customer VLAN list. After receiving packets of these VLANs, the switch will encapsulate the packets with the specified outer VLAN tag (S-VID) and T-PID (set at NNI port). The priority tag of the outer tag is decided by following the following conditions:

1. If the there is a CoS remarking pair for the customer VLAN, the priority tag value of the outer VLAN value is set to the same value as the cos remarking.

2. Otherwise, the priority tag value of the outer tag is replicated from the user/inner priority tag.

Examples In the example shown here, eth4.1 is configured as COS value of 3 and CoS value of 1 for C-VID 22 and customer CoS trusted for C-VID 23-26. In addition, S-VID 100 is used to encapsulate the receiving packet which has C-VID equal to 22-26.

Switch(config)#interface eth4.1
Switch(config-if)#vlan encapsulation 100 22-26
Switch(config-if)#cos remarking 3
Switch(config-if)#cos remarking 1 22 

Verify the settings by entering show vlan-tunnel command.

vlan name

Use the vlan name VLAN-NAME configuration command to specify the VLAN name. Use the no vlan name command to reset the VLAN name to the default VLAN name.

vlan name VLAN-NAME

no vlan name

Syntax Description
VLAN-NAME	Specifies the VLAN name, an ASCII string from 1 to 32 characters that must be unique within the administrative domain. The character syntax allowed is a general string that does not allow spaces.

Default VLAN-NAME: VLANxxxx

where xxxx represents four numeric digits (include leading zeros) equal to the VLAN id number.

Command Mode VLAN configuration

Usage Guideline Use the vlan name VLAN-NAME config-VLAN command to specify VLAN name. The VLAN name length must be 1 to 32, and it must be unique within the administrative domain. The error message will be returned if an invalid name or a duplicated name is specified. Use no vlan name config-VLAN command to reset the VLAN name to the default VLAN name.

Example This example shows how to set a VLAN name of VLAN 1000.

Switch(config)# vlan 1000
Switch(config-vlan)# vlan name admin-vlan 

Verify the settings by entering the show vlan command.

vlan remarking

Use this command to define the VLAN remarking pair. Use the no form of this command to delete the related VLAN remarking pair.

vlan remarking S-VID C-VID

no vlan remarking C-VID[, | -]

Syntax Description
C-VID[, | -]	The VLAN IDs specified here refers to the inner-VID list (i.e. customer VLAN ID, C-VID).
S-VID	The VLAN ID specified here refers to the outer-VIDs (i.e. service provider VLAN ID, S-VID).

Default No VLAN remarking pair is created.

Once a VLAN remarking pair is created, the CoS setting is set to customer CoS trusted by default.

Command Mode Interface configuration (only available for a UNI port)

Usage Guideline

C-VID [, | -] is a customer VLAN list. After receiving packets of these VLANs, the switch will replace the VLAN tag of the packets with the specified S-VID VLAN tag. The priority tag of the outgoing tag is decided by following the following conditions:1.If the C-VID is set as remarking priority by the cos remarking command, the priority tag value of the outgoing tag is decided by the configuration associated with the ingress port and inner VID.2.Otherwise, the priority tag value of the outer VLAN value is retained as the original CoS priority tag value.

Example

This example shows how to create VLAN translation entries. The created VLAN translation relationships are: C-VLAN 200 will be translated to SP-VLAN 1002, priority is 7. And the S-TAG is added.Please follow the example below for a step by step explanation1. Go to interface Ethernet 4.1

Switch (config) #>interface eth4.1

1. Make a VLAN encapsulation table - S-VID is 1001 and CVID is 101-104. So far the user's COS is trusted.

Switch(config-if)#>vlan encapsulation 1001 101-104

1. Make a VLAN remarking from C-VID 200 to S-VID is 1002. So far the user's COS is trusted.

Switch(config-if)#>vlan remarking 1002 200 

1. Remark COS as 7.

Switch(config-if)#>cos remarking 7 

1. Remark COS as 3 for C-VID 101-102, remarking COS as 7 for and 103-104 and 200.

Switch(config-if)#>cos remarking 3 101-102 

1. Trust user's COS for VID 200 and 103-104 (that is because when C-VID is not specified with COS rearming policy explicitly, its COS is changed according to cos remarking NEW-COS or no cos remarking commands), but remark COS as 3 for C-VID 101-102.

Switch(config-if)#>no cos remarking
Switch(config-if)#>

1. Verify the settings by entering show vlan-tunnel interface command.

vlan-tunnel

Use this command to enable the VLAN tunnel mode. Use the no form of the command to disable the VLAN tunnel mode.

vlan-tunnel

no vlan-tunnel

Syntax None

Default Disabled

Command Mode Global configuration

Usage Guideline

This command enables VLAN tunneling mode. To turn VLAN tunneling mode from disabled to enabled state. The default setting of VLAN tunneling mode is applied with the following setting:

1. All interfaces are set as Network-to-Network Interfaces (NNI) port.
2. All existing static VLANs will run as SP-VLANs. All dynamically learned L2 addresses will be cleared.
3. All dynamically registered VLAN entries will be cleared.
4. In order to run GVRP on the switch, enable GVRP manually. In VLAN tunnel mode, the SP-VLAN GVRP Address (01-80-C2-00-00-0D) will be used by the GVRP protocol.

Example This example shows how to enable the VLAN tunnel mode.

Switch# configure terminal
Switch(config)# vlan-tunnel
Switch(config)# 

Verify the settings by entering show vlan-tunnel command.

vlan-tunnel ctag-mapping dynamic

Use this command to enable or disable the dynamic customer VLAN tag learning mechanism for IPv4/IPv6 packets.

vlan-tunnel ctag-mapping dynamic { ipv4 | ipv6 } { enable | disable}

Syntax Description
ipv4 Specifies IPv4 packets.
ipv6 Specifies IPv6 packets.
enable Enables the VLAN tunnel dynamic customer VLAN tag learning mechanism.
disable	Disables the VLAN tunnel dynamic customer VLAN tag learning mechanism.

Default Disabled

Command Mode Global configuration

Usage Guideline Use this command to enable the dynamic customer VLAN tag learning mechanism. The mechanism learns the customer VLAN tag and source IP address mapping from incoming control packets. The learned customer VLAN tag mapping will be used for outgoing Layer 3 control packets. When a Layer 3 control packet is sent, and its destination IP is the same value as the source IP of dynamic learned customer VLAN tag mapping entry, then the control packet will be added to the matched customer VLAN tag.

If VLAN tunneling mode is disabled, the mechanism will not work even it is enabled.

Examples This example shows how to enable the VLAN tunnel dynamic customer VLAN tag learning mechanism for IPv4 packets.

Switch(config)# vlan-tunnel ctag-mapping dynamic ipv4 enable

Verify the settings by entering show vlan-tunnel ctag-mapping dynamic state command.

vlan-tunnel ctag-mapping static

Use this command to add a static customer VLAN tag mapping entry. Use the no form of the command to delete a static customer VLAN tag mapping entry.

vlan-tunnel ctag-mapping static {A.B.C.D/M | X:X::X:X/M} C-VID

no vlan-tunnel ctag-mapping static {A.B.C.D/M | X:X::X:X/M}

Syntax Description

A.B.C.D/M Specifies the destination IPv4 network address.
	A.B.C.D: IPv4 address
	M: IPv4 prefix length, maximum length is 32.
X:X::X:X/M Specifies the destination IPv6 network address.
	X:X::X:X: IPv6 address
	M: IPv6 prefix length, maximum length is 128.
C-VID	The VLAN ID specified here refers to the inner-VID (i.e. customer VLA ID)

Default Not configured

Command Mode Global configuration

Usage Guideline Use this command to add a static customer VLAN tag mapping entry for the specified IP subnet.

Examples This example shows how to add a static customer VLAN tag mapping entry.

Using the following configuration, the C-VID 500 is used to add the out-going control packet which has destination IP equal to 10.90.90.1/24 subnet.

Switch(config)# vlan-tunnel ctag-mapping static 10.90.90.1/24 500

Verify the settings by entering show vlan-tunnel ctag-mapping static command.

vlan-tunnel ingress checking

Use this command to specify to drop the C-tagged packets that do not match any VLAN encapsulation pair or remarking pair. Use the no form of this command to allow the unmatched packet to be forwarded.

vlan-tunnel ingress-checking

no vlan-tunnel ingress-checking

Syntax None

Default Disabled

Command Mode Interface configuration (only available for a UNI port)

Usage Guideline

If the receiving packet is tagged, the VLAN tunnel table (including VLAN encapsulation and VLAN remarking) is searched using the packet VLAN ID and the ingress port. If there is an entry missing, then the packet can optionally be dropped or have a SP VLAN (service provider VLAN) tag added based on the VLAN lookup tables (MAC, Subnet, Protocol, Port VLAN ID). When VLAN tunnel ingress filtering is enabled, the translation missed packets are dropped. If it has an SP VLAN tag added to the translation missed packet and forwarded to the SP VLAN, it is referred to as VLAN tunnel ingress-checking disabled.

Examples

This example shows how to enable the VLAN tunnel ingress-checking Ethernet eth3.1

Switch(config)#interface eth3.1
Switch(config-if)#vlan-tunnel ingress-checking 

Verify the settings by entering show vlan-tunnel command.

vlan-tunnel interface-type

Use this command to configure an interface as NNI (Network-to Network) or UNI (User-to-Network).

vlan- tunnel interface-type { nni | uni }

Syntax Description

nni | uni Specifies the interface type for the interface (port channel or ethernet port).

nni - Network to Network Interface.

uni - User to Network Interface.

Default When a VLAN tunnel is enabled, all interface are set as a nni port.

Command Mode Interface configuration

Usage Guideline This command sets the interface type at the port used by the VLAN tunnel application.

uni - User to Network Interface.

nni - Networks to Network Interface.

Example This example shows how to set Ethernet eth3.1 NNI port.

Switch# configure terminal
Switch(config)#interface eth3.1
Switch(config-if)#vlan-tunnel interface-type nni

Verify the settings by entering show vlan-tunnel command.

vlan-tunnel remove-inner-tag

Use this command to strip off the packet's inner tag (C-TAG; should the packet have it) of the incoming packet. Use the no form of the command to keep the packet's inner tag.

vlan-tunnel remove-inner-tag

no vlan-tunnel remove-inner-tag

Syntax None

Default Disabled

Command Mode Interface configuration (only available for UNI ports only).

Usage Guideline The command is available only for a UNI port. If an incoming packet has an inner tag (C-TAG) and the packet is forwarded to a UNI port which is configured as remove-inner-tag enabled, then the packet's inner tag is removed.

Example This example shows how to enable the vlan-tunnel remove-inner-tag in Ethernet eth3.1

Switch(config)#interface eth3.1
Switch(config-if)#vlan-tunnel remove-inner-tag 

Verify the settings by entering show vlan-tunnel command.

vlan-tunnel tpid

Use this command to specify the outer tag TPID at a Network-to-Network Interface (NNI) for the VLAN tunnel application.

vlan-tunnel tpid TPID

Syntax Description

TPID Specifies the TPID for the VLAN tag. The value is in hexadecimal form. Range is 0x0 to 0xFFFF.

Default 0x88A8

Command Mode Interface configuration (physical port and port channel interface only).

Usage Guideline This setting is only available for an NNI port in VLAN tunnel mode. The following shows the TPID usage for the NNI setting:

1. Packet transmitted at an NNI port.

a. As a packet is transmitted from an NNI port for VLAN encapsulation, a TPID specified by the vlan-tunnel tpid command is used for the S tag (outer tag) TPID.
b. As a packet is transmitted at an NNI port for VLAN remarking (replacement), a TPID specified by the vlan-tunnel tpid command is used for the VLAN tag TPID.

1. Packet received at an NNI port:

a. As a packet is received at an NNI port, the TPID specified by the vlan-tunnel tpid command is used to identify whether or not the packet has an S tag (outer tag).

Example This example shows how to set outer TPID at eth3.12 to 0x9100.

Switch(config)#interface eth3.12
Switch(config-if)#vlan-tunnel tpid 0x9100 

Verify the settings by entering the show vlan-tunnel command.

vrrp critical-ip

Use this command to configure the critical IP address. To remove the critical IP address using the no form of this command.

vrrp VRID critical-ip IP-ADDRESS

no vrrp VRID critical-ip

Syntax Description
VRID	Specifies the Virtual router identifier, which is the number identifying the virtual router for which the critical IP address is being configured.
	The virtual router identifier is configured with the command "vrrp ip" on page 719.
	Range is from 1 to 255.
IP-ADDRESS	Specifies the IP address of the neighbor router that provide the most direct route to the Internet.

Default Not configured

Command Mode Interface configuration

Usage Guideline

Referring to the figure below, Router-1 is the VRRP master router while Router-2 is the backup router for virtual IP 20.1.1.5. For the master router, the next hop router which provides access to the Interface is Router-X and the interface IP address on Router-X that connects to Router-1 is 60.5.1.1. IP address 60.5.1.1 is the critical IP address for the master router.

Configure the critical IP address on the master router and the master router will monitor the ARP cache of the critical IP address. Once the ARP cache of critical IP is gone from the ARP table, the master router will give up its master status.

graph TD
    Internet["Internet"] --> RouterX["Router-X"]
    RouterX -->|60.5.1.1/24| Router1["Router-1"]
    RouterX -->|70.5.1.1/24| Router2["Router-2"]
    Router1 -->|VRID=7\nIP=20.1.1.5\nPRI=200\nMaster| HostA["Host A"]
    Router1 -->|VRID=7\nIP=20.1.1.5\nPRI=100\nBackup| HostB["Host B"]
    Router2 -->|VRID=7\nIP=20.1.1.5\nPRI=100\nBackup| HostC["Host C"]

Examples

The following example shows how to configure the critical-ip address 60.5.1.1 for virtual router 7 with priority 200 on interface vlan1.

Switch(config)#interface vlan1
Switch(config-if)#vrrp 7 ip 20.1.1.5
Switch(config-if)#vrrp 7 priority 200
Switch(config-if)#vrrp 7 critical-ip 60.5.1.1

The following example shows how to remove the critical-ip address for virtual router 7 on interface vlan1.

Switch(config)#interface vlan1
Switch(config-if)#no vrrp 7 critical-ip

vrrp ip

To enable the Virtual Router Redundancy Protocol (VRRP) on an interface and identify the IP address of the virtual router, use the vrrp ip command.

To disable VRRP on the interface and remove the IP address of the virtual router, use the no form of this command.

vrrp VRID ip IP-ADDRESS

no vrrp VRID

Syntax Description

VRID	Specifies the virtual router identifier, which is the number that identifies the virtual router.
	Range is from 1 to 255.

IP-ADDRESS Specifies the IP address of the virtual router.

Default Disabled

Command Mode Interface configuration

Usage Guideline

The vrrp ip command activates VRRP on the configured interface. The IP address specified in the VRRP configuration is used as the address for the virtual router.

A master will be elected in a group of virtual routers which have the same virtual router identifier for forwarding the packets from the host that sends to this virtual router.

Examples

The following example shows how to enable VRRP on vlan1. The virtual router identifier is 7, and 10.1.1.1 is the IP address of the virtual router.

Switch(config)#interface vlan1
Switch(config-if)#vrrp 7 ip 10.1.1.1

The following example shows how to remove the IP address of the virtual router and disable the VRRP on the interface.

Switch(config)#interface vlan1
Switch(config-if)#no vrrp 7

vrrp preempt

To configure the router to take over as the master virtual router for a Virtual Router Redundancy Protocol (VRRP) group, if it has higher priority than the current master virtual router, use the vrrp preempt command. To disable this function, use the no form of this command.

vrrp VRID preempt

no vrrp VRID preempt

Syntax Description
VRID	Specifies the virtual router identifier, which is the number identifying the virtual router that preemption is being configured for.
	The virtual router identifier is configured with the command "vrrp ip" on page 719.
	Range is from 1 to 255.

Default Enabled

Command Mode Interface configuration

Usage Guideline	A backup router will not attempt to preempt the master unless it has higher priority.
	This command controls whether a higher priority backup router preempts a lower priority master.
	By default, the router preempt mode is enabled on the router when it takes over as master router for the virtual router if, it has a higher priority than the current master router.
	After using the no form of this command, the preempt mode changes to disabled, and the backup router will not attempt to preempt the master router even if it has a higher priority than the master router.
	One exception is that the router, that is the virtual IP address owner, always preempts, regardless of the setting of this command.
Examples	The following example shows how to configure the router to preempt the current master router when its priority of 200 is higher than that of the current master router.

Switch(config)#interface vlan1
Switch(config-if)#vrrp 7 preempt
Switch(config-if)#vrrp 7 priority 200

The following example shows how to configure the router to disable preempt of a virtual router.

Switch(config)#interface vlan1
Switch(config-if)#no vrrp 7 preempt

vrrp priority

To set the priority of the virtual router, use the vrrp priority command in VRRP interface configuration mode.

To restore the default priority value of the virtual router, use the no form of this command.

vrrp VRID priority PRIORITY

no vrrp VRID priority

Syntax Description
VRID	Specifies the virtual router identifier, which is the number that identifies the virtual router fthat the priority is being configured for.
	The virtual router identifier is configured with the command "vrrp ip" on page 719.
	Range is from 1 to 255.
PRIORITY	Specifies the priority of the virtual router. Higher values equal higher priority.
	Range is from 1 to 254

Default Priority: 100

Command Mode Interface configuration

Usage Guideline

Use this command to control which router becomes the master router. This command is ignored while the router is the virtual IP address owner.

The router with the highest priority will become the master, and other routers with lower priority will then become the backups for the virtual router. Each router should be configured with different priority values. If there is more than one router accidentally configured to have the same highest priority, then one of them will become the master which depends on which one of them sends the advertisement packet out first. If the advertisement packets are sent out at the same time, the primary IP address (see Note 1) will be compared. The router with greater primary IP address becomes the master.

Note 1: the primary IP address is the interface IP address that is configured by the command "ip address" on page 164.

Examples

The following example shows how to configure the router with a priority of 200.

Switch(config)#interface vlan1 Switch(config-if)#vrrp 7 priority 200

The following example shows how to restore the default priority of the virtual router.

Switch(config)#interface vlan1
Switch(config-if)#no vrrp 7 priority

vrrp shutdown

This command is to disable the VRRP of a VRID on an interface. Use the no form of the command to re-activate the VRRP.

vrrp VRID shutdown

no vrrp VRID shutdown

Syntax Description
VRID	Specifies the virtual router identifier, the number identifying the virtual router that the shutdown is being configured for.
	The virtual router identifier is configured with the command "vrrp ip" on page 719.
	Range is from 1 to 255.

Default None

Command Mode Interface configuration

Usage Guideline When a VRRP VRID is being configured using the vrrp VRID ip command, the protocol will be fully operational. Using vrrp shutdown disables the protocol operation for one VRID of an interface.

Examples The following example shows how to disable one VRRP VRID 7 on interface vlan1 while retaining the VRRP VRID 8.

Switch(config)#interface vlan1
Switch(config-if)#vrrp 7 ip 20.1.1.1
Switch(config-if)#vrrp 7 shutdown
Switch(config-if)#
Switch(config-if)#vrrp 8 ip 20.1.1.2
Switch(config-if)#

The following example shows how to re-activate VRRP protocol on VRID 7 of interface vlan1.

Switch(config)#interface vlan1
Switch(config-if)#no vrrp 7 shutdown

vrrp timers advertise

This command configures the interval between successive advertisements by the master router. To restore the default value, use the no form of this command.

vrrp VRID timers advertise INTERVAL

no vrrp VRID timers advertise

Syntax Description
VRID	Specifies the virtual router identifier, which is the number identifying the virtual router that the advertisement timing is being configured for.The virtual router identifier is configured with the command "vrrp ip" on page 719.Range is from 1 to 255.
INTERVAL	Time interval between successive advertisements by the master router. The unit of the interval is in seconds.Range is from 1 to 255 seconds.

Default Interval: 1 second

Command Mode Interface configuration

Usage Guideline	The VRRP advertisements being sent by the master virtual router communicate the state and priority of the current master virtual router.
	The vrrp timers advertise command configures the time between the advertisement packets and the time before other routers declare the master router to be down. All routers in a VRRP group must use the same timer values.
Examples	The following example shows how to configure the router to send advertisements every 10 seconds.

Switch(config)#interface vlan1 Switch(config-if)#vrrp 7 timers advertise 10

The following example shows how to configure the advertisement interval to default.

Switch(config)#interface vlan1 Switch(config-if)#no vrrp 7 timers advertise

Acronym List

ACL Access Control List

ARP Address Resolution Protocol

BGP Border Gateway Protocol

BPDU Bridge Protocol Data Unit

CHAP Challenge Handshake Authentication Protocol

CIR Committed Information Rate

CIST Common and Internal Spanning Tree

CLI Command-Line Interface

CLNS Connection-Less Network Service

CoS Class of Service

CPLD Complex Programmable Logic Device

CRC Cyclic Redundancy Check

DHCP Dynamic Host Configuration Protocol

DM Dense Mode (PIM)

DNS Domain Name System

DoS Denial of Service

dot1q 802.1Q

dot1x 802.1X

DRAM Dynamic RAM

DVMRP Distance Vector Multicast Routing Protocol

EAP Extensible Authentication Protocol

FAT File Allocation Table

FIB Forwarding Information Base

FTP File Transfer Protocol

GARP General Attribute Registration Protocol

GBIC Gigabit Interface Converter

GMRP GARP Multicast Registration Protocol

GVRP GARP VLAN Registration Protocol

ICMP Internet Control Message Protocol

IGMP Internet Group Management Protocol

IGMPv2 IGMP version 2

IGMPv3 IGMP version 3

IGRP Interior Gateway Routing Protocol

ILMI Integrated Local Management Interface

IP Internet Protocol

IS-IS Intermediate System-to-Intermediate System Intradomain Routing Protocol

ISO International Organization of Standardization

LACP Link Aggregation Control Protocol

LACPDU Link Aggregation Control Protocol data unit

LAN Local Area Network

LAPB Link Access Procedure, Balanced

LCP Link Control Protocol

LLC Logical Link Control

MAC Media Access Control

MD5 Message Digest 5

MED Multi-Exit Discriminator

MIB Management Information Base

mroute multicast route

mrouter multicast router

MST Multiple Spanning Tree (802.1s)

MSTCI MST configuration identifier

MTU Maximum Transmission Unit

NAT Network Address Translation

NetBIOS Network Basic Input/Output System

NSAP Network Service Access Point

NSF Non-Stop Forwarding

NTP Network Time Protocol

NVRAM Non-Volatile RAM

OAM Operation, Administration, and Maintenance

OSI Open System Interconnection

OSPF Open Shortest Path First

PAE Port Access Entity

PDU Protocol Data Unit

PHY Physical sublayer

PIM Protocol Independent Multicast

PIM-SM Protocol Independent Multicast Sparse Mode

PPP Point-to-Point Protocol

QoS Quality of Service

RADIUS Remote Access Dial-In User Service

RAM Random-Access Memory

RIB Routing Information Base

RMON Remote Network Monitor

ROM Read-Only Memory

RP Route Processor

RSTP Rapid Spanning Tree Protocol

RTP Real-Time Transport Protocol

SM Sparse Mode (PIM)